Commit Graph

42802 Commits

Author SHA1 Message Date
Sudeep Mohanty
d1d95b3255 test(ulp/lp_spi): improve test stability and add cleanup
Reset the LP SPI peripheral and GPIOs before and after every SPI case so
each test starts from a known-clean baseline, and gate the master on an
explicit slave-armed handshake so the master cannot clock the bus while
the slave is still in its arm prologue. Verify received data against the
expected pattern with bounded waits instead of merely logging it.

Add a dedicated LP SPI multi-device pytest for esp32p4 that runs the
retagged lp_core_spi cases, and tag the LP I2C case accordingly.
2026-07-29 15:34:54 +02:00
Sudeep Mohanty
4c95edacc7 fix(ulp/lp_spi): fix driver bugs and add bus deinit API
The LP SPI driver read and wrote the W0..W15 data buffer registers a
whole 32-bit word at a time, which overran the caller's buffer for
transfers whose length was not a multiple of four bytes and corrupted
the received data. Read and write the data buffer byte-granularly so
sub-word transfers no longer alias adjacent bytes.

The master transfer also programmed the shared bit-length register from
tx_length alone, truncating receive-longer-than-transmit transactions,
and always enabled MOSI even on read-only transfers, clocking out stale
buffer contents. Size each hardware transaction by max(tx_length,
rx_length) and gate MOSI/MISO on the corresponding buffer.

The slave path reused the master's single-shot flow, so it re-triggered
reg_update after preload (clocking out the previous transaction's data)
and offered no way for the caller to publish readiness before the master
started the clock. Split the slave transfer into an arm step that
preloads the buffer and starts the user phase, and a wait step that
blocks on TRANS_DONE and drains only the bytes the master actually
clocked in, tracked in software since reg_usr is not a reliable busy
indicator in slave mode.

Set the LP IO direction for the SPI pads, add
lp_core_lp_spi_bus_deinit() to release the LP GPIO pins, and reset the
LP SPI peripheral at bus initialization so a stale configuration from a
previous run cannot leak into the next.
2026-07-29 15:34:29 +02:00
morris
50967d2dfd Merge branch 'feat/sec_esp_drivers_v5.3' into 'release/v5.3'
fix(drivers): harden multiple peripheral drivers against local DoS and memory corruption (v5.3)

See merge request espressif/esp-idf!50561
2026-07-29 19:23:15 +08:00
morris
faa0bd021c Merge branch 'bugfix/ppa_buffer_oob_v5.3' into 'release/v5.3'
fix(ppa): add checks for input to avoid any OOB access (v5.3)

See merge request espressif/esp-idf!51142
2026-07-29 18:55:37 +08:00
Rahul Tank
76fa1483ab Merge branch 'feat/sbom_changes_v5.3' into 'release/v5.3'
fix(nimble): update sbom file with cve details (v5.3)

See merge request espressif/esp-idf!51184
2026-07-29 15:03:51 +05:30
Alexey Gerenkov
dd77984ee6 Merge branch 'fix/cxx-tls-destructors_v5.3' into 'release/v5.3'
fix(cxx): fix TLS classes destructor call (v5.3)

See merge request espressif/esp-idf!34209
2026-07-29 16:17:58 +08:00
Rahul Tank
2ccfcc7066 fix(nimble): update sbom file with cve details 2026-07-29 12:53:31 +05:30
Jiang Jiang Jian
be0801377d Merge branch 'bugfix/clear_ifx_tx_queue_v5.3' into 'release/v5.3'
bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure (Backport v5.3)

See merge request espressif/esp-idf!50901
2026-07-29 15:16:35 +08:00
Island
6e1600f2f9 Merge branch 'feat/add_bt_common_npl_v5.3' into 'release/v5.3'
feat(bt): Add host-agnostic BT OSAL and shared BLE profile task (5.3)

See merge request espressif/esp-idf!51217
2026-07-29 15:00:21 +08:00
akshat
a791b31867 bugfix(wifi): Clear Sta TX queue to prevent key 2 send failure
Also, Ensure correct return values for key 2 and key 4.
2026-07-29 10:45:06 +05:30
morris
681fd6177f fix(sdspi): reject oversized pre-read data before block receive
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
2026-07-29 11:45:31 +08:00
morris
d2984d636d fix(spi_slave): free DMA-private buffers when transaction queue is full
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
2026-07-29 11:45:31 +08:00
morris
421b3f8954 fix(jpeg): release platform mutex on semaphore/pm-lock allocation failure
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
2026-07-29 11:45:31 +08:00
morris
63fa4546a0 fix(i2c): release platform mutex on intr/pm_lock delete failure
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
2026-07-29 11:45:31 +08:00
morris
4f054f74bb fix(csi): move csi_fsm init before resource allocation to fix err-path leak
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
2026-07-29 11:42:56 +08:00
morris
05ebe7ad4b fix(adc): add missing input validation for channel and ret_handle
- adc_cali_curve_fitting: validate config->chan in check_valid() to
  prevent OOB access into s_adc_cali_chan_compens compensation table
- adc_filter: make s_adc_filter_free idempotent on !UNIT_BINDED SoCs
  to prevent double-free on repeated adc_del_continuous_iir_filter
- adc_cali_line_fitting(esp32): fix config && config typo to
  config && ret_handle, preventing NULL-pointer dereference
2026-07-29 11:42:56 +08:00
Jiang Jiang Jian
ffd6fbd9fc Merge branch 'bugfix/fix_some_coex_bugs_260727_v5.3' into 'release/v5.3'
fix(coex): move 15.4 register configuration to 15.4 init(Backport v5.3)

See merge request espressif/esp-idf!51178
2026-07-29 10:23:34 +08:00
Jiang Jiang Jian
06ec4430d0 Merge branch 'bugfix/roaming_app_issues_v5.3' into 'release/v5.3'
Fixed some issues in roaming app found using static analysis(v5.3)

See merge request espressif/esp-idf!49937
2026-07-29 10:17:57 +08:00
Jiang Jiang Jian
74622529fd Merge branch 'fix/fix_iram_sleep_process_access_cache_v5.3' into 'release/v5.3'
fix(esp_hw_support): fix get_act_hp/lp_dbias accessed ext mem (v5.3)

See merge request espressif/esp-idf!51212
2026-07-29 10:15:42 +08:00
Wang Meng Yang
9079e1473a Merge branch 'bugfix/ai_review_avrcp_v5.3' into 'release/v5.3'
fix(bt): Fix the critical and high issues related to AVRCP from AI review report (v5.3)

See merge request espressif/esp-idf!50023
2026-07-28 19:59:39 +08:00
Wang Meng Yang
d9f2d61539 Merge branch 'bugfix/hid_host_oob_read_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fixed possible 1-byte OOB read in bta_hh_ctrl_dat_act (v5.3)

See merge request espressif/esp-idf!50975
2026-07-28 19:52:02 +08:00
Wang Meng Yang
e13cc8ef6f Merge branch 'bugfix/bredr_critical_bugs_v5.3' into 'release/v5.3'
fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI (v5.3)

See merge request espressif/esp-idf!51081
2026-07-28 19:43:58 +08:00
morris
ee2818b7ff Merge branch 'fix/uhci_rx_size_check_v5.3' into 'release/v5.3'
fix(uhci): rx fsm race condition and buffer size check (v5.3)

See merge request espressif/esp-idf!51234
2026-07-28 18:22:54 +08:00
Hu Rui
194de3ab4b fix(uhci): rx fsm race condition and buffer size check
Closes https://github.com/espressif/esp-idf/issues/18819
Closes https://github.com/espressif/esp-idf/issues/18820
2026-07-28 14:56:43 +08:00
chenjianhua
67960f06d7 feat(bt): Add host-agnostic BT OSAL and shared BLE profile task
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
2026-07-27 19:52:30 +08:00
Li Shuai
38c2c69378 change(esp_hw_support): optimize get hp/lp dbias implementation iram or flash usage 2026-07-27 19:14:08 +08:00
Alexey Lapshin
390a496942 fix(cxx): fix TLS classes destructor call
Closes https://github.com/espressif/esp-idf/issues/14360
2026-07-27 15:16:36 +07:00
Xu Si Yu
b762a6f5d0 fix(coex): move 15.4 register configuration to 15.4 init
1. move 15.4 register configuration to 15.4 init
2. fix coex status get issue
2026-07-27 11:41:56 +08:00
morris
25039385e2 Merge branch 'backport/spi_flash_fixes_v5.3' into 'release/v5.3'
fix(spi_flash): backport aes-xts error-path & mxic fixes (v5.3)

See merge request espressif/esp-idf!51138
2026-07-27 10:36:36 +08:00
Rahul Tank
6590778c43 Merge branch 'bugfix/nimble_security_fixes_v5.3' into 'release/v5.3'
fix(nimble): Ai reported security fixes (v5.3)

See merge request espressif/esp-idf!50694
2026-07-25 18:49:34 +05:30
Shreeyash Bhakare
f2b7aa1db8 fix(nimble): Added security related fixes 2026-07-25 13:48:33 +05:30
Rahul Tank
b6aaa5f765 Merge branch 'bugfix/l2cap_throughput_degrading_v5.3' into 'release/v5.3'
Preserve throughput when switching from LE Coded to 1M/2M PHY (v5.3)

See merge request espressif/esp-idf!50833
2026-07-25 08:35:44 +05:30
Astha Verma
8025ab856c fix(nimble): Restore throughput after switching from LE Coded PHY 2026-07-24 18:08:38 +05:30
Shu Chen
dae526045b Merge branch 'feat/update_phylib_on_s31_c6_for_track_v5.3' into 'release/v5.3'
feat(phy): update phy lib for esp32s31 & esp32c6 for track (v5.3)

See merge request espressif/esp-idf!50794
2026-07-24 11:05:06 +00:00
Rahul Tank
cc3a5ec838 Merge branch 'bugfix/fix_ai_example_review_v5.3' into 'release/v5.3'
fix(nimble): Fix nimble examples review issues (v5.3)

See merge request espressif/esp-idf!50844
2026-07-24 16:23:33 +05:30
Rahul Tank
8aa7006649 fix(nimble): Fix issues found in review for nimble examples 2026-07-24 15:53:38 +05:30
Rahul Tank
7ec47c264d Merge branch 'bugfix/red_rem_feat_evt_v5.3' into 'release/v5.3'
Handle Read Remote Supported Feature failure (v5.3)

See merge request espressif/esp-idf!50812
2026-07-24 14:28:47 +05:30
Jiang Jiang Jian
8363d0e4d1 Merge branch 'bugfix/a2dp_sbc_v5.3' into 'release/v5.3'
fix(bt): Fix the pointer sbc_start_frame is not initialized (v5.3)

See merge request espressif/esp-idf!51020
2026-07-24 16:02:04 +08:00
Shu Chen
a6e1a47dd7 Merge branch 'support/ot_register_154_event_cb_v5.3' into 'release/v5.3'
feat(openthread): use ieee802154 event callback list instead of weak overrides (v5.3)

See merge request espressif/esp-idf!51130
2026-07-24 08:00:58 +00:00
Song Ruo Jing
134328affb fix(ppa): add checks for input to avoid any OOB access 2026-07-24 15:39:29 +08:00
C.S.M
c7dd46e84b fix(spi_flash): Fix spi_flash leaks release aes-xts in error path
(cherry picked from commit 305c5869ee)
2026-07-24 15:00:50 +08:00
Shengyu Qu
352d18b48e fix(spi_flash): add #if check for s_mxic_set_required_regs()
Currently, s_mxic_set_required_regs() lacks checking for
CONFIG_SPI_FLASH_SUPPORT_MXIC_OPI_CHIP. And this causes a defined but not
used warning when MXIC flash driver is disabled in project config. So add
a #if check for this to supress warning.

Signed-off-by: Shengyu Qu <wiagn@4d2.org>
(cherry picked from commit 062c948c18)
2026-07-24 15:00:50 +08:00
zwx
5b13be2889 feat(openthread): use ieee802154 event callback list instead of weak overrides 2026-07-24 14:23:55 +08:00
Island
7efbfbb0a1 Merge branch 'fix/ble_hidd_remove_ccc_gating_v5.3' into 'release/v5.3'
fix(esp_hid/bluedroid): remove app-layer CCC gating in HID device (5.3)

See merge request espressif/esp-idf!51004
2026-07-23 19:26:18 +08:00
Wang Meng Yang
9c15348402 Merge branch 'bugfix/low_spp_throughput_v5.3' into 'release/v5.3'
change(bt/bluedroid): increased port low watermark of RFCOMM (v5.3)

See merge request espressif/esp-idf!51087
2026-07-23 16:41:33 +08:00
morris
9727ba62c3 Merge branch 'bugfix/ana_cmpr_macro_v5.3' into 'release/v5.3'
fix(ana_cmpr): Fix swapped POS/NEG cross interrupt masks on ESP32-C5/P4 (v5.3)

See merge request espressif/esp-idf!50802
2026-07-23 14:56:22 +08:00
Island
8f897fb259 Merge branch 'fix/ble_log_compression_safety_v5.3' into 'release/v5.3'
fix(ble_log): fix unaligned access and buffer safety in log compression (5.3)

See merge request espressif/esp-idf!47928
2026-07-23 14:22:57 +08:00
Jin Cheng
ed20c79614 change(bt/bluedroid): increased port low watermark of RFCOMM
When PORT_RX_BUF_LOW_WM is too low, RFCOMM replenishes credits only
after receiving a relatively large number of packets, which may cause
the peer to exhaust its credits and enter a stop-and-wait state.
Increase the low watermark to replenish credits more promptly and
reduce the likelihood of the peer stalling while waiting for additional
credits.
2026-07-23 08:11:29 +08:00
Jin Cheng
d70a124dec fix(bt/bluedroid): fixed issues from AI review in GAP, SPP, HID, L2CAP and HCI 2026-07-23 07:53:22 +08:00
Jack
f69b8bde01 fix(phy): removed all librfate logic from cmake 2026-07-22 20:06:39 +08:00