L2CAP_CONFIGURATION_RSP packets lost when establishing HID control channel between ESP32 & BK3513 based ShanWan PS3 controller (IDFGH-14343)

[darthcloud]

Answers checklist.

• I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
• I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
• I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

v5.5-dev-698-g030c9957db

Espressif SoC revision.

ESP32 (ESP32-D0WD-V3 (revision v3.0))

Operating System used.

Linux

How did you build your project?

Command line with idf.py

If you are using Windows, please specify command line type.

None

Development Kit.

ESP32-DevKitC-32E & ESP-WROVER-KIT

Power Supply used.

USB

What is the expected behavior?

When using an ESP32 as the BT BR/EDR Central device the two L2CAP_CONFIGURATION_RSP send by either the ESP32 or BK3513 should be received by the other device and allow the L2CAP config step to complete sucessfully.

This should result in the ShanWan PS3 controller (BK3513) to start sending HID report to the ESP32.

What is the actual behavior?

1. L2CAP_CONNECTION step between the two device for the HID Control channel is Sucessful.
2. Each device send L2CAP_CONFIGURATION_REQ.
3. Each device receive the other device L2CAP_CONFIGURATION_REQ.
4. Each device send L2CAP_CONFIGURATION_RSP.
5. Neither device receive the other device L2CAP_CONFIGURATION_RSP.

The ShanWan PS3 controller (BK3513) then timeout and shutdown.

Steps to reproduce.

I can reproduce 100% so I think the easiest way to debug this would be to send me a debug build of libbtdm_app.a .
I did debug another issue this way a couple year back with BetterJincheng (#10814).

I first found the issue using my own BlueRetro project and then found out that using BlueZ with the ESP32 had the exact same issue with that controller.

Here the step I used to use the ESP32 with Linux BlueZ stack:

0. Pair ShanWan PS3 controller to ESP32 BDADDR using the sixpair linux USB utility.
1. Build and flash controller_hci_uart_esp_wrover_kit on a ESP-WROVER-KIT.
   This special version of the esp-idf example change the pins to use IOs 12,13,14,15.

git clone https://github.com/darthcloud/controller_hci_uart_esp_wrover_kit
cd controller_hci_uart_esp_wrover_kit
idf.py build
idf.py flash

2. Set the jumper on JP2 as if using JTAG (First UART of FTDI2232 used for ESP UART1 HCI)
   (TMS, TDO, TDI & TCK)
3. Connect ESP-WROVER-KIT to a Linux PC with USB cable.
4. Attach the ESP32 to BlueZ:
   sudo hciattach /dev/ttyUSB0 any 921600 flow
5. Enter sudo bluetoothctl and type the following commands:

list
select <ESP32 BDADDR FROM LIST>
discoverable on

6. Connect ShanWan PS3 controller to ESP32 by pressing P3 button of the controller.

Debug Logs.

See below in more information section.

More Information.

sdkconfig:

sdkconfig.txt

Btsnoop traces on both the central & peripheral side HCI interface:

shanwan_btsnoop_traces.zip

This zip archive contain 6 btsnoop trace you can open in wireshark:

Test with Bluez + ESP32 (Fail)

Done with Ubuntu 24.04 & BlueZ 5.79

• Bluez_ESP32_with_ShanWan_PS3_BK3513_central_fail.log
  Trace of the HCI packets between the ESp32 and BlueZ
• Bluez_ESP32_with_ShanWan_PS3_BK3513_peripheral_fail.log
  Trace of the HCI packets between the ShanWan controller MCU & BK3513

You can see in this trace that both device send a L2CAP_CONFIGURATION_RSP but neither of them receive one.

Test with BlueZ + Intel AX201 (Success)

Done with Ubuntu 24.04 & BlueZ 5.79

• Bluez_Intel_AX201_with_ShanWan_PS3_BK3513_central_success.log
  Trace of the HCI packets between Intel BT and BlueZ
• Bluez_Intel_AX201_with_ShanWan_PS3_BK3513_peripheral_success.log
  Trace of the HCI packets between the ShanWan controller MCU & BK3513

Test with a 8bitdo receiver (Success)

• 8bitdo_Realtek_with_ShanWan_PS3_BK3513_central_success.log
  Trace of the HCI packets between 8bitdo MCU and Realtek radio
• 8bitdo_Realtek_with_ShanWan_PS3_BK3513_peripheral_success.log
  Trace of the HCI packets between the ShanWan controller MCU & BK3513

NOTES: All the peripheral traces were sniffed using 2 independant UART interface. So due to buffering sometimes the request and responces packets are out of order due to the way my script merged the TX & RX packet in the same trace.

ESP32 boot logs:

esp32_boot_logs.txt