Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.
(cherry picked from commit 31bd80fee8)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.
(cherry picked from commit 1b6f9380f4)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.
(cherry picked from commit 4c0488d92a)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.
(cherry picked from commit f91a41510c)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
AVDT:
- Roll back CCB allocation when cmd/rsp queue creation fails
- Free media packet on invalid handle in AVDT_WriteReqOpt
- Zero-init timeout failure message before GETCAP callback
- Initialize lcid_tbl to 0xFF to avoid mapping to tc_tbl[0]
BTA/AVRCP:
- Use size_t for AVRC message copy buffer allocation
- Allocate before register in BTA_AvEnable
- Guard BTA_AvRegister callback when enable never completed
- Remove invalid free of inline Cover Art image_descriptor
A2DP BTC/API:
- Default g_a2dp_on_deinit to true before profile init
- Add shutdown state check in btc_a2dp_sink_shutdown
- Guard A2DP source timer against freed dynamic local param
- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events
Return BTM_HCI_ERROR | hci_status from legacy BLE 4.2 GAP HCI command
paths instead of mapping failures to BTM_ILLEGAL_VALUE or
BTM_NO_RESOURCES. Add btm_ble_status_from_hci() helper and propagate
real status through scan start/stop completion callbacks.
(cherry picked from commit 47dd785a18)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Read By Type Response Length is one octet (max 255). When MTU was
large enough to return a long characteristic value in one pair, the
server wrote (UINT8)(value_len + 2) and overflowed (e.g. 513 -> 1),
so the client rejected the PDU as GATT_INVALID_PDU (0x04).
Cap server value to 253 bytes per pair, clamp the length byte, and
continue long reads via Read Blob when the capped size is returned.
(cherry picked from commit 97905afccc)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Release the BLE sync semaphore and record HCI status when a
synchronous command is rejected via Command Status, since no
Command Complete event follows.
(cherry picked from commit 29ae92f4ef)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Route unknown BD_ADDR and other immediate failures through the existing
need_cb path so ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT is always delivered.
(cherry picked from commit f9eaeb5e84)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
Wang Meng Yang
Island
Zhi Wei Jian
Zhang Hai Peng
Jin Cheng
yangfeng
