Fix DTM TX buffer leak in the BLE controller that could cause memory exhaustion and Interrupt WDT timeout during or after DTM TX tests. (6.0)
See merge request espressif/esp-idf!52615
BDL diskio test part only; the rest of the commit is already on release/v6.0
via 4f7b1af0f9, which predates components/fatfs/test_apps/bdl.
(cherry picked from commit a8b5b8d582)
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
(cherry picked from commit ed1f4de3a3)
Co-authored-by: luoxu <luoxu@espressif.com>
The SoC RC_FAST approximation is a nominal figure that can be off by ~10%
from the clock the LP core actually runs at, which made
ulp_lp_core_delay_us() over-delay by up to 9% and the LP core delay test
flake on ESP32-C5 and ESP32-C6.
Use a measured per-target value instead, and fail the build for targets
that have no measured value so that new chips cannot silently inherit a
wrong one.
1. Added validation for password and reserved data length in ESPTouch v2
2. Added bound check for data index in ESPTouch v1 HT40
3. prevent buffer overflow when parsing MBSSID beacon
These per-event traces fire on every async dispatch and flood BT logs
without aiding diagnosis; higher-layer traces remain for debugging.
(cherry picked from commit b9b9b8633f)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
When the bond list is full, drop the oldest disconnected device instead
of the oldest NVS entry, and allow a per-bond except flag so selected
devices are never auto-removed.
(cherry picked from commit bf86892eef)
Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
The loops waiting for the card to leave its busy state started their yield
backoff at 100 ms. A card is typically busy for a few milliseconds after a
write, so the backoff never fired and every write was followed by hundreds
of back-to-back CMD13 commands. Occupying the host controller like this
slows down unrelated work on both cores, not just the calling task.
Delay between polls instead, starting at CONFIG_SD_READY_POLL_PERIOD_START_US
(100 us) and doubling. Both the delay and the configured start period are
capped at one FreeRTOS tick period, where vTaskDelay() already yields and one
command per tick is not a storm. A typical wait now costs a handful of
commands instead of hundreds.
Applies to sdmmc_wait_for_idle(), sdmmc_init_sd_wait_data_ready() and
read_tuning_block().
Closes https://github.com/espressif/esp-idf/issues/19034
