Commit Graph
2075 Commits
Author SHA1 Message Date
Island 2dc3285e57 Merge branch 'bugfix/fix_bluedroid_read_multi_v6.0' into 'release/v6.0'
fix(ble/bluedroid): fix GATT Read Multiple response handling (6.0)

See merge request espressif/esp-idf!50709
2026-07-15 15:38:50 +08:00
Island 1dc74d56a2 Merge branch 'feat/support_bluedroid_le_coc_and_eatt_v6.0' into 'release/v6.0'
feat(ble/bluedroid): Support bluedroid LE COC and EATT features (6.0)

See merge request espressif/esp-idf!50715
2026-07-15 14:02:50 +08:00
Zhi Wei Jian 1ade9c6f0e feat(ble/bluedroid): Support bluedroid dual identity
(cherry picked from commit 2358786647)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 14:17:33 +08:00
Zhi Wei Jian 279ad49fb0 fix(ble/bluedroid): use BOOLEAN for BLE HCI command builders
(cherry picked from commit abbf001120)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:31 +08:00
Zhi Wei Jian 05e35f842a fix(ble/bluedroid): clean up LE CoC connect on CCB alloc failure
(cherry picked from commit 4fd1ebb4a9)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:25 +08:00
Zhi Wei Jian 656af102e8 docs(ble/bluedroid): note ISO BIG HCI alloc failure not checked
(cherry picked from commit 34b59d30ae)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:25 +08:00
Zhi Wei Jian 8efe8f6ff4 fix(ble/bluedroid): fix direct-connect cleanup and adv bounds
(cherry picked from commit 82e71c1767)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:24 +08:00
Zhi Wei Jian 395229d444 fix(ble/bluedroid): validate BLE confirm/OOB and sec-check device
(cherry picked from commit 93ab11d564)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:24 +08:00
Zhi Wei Jian 273c463497 fix(ble/bluedroid): validate SMP pair-fail reason and OOB device
(cherry picked from commit 98efe02385)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:23 +08:00
Zhi Wei Jian 179ea3578f fix(ble/bluedroid): route ATT indication-conf timeout separately
(cherry picked from commit 6c3267ee84)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:23 +08:00
Zhi Wei Jian 0e4c3ca05d fix(ble/bluedroid): validate ATT PDU sizes
(cherry picked from commit bb00b9817d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:23 +08:00
Zhi Wei Jian 7383c07af9 fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback
(cherry picked from commit 37562af0ea)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:22 +08:00
Zhi Wei Jian c7d6a7ce9e fix(ble/bluedroid): fix GATT long read and Service Changed CCC
(cherry picked from commit 4ce692ac0c)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:22 +08:00
Zhi Wei Jian bd8ce47005 fix(ble/bluedroid): validate GATT client discovery handles
(cherry picked from commit ac35ae6f2d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:21 +08:00
Zhi Wei Jian 98a8e41c83 fix(ble/bluedroid): cap Read By Type length and free failed service decl
(cherry picked from commit 27ff0cf8c7)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:21 +08:00
Zhi Wei Jian 418cf61513 fix(ble/bluedroid): guard GATT database hash and serialization
(cherry picked from commit 995c1508e8)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:21 +08:00
Zhi Wei Jian de2544c5de fix(ble/bluedroid): fix GATT server busy errors and sr_cmd handling
(cherry picked from commit f86739b03d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:20 +08:00
Zhi Wei Jian 07f3362a98 fix(ble/bluedroid): fix GATT teardown and service-change flow
(cherry picked from commit 0645ba469d)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:20 +08:00
Zhi Wei Jian bdba7a71d7 fix(ble/bluedroid): fix GATT service lifecycle leaks
(cherry picked from commit ac93d94958)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:19 +08:00
Zhi Wei Jian 6e0ea41536 fix(ble/bluedroid): add GATT resource-cleanup helpers
(cherry picked from commit b83327f3ca)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 12:04:19 +08:00
Zhi Wei Jian 87d614ba91 feat(ble/bluedroid): Support bluedroid LE COC and EATT features
(cherry picked from commit 83f0831c53)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
2026-07-14 11:56:06 +08:00
Zhang Hai Peng d53c6ad240 fix(ble/bluedroid): downgrade numeric comparison log to warning
(cherry picked from commit 72a49ed53b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:17 +08:00
Zhang Hai Peng 4e60648f13 fix(ble/bluedroid): preserve ext adv state when set params fails
Only update extend_adv_cb after HCI Set Extended Advertising
Parameters succeeds, so a failed update does not corrupt cached
legacy_pdu and related fields used by adv data validation.


(cherry picked from commit 31bd80fee8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:37:16 +08:00
Zhang Hai Peng 2a1436daa2 fix(ble/bluedroid): reject invalid ATT error code 0x00 on client
Map received error reason 0x00 to GATT_UNKNOWN_ERROR so the client
does not report GATT_SUCCESS with zero-length data on malformed errors.


(cherry picked from commit 1b6f9380f4)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:30 +08:00
Zhang Hai Peng 1a914b54d7 fix(ble/bluedroid): use sr_cmd status for GATT server error rsp
When sending an ATT error response after a failed server operation,
use p_tcb->sr_cmd.status instead of the last app callback status so
invalid error code 0x00 is not sent to the peer.


(cherry picked from commit 4c0488d92a)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:29 +08:00
Zhang Hai Peng af4690857c fix(ble/bluedroid): match read-multiple-var responses by handle
(cherry picked from commit 979c7dc567)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:28 +08:00
Zhang Hai Peng bd4b2050a0 fix(ble/bluedroid): match read-multiple responses by handle
Read Multiple may mix stack auto-responses with app async responses,
so multi_rsp_q order can differ from the request handle order. Look up
each response by handle (with occurrence for duplicates) instead of
walking the queue by index, and treat opcode-only buffers as empty.


(cherry picked from commit f91a41510c)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-07-14 10:36:27 +08:00
Rahul Tank 732c19d77a fix(nimble): Fix bond-store overflow when IRK is enabled 2026-07-10 13:23:41 +05:30
Rahul Tank 519ff91e23 Merge branch 'bugfix/ai_reviewer_nimble_1.6_v6.0' into 'release/v6.0'
fix(nimble): Fixes for AI reported issues (v6.0)

See merge request espressif/esp-idf!50014
2026-07-08 13:57:25 +05:30
Wang Meng Yang b1f7a5b8b8 Merge branch 'bugfix/sdp_null_access_v6.0' into 'release/v6.0'
fix(bt/bluedroid): fixed SDP deinit race with pending callbacks (v6.0)

See merge request espressif/esp-idf!48895
2026-07-08 12:42:23 +08:00
Rahul Tank 38f4edb16e fix(nimble): Fixes for AI reported issues 2026-07-07 16:18:32 +05:30
Wang Meng Yang 967825b6e2 Merge branch 'bugfix/bbp_issues_v6.0' into 'release/v6.0'
Bugfix/bbp issues v6.0

See merge request espressif/esp-idf!50189
2026-07-06 11:16:54 +08:00
Rahul Tank c79592004e fix(nimble): Defer Events / ATT related information from stack
Defer Events/ ATT related GAP events from stack until connection
 event is sent to GAP layer
2026-07-03 11:17:23 +05:30
Wang Meng Yang 5f4062d827 Merge branch 'bugfix/ai_review_btu_common_v6.0' into 'release/v6.0'
fix: Fix the critical issues of btu and bt_common from AI review report (v6.0)

See merge request espressif/esp-idf!50122
2026-06-30 19:25:09 +08:00
Jin Cheng 0d118139ff fix(bt/bluedroid): fixed possible OOB write in btc_a2dp_sink_handle_inc_media 2026-06-30 14:43:00 +08:00
Jin Cheng 2a6c38d1eb fix(bt/bluedroid): fixed possible OOB read/write in process_l2cap_cmd 2026-06-30 14:42:56 +08:00
Jiang Jiang Jian d40f9586c5 Merge branch 'bugfix/ai_review_a2dp_v6.0' into 'release/v6.0'
fix(bt): Fix the critical issues related to A2DP from AI review report (v6.0)

See merge request espressif/esp-idf!50128
2026-06-30 12:03:32 +08:00
Jin Cheng f3230cae05 fix(bt/bluedroid): fixed SDP deinit race with pending callbacks
Cancel any active SDP search during disabling and mark the BTA SDP
callbacks inactive so late search completions are not propagated
after deinit. Guard BTC side SDP completion handling after cleanup
to avoid null references.
2026-06-30 11:57:31 +08:00
Island 518eabeb7d Merge branch 'bugfix/fix_bluedroid_static_random_conn_rpa_v6.0' into 'release/v6.0'
fix(ble/bluedroid): skip identity conversion for static random direct connect (6.0)

See merge request espressif/esp-idf!50085
2026-06-30 10:24:28 +08:00
Rahul Tank cd0ad239a6 Merge branch 'bugfix/nimble_issues_02062026_v6.0' into 'release/v6.0'
fix(nimble):  Fix few nimble issues 02062026 (v6.0)

See merge request espressif/esp-idf!49153
2026-06-29 21:52:48 +05:30
Zhang Hai Peng af02bd9018 fix(ble/bluedroid): return ESP_ERR_INVALID_ARG for invalid conn params
Return ESP_ERR_INVALID_ARG instead of ESP_FAIL when connection
parameter validation fails


(cherry picked from commit 6c53838e66)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng add48e6f2c fix(ble/bluedroid): add context to GATTC reg-notify cache warning
Include client_if, handle, bd_addr, and server cache state in the
warning logged when notification registration skips handle validation.


(cherry picked from commit 1085a32be8)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng b13f63fd7f fix(ble/bluedroid): report conn param update failure for unknown BD_ADDR
Route unknown BD_ADDR and other immediate failures through the existing
need_cb path so ESP_GAP_BLE_UPDATE_CONN_PARAMS_EVT is always delivered.


(cherry picked from commit f9eaeb5e84)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng 0217c922fe fix(ble/bluedroid): preserve ATT error on prepare write completion
Skip prepare-write echo validation when the GATT stack reports a
non-success status. ATT Error Response carries no prepare-write echo
body (rsp_len=0), so the check incorrectly overwrote errors such as
GATT_INSUF_AUTHENTICATION (0x05) with GATT_INVALID_PDU (0x04).


(cherry picked from commit d5b9350d0f)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng a8ee33b38f fix(ble/bluedroid): preserve HCI status on BLE 4.2 GAP failures
Return BTM_HCI_ERROR | hci_status from legacy BLE 4.2 GAP HCI command
paths instead of mapping failures to BTM_ILLEGAL_VALUE or
BTM_NO_RESOURCES. Add btm_ble_status_from_hci() helper and propagate
real status through scan start/stop completion callbacks.


(cherry picked from commit 47dd785a18)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng 005e8029a9 feat(ble/bluedroid): Optimize Bluedroid memory usage
- Delete unused device records (~356B each)


(cherry picked from commit 7d1c0e9a32)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng ad3a325cc9 fix(ble/bluedroid): cap Read By Type response length at ATT maximum
Read By Type Response Length is one octet (max 255). When MTU was
large enough to return a long characteristic value in one pair, the
server wrote (UINT8)(value_len + 2) and overflowed (e.g. 513 -> 1),
so the client rejected the PDU as GATT_INVALID_PDU (0x04).

Cap server value to 253 bytes per pair, clamp the length byte, and
continue long reads via Read Blob when the capped size is returned.


(cherry picked from commit 97905afccc)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng 50b98393c6 fix(ble/bluedroid): Fixed potential double Execute Write Response
(cherry picked from commit 0a93ccd3b3)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng be3b2cf56b fix(ble/bluedroid): unblock sync HCI cmd on Command Status error
Release the BLE sync semaphore and record HCI status when a
synchronous command is rejected via Command Status, since no
Command Complete event follows.


(cherry picked from commit 29ae92f4ef)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00
Zhang Hai Peng 78f1bd2ccf fix(ble/bluedroid): set REQ_WAITING before GATTC service-change rediscovery
When service change cancels in-progress discovery, bta_gattc_disc_cmpl()
re-triggers discovery without marking auto_update as REQ_WAITING. If a
client command is queued in p_q_cmd, bta_gattc_start_discover() refuses
to restart and the command is never dispatched.


(cherry picked from commit 13926bb9bc)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
2026-06-29 19:04:29 +08:00