Bluetooth controller panic when scanning on busy environments

[mariosd97]

Recently I've been consistently experiencing a bluetooth controller related panic on my ESP32Pico board. The only bluetooth task I'm running is an active scanner with the following parameters:

Code: Select all

esp_ble_scan_params_t scan_params = {
        .scan_type              = BLE_SCAN_TYPE_ACTIVE,
        .own_addr_type          = BLE_ADDR_TYPE_PUBLIC,
        .scan_filter_policy     = BLE_SCAN_FILTER_ALLOW_ALL,
        .scan_duplicate         = BLE_SCAN_DUPLICATE_DISABLE
    };

Additionally, I advertise some data with the following parameters:

Code: Select all

static esp_ble_adv_data_t adv_config = {
    .set_scan_rsp = false,
    .include_txpower = true,
    .min_interval = 0x0006, //slave connection min interval, Time = min_interval * 1.25 msec
    .max_interval = 0x0010, //slave connection max interval, Time = max_interval * 1.25 msec
    .appearance = 0x00,
    .manufacturer_len = 0,
    .p_manufacturer_data =  NULL,
    .service_data_len = 0,
    .p_service_data = NULL,
    .service_uuid_len = sizeof(sec_service_uuid),
    .p_service_uuid = sec_service_uuid,
    .flag = (ESP_BLE_ADV_FLAG_GEN_DISC | ESP_BLE_ADV_FLAG_BREDR_NOT_SPT),
};
// config scan response data
static esp_ble_adv_data_t scan_rsp_config = {
    .set_scan_rsp = true,
    .include_name = true,
    .manufacturer_len = sizeof(manufacturer_name),
    .p_manufacturer_data = manufacturer_name,
};

static esp_ble_adv_params_t adv_params = {
    .adv_int_min        = 0x100,
    .adv_int_max        = 0x100,
    .adv_type           = ADV_TYPE_IND,
    .own_addr_type      = BLE_ADDR_TYPE_PUBLIC,
    .channel_map        = ADV_CHNL_ALL,
    .adv_filter_policy = ADV_FILTER_ALLOW_SCAN_ANY_CON_ANY,
};

When I run this scanner on quiet environments everything works as expected, but when surrounded by a considerable amount of BLE devices (~200-400), I start seeing the following panics regularly:

Code: Select all

ASSERT_PARAM(-218959118 0), in arch_main.c at line 372
Guru Meditation Error: Core  0 panic'ed (IllegalInstruction). Exception was unhandled.
Memory dump at 0x400909e8: f01d020c 00004136 f01d0000
--- 0x400909e8: btdm_sleep_check_duration at /<>/esp-idf/components/bt/controller/esp32/bt.c:918

Core  0 register dump:
PC      : 0x400909ef  PS      : 0x00060334  A0      : 0x80089122  A1      : 0x3ffca7a0  
--- 0x400909ef: r_assert at /<>/esp-idf/components/bt/controller/esp32/bt.c:1930

A2      : 0x00000000  A3      : 0xf2f2f2f2  A4      : 0x00000000  A5      : 0x3f40c8d8  
A6      : 0x00000174  A7      : 0xfffffffc  A8      : 0x8000814b  A9      : 0x3ffca710  
A10     : 0x00000000  A11     : 0x3ffca733  A12     : 0x3ffca6df  A13     : 0x00000032  
A14     : 0x00000000  A15     : 0x3ffca6e4  SAR     : 0x00000004  EXCCAUSE: 0x00000000  
EXCVADDR: 0x00000000  LBEG    : 0x4000c2e0  LEND    : 0x4000c2f6  LCOUNT  : 0xffffffff  
--- 0x4000c2e0: memcpy in ROM
--- 0x4000c2f6: memcpy in ROM



Backtrace: 0x400909ec:0x3ffca7a0 0x4008911f:0x3ffca7c0 0x400ea5d5:0x3ffca7e0 0x40019fb5:0x3ffca800 0x4001a1f2:0x3ffca830 0x400fc2ee:0x3ffca850 0x400fdc25:0x3ffca8c0 0x400fa9ef:0x3ffca910 0x400f7966:0x3ffca960 0x40019d11:0x3ffca9a0 0x40055b4d:0x3ffca9c0 0x400ea9af:0x3ffca9e0 0x400eaff3:0x3ffcaa00 0x400936b9:0x3ffcaa30
--- 0x400909ec: r_assert at /<>/esp-idf/components/bt/controller/esp32/bt.c:1929
--- 0x4008911f: r_assert_param at ??:?
--- 0x400ea5d5: r_platform_reset at ??:?
--- 0x40019fb5: r_ke_malloc in ROM
--- 0x4001a1f2: r_ke_msg_alloc in ROM
--- 0x400fc2ee: r_llm_le_adv_report_ind at ??:?
--- 0x400fdc25: r_llm_pdu_defer at ??:?
--- 0x400fa9ef: r_lld_pdu_check at ??:?
--- 0x400f7966: r_lld_evt_deffered_elt_handler at ??:?
--- 0x40019d11: r_ke_event_schedule in ROM
--- 0x40055b4d: r_rwip_schedule in ROM
--- 0x400ea9af: r_rw_schedule at ??:?
--- 0x400eaff3: btdm_controller_task at ??:?
--- 0x400936b9: vPortTaskWrapper at /<>/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:134

The only way it seems to be mitigated is by reducing the scan window (e.g. by setting the scan interval to be 1s and the scan window to be 500ms). I'd like to keep a 100% duty cycle on scans to get the closest to real-time data on BLE advertising around my esp32 sensor.

- Is it possible to fix this panic on busy environments without decreasing the scan window?
- If this is related to an overflow in memory, is it possible to allocate more memory for the controller?