Merge branch 'change/ble_update_20250221_v5.2' into 'release/v5.2'

Combined backport MR for BLE Lib & Feature Updates

See merge request espressif/esp-idf!37188

components/bt/CMakeLists.txt

@@ -31,6 +31,7 @@ set(common_include_dirs
     common/btc/profile/esp/blufi/include
     common/btc/profile/esp/include
     common/hci_log/include
+    common/ble_log/include
 )
 
 set(ble_mesh_include_dirs
@@ -148,6 +149,7 @@ if(CONFIG_BT_ENABLED)
          "common/osi/osi.c"
          "common/osi/semaphore.c"
          "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
          )
 
     # Host Bluedroid
@@ -890,6 +892,9 @@ if(CONFIG_BT_ENABLED)
             target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
         endif()
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
+        endif()
         if(CONFIG_IDF_TARGET_ESP32C6)
             add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
         else()

components/bt/common/Kconfig.in

@@ -4,3 +4,73 @@ config BT_ALARM_MAX_NUM
     help
         This option decides the maximum number of alarms which
         could be used by Bluetooth host.
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    bool "Enable HCI log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
+
+config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    bool "Enable Host log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
+        When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
+
+config BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    int "Number of ble log async SPI output queues"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 4
+    help
+            The number of ble log async SPI output queues
+
+config BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE
+    int "Size of ble log async SPI output transaction buffer size"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2048
+    help
+            The size of ble log async SPI output transaction buffer size
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+            GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+            GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+            GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+            Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+            GPIO number of SYNC IO

components/bt/common/ble_log/ble_log_spi_out.c

@@ -0,0 +1,502 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_spi_out.h"
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+// Private defines
+#define SPI_OUT_BUS SPI2_HOST
+#define SPI_OUT_TAIL 0xAA
+#define SPI_OUT_FLUSHOUT_TIMEOUT (1000 * 1000)
+#define SPI_OUT_TS_SYNC_TIMEOUT (1000 * 1000)
+
+// Private typedefs
+typedef struct spi_out_trans {
+    spi_transaction_t trans;
+    struct spi_out_trans *next;
+} spi_out_trans_t;
+
+// Private variables
+static spi_device_handle_t spi_handle = NULL;
+static spi_out_trans_t *trans_head = NULL;
+static SemaphoreHandle_t mutex_handle = NULL;
+static bool spi_out_inited = false;
+static esp_timer_handle_t flushout_timer_handle = NULL;
+static uint32_t loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static bool sync_io_level = false;
+static esp_timer_handle_t ts_sync_timer_handle = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private function declarations
+static void spi_out_init_trans(void);
+static void spi_out_deinit_trans(void);
+static void spi_out_recycle_trans(uint32_t ms_to_wait);
+static void spi_out_append_trans(void);
+static int spi_out_write(const uint8_t *addr, uint16_t len);
+static void esp_timer_cb_flushout(void);
+static void esp_timer_cb_ts_sync(void);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+extern uint32_t r_ble_lll_timer_current_tick_get(void);
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+extern uint32_t r_os_cputime_get32(void);
+#endif // CONFIG_IDF_TARGET_ESP32C2
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private functions
+static void spi_out_init_trans(void)
+{
+    for (int i = 0; i < CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE; i++) {
+        // Allocate memory for SPI transaction
+        uint8_t *buf = (uint8_t *)heap_caps_malloc(CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE, MALLOC_CAP_DMA);
+        assert(buf);
+
+        // Initialize new trans
+        spi_out_trans_t *new_trans = (spi_out_trans_t *)malloc(sizeof(spi_out_trans_t));
+        assert(new_trans);
+        memset(new_trans, 0, sizeof(spi_out_trans_t));
+        new_trans->trans.tx_buffer = buf;
+        new_trans->trans.length = 0;
+
+        // Append new trans to free trans list
+        new_trans->next = trans_head;
+        trans_head = new_trans;
+    }
+    return;
+}
+
+static void spi_out_deinit_trans(void)
+{
+    // Wait up to QUEUE_SIZE * 100 ms for all transactions to complete and be recycled
+    spi_out_recycle_trans(100);
+
+    // Release memory
+    spi_out_trans_t *next;
+    while (trans_head != NULL) {
+        next = trans_head->next;
+        free((uint8_t *)trans_head->trans.tx_buffer);
+        free(trans_head);
+        trans_head = next;
+    }
+    trans_head = NULL;
+    return;
+}
+
+// CRITICAL: Do not recycle trans when trans_head is not empty!
+IRAM_ATTR static void spi_out_recycle_trans(uint32_t ms_to_wait)
+{
+    // Try to recycle transaction
+    spi_transaction_t *ret_trans;
+    spi_out_trans_t *recycled_trans;
+    while (ESP_OK == spi_device_get_trans_result(spi_handle, &ret_trans, pdMS_TO_TICKS(ms_to_wait))) {
+        recycled_trans = __containerof(ret_trans, spi_out_trans_t, trans);
+        recycled_trans->next = trans_head;
+        trans_head = recycled_trans;
+        trans_head->trans.length = 0;
+        trans_head->trans.rxlength = 0;
+    }
+}
+
+IRAM_ATTR static void spi_out_append_trans(void)
+{
+    // Stop flushout timer
+    esp_timer_stop(flushout_timer_handle);
+
+    // Transaction head shall not be NULL for appending
+    if (trans_head) {
+        // Detach transaction head
+        spi_out_trans_t *trans_to_append = trans_head;
+        trans_head = trans_head->next;
+        trans_to_append->next = NULL;
+
+        // CRITICAL: Length unit conversion from bytes to bits
+        trans_to_append->trans.length *= 8;
+        ESP_ERROR_CHECK(spi_device_queue_trans(spi_handle, &trans_to_append->trans, 0));
+    }
+
+    // Try to recycle trans
+    spi_out_recycle_trans(0);
+
+    // Restart flushout timer
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+}
+
+IRAM_ATTR static int spi_out_write(const uint8_t *addr, uint16_t len)
+{
+    // Recycle trans if free buffer list is empty
+    if (!trans_head) {
+        spi_out_recycle_trans(0);
+    }
+
+    // Copy user data to buffer
+    uint16_t copy_buf_len;
+    uint16_t data_left_len = len;
+    uint16_t empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE - trans_head->trans.length;
+    while (data_left_len) {
+        // There shall always be available buffer in free buffer list during write operation
+        if (!trans_head) {
+            return -1;
+        }
+
+        // Copy data to buffer and update length
+        copy_buf_len = (data_left_len > empty_buf_len) ? empty_buf_len : data_left_len;
+        memcpy((uint8_t *)trans_head->trans.tx_buffer + trans_head->trans.length, addr + (len - data_left_len), copy_buf_len);
+        trans_head->trans.length += copy_buf_len;
+        data_left_len -= copy_buf_len;
+
+        // If buffer is full, append transaction and reset buffer length
+        if (trans_head->trans.length == CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE) {
+            spi_out_append_trans();
+            empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE;
+        }
+    }
+    return 0;
+}
+
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_flushout(void)
+{
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Flushout
+    if (trans_head) {
+        // Make sure there's enough space for loss frame counter
+        if (trans_head->next && loss_frame_cnt) {
+            ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_LOSS, (uint8_t *)&loss_frame_cnt, sizeof(loss_frame_cnt));
+            loss_frame_cnt = 0;
+        }
+        if (trans_head->trans.length) {
+            spi_out_append_trans();
+        }
+    }
+
+    // Restart flushout timer if not active
+    if (!esp_timer_is_active(flushout_timer_handle)) {
+        esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    }
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_ts_sync(void)
+{
+    // Initialize variables
+    uint32_t lc_ts = 0;
+    uint32_t esp_ts = 0;
+
+    // Toggle sync IO
+    sync_io_level = !sync_io_level;
+
+    // Enter critical
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+    // Get LC timestamp
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+    lc_ts = r_ble_lll_timer_current_tick_get();
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+    lc_ts = r_os_cputime_get32();
+#endif // CONFIG_IDF_TARGET_ESP32C2
+
+    // Set sync IO level
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+
+    // Get ESP timestamp
+    esp_ts = esp_timer_get_time();
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    // Exit critical
+
+    // Write timestamp sync log
+    uint8_t sync_frame[9];
+    sync_frame[0] = ((uint8_t)sync_io_level & 0xFF);
+    memcpy(sync_frame + 1, &lc_ts, sizeof(lc_ts));
+    memcpy(sync_frame + 5, &esp_ts, sizeof(esp_ts));
+    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_SYNC, sync_frame, 9);
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Public functions
+void ble_log_spi_out_init(void)
+{
+    // Avoid double init
+    if (spi_out_inited) {
+        return;
+    }
+
+    // Initialize mutex
+    mutex_handle = xSemaphoreCreateRecursiveMutex();
+
+    // Initialize SPI
+    spi_bus_config_t bus_config = {
+        .miso_io_num = -1,
+        .mosi_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM,
+        .sclk_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM,
+        .quadwp_io_num = -1,
+        .quadhd_io_num = -1,
+        .max_transfer_sz = 10240
+    };
+    spi_device_interface_config_t dev_config = {
+        .clock_speed_hz = SPI_MASTER_FREQ_20M,
+        .mode = 0,
+        .spics_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_CS_IO_NUM,
+        .queue_size = CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    };
+    ESP_ERROR_CHECK(spi_bus_initialize(SPI_OUT_BUS, &bus_config, SPI_DMA_CH_AUTO));
+    ESP_ERROR_CHECK(spi_bus_add_device(SPI_OUT_BUS, &dev_config, &spi_handle));
+
+    // Initialize transaction link nodes
+    spi_out_init_trans();
+
+    // Initialize flushout timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_flushout,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&timer_args, &flushout_timer_handle));
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Initialize timestamp synchronizer
+    gpio_config_t io_conf = {
+        .intr_type = GPIO_INTR_DISABLE,
+        .mode = GPIO_MODE_OUTPUT,
+        .pin_bit_mask = (1UL << CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM),
+        .pull_down_en = 0,
+        .pull_up_en = 0
+    };
+    ESP_ERROR_CHECK(gpio_config(&io_conf));
+    sync_io_level = false;
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, sync_io_level);
+    esp_timer_create_args_t ts_sync_timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ts_sync,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&ts_sync_timer_args, &ts_sync_timer_handle));
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Set init flag
+    spi_out_inited = true;
+}
+
+void ble_log_spi_out_deinit(void)
+{
+    // Avoid double deinit
+    if (!spi_out_inited) {
+        return;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Deinitialize timestamp synchronizer
+    esp_timer_stop(ts_sync_timer_handle);
+    esp_timer_delete(ts_sync_timer_handle);
+    gpio_reset_pin(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Deinitialize flushout timer
+    esp_timer_stop(flushout_timer_handle);
+    esp_timer_delete(flushout_timer_handle);
+
+    // Deinitialize transaction link nodes
+    spi_out_deinit_trans();
+
+    // Deinitialize SPI
+    ESP_ERROR_CHECK(spi_bus_remove_device(spi_handle));
+    ESP_ERROR_CHECK(spi_bus_free(SPI_OUT_BUS));
+    spi_handle = NULL;
+
+    // Deinitialize mutex
+    vSemaphoreDelete(mutex_handle);
+    mutex_handle = NULL;
+
+    // Reset init flag
+    spi_out_inited = false;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+void ble_log_spi_out_ts_sync_start(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Start timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (!esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_start_periodic(ts_sync_timer_handle, SPI_OUT_TS_SYNC_TIMEOUT);
+        }
+    }
+}
+
+void ble_log_spi_out_ts_sync_stop(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Stop timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_stop(ts_sync_timer_handle);
+        }
+
+        // Set sync IO to low level
+        sync_io_level = 0;
+        gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+    }
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+IRAM_ATTR void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end)
+{
+    return ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP, addr, len);
+}
+
+IRAM_ATTR void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    // Initialize frame sequence number
+    static uint8_t frame_sn = 0;
+
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Prepare frame head and frame tail
+    const uint8_t head[4] = {len & 0xFF, (len >> 8) & 0xFF, (uint8_t)source, frame_sn};
+    const uint8_t tail = SPI_OUT_TAIL;
+
+    // Write frame head first, then payload, finally frame tail
+    do {
+        if (spi_out_write(head, 4) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(addr, len) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(&tail, 1) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+    } while (0);
+
+    // Update frame sequence number
+    frame_sn++;
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+    return;
+}
+
+IRAM_ATTR int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
+{
+    // Get esp timestamp
+    uint32_t esp_ts = esp_timer_get_time();
+
+    // Get arguments
+    va_list args;
+    va_start(args, format);
+
+    // Get len as ref to allocate heap memory
+    va_list args_copy;
+    va_copy(args_copy, args);
+    int len = vsnprintf(NULL, 0, format, args_copy);
+    va_end(args_copy);
+
+    // Length validation
+    if ((len < 0) || (len > 0xFFFF)) {
+        va_end(args);
+        return -1;
+    }
+
+    // Allocate memory
+    uint8_t *buffer = malloc(len + 1);
+    if (!buffer) {
+        va_end(args);
+        return -1;
+    }
+
+    // Generate string
+    vsnprintf((char *)buffer, len + 1, format, args);
+    va_end(args);
+
+    // Write to SPI
+    ble_log_spi_out_write(source, (const uint8_t *)&esp_ts, 4);
+    ble_log_spi_out_write(source, (const uint8_t *)buffer, len);
+
+    // Release
+    free(buffer);
+    return 0;
+}
+
+IRAM_ATTR int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...)
+{
+    // Get ESP timestamp
+    uint32_t esp_ts = esp_timer_get_time();
+
+    // Create log prefix in the format: "[level][tag] "
+    char prefix[32];
+    int prefix_len = snprintf(prefix, sizeof(prefix), "[%d][%s] ", level, tag ? tag : "NULL");
+
+    // Compute the length of the formatted log message
+    va_list args;
+    va_start(args, format);
+    va_list args_copy;
+    va_copy(args_copy, args);
+    int log_len = vsnprintf(NULL, 0, format, args_copy);
+    va_end(args_copy);
+
+    // Validate length
+    if (log_len < 0 || log_len > 0xFFFF) {
+        va_end(args);
+        return -1;
+    }
+
+    // Compute total log length (prefix + formatted message)
+    int total_len = prefix_len + log_len;
+
+    // Allocate memory for the complete log message
+    uint8_t *buffer = malloc(total_len + 1);
+    if (!buffer) {
+        va_end(args);
+        return -1;
+    }
+
+    // Construct the final log message
+    memcpy(buffer, prefix, prefix_len);  // Copy the prefix
+    vsnprintf((char *)(buffer + prefix_len), log_len + 1, format, args);
+    va_end(args);
+
+    // Transmit log data via SPI
+    ble_log_spi_out_write(source, (const uint8_t *)&esp_ts, 4);
+    ble_log_spi_out_write(source, buffer, total_len);
+
+    // Free allocated memory
+    free(buffer);
+    return 0;
+}
+
+IRAM_ATTR void ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    // Get esp timestamp
+    uint32_t esp_ts = esp_timer_get_time();
+
+    // Write to SPI
+    ble_log_spi_out_write(source, (const uint8_t *)&esp_ts, 4);
+    ble_log_spi_out_write(source, addr, len);
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -0,0 +1,47 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+
+// Public typedefs
+#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
+#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
+#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
+#define BLE_LOG_SPI_OUT_SOURCE_USER 0x10
+#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
+#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+
+// SPI Log Level Definitions
+#define BLE_LOG_SPI_OUT_LEVEL_NONE      0  /*!< No log output */
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR     1  /*!< Critical errors that SPI driver cannot recover from */
+#define BLE_LOG_SPI_OUT_LEVEL_WARN      2  /*!< Recoverable error conditions in SPI communication */
+#define BLE_LOG_SPI_OUT_LEVEL_INFO      3  /*!< Informational messages about SPI transactions */
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG     4  /*!< Detailed debug information, such as SPI register values */
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE   5  /*!< Very detailed debugging logs, potentially flooding output */
+#define BLE_LOG_SPI_OUT_LEVEL_MAX       6  /*!< Number of SPI log levels supported */
+
+// Public functions
+void ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+int ble_log_spi_out_printf(uint8_t source, const char *format, ...);
+int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...);
+void ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len);
+
+#endif // __BT_SPI_OUT_H__

components/bt/common/include/bt_common.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -84,6 +84,20 @@
 #define BT_HCI_LOG_INCLUDED  FALSE
 #endif
 
+// HCI LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+// BLURDROID LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/common/include/bt_user_config.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -126,6 +126,20 @@
 #define UC_BT_HCI_LOG_DEBUG_EN  FALSE
 #endif
 
+//HCI LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+//BLUEDROID LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/controller/esp32/bt.c

@@ -44,6 +44,10 @@
 #include "esp_rom_sys.h"
 #include "hli_api.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -1682,6 +1686,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_cfg_mask = btdm_config_mask_load();
 
     err = btdm_controller_init(btdm_cfg_mask, cfg);
@@ -1709,6 +1717,10 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();

components/bt/controller/esp32c2/Kconfig.in

@@ -308,6 +308,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -347,6 +356,19 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5

components/bt/controller/esp32c2/bt.c

@@ -62,6 +62,12 @@
 #include "hal/efuse_ll.h"
 #include "soc/rtc.h"
 
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -208,6 +214,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -216,6 +223,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -263,6 +272,13 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
@@ -278,6 +294,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -435,6 +454,21 @@ void esp_ble_controller_log_dump_all(bool output)
         portEXIT_CRITICAL_SAFE(&spinlock);
     }
 }
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -45,6 +45,9 @@
 #else //CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/rom_layout.h"
 #endif
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -1442,6 +1445,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
@@ -1470,6 +1477,10 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();

components/bt/controller/esp32c6/Kconfig.in

@@ -342,6 +342,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -381,6 +390,36 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+    int "The output level of controller log"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    range 0 5
+    default 1
+    help
+        The output level of controller log.
+
+config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+    hex "The switch of module log output"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    range 0 0xFFFFFFFF
+    default 0xFFFFFFFF
+    help
+        The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -705,3 +744,48 @@ config BT_CTRL_RUN_IN_FLASH_ONLY
         Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
         Because the code is moved to the flash, the execution speed of the code is reduced.
         To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32c6/bt.c

@@ -57,6 +57,13 @@
 
 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -114,6 +121,8 @@ extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -193,6 +202,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -201,6 +211,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -248,21 +260,35 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
-
     return ret;
 }
 
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -387,6 +413,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -154,6 +154,44 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else

components/bt/controller/esp32h2/Kconfig.in

@@ -333,6 +333,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -372,6 +381,36 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+    int "The output level of controller log"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    range 0 5
+    default 1
+    help
+        The output level of controller log.
+
+config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+    hex "The switch of module log output"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    range 0 0xFFFFFFFF
+    default 0xFFFFFFFF
+    help
+        The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -615,7 +654,7 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
         again.
 
 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
     default y
 
 config BT_LE_TX_CCA_ENABLED
@@ -706,3 +745,48 @@ config BT_CTRL_RUN_IN_FLASH_ONLY
         Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
         Because the code is moved to the flash, the execution speed of the code is reduced.
         To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32h2/bt.c

@@ -52,6 +52,13 @@
 #include "esp_private/periph_ctrl.h"
 #include "esp_sleep.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -108,6 +115,8 @@ extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -190,6 +199,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -198,6 +208,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -245,11 +257,23 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+        if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
@@ -259,6 +283,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -383,6 +410,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -917,6 +960,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
         goto free_controller;
     }
+
     ESP_ERROR_CHECK(esp_read_mac((uint8_t *)mac, ESP_MAC_BT));
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
              mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
@@ -1027,6 +1071,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
+
 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
     r_ble_ll_scan_start_time_init_compensation(500);
     r_priv_sdk_config_insert_proc_time_set(500);

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -154,6 +154,44 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else

components/bt/host/bluedroid/api/esp_bluedroid_hci.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -16,6 +16,10 @@
 
 #define LOG_TAG "HCI_API"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+
 static esp_bluedroid_hci_driver_operations_t s_hci_driver_ops = { 0 };
 
 esp_err_t esp_bluedroid_attach_hci_driver(const esp_bluedroid_hci_driver_operations_t *p_ops)
@@ -63,6 +67,9 @@ void hci_host_send_packet(uint8_t *data, uint16_t len)
 #if (BT_HCI_LOG_INCLUDED == TRUE)
     bt_hci_log_record_hci_data(data[0], &data[1], len - 1);
 #endif
+#if (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
+#endif // (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
 #if (BT_CONTROLLER_INCLUDED == TRUE)
     esp_vhci_host_send_packet(data, len);
 #else /* BT_CONTROLLER_INCLUDED == TRUE */

components/bt/host/bluedroid/common/include/common/bt_trace.h

@@ -25,6 +25,9 @@
 #include "stack/bt_types.h"
 #include "bt_common.h"
 
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+#include "ble_log/ble_log_spi_out.h"
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t len)
 {
     uint16_t i;
@@ -217,20 +220,83 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 
 /* Define tracing for BTM
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define BTM_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(BTM, ERROR)) BT_PRINT_E("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(BTM, WARNING)) BT_PRINT_W("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(BTM, API)) BT_PRINT_I("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(BTM, EVENT)) BT_PRINT_D("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(BTM, DEBUG)) BT_PRINT_D("BT_BTM", fmt, ## args); \
+}
+
+#else
+
 #define BTM_TRACE_ERROR(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(BTM, ERROR)) BT_PRINT_E("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_WARNING(fmt, args...)     {if (btm_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(BTM, WARNING)) BT_PRINT_W("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_API(fmt, args...)         {if (btm_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(BTM,API)) BT_PRINT_I("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_EVENT(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(BTM,EVENT)) BT_PRINT_D("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_DEBUG(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(BTM,DEBUG)) BT_PRINT_D("BT_BTM", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
 /* Define tracing for the L2CAP unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define L2CAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(L2CAP, ERROR)) BT_PRINT_E("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(L2CAP, WARNING)) BT_PRINT_W("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(L2CAP, API)) BT_PRINT_I("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(L2CAP, EVENT)) BT_PRINT_D("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(L2CAP, DEBUG)) BT_PRINT_D("BT_L2CAP", fmt, ## args); \
+}
+
+#else
+
 #define L2CAP_TRACE_ERROR(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(L2CAP, ERROR)) BT_PRINT_E("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_WARNING(fmt, args...)   {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(L2CAP, WARNING)) BT_PRINT_W("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_API(fmt, args...)       {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(L2CAP,API)) BT_PRINT_I("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_EVENT(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(L2CAP,EVENT)) BT_PRINT_D("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_DEBUG(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(L2CAP,DEBUG)) BT_PRINT_D("BT_L2CAP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+
 /* Define tracing for the SDP unit
 */
 #define SDP_TRACE_ERROR(fmt, args...)       {if (sdp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SDP, ERROR)) BT_PRINT_E("BT_SDP", fmt, ## args);}
@@ -248,11 +314,38 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #define RFCOMM_TRACE_DEBUG(fmt, args...)    {if (rfc_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(RFCOMM,DEBUG)) BT_PRINT_D("BT_RFCOMM", fmt, ## args);}
 
 /* Generic Access Profile traces */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define GAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GAP, ERROR)) BT_PRINT_E("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GAP, WARNING)) BT_PRINT_W("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GAP, API)) BT_PRINT_I("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GAP, EVENT)) BT_PRINT_D("BT_GAP", fmt, ## args); \
+}
+
+#else
+
 #define GAP_TRACE_ERROR(fmt, args...)       {if (gap_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GAP, ERROR)) BT_PRINT_E("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_API(fmt, args...)         {if (gap_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GAP,API)) BT_PRINT_I("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_EVENT(fmt, args...)       {if (gap_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GAP,EVENT)) BT_PRINT_D("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_WARNING(fmt, args...)     {if (gap_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GAP, WARNING)) BT_PRINT_W("BT_GAP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+
 /* define traces for HID Host */
 #define HIDH_TRACE_ERROR(fmt, args...)      {if (hh_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(HIDH, ERROR)) BT_PRINT_E("BT_HIDH", fmt, ## args);}
 #define HIDH_TRACE_WARNING(fmt, args...)    {if (hh_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(HIDH, WARNING)) BT_PRINT_W("BT_HIDH", fmt, ## args);}
@@ -326,20 +419,81 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 
 /* Define tracing for the ATT/GATT unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define GATT_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GATT, ERROR)) BT_PRINT_E("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GATT, WARNING)) BT_PRINT_W("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GATT, API)) BT_PRINT_I("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GATT, EVENT)) BT_PRINT_D("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(GATT, DEBUG)) BT_PRINT_D("BT_GATT", fmt, ## args); \
+}
+
+#else
+
 #define GATT_TRACE_ERROR(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GATT, ERROR)) BT_PRINT_E("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_WARNING(fmt, args...)    {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GATT, WARNING)) BT_PRINT_W("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_API(fmt, args...)        {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GATT,API)) BT_PRINT_I("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_EVENT(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GATT,EVENT)) BT_PRINT_D("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_DEBUG(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(GATT,DEBUG)) BT_PRINT_D("BT_GATT", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
 /* Define tracing for the SMP unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define SMP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SMP, ERROR)) BT_PRINT_E("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(SMP, WARNING)) BT_PRINT_W("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(SMP, API)) BT_PRINT_I("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(SMP, EVENT)) BT_PRINT_D("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(SMP, DEBUG)) BT_PRINT_D("BT_SMP", fmt, ## args); \
+}
+
+#else
+
 #define SMP_TRACE_ERROR(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SMP, ERROR)) BT_PRINT_E("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_WARNING(fmt, args...)     {if (smp_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(SMP, WARNING)) BT_PRINT_W("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_API(fmt, args...)         {if (smp_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(SMP,API)) BT_PRINT_I("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_EVENT(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(SMP,EVENT)) BT_PRINT_D("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_DEBUG(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(SMP,DEBUG)) BT_PRINT_D("BT_SMP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 extern UINT8 btif_trace_level;
 

components/bt/host/bluedroid/hci/hci_hal_h4.c

@@ -41,6 +41,10 @@
 #include "stack/hcimsgs.h"
 #include "hci_log/bt_hci_log.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+
 #define HCI_BLE_EVENT 0x3e
 #define PACKET_TYPE_TO_INBOUND_INDEX(type) ((type) - 2)
 #define PACKET_TYPE_TO_INDEX(type) ((type) - 1)
@@ -567,6 +571,9 @@ void bt_record_hci_data(uint8_t *data, uint16_t len)
 
 static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
 {
+#if (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
+#endif // (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
     //Target has packet to host, malloc new buffer for packet
     BT_HDR *pkt = NULL;
 #if (BLE_42_SCAN_EN == TRUE)

components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -24,6 +24,10 @@
 #include "bt_common.h"
 #include "hci_log/bt_hci_log.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+
 #define NIMBLE_VHCI_TIMEOUT_MS  2000
 #define BLE_HCI_EVENT_HDR_LEN               (2)
 #define BLE_HCI_CMD_HDR_LEN                 (3)
@@ -68,6 +72,9 @@ void esp_vhci_host_send_packet_wrapper(uint8_t *data, uint16_t len)
 #if (BT_HCI_LOG_INCLUDED == TRUE)
     bt_hci_log_record_hci_data(data[0], &data[1], len - 1);
 #endif
+#if (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
+#endif // (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
     esp_vhci_host_send_packet(data, len);
 }
 
@@ -219,6 +226,10 @@ static int dummy_host_rcv_pkt(uint8_t *data, uint16_t len)
  */
 static int host_rcv_pkt(uint8_t *data, uint16_t len)
 {
+#if (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
+#endif // (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+
     bt_record_hci_data(data, len);
 
     if(!ble_hs_enabled_state) {

components/bt/include/esp32c6/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -156,7 +156,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20241121
+#define CONFIG_VERSION  0x20250104
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -213,6 +213,15 @@ typedef struct {
     uint8_t csa2_select;                             /*!< Select CSA#2*/
     uint8_t enable_csr;                              /*!< Enable CSR */
     uint8_t ble_aa_check;                            /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
+    uint8_t ble_llcp_disc_flag;                      /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                        - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    uint16_t scan_backoff_upperlimitmax;             /*!< The value of upperlimitmax is 2^n, The maximum value is 256 */
+    uint8_t ble_chan_ass_en;                         /*!< Enable / disable BLE channel assessment. Configurable in menuconfig.
+                                                        - 0 - Disable
+                                                        - 1 - Enable (default) */
+    uint8_t ble_data_lenth_zero_aux;                 /*!< Enable / disable auxiliary packets when the extended ADV data length is zero. Configurable in menuconfig.
+                                                        - 0 - Disable (default)
+                                                        - 1 - Enable */
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
@@ -263,6 +272,10 @@ typedef struct {
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .enable_csr                 = 0,                                                    \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
+    .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
+    .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
+    .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/include/esp32h2/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -109,14 +109,6 @@ typedef enum {
     ESP_BLE_ENHANCED_PWR_TYPE_MAX,
 } esp_ble_enhanced_power_type_t;
 
-/**
- * @brief Address type and address value.
- */
-typedef struct {
-    uint8_t type;     /*!< Type of the Bluetooth address (public, random, etc.) */
-    uint8_t val[6];   /*!< Array containing the 6-byte Bluetooth address value */
-} esp_ble_addr_t;
-
 /**
  * @brief Select buffers
 */
@@ -125,6 +117,14 @@ typedef enum {
     ESP_BLE_LOG_BUF_CONTROLLER  = 0x05,
 } esp_ble_log_buf_t;
 
+/**
+ * @brief Address type and address value.
+ */
+typedef struct {
+    uint8_t type;     /*!< Type of the Bluetooth address (public, random, etc.) */
+    uint8_t val[6];   /*!< Array containing the 6-byte Bluetooth address value */
+} esp_ble_addr_t;
+
 /**
  * @brief  Set BLE TX power
  *         Connection Tx power should only be set after connection created.
@@ -161,7 +161,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20241121
+#define CONFIG_VERSION  0x20250104
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -217,7 +217,16 @@ typedef struct {
     uint8_t csa2_select;                         /*!< Select CSA#2*/
     uint8_t enable_csr;                          /*!< Enable CSR */
     uint8_t ble_aa_check;                        /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
-    uint32_t config_magic;                       /*!< Configuration magic value */
+    uint8_t ble_llcp_disc_flag;                     /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                        - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    uint16_t scan_backoff_upperlimitmax;            /*!< The value of upperlimitmax is 2^n, The maximum value is 256 */
+    uint8_t ble_chan_ass_en;                        /*!< Enable / disable BLE channel assessment. Configurable in menuconfig.
+                                                        - 0 - Disable
+                                                        - 1 - Enable (default) */
+    uint8_t ble_data_lenth_zero_aux;                /*!< Enable / disable auxiliary packets when the extended ADV data length is zero. Configurable in menuconfig.
+                                                        - 0 - Disable (default)
+                                                        - 1 - Enable */
+    uint32_t config_magic;                          /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
 
@@ -263,10 +272,14 @@ typedef struct {
     .main_xtal_freq             = CONFIG_XTAL_FREQ,                                     \
     .cpu_freq_mhz               = CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ,                      \
     .ignore_wl_for_direct_adv   = 0,                                                    \
-    .enable_pcl                 = 0,                                                    \
+    .enable_pcl                 = DEFAULT_BT_LE_POWER_CONTROL_ENABLED,                  \
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .enable_csr                 = 0,                                                    \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
+    .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
+    .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
+    .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/esp_rom/esp32c2/ld/esp32c2.rom.ble-eco4.ld

@@ -489,7 +489,7 @@ r_ble_ll_scan_dup_check_legacy = 0x400011ec;
 r_ble_ll_scan_dup_move_to_head = 0x400011f0;
 r_ble_ll_scan_dup_new = 0x400011f4;
 r_ble_ll_scan_dup_update_ext = 0x400011f8;
-r_ble_ll_scan_dup_update_legacy = 0x400011fc;
+//r_ble_ll_scan_dup_update_legacy = 0x400011fc;
 r_ble_ll_scan_enabled = 0x40001200;
 r_ble_ll_scan_end_adv_evt = 0x40001204;
 //r_ble_ll_scan_env_init = 0x40001208;

components/esp_rom/esp32c2/ld/esp32c2.rom.ble.ld

@@ -394,7 +394,7 @@ r_ble_ll_scan_dup_check_legacy = 0x400011ec;
 r_ble_ll_scan_dup_move_to_head = 0x400011f0;
 r_ble_ll_scan_dup_new = 0x400011f4;
 r_ble_ll_scan_dup_update_ext = 0x400011f8;
-r_ble_ll_scan_dup_update_legacy = 0x400011fc;
+//r_ble_ll_scan_dup_update_legacy = 0x400011fc;
 r_ble_ll_scan_enabled = 0x40001200;
 r_ble_ll_scan_end_adv_evt = 0x40001204;
 r_ble_ll_scan_ext_initiator_start = 0x4000120c;