The ESP32 BLE controller glue guards ble_enc_funcs_reset() on
CONFIG_BT_CTRL_BLE_SECURITY_ENABLE, an ESP-IDF sdkconfig symbol that is never
defined in a Zephyr build. The call is therefore compiled out and the
controller's LE Secure Connections encryption table is left uninitialised, so
SC pairing derives a wrong session key and the link is terminated with HCI
reason 0x3D (MIC failure).
This breaks pairing for SC-capable centrals (e.g. Pixel 7 / recent Android);
legacy-pairing centrals use a different path and are unaffected. The existing
CONFIG_ESP32_BT_CTLR_LE_SECURITY_ENABLE=y only sets .enc_en and does not reach
this guard.
Correct the guard to BLE_SECURITY_ENABLE, which esp_bt.h already derives from
CONFIG_ESP32_BT_CTLR_LE_SECURITY_ENABLE (the Zephyr knob) and already uses for
.enc_en. Carried as a managed hal_espressif patch via the existing
zephcore_apply_patches() mechanism (mirrors the loramac-node patch).
Verified on Heltec Wireless Tracker (ESP32-S3): device reaches security
level 4, pairing complete bonded=1; Pixel 7 bonds over SC and the companion app
communicates; older Samsung still pairs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Three correctness fixes for the SX127x radio adapter on top of
Rastislav's initial sx1276 + patch commits:
1. _loramac_node flag (LoRaRadioBase + SX127xRadio):
Guard the direction-only fast path in configureTx()/configureRx()
so loramac-node always calls both Radio.SetTxConfig() and
Radio.SetRxConfig(). Skipping either leaves TxTimeout=0 in the
library, causing an immediate TX timeout callback, which prevents
the _tx_signal from ever being raised and blocks the TX wait thread
for TX_TIMEOUT_MS (5 s) — a 5-second RX blackout per transmission.
This was the root cause of "boots but no RX".
2. SX127xRadio::resetAGC() override:
The base-class resetAGC() calls startReceive() after hwResetAGC().
During async RX the loramac-node modem mutex is STATE_BUSY, so
lora_recv_async() returns -EBUSY, which sets _in_recv_mode = 0 and
corrupts the receive state machine. Override skips the call
entirely — the loramac-node driver self-manages AGC.
3. BW 62.5 kHz support in loramac-node/sx1276.c + patch:
Rastislav's 0004-lora-sx127x-62k5-bandwidth.patch adds BW_62_KHZ
support to sx12xx_common.c (Zephyr side) but not to the loramac-
node library itself. Without this fix bandwidth index 3 hits the
"while(1)" fatal guard in SX1276SetRxConfig/SX1276SetTxConfig.
This commit patches sx1276.c directly and adds
patches/modules/loramac-node/0001-sx1276-bw62k5.patch so the fix
survives west update. CMakeLists.txt is extended to apply module
patches via the existing zephcore_apply_patches() mechanism.
