fix(firmware): C6 IDF v5.5 guard + HE-LTF host ingest + WITNESS-LOG-110 B1 resolution (#1005) (#1011)

* fix(firmware): c6_sync_espnow IDF v5.5 send-callback guard + B1 HE-LTF resolution (#1005)

Espressif backported the esp_now_send_cb_t signature change to v5.5
(esp_now_send_info_t = wifi_tx_info_t there), so the #944 guard must be
ESP_IDF_VERSION >= VAL(5,5,0), not MAJOR >= 6.

Validated on this repo's hardware toolchain:
- WITHOUT fix, IDF v5.5.2 esp32c6 build fails with the reporter's exact
  incompatible-pointer error at c6_sync_espnow.c:199 (reproduced)
- WITH fix, clean build on IDF v5.5.2 (esp32c6) AND IDF v5.4 (regression)

Docs: WITNESS-LOG-110 §B1 marked RESOLVED WITH MEASUREMENT (external,
@stuinfla, issue #1005): IDF v5.4 driver downconverts HE->HT; v5.5.2
delivers true HE-LTF (532B / 256 bins / 242 tones, PPDU 0x01 HE-SU).
ADR-110 capability table updated accordingly.

Co-Authored-By: claude-flow <ruv@ruv.net>

* docs: WITNESS-LOG-110 §B1 — in-house HE-LTF replication on the original COM12 C6

84% of 1,525 frames at 532B/PPDU 0x01 (HE-SU) with IDF v5.5.2 + the #1005
guard fix, AP ruv.net 11ax 2.4GHz. Two independent rigs now confirm:
v5.4 downconverts, v5.5.2 delivers 242-tone HE20.

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(host): 256-bin HE-LTF ingest end-to-end + latent offset bugs (#1005)

Audit of every ADR-018 consumer against live C6 HE20 frames (532B/256-bin):
- sensing-server + CLI calibrate parsers read n_subcarriers from one byte
  (256 decoded as 0) with stale seq/rssi offsets (rssi always 0 — latent,
  pre-existing, confirmed vs firmware csi_collector.c). Fixed to the real
  ADR-018 layout; n_subcarriers u8->u16; byte 18 surfaced as typed PpduType.
- sensing-server probe buffer 256B -> 2048B (532B datagram errored on Windows)
- per-node grid gate: lock densest (n_subcarriers, ppdu_type) grid, re-warm
  on upgrade, skip sparser minority frames — HT-64 never mixes into an
  HE-256 baseline window
- hardware parser: HE-aware bandwidth classification (256-FFT HE20 = 20MHz,
  was Bw160); PpduType/Adr018Flags re-exported
- verbatim live frames (532B HE-SU, 148B HT) embedded as regression fixtures
- archive python parser: bandwidth heuristic mirror fix

Live-validated: calibrate --tier he20 consumed 600x 256-bin frames into an
ADR-135 He20 baseline (242 tones) skipping 94 HT frames; sensing-server
shows node 12 active with real RSSI (-40dBm). 765 tests green across the
three crates; workspace check clean; Python proof PASS.

Co-Authored-By: claude-flow <ruv@ruv.net>

* test(fuzz): esp_netif/ping_sock/ip_addr stubs — un-break ADR-061 fuzz build after #954

csi_collector.c gained esp_netif.h / ping/ping_sock.h / lwip/ip_addr.h
includes for the #954 gateway self-ping; the host-fuzz stub env lacked
them, breaking the fuzz build on main since 5789351b7. Stubs return
no-gateway so the self-ping path early-outs (compiles + links, never
exercised — matches the fuzz threat model which targets frame
serialization, not the network stack).

Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
rUv
2026-06-11 11:00:37 -04:00
committed by GitHub
parent 2a307138f2
commit d0e27e652e
15 changed files with 618 additions and 77 deletions
@@ -151,9 +151,13 @@ static void on_recv(const uint8_t *src_mac, const uint8_t *data, int len)
* void (*)(const esp_now_send_info_t *tx_info, esp_now_send_status_t status)
* Both signatures ignore the address-side argument here — we only inspect
* `status` to bump the TX-fail counter — so the body is identical; only the
* function-pointer type differs. ESP_IDF_VERSION_MAJOR is the canonical guard.
* function-pointer type differs.
*
* Issue #1005: Espressif backported the new signature to v5.5
* (`esp_now_send_info_t` = typedef of `wifi_tx_info_t` there), so the guard
* must be the full version triple, not ESP_IDF_VERSION_MAJOR.
*/
#if ESP_IDF_VERSION_MAJOR >= 6
#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
static void on_send(const esp_now_send_info_t *tx_info, esp_now_send_status_t status)
{
(void)tx_info;
@@ -0,0 +1,48 @@
/* Host-fuzzing stub for esp_netif.h (ADR-061).
*
* csi_collector.c's #954 self-ping needs the STA netif handle + gateway IP.
* In the fuzz environment there is no network stack: the handle lookup
* returns NULL, so csi_start_self_ping() takes its no-gateway early-out and
* the esp_ping path is never exercised (but must compile and link).
*/
#pragma once
#include <stdint.h>
#include <stdio.h>
#include "esp_err.h"
typedef struct esp_netif_obj esp_netif_t;
typedef struct {
uint32_t addr;
} esp_ip4_addr_t;
typedef struct {
esp_ip4_addr_t ip;
esp_ip4_addr_t netmask;
esp_ip4_addr_t gw;
} esp_netif_ip_info_t;
static inline esp_netif_t *esp_netif_get_handle_from_ifkey(const char *if_key)
{
(void)if_key;
return NULL; /* no netif in fuzz env -> self-ping early-out */
}
static inline esp_err_t esp_netif_get_ip_info(esp_netif_t *netif, esp_netif_ip_info_t *ip_info)
{
(void)netif;
(void)ip_info;
return ESP_FAIL;
}
static inline char *esp_ip4addr_ntoa(const esp_ip4_addr_t *addr, char *buf, int buflen)
{
if (buf != NULL && buflen > 0) {
snprintf(buf, (size_t)buflen, "%u.%u.%u.%u",
(unsigned)(addr->addr & 0xff), (unsigned)((addr->addr >> 8) & 0xff),
(unsigned)((addr->addr >> 16) & 0xff), (unsigned)((addr->addr >> 24) & 0xff));
}
return buf;
}
@@ -0,0 +1,20 @@
/* Host-fuzzing stub for lwip/ip_addr.h (ADR-061). Minimal surface for the
* #954 self-ping block; never functionally exercised in the fuzz env. */
#pragma once
#include <stdint.h>
typedef struct {
uint32_t addr;
uint8_t type;
} ip_addr_t;
static inline int ipaddr_aton(const char *cp, ip_addr_t *addr)
{
(void)cp;
if (addr != NULL) {
addr->addr = 0;
addr->type = 0;
}
return 1;
}
@@ -0,0 +1,79 @@
/* Host-fuzzing stub for ping/ping_sock.h (ADR-061). The #954 self-ping is
* unreachable in the fuzz env (esp_netif stub returns no gateway), but the
* symbols must compile and link. */
#pragma once
#include <stdint.h>
#include "esp_err.h"
#include "lwip/ip_addr.h"
typedef void *esp_ping_handle_t;
typedef void (*esp_ping_cb_t)(esp_ping_handle_t hdl, void *args);
typedef struct {
uint32_t count;
uint32_t interval_ms;
uint32_t timeout_ms;
uint32_t data_size;
uint8_t tos;
int ttl;
ip_addr_t target_addr;
uint32_t task_stack_size;
uint32_t task_prio;
uint32_t interface;
} esp_ping_config_t;
#define ESP_PING_COUNT_INFINITE (0)
#define ESP_PING_DEFAULT_CONFIG() \
{ \
.count = 5, \
.interval_ms = 1000, \
.timeout_ms = 1000, \
.data_size = 64, \
.tos = 0, \
.ttl = 64, \
.target_addr = {0, 0}, \
.task_stack_size = 2048, \
.task_prio = 2, \
.interface = 0, \
}
typedef struct {
void *cb_args;
esp_ping_cb_t on_ping_success;
esp_ping_cb_t on_ping_timeout;
esp_ping_cb_t on_ping_end;
} esp_ping_callbacks_t;
static inline esp_err_t esp_ping_new_session(const esp_ping_config_t *config,
const esp_ping_callbacks_t *cbs,
esp_ping_handle_t *hdl_out)
{
(void)config;
(void)cbs;
if (hdl_out != NULL) {
*hdl_out = (void *)0;
}
return ESP_FAIL; /* never starts a ping task in the fuzz env */
}
static inline esp_err_t esp_ping_start(esp_ping_handle_t hdl)
{
(void)hdl;
return ESP_OK;
}
static inline esp_err_t esp_ping_stop(esp_ping_handle_t hdl)
{
(void)hdl;
return ESP_OK;
}
static inline esp_err_t esp_ping_delete_session(esp_ping_handle_t hdl)
{
(void)hdl;
return ESP_OK;
}