- fixed IntegerDividedByZero during Qos negotiation.
Closes https://github.com/espressif/esp-idf/issues/18951
- ignored the check for bandwidth and retransmission effort when Host
accepts the SCO connection request.
Move the SPI2 bus, transfer-size and DMA-alignment constants shared by the
full-duplex DMA and half-duplex HD transports into
ble_log_prph_spi_common.h. Pin numbers stay Kconfig-driven but fall back to
the target's native SPI2 IOMUX pins when configured negative, and default to
-1 so both transports use the native pins out of the box; any GPIO number
still overrides.
Add BLE_LOG_PRPH_SPI_MASTER_HD, a half-duplex SPI2 transport built on the
HD DMA protocol (slave HD ver2). Reuses the SPI master pin config shared
with the full-duplex DMA transport; the HD device queue is sized 2x for
ping-pong so the next transaction is queued while the previous DMA runs.
Extract ble_log_lbm_recycle_trans() so every transport (UART DMA, SPI DMA,
dummy) recycles owned trans through one path; the HD transport builds on it.
Also prepare buffers for GDMA weighted arbitration: align transport buffers
to the 32-byte burst size, and disable the UART data burst (UHCI enforces
burst-size alignment on uhci_transmit() once weighted arbitration is enabled,
and UART bandwidth is baud-rate limited anyway).
- Add sdp_seq to avoid p_ccb being free during sdp
- Changed some BTA_Pba functions to return non-void value
- Improve error catching and report
- Refactor bta_pba_client_response to avoid UAF problem
- Rearrange btc_pba_client init flag to avoid some disturbing bug
Route legacy PAwR peripheral completion events through the active periodic
sync callback and accept the controller-established link without normal
advertising state.
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
fix(bt): Fixed memory-safety and DoS defects in BR/EDR controller on ESP32-S31
Closes BTQABR2023-853 and BTQABR2023-852
See merge request espressif/esp-idf!51299
- remmediate deep-review memory-saftey and DoS defects
- fix duplicated report of HCI mode change event
- fix conflicts in handling sniff subrate request when ACL link enters active mode
fix(bt): Fixed several issues on BR/EDR controller on ESP32-S31
Closes BTQABR2023-829, BTQABR2023-836, BTQABR2023-837, BTQABR2023-840, BTQABR2023-687, and BTQABR2023-697
See merge request espressif/esp-idf!51249
Fixed bug when BR/EDR ACL-U dynamic Tx buffer is enabled
Fixed infinite loop during connection set-up
Optimized the scheduling of SCO/eSCO and sniff events
