Commit Graph
5912 Commits
Author SHA1 Message Date
Wang Meng Yang 0e7b62c941 Merge branch 'bugfix/bta_disable_not_run_v6.1' into 'release/v6.1'
fix(bt/bluedroid): fixed BTA event dispatch race during module disable (v6.1)

See merge request espressif/esp-idf!51974
2026-08-27 17:49:30 +08:00
Wang Meng Yang acc48fb46e Merge branch 'fix/aireview_pbap_v6.1' into 'release/v6.1'
fix(bt_pbap): Fix some bugs in bluedroid PBAP (v6.1)

See merge request espressif/esp-idf!51727
2026-08-27 17:48:30 +08:00
Wang Meng Yang 0b976b4458 Merge branch 'fix/bluedroid_aireview_v6.1' into 'release/v6.1'
Fix/bluedroid aireview (v6.1)

See merge request espressif/esp-idf!51294
2026-08-27 17:46:38 +08:00
Wang Meng Yang 3f090c0eb0 Merge branch 'bugfix/bredr_critical_bugs_v6.1' into 'release/v6.1'
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v6.1)

See merge request espressif/esp-idf!51078
2026-08-27 17:44:25 +08:00
Wang Meng Yang 4e8e22ac63 Merge branch 'feat/bt_in_psram_v6.1' into 'release/v6.1'
feat(bluedroid): Add config to place btu and hci task stack in psram (v6.1)

See merge request espressif/esp-idf!51489
2026-08-27 17:38:13 +08:00
Jin Cheng 3b266e017a fix(bt/bluedroid): fixed BTA event dispatch race during module disable
- Gate bta_sys_event() on both 'is_reg' and 'reg[id]' to prevent
  stale event delivery.
- Defer bta_sys_deregister() to the end of profile disable handlers
  to ensure pending DISABLE events are processed.
- Add disabling flag to HFP AG for tracking asynchronous teardown.
2026-08-24 10:41:38 +08:00
hejiaxin f9b088749b fix(bt_pbap): Fix some bugs in bluedroid PBAP
- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
2026-08-20 16:35:59 +08:00
yangfeng 5ef217c63a fix(bluedroid): Fix the compilation issue of BCM_STRNCPY_S 2026-08-13 19:15:56 +08:00
hejiaxin 0515e0da6b feat(bluedroid): Add config to place btu and hci task stack in psram
- Also adjust the osi_thread_stop implementation.
2026-08-04 14:55:27 +08:00
Jiang Jiang Jian 6a9c44fe7e Merge branch 'fix/ble_log_compression_add_local_header_file_v6.1' into 'release/v6.1'
feat(ble_log): mirror local compression headers (6.1)

See merge request espressif/esp-idf!50953
2026-08-03 10:48:09 +08:00
Jiang Jiang Jian d52ecaa3ea Merge branch 'bugfix/low_spp_throughput_v6.1' into 'release/v6.1'
change(bt/bluedroid): increased port low watermark of RFCOMM (v6.1)

See merge request espressif/esp-idf!51083
2026-07-31 19:35:19 +08:00
Wang Mengyang 481b244fe8 fix(bt): Fixed blocking during LMP packet type negotiation on ESP32-S31
In the Bluetooth connections with some smartphones, communication can possibly be blocked
during packet type negotation, when ESP32-S31 attempts to finalize the ACL-U transmission
and waits for the last Tx ACL-U packet to be transmitted, but peer device rejects the
packet with FLOW=STOP in its packet, thus causing a deadlock.

Closes https://github.com/espressif/esp-idf/issues/18797

This MR also provide with some optimizations and fixes
2026-07-31 14:06:02 +08:00
Jiang Jiang Jian fdf5ee1e93 Merge branch 'feat/optimize_for_esp32h4_light_sleep_ble_current_v6.1_new_chip_only' into 'release/v6.1'
Feat/optimize for esp32h4 light sleep ble current v6.1 new chip only

See merge request espressif/esp-idf!51302
2026-07-31 11:32:41 +08:00
cjin bfb9a07dbb feat(ble): supported placing bt function in iram on esp32-h4 and esp32-s31 2026-07-30 08:17:26 +08:00
Jin Cheng b5d3256213 fix(bt/bluedroid): fixed incorrect eSCO packet type validation under secure connection mode in BlueDroid 2026-07-29 17:30:20 +08:00
hejiaxin bb47816fb1 fix(bt): Fix some bug in stm_sco.c
- Memory safety
- State machine & logic integrity
- Resource leaks
- Edge cases check
2026-07-29 17:30:20 +08:00
Jin Cheng 44d2861950 change(bt/bluedroid): increased port low watermark of RFCOMM
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
2026-07-23 08:07:38 +08:00
Jin Cheng a16219df1c fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:41:31 +08:00
Zhou Xiao a3e5f62bd4 fix(bt): keep BLE log ISR state in internal RAM
(cherry picked from commit 2fa434eb50)

Co-authored-by: Zhou Xiao <zhouxiao@espressif.com>
2026-07-21 19:44:26 +08:00
Luo XuandWang Mengyang 91a748fedd fix(bt): Fixed build error on array-bounds in HFP AG
(cherry picked from commit bbd20cae01)

Co-authored-by: Wang Mengyang <wangmengyang@espressif.com>
2026-07-20 13:44:50 +08:00
Luo Xu e12576a2d6 feat(ble_log): mirror local compression headers
(cherry picked from commit ee732a4591)

Co-authored-by: luoxu <luoxu@espressif.com>
2026-07-20 13:44:49 +08:00
Jiang Jiang Jian 66d5ec660e Merge branch 'bugfix/fix_bredr_inq_crash_v6.1' into 'release/v6.1'
fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found (v6.1)

See merge request espressif/esp-idf!50853
2026-07-18 08:07:38 +08:00
Jiang Jiang Jian 9cf02d6dc4 Merge branch 'fix/fix_coex_iso_cache_error_v6.1' into 'release/v6.1'
fix(coex): Fixed BLE iso coex cache error (6.1)

See merge request espressif/esp-idf!50849
2026-07-17 11:43:27 +08:00
zhiweijian f2cf653370 fix(coex): Fixed BLE iso coex cache error 2026-07-17 10:49:31 +08:00
linruihao 9d4cf4d70c fix(bt/bluedroid): fix crash during bredr inquiry when zero-addr device is found 2026-07-17 10:39:13 +08:00
Jiang Jiang Jian 526285007f Merge branch 'fix/tx_power_validate_v6.1' into 'release/v6.1'
fix(bt): validate BR/EDR TX power against chip-supported range (v6.1)

See merge request espressif/esp-idf!50544
2026-07-17 10:32:04 +08:00
Jiang Jiang Jian 2dd51a0e75 Merge branch 'bugfix/avrc_ca_attr_id_check_v6.1' into 'release/v6.1'
fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp (v6.1)

See merge request espressif/esp-idf!50549
2026-07-17 10:31:02 +08:00
Jiang Jiang Jian 947e534927 Merge branch 'fix/mmap_cache_flash_wr_v6.1' into 'release/v6.1'
fix(mmap): fixed mmap read data wrong when flash being erased/written and cache not disabled (v6.1)

See merge request espressif/esp-idf!50117
2026-07-17 10:30:14 +08:00
Jiang Jiang Jian 4fe6db39ca Merge branch 'bugfix/bug_bounty_av_v6.1' into 'release/v6.1'
fix(bt/bluedroid): Fix bug bounty issues about A/V from NVIDIA (v6.1)

See merge request espressif/esp-idf!50476
2026-07-16 18:57:38 +08:00
liqigan 1004beff62 feat(bt/controller): Added LMP debug vendor HCI and fixed some bugs ts on ESP32-S31 2026-07-16 14:30:38 +08:00
liqigan b93794265f fix(bt/controller): Fixed BR/EDR controller bugs found by regression tests on ESP32-S31
- Fixed the state machine issue caused by security related LMP procedures on ESP32-S31
- Fixed the issue of insufficient air time for ACK reception from the Central on ESP32-S31
- Fixed the page scan collision issue on ESP32-S31
- Fixed read failures for local supported features and extended features on ESP32-S31
- Fixed NULL access issue during SYNC disconnection on ESP32-S31
- Fixed ACL schedule issue during SYNC connection establishment on ESP32-S31
2026-07-16 14:30:38 +08:00
liqigan 48dd8b588f feat(bt): Added support for slot availablity mask functionality 2026-07-16 14:30:38 +08:00
yangfeng 5af3a74a45 fix(bt): Fix the validation of AVRCP metadata attr_id in handle_rc_attributes_rsp 2026-07-16 14:27:53 +08:00
chenqingqing 19f0627092 fix(bt): clarify BR/EDR TX power behavior in menuconfig help 2026-07-16 12:05:12 +08:00
chenqingqing 7eb168e2f2 fix(bt): validate BR/EDR TX power against chip-supported range
The TX power range configurable in menuconfig only describes the maximum possible range.
Add a function to report the real range, and validate the configured BR/EDR TX power values during conroller init.
2026-07-16 12:05:12 +08:00
Jiang Jiang Jian 6cb467a433 Merge branch 'bugfix/fix_bluedroid_read_multi_v6.1' into 'release/v6.1'
fix(ble/bluedroid): fix GATT Read Multiple response handling (6.1)

See merge request espressif/esp-idf!50710
2026-07-16 11:59:11 +08:00
Jiang Jiang Jian 64218b5dd3 Merge branch 'bugfix/smp_sec_flags_v6.1' into 'release/v6.1'
fix(bt/bluedroid): fixed several security issues from NVIDIA (v6.1)

See merge request espressif/esp-idf!50565
2026-07-16 11:35:17 +08:00
yangfeng 24369a6f81 fix(bt/bluedroid): Fix unchecked p_ctrl_cback and p_msg_cback in AVRC
Closes SEC-1186
2026-07-16 11:30:38 +08:00
yangfeng e8108fefe1 fix(bt/bluedroid): Fix missing NULL check on p_cfg in AVDT_ReconfigReq
Closes SEC-1187
2026-07-16 11:30:38 +08:00
Jiang Jiang Jian 0196213a13 Merge branch 'fix/ble_mesh_fixed_issues_v6.1' into 'release/v6.1'
Resolve reported BLE mesh stack issues (6.1)

See merge request espressif/esp-idf!50408
2026-07-16 11:27:36 +08:00
Jiang Jiang Jian 68137eca5d Merge branch 'fix/fix_ble_rtc_register_issue_after_reset_v6.1' into 'release/v6.1'
fix(ble): fix ble rtc reset issues on esp32-h4 and esp32-s31 (6.1)

See merge request espressif/esp-idf!50204
2026-07-16 10:43:26 +08:00
Jiang Jiang Jian 7a0db8d0aa Merge branch 'fix/ble_mesh_disable_adv_pkt_discard_log_v6.1' into 'release/v6.1'
fix(ble_mesh): Disable warning logging when advertising packets are discarded (6.1)

See merge request espressif/esp-idf!50168
2026-07-16 10:42:18 +08:00
Xiao Xufeng 3e8389cc31 fix(mmap): fixed some API read wrong data via mmap when flash being erased/written while XIP on PSRAM
Before:

The cache won't be disabled when XIP on psram. But during flash
erasing/programming, read data will be courrupt.

When XIP in psram is enabled, the image is not mapped to the cache so
usually there will be no flash access. The only way to read from flash
is via the driver or use mmap. The driver has protection during erasing,
while th mmap region not.

Now:

Mmap APIs provide a flag to make mmap->unmap region mutually exclusive
to flash erase/programming when XIP from psram. SPI Flash write APIs
will benefit from this. When the flag is used, no concurrent access to
mapped region will happen while writing; otherwise the cache will be
disable to avoid data corruption.

Most ESP-IDF APIs calls mmap with this flag. As for users calling
mmap-like APIs directly, they can choose whether to enable this by a
flag.

Closes https://github.com/espressif/esp-idf/issues/14897
2026-07-15 18:57:08 +08:00
Zhang Hai Peng a6404dcf8d fix(ble/bluedroid): downgrade numeric comparison log to warning
(cherry picked from commit 72a49ed53b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:22 +08:00
Zhang Hai Peng f4c2b75897 fix(ble/bluedroid): preserve ext adv state when set params fails
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.


(cherry picked from commit 31bd80fee8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:21 +08:00
Zhang Hai Peng 169bf6975b fix(ble/bluedroid): reject invalid ATT error code 0x00 on client
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.


(cherry picked from commit 1b6f9380f4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:38 +08:00
Zhang Hai Peng be95975fee fix(ble/bluedroid): use sr_cmd status for GATT server error rsp
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.


(cherry picked from commit 4c0488d92a)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:36 +08:00
Zhang Hai Peng 96b27367a1 fix(ble/bluedroid): match read-multiple-var responses by handle
(cherry picked from commit 979c7dc567)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:34 +08:00
Zhang Hai Peng 2bb2f01dd3 fix(ble/bluedroid): match read-multiple responses by handle
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.


(cherry picked from commit f91a41510c)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:33 +08:00
Jin Cheng e4c999e891 fix(bt/bluedroid): fixed OOB read in PBAP app parameter parsing
Closes SEC-713
2026-07-09 15:44:57 +08:00