Merge branch 'bugfix/V3.1.7_ble_bug_mr' into 'master'

component/bt: fix notify malloc failed , fix no BLE_AUTH_CMPL_EVT and fix bluedroid btc deinit crash

See merge request espressif/esp-idf!8729

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -334,6 +334,9 @@ void bta_dm_deinit_cb(void)
     }
 #endif
     memset(&bta_dm_cb, 0, sizeof(bta_dm_cb));
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreGive(deinit_semaphore);
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 /*******************************************************************************

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -25,7 +25,7 @@
 #define BTA_DM_INT_H
 
 #include "common/bt_target.h"
-
+#include "freertos/semphr.h"
 #if (BLE_INCLUDED == TRUE && (defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE))
 #include "bta/bta_gatt_api.h"
 #endif
@@ -1270,6 +1270,7 @@ extern tBTA_DM_DI_CB  bta_dm_di_cb;
 #else
 extern tBTA_DM_DI_CB *bta_dm_di_cb_ptr;
 #define bta_dm_di_cb (*bta_dm_di_cb_ptr)
+SemaphoreHandle_t deinit_semaphore;
 #endif
 
 #if BTA_DYNAMIC_MEMORY == FALSE

components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c

@@ -48,6 +48,7 @@ static void bta_gatts_send_request_cback (UINT16 conn_id,
         UINT32 trans_id,
         tGATTS_REQ_TYPE req_type, tGATTS_DATA *p_data);
 static void bta_gatts_cong_cback (UINT16 conn_id, BOOLEAN congested);
+extern void btc_congest_callback(tBTA_GATTS *param);
 
 static const tGATT_CBACK bta_gatts_cback = {
     bta_gatts_conn_cback,
@@ -1026,20 +1027,9 @@ static void bta_gatts_conn_cback (tGATT_IF gatt_if, BD_ADDR bda, UINT16 conn_id,
 *******************************************************************************/
 static void bta_gatts_cong_cback (UINT16 conn_id, BOOLEAN congested)
 {
-    tBTA_GATTS_RCB *p_rcb;
-    tGATT_IF gatt_if;
-    tBTA_GATT_TRANSPORT transport;
     tBTA_GATTS cb_data;
-
-    if (GATT_GetConnectionInfor(conn_id, &gatt_if, cb_data.req_data.remote_bda, &transport)) {
-        p_rcb = bta_gatts_find_app_rcb_by_app_if(gatt_if);
-
-        if (p_rcb && p_rcb->p_cback) {
-            cb_data.congest.conn_id = conn_id;
-            cb_data.congest.congested = congested;
-
-            (*p_rcb->p_cback)(BTA_GATTS_CONGEST_EVT, &cb_data);
-        }
-    }
+    cb_data.congest.conn_id = conn_id;
+    cb_data.congest.congested = congested;
+    btc_congest_callback(&cb_data);
 }
 #endif /* GATTS_INCLUDED */

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -70,11 +70,18 @@ static void btc_init_bluetooth(void)
     btc_dm_load_ble_local_keys();
 #endif  ///BLE_INCLUDED == TRUE
 #endif /* #if (SMP_INCLUDED) */
+#if BTA_DYNAMIC_MEMORY
+    deinit_semaphore = xSemaphoreCreateBinary();
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 
 static void btc_deinit_bluetooth(void)
 {
+    /* Wait for the disable operation to complete */
+#if BTA_DYNAMIC_MEMORY
+    xSemaphoreTake(deinit_semaphore, BTA_DISABLE_DELAY / portTICK_PERIOD_MS);
+#endif /* #if BTA_DYNAMIC_MEMORY */
 #if (BLE_INCLUDED == TRUE)
     btc_gap_ble_deinit();
 #endif  ///BLE_INCLUDED == TRUE
@@ -92,6 +99,10 @@ static void btc_deinit_bluetooth(void)
     osi_alarm_deinit();
     osi_alarm_delete_mux();
     future_ready(*btc_main_get_future_p(BTC_MAIN_DEINIT_FUTURE), FUTURE_SUCCESS);
+#if BTA_DYNAMIC_MEMORY
+    vSemaphoreDelete(deinit_semaphore);
+    deinit_semaphore = NULL;
+#endif /* #if BTA_DYNAMIC_MEMORY */
 }
 
 void btc_main_call_handler(btc_msg_t *msg)

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -963,4 +963,13 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
     btc_gatts_cb_param_copy_free(msg, p_data);
 }
 
+void btc_congest_callback(tBTA_GATTS *param)
+{
+    esp_ble_gatts_cb_param_t esp_param;
+    esp_gatt_if_t gatts_if = BTC_GATT_GET_GATT_IF(param->congest.conn_id);
+    esp_param.congest.conn_id = BTC_GATT_GET_CONN_ID(param->congest.conn_id);
+    esp_param.congest.congested = param->congest.congested;
+    btc_gatts_cb_to_app(ESP_GATTS_CONGEST_EVT, gatts_if, &esp_param);
+}
+
 #endif  ///GATTS_INCLUDED

components/bt/host/bluedroid/hci/packet_fragmenter.c

@@ -88,6 +88,13 @@ static void fragment_and_dispatch(BT_HDR *packet)
         controller->get_acl_data_size_ble();
 
     max_packet_size = max_data_size + HCI_ACL_PREAMBLE_SIZE;
+    if((packet->len > max_packet_size) && (packet->layer_specific == 0) && (event == MSG_STACK_TO_HC_HCI_ACL)) {
+        packet->event = MSG_HC_TO_STACK_L2C_SEG_XMIT;
+        current_fragment_packet = NULL;
+        callbacks->transmit_finished(packet, false);
+        return;
+
+    }
     remaining_length = packet->len;
     STREAM_TO_UINT16(continuation_handle, stream);
     continuation_handle = APPLY_CONTINUATION_FLAG(continuation_handle);

components/bt/host/bluedroid/stack/l2cap/include/l2c_int.h

@@ -264,7 +264,7 @@ typedef struct
 }tL2CAP_SEC_DATA;
 
 #ifndef L2CAP_CBB_DEFAULT_DATA_RATE_BUFF_QUOTA
-#define L2CAP_CBB_DEFAULT_DATA_RATE_BUFF_QUOTA 100
+#define L2CAP_CBB_DEFAULT_DATA_RATE_BUFF_QUOTA 10
 #endif
 /* Define a channel control block (CCB). There may be many channel control blocks
 ** between the same two Bluetooth devices (i.e. on the same link).

components/bt/host/bluedroid/stack/l2cap/l2c_api.c

@@ -1836,7 +1836,7 @@ UINT16 L2CA_SendFixedChnlData (UINT16 fixed_cid, BD_ADDR rem_bda, BT_HDR *p_buf)
 
     // If already congested, do not accept any more packets
     if (p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->cong_sent) {
-        L2CAP_TRACE_DEBUG ("L2CAP - CID: 0x%04x cannot send, already congested\
+        L2CAP_TRACE_ERROR ("L2CAP - CID: 0x%04x cannot send, already congested\
             xmit_hold_q.count: %u buff_quota: %u", fixed_cid,
             fixed_queue_length(p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->xmit_hold_q),
             p_lcb->p_fixed_ccbs[fixed_cid - L2CAP_FIRST_FIXED_CHNL]->buff_quota);

components/bt/host/bluedroid/stack/l2cap/l2c_utils.c

@@ -3660,8 +3660,9 @@ void l2cu_check_channel_congestion (tL2C_CCB *p_ccb)
 #endif
             }
         } else {
+            tL2C_LCB *p_lcb = p_ccb->p_lcb;
             /* If this channel was not congested but it is congested now, tell the app */
-            if (q_count > p_ccb->buff_quota) {
+            if ((q_count > p_ccb->buff_quota) || (p_lcb && (p_ccb->local_cid == L2CAP_ATT_CID) && (p_lcb->link_xmit_quota > 0) && (p_lcb->link_xmit_quota <= p_lcb->sent_not_acked))) {
                 p_ccb->cong_sent = TRUE;
                 if (p_ccb->p_rcb && p_ccb->p_rcb->api.pL2CA_CongestionStatus_Cb) {
                     L2CAP_TRACE_DEBUG ("L2CAP - Calling CongestionStatus_Cb (TRUE),CID:0x%04x,XmitQ:%u,Quota:%u",

components/bt/host/bluedroid/stack/smp/smp_act.c

@@ -1990,9 +1990,7 @@ void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable)
         }
 
         smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
-    }
-    else if(p_dev_rec && !p_dev_rec->enc_init_by_we){
-
+    } else if (p_dev_rec && !p_dev_rec->role_master && !p_dev_rec->enc_init_by_we ){
         /*
         if enc_init_by_we is false, it means that client initiates encryption before slave calls esp_ble_set_encryption()
         we need initiate pairing_bda and p_cb->role then encryption, for example iPhones
@@ -2002,6 +2000,12 @@ void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable)
         p_cb->role = HCI_ROLE_SLAVE;
         p_dev_rec->enc_init_by_we = FALSE;
         smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
+    } else if (p_dev_rec && p_dev_rec->role_master && p_dev_rec->enc_init_by_we){
+        memcpy(&smp_cb.pairing_bda[0], bda, BD_ADDR_LEN);
+        p_cb->state = SMP_STATE_ENCRYPTION_PENDING;
+        p_cb->role = HCI_ROLE_MASTER;
+        p_dev_rec->enc_init_by_we = FALSE;
+        smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
     }
 }