The minimum length check in `reassemble_and_dispatch()` applied the START packet minimum (`HCI_ACL_PREAMBLE_SIZE + L2CAP_LENGTH_SIZE` = 8 bytes) to **all** ACL packets, including continuation fragments. Continuation fragments only carry the 4-byte ACL preamble (handle + length) with no L2CAP header, so small but valid continuations (5-7 bytes) were incorrectly rejected as "too short."
This caused the first L2CAP PDU in a rapid burst of BLE GATT indications to be silently dropped. The partial reassembly was orphaned, then discarded when the next indication's START fragment arrived, producing:
```
E BT_HCI: ACL packet too short (len=5)
W BT_HCI: reassemble_and_dispatch found unfinished packet for handle with start packet. Dropping old.
```
Parse the ACL preamble first (requires only 4 bytes) to determine the boundary flag, then apply the L2CAP length check only to START packets. Continuation packets are now accepted with the correct minimum of `HCI_ACL_PREAMBLE_SIZE` (4 bytes).
- ESP32-S3 connected to a BLE peripheral that fragments indications at 40 bytes per L2CAP PDU
- Peripheral sends 8+ indications within ~200ms (burst of state changes)
- The final continuation fragment of the first indication is small (5-6 bytes after type stripping)
- 100% reproducible on every burst; confirmed on ESP-IDF 5.5.3, 5.5.4, and 6.0.0
Verified on ESP32-S3 with a Sub-Zero wall oven (SO3050PESP, firmware 8.5):
- **Before fix:** First indication in every burst lost (ACL reassembly failure)
- **After fix:** All indications in burst delivered correctly, including when the final continuation fragment is 5-6 bytes
Closes https://github.com/espressif/esp-idf/issues/18414
idf-ci discovers pyproject.toml pytest config and runs a separate
collection pass with --target all, which finds 0 target tests and
raises RuntimeError. Add to .idf_ci.toml exclude_dirs instead of
deleting tests. Restore all 227 unit tests with lint/mypy fixes.
Reflect changes from dev/ble-log-202603: ping-pong to multi-buffer
transport (4 buffers/LBM), renamed Kconfig options (LBM_TRANS_SIZE →
LBM_TRANS_BUF_SIZE with new defaults), always-enabled checksum and
enhanced statistics, UART redirection support, UHCI Out removal,
SPI Out deprecation, and updated memory estimation.
Add Kconfig options for bandwidth-optimized logging via the BLE Log
Async Output system. When enabled, controller log levels default to 2
and host/mesh log encoding is auto-selected.
- BT_LOG_CRITICAL_ONLY parent: selects BLE_LOG_ENABLED + compression
- BT_LOG_CRITICAL_ONLY_CTRL: supports both NimBLE and non-NimBLE (C3)
controllers with default level override
- BT_LOG_CRITICAL_ONLY_HOST: host-agnostic, selects compressed log
for Bluedroid conditionally
- BT_LOG_CRITICAL_ONLY_MESH: placeholder for mesh log encoding
- Guards against BT_STACK_NO_LOG conflict
Move per-chip BLE log Kconfig options (esp32c2/c5/c6/h2) into
components/bt/common/Kconfig.in for single-source-of-truth configuration.
Restructure menu as "BT Logs" with "Log Sources" sub-menu containing
controller log config options. Controller log output mode choice defaults
to BLE Log v2 when BLE_LOG_ENABLED, with legacy mode as deprecated
fallback. Migrate wrap_panic_handler and task_wdt_user_handler configs
as well since they depend on BT_LE_CONTROLLER_LOG_ENABLED.
Replace the two-step acquire() + get_trans() flow with a unified
acquire_trans() that iterates all candidate pools. When a pool's
buffers are exhausted, the lock is released and the next pool is
tried, enabling load balancing across pools instead of only
resolving lock contention.
Replace __atomic_exchange_n with __atomic_load_n in
ble_log_emit_buf_util() so inflight_peak reports the all-time peak
since init rather than resetting to zero after each report.
Migrate all LBM, RT, and peripheral backend code from 2-buffer
ping-pong to 4-buffer transport with bitmask index arithmetic.
LBM changes:
- Init sets owner on each transport buffer
- get_trans/flush/dump use (idx+1) & (cnt-1) instead of !idx
- get_trans/flush use __atomic_load_n(ACQUIRE) for prph_owned
- New ble_log_write_buf_util() emits BUF_UTIL telemetry frames,
exchange peak with 0 to avoid stale baseline after bursts
RT changes:
- Queue depth uses unified BLE_LOG_TRANS_TOTAL_CNT
- rt_queue_trans uses __atomic_store_n for prph_owned, tracks
per-LBM inflight count and peak via lock-free CAS
- ISR path captures pxHigherPriorityTaskWoken and yields
Peripheral changes:
- All tx_done callbacks: decrement inflight before releasing
prph_owned with __atomic_store_n(RELEASE)
- SPI/UART send_trans error paths: decrement inflight and
release prph_owned to allow retry on next get_trans pass
- Dummy send_trans: recycle buffer immediately (pos=0, decrement
inflight, release prph_owned) since no DMA hardware to wait for
- Redir LBM upgraded to 4-buffer with owner and reset support
- All peripherals implement ble_log_prph_reset_util_counters()
Add BLE_LOG_GET_FRAME_SN() on the buffer-full loss path so the SN
counter advances even when frames are dropped. This allows the console
to detect firmware-side buffer loss via SN gaps. Bump BLE_LOG_VERSION
to reflect the semantic change.
Introduce stream write API with deferred frame encapsulation for UART
redirection on port 0. Redirected data is now properly framed (header +
payload + checksum) instead of being sent as raw ASCII, preventing frame
parser sync oscillation on the receiver.
- Add stream_seal/stream_write/stream_flush in ble_log_lbm.c
- Add BLE_LOG_SRC_REDIR source and BLE_LOG_UART_REDIR_ENABLED gate
- Simplify redir_uart_tx_chars and timer callback to use stream API
- Flush pending stream data in ble_log_prph_deinit
- Make get_trans static (no external callers after refactor)
- Move UART wrap linker flags outside CONFIG_BT_ENABLED guard
- Default UART DMA peripheral when SOC_UHCI_SUPPORTED
- Default baud rate 921600 -> 3000000
Replace embedded ble_log_enh_stat_t (packed wire struct) inside
ble_log_stat_mgr_t with flat uint32_t counters. Natural 4-byte
alignment ensures each load/store compiles to a single l32i/s32i
on Xtensa/RISC-V, making individual field access atomic without
locks.
Build the packed wire format on the stack inside a critical section
in ble_log_write_enh_stat() so the full snapshot is consistent.
Remove CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED conditional compilation
-- payload checksum is always computed over the full frame.
Remove CONFIG_BLE_LOG_XOR_CHECKSUM_ENABLED conditional -- XOR checksum
is always used; delete the sum checksum dead code path.
Remove CONFIG_BLE_LOG_ENH_STAT_ENABLED conditional -- enhanced
statistics (frame/byte counters per source) are always active.
Remove incorrect select on choice symbol
BT_LE_CONTROLLER_LOG_MODE_BLE_LOG_V2 from BLE_LOG_IS_ESP_CONTROLLER.
Move ble_log_spi_out.c and ble_log_spi_out.h into a deprecated/
subdirectory under components/bt/common/ble_log/. Extract all
BT_BLE_LOG_SPI_OUT_* Kconfig options into deprecated/Kconfig.in
with an if-block to reduce depends-on repetition, sourced from
ble_log/Kconfig.in inside a "Legacy SPI Log Output (Deprecated)"
menu. Add mutual exclusion with BLE_LOG_ENABLED so that the legacy
SPI Out and the new BLE Log Module cannot be enabled simultaneously.
Update CMakeLists.txt source path and add deprecated/include to
include dirs so existing callers are unaffected. The BLE Log
Module's SPI Master DMA peripheral transport is the replacement.
Delete ble_log_uhci_out.c and its header. Remove the UHCI Out source
from CMakeLists.txt and all BT_BLE_LOG_UHCI_OUT_* Kconfig options.
Remove per-chip BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED Kconfig and
all UHCI Out caller references in esp32c5/c6/h2 controller bt.c.
Update ble_log_console README to reference the new BLE Log Module
UART DMA config. The functionality is superseded by the BLE Log
Module's UART DMA peripheral transport.
This commit introduces a new feature to the roaming logic. If the
currently connected AP has the 'transition disable' bit set in its
RSN IE, the roaming logic will now ignore any scanned APs that only
support WPA2-PSK. This prevents a security downgrade when roaming in a
mixed WPA2/WPA3 environment.
A new Kconfig option, CONFIG_ESP_WIFI_IGNORE_WPA2_ONLY_ON_TRANSITION_DISABLE,
has been added to control this feature. It is disabled by default.
This commit addresses several issues in the BSSID blacklisting
feature of the roaming application:
- Merged duplicate functions into a single,
unified function, resolving a compilation error.
- Corrected and
to properly access the member of the
struct, fixing invalid memory access.
- Introduced in Kconfig to enable
the manual blacklisting feature and made auto-blacklisting
dependent on it.
- Updated to use the
correct BSSID from .
- Optimized the removal of expired blacklist entries by using
for better efficiency.
