Merge branch 'contrib/github_pr_502' into 'master'

fix(ble_ota): fix reading of NimBLE's mbufs (GitHub PR)

Closes AEGHB-1060

See merge request ae_group/esp-iot-solution!1326

Author: laride

components/bluetooth/ble_profiles/esp/ble_ota/CHANGELOG.md

@@ -77,3 +77,7 @@
 ## v0.1.14 - 2024-11-21
 * BLE-OTA:
   * Add support for enabling BLE 5.0 for NimBLE
+
+## v0.1.15 - 2025-07-29
+* BLE-OTA:
+  * Fixed BLE OTA data corruption issue caused by incomplete NimBLE's mbufs reading [#502](https://github.com/espressif/esp-iot-solution/pull/502)

components/bluetooth/ble_profiles/esp/ble_ota/README.md

@@ -11,3 +11,7 @@ You can create a project from this example by the following command:
 ```
 idf.py create-project-from-example "espressif/ble_ota^0.1.8:ble_ota"
 ```
+
+> ![TIP]
+>
+> When using NimBLE, it may be necessary to increase `CONFIG_BT_NIMBLE_HOST_TASK_STACK_SIZE`。

components/bluetooth/ble_profiles/esp/ble_ota/README_CN.md

@@ -5,3 +5,7 @@
 ## 从机示例代码
 
 [ESP BLE OTA](https://github.com/espressif/esp-iot-solution/tree/master/examples/bluetooth/ble_ota)
+
+> ![TIP]
+>
+> 使用 NimBLE 时，可能需要增大 `CONFIG_BT_NIMBLE_HOST_TASK_STACK_SIZE`。

components/bluetooth/ble_profiles/esp/ble_ota/idf_component.yml

@@ -1,4 +1,4 @@
-version: "0.1.14"
+version: "0.1.15"
 targets:
   - esp32
   - esp32c3

components/bluetooth/ble_profiles/esp/ble_ota/src/nimble_ota.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
 */
@@ -19,6 +19,25 @@
 #include "freertos/semphr.h"
 #if ESP_IDF_VERSION < ESP_IDF_VERSION_VAL(5, 0, 0)
 #include "esp_nimble_hci.h"
+
+/*
+ * This is a workaround for the missing os_mbuf_len function in NimBLE.
+ * It is not present in NimBLE 1.3, but is present in NimBLE 1.4.
+ * This function is used to get the length of an os_mbuf.
+ */
+uint16_t
+os_mbuf_len(const struct os_mbuf *om)
+{
+    uint16_t len;
+
+    len = 0;
+    while (om != NULL) {
+        len += om->om_len;
+        om = SLIST_NEXT(om, om_next);
+    }
+
+    return len;
+}
 #endif
 
 #ifdef CONFIG_PRE_ENC_OTA
@@ -117,14 +136,9 @@ esp_ble_ota_write_chr(struct os_mbuf *om)
     esp_err_t err;
     pre_enc_decrypt_arg_t pargs = {};
 
-    pargs.data_in_len = om->om_len - 3;
-
-    if (SLIST_NEXT(om, om_next) != NULL) {
-        struct os_mbuf *temp2 = SLIST_NEXT(om, om_next);
-        pargs.data_in_len += temp2->om_len;
-    }
+    pargs.data_in_len = os_mbuf_len(om) - 3;
 
-    pargs.data_in = (const char *)malloc(pargs.data_in_len * sizeof(char *));
+    pargs.data_in = (const char *)malloc(pargs.data_in_len);
     err = os_mbuf_copydata(om, 3, pargs.data_in_len, pargs.data_in);
 
     if (om->om_data[2] == 0xff) {
@@ -191,23 +205,11 @@ esp_ble_ota_write_chr(struct os_mbuf *om)
     ESP_LOGD(TAG, "DEBUG: Sector:%" PRIu32 ", total length:%" PRIu32 ", length:%d", cur_sector,
              fw_buf_offset, pargs.data_out_len);
 #else
-    memcpy(fw_buf + fw_buf_offset, om->om_data + 3, om->om_len - 3);
-    fw_buf_offset += om->om_len - 3;
-
-    if (SLIST_NEXT(om, om_next) != NULL) {
-        struct os_mbuf *last;
-        last = om;
-        while (SLIST_NEXT(last, om_next) != NULL) {
-            struct os_mbuf *temp = SLIST_NEXT(last, om_next);
-            memcpy(fw_buf + fw_buf_offset, temp->om_data, temp->om_len);
-            fw_buf_offset += temp->om_len;
-            last = SLIST_NEXT(last, om_next);
-            temp = NULL;
-        }
-    }
+    os_mbuf_copydata(om, 3, os_mbuf_len(om) - 3, fw_buf + fw_buf_offset);
+    fw_buf_offset += os_mbuf_len(om) - 3;
 
     ESP_LOGD(TAG, "DEBUG: Sector:%" PRIu32 ", total length:%" PRIu32 ", length:%d", cur_sector,
-             fw_buf_offset, om->om_len - 3);
+             fw_buf_offset, os_mbuf_len(om) - 3);
 #endif
     if (om->om_data[2] == 0xff) {
         cur_packet = 0;
@@ -446,7 +448,7 @@ ble_ota_gatt_handler(uint16_t conn_handle, uint16_t attr_handle,
     case BLE_GATT_ACCESS_OP_WRITE_CHR:
 
         ota_char = find_ota_char_and_desr_by_handle(attr_handle);
-        ESP_LOGD(TAG, "client write; len = %d", ctxt->om->om_len);
+        ESP_LOGD(TAG, "client write; len = %d", os_mbuf_len(ctxt->om));
 
         if (ota_char == RECV_FW_CHAR) {
             if (start_ota) {

examples/bluetooth/ble_ota/sdkconfig.ci.nimble

@@ -1 +1,2 @@
 CONFIG_BT_NIMBLE_ENABLED=y
+CONFIG_BT_NIMBLE_HOST_TASK_STACK_SIZE=6144