Merge branch 'fix/heap-task-tracking_v5.2' into 'release/v5.2'

fix(heap): Fix bugs in heap task tracking (backport v5.2) See merge request espressif/esp-idf!27042
Merge branch 'feature/add_run_time_counter_type_option_v5.2' into 'release/v5.2'
2023-11-17 12:47:52 +08:00 · 2023-11-17 11:25:37 +08:00 · 2023-11-17 11:04:23 +08:00 · 2023-11-17 10:47:31 +08:00 · 2023-11-17 10:33:51 +08:00 · 2023-11-17 10:31:57 +08:00
421 changed files with 8525 additions and 3333 deletions
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@ -2,228 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.github/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.github/dependabot.yml               @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.gitlab/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/fatfs/**/*.py             @esp-idf-codeowners/tools
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/en/api-guides/jtag-debugging/     @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb* @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-/docs/**/migration-guides/              @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-/tools/test_apps/README.md    @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@ -59,7 +59,7 @@
 - `example_test[_esp32/esp32s2/...]`
 - `fuzzer_test`
 - `host_test`
- `integration_test[_wifi/ble]`
+- `integration_test`
 - `iperf_stress_test`
 - `macos`
 - `macos_test`
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@ -516,8 +516,10 @@ build_clang_test_apps_esp32c6:
  script:
    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
    - cd ${IDF_PATH}/tools/test_build_system
+    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    - pytest --parallel-count ${CI_NODE_TOTAL:-1} --parallel-index ${CI_NODE_INDEX:-1}
      --work-dir ${CI_PROJECT_DIR}/test_build_system --junitxml=${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+      --ignore-result-files known_failure_cases/known_failure_cases.txt

 pytest_build_system:
  extends: .test_build_system_template
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@ -83,16 +83,6 @@
    - "build:{0}"
    - build:target_test

-build:integration_test:
-  labels:
-    - build
-  patterns:
-    - build_components
-    - build_system
-  included_in:
-    - build:target_test
-
-
 ####################
 # Target Test Jobs #
 ####################
@ -173,23 +163,6 @@ build:integration_test:
    - "build:example_test"
    - build:target_test

-"test:integration_test_{0}":
-  matrix:
-    - - wifi
-      - ble
-  labels:
-    - integration_test_{0}
-    - integration_test
-    - target_test
-  patterns:
-    - integration_test-{0}
-    - target_test-{0}
-    # - maybe others
-  included_in:
-    - test:integration_test
-    - build:integration_test
-    - build:target_test
-
 "test:host_test":
  labels:
    - host_test
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@ -132,6 +132,7 @@ build_docs_html_full_prod:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full-prod
+  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
    when: always
    paths:
@ -184,6 +185,7 @@ build_docs_pdf_prod:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full-prod
+  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
    when: always
    paths:
--- a/.gitlab/ci/integration_test.yml
+++ b/.gitlab/ci/integration_test.yml
@ -8,7 +8,7 @@
  - "tools/**/*"
  - ".gitlab-ci.yml"
  - ".gitlab/ci/common.yml"
-  - ".gitlab/ci/integration-test.yml"
+  - ".gitlab/ci/integration_test.yml"
  - ".gitmodules"
  - "CMakeLists.txt"
  - "install.sh"
@ -22,6 +22,10 @@
    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      changes: *patterns-integration_test
+    # support trigger by ci labels
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build(?:,[^,\n\r]+)*$/i'

 gen_integration_pipeline:
  extends:
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@ -112,22 +112,6 @@
 .patterns-component_ut-wifi: &patterns-component_ut-wifi
  - "components/esp_wifi/**/*"

-.patterns-integration_test-ble: &patterns-integration_test-ble
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-  - "components/bt/controller/lib_esp32"
-  - "components/bt/controller/lib_esp32c3_family"
-  - "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"
-  - "components/bt/host/nimble/nimble"
-  - "components/esp_phy/lib"
-  - "components/esp_coex/??[!s][!t]*/**/*"
-  - "components/esp_coex/???/**/*"
-  - "components/esp_coex/*"
-
-.patterns-integration_test-wifi: &patterns-integration_test-wifi
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-
 .patterns-build_macos: &patterns-build_macos
  - "tools/ci/test_configure_ci_environment.sh"

@ -571,15 +555,6 @@
 .if-label-host_test: &if-label-host_test
  if: '$BOT_LABEL_HOST_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*host_test(?:,[^,\n\r]+)*$/i'

-.if-label-integration_test: &if-label-integration_test
-  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_ble: &if-label-integration_test_ble
-  if: '$BOT_LABEL_INTEGRATION_TEST_BLE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_ble(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_wifi: &if-label-integration_test_wifi
-  if: '$BOT_LABEL_INTEGRATION_TEST_WIFI || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_wifi(?:,[^,\n\r]+)*$/i'
-
 .if-label-macos: &if-label-macos
  if: '$BOT_LABEL_MACOS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*macos(?:,[^,\n\r]+)*$/i'

@ -1584,9 +1559,6 @@
    - <<: *if-label-example_test_esp32p4
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
-    - <<: *if-label-integration_test_ble
-    - <<: *if-label-integration_test_wifi
    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
@ -1634,10 +1606,6 @@
      changes: *patterns-example_test-usb
    - <<: *if-dev-push
      changes: *patterns-example_test-wifi
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-ble
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-wifi
    - <<: *if-dev-push
      changes: *patterns-target_test-adc
    - <<: *if-dev-push
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@ -139,7 +139,7 @@ menu "Bootloader config"

        config BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
            bool
-            default y if ESPTOOLPY_OCT_FLASH && SPI_FLASH_32BIT_ADDRESS
+            default y if ESPTOOLPY_OCT_FLASH && BOOTLOADER_FLASH_32BIT_ADDR
            default n

    endmenu
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -18,6 +18,9 @@
 #include "esp32s2/rom/usb/cdc_acm.h"
 #include "esp32s2/rom/usb/usb_common.h"
 #endif
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+#include "hal/usb_phy_ll.h"
+#endif
 #include "esp_rom_gpio.h"
 #include "esp_rom_uart.h"
 #include "esp_rom_sys.h"
@ -98,6 +101,10 @@ void bootloader_console_init(void)
    esp_rom_uart_usb_acm_init(s_usb_cdc_buf, sizeof(s_usb_cdc_buf));
    esp_rom_uart_set_as_console(ESP_ROM_USB_OTG_NUM);
    esp_rom_install_channel_putc(1, bootloader_console_write_char_usb);
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+    usb_phy_ll_usb_wrap_pad_enable(&USB_WRAP, true);
+    usb_phy_ll_int_otg_enable(&USB_WRAP);
+#endif
 }
 #endif //CONFIG_ESP_CONSOLE_USB_CDC

--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -70,31 +70,36 @@ if(CONFIG_BT_ENABLED)
    set(srcs "")
    set(include_dirs "")
    set(ldfragments "linker.lf")
+    if(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_IDF_TARGET_ESP32)
+            list(APPEND srcs "controller/esp32/bt.c"
+                             "controller/esp32/hli_api.c"
+                             "controller/esp32/hli_vectors.S")

-    if(CONFIG_IDF_TARGET_ESP32)
-        list(APPEND srcs "controller/esp32/bt.c"
-                         "controller/esp32/hli_api.c"
-                         "controller/esp32/hli_vectors.S")
+        elseif(CONFIG_IDF_TARGET_ESP32C3)
+            list(APPEND srcs "controller/esp32c3/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32S3)
+            list(APPEND srcs "controller/esp32c3/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C2)
-        set(ldfragments "linker.lf.esp32c2")
-        list(APPEND srcs "controller/esp32c2/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            set(ldfragments "linker.lf.esp32c2")
+            list(APPEND srcs "controller/esp32c2/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        list(APPEND srcs "controller/esp32c6/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C6)
+            list(APPEND srcs "controller/esp32c6/bt.c")
+
+        elseif(CONFIG_IDF_TARGET_ESP32H2)
+            list(APPEND srcs "controller/esp32h2/bt.c")
+        endif()
+
+        list(APPEND include_dirs ${target_specific_include_dirs})

-    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        list(APPEND srcs "controller/esp32h2/bt.c")
    endif()

-    list(APPEND include_dirs ${target_specific_include_dirs})
-
    # Common
    list(APPEND include_dirs common/osi/include)

@ -174,6 +179,7 @@ if(CONFIG_BT_ENABLED)

        list(APPEND srcs "host/bluedroid/api/esp_a2dp_api.c"
                   "host/bluedroid/api/esp_avrc_api.c"
+                   "host/bluedroid/api/esp_bluedroid_hci.c"
                   "host/bluedroid/api/esp_bt_device.c"
                   "host/bluedroid/api/esp_bt_main.c"
                   "host/bluedroid/api/esp_gap_ble_api.c"
@ -509,7 +515,6 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/core/rpl.c"
                    "esp_ble_mesh/core/scan.c"
                    "esp_ble_mesh/core/test.c"
-                    "esp_ble_mesh/core/transport.c"
                    "esp_ble_mesh/models/common/device_property.c"
                    "esp_ble_mesh/models/common/model_common.c"
                    "esp_ble_mesh/models/client/client_common.c"
@ -546,6 +551,12 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
                    "esp_ble_mesh/v1.1/ext.c")
+
+        if(CONFIG_BLE_MESH_SAR_ENHANCEMENT)
+            list(APPEND srcs "esp_ble_mesh/core/transport.enh.c")
+        else()
+            list(APPEND srcs "esp_ble_mesh/core/transport.c")
+        endif()
    endif()


--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@ -1,9 +1,8 @@
 menu "Bluetooth"
-    visible if SOC_BT_SUPPORTED

    config BT_ENABLED
        bool "Bluetooth"
-        depends on SOC_BT_SUPPORTED && !APP_NO_BLOBS
+        depends on !APP_NO_BLOBS
        help
            Select this option to enable Bluetooth and show the submenu with Bluetooth configuration choices.

@ -22,10 +21,12 @@ menu "Bluetooth"

        config BT_NIMBLE_ENABLED
            bool "NimBLE - BLE only"
+            depends on BT_CONTROLLER_ENABLED
            help
                This option is recommended for BLE only usecases to save on memory

        config BT_CONTROLLER_ONLY
+            depends on SOC_BT_SUPPORTED
            bool "Disabled"
            help
                This option is recommended when you want to communicate directly with the
@ -42,6 +43,7 @@ menu "Bluetooth"
            This helps to choose Bluetooth controller stack

        config BT_CONTROLLER_ENABLED
+            depends on SOC_BT_SUPPORTED
            bool "Enabled"
            help
                This option is recommended for Bluetooth controller usecases
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -29,6 +29,12 @@
 #define UC_BT_STACK_NO_LOG               FALSE
 #endif

+#ifdef CONFIG_BT_CONTROLLER_ENABLED
+#define UC_BT_CONTROLLER_INCLUDED        TRUE
+#else
+#define UC_BT_CONTROLLER_INCLUDED        FALSE
+#endif
+
 /**********************************************************
 * Thread/Task reference
 **********************************************************/
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@ -35,7 +35,7 @@
 #include "soc/rtc.h"
 #include "soc/soc_memory_layout.h"
 #include "soc/dport_reg.h"
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #include "esp_timer.h"
 #if !CONFIG_FREERTOS_UNICORE
 #include "esp_ipc.h"
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@ -24,7 +24,7 @@
 #endif

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif

 #include "nimble/nimble_npl_os.h"
@ -1003,7 +1003,7 @@ uint8_t esp_ble_get_chip_rev_version(void)
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@ -34,7 +34,7 @@
 #include "soc/rtc.h"
 #include "soc/rtc_cntl_reg.h"
 #include "soc/soc_memory_layout.h"
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #include "esp_timer.h"
 #include "esp_sleep.h"
 #include "esp_rom_sys.h"
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@ -212,6 +212,15 @@ menu "Memory Settings"
        help
            Dynamic memory size of block 2

+    config BT_LE_MSYS_BUF_FROM_HEAP
+        bool "Get Msys Mbuf from heap"
+        default y
+        depends on BT_LE_MSYS_INIT_IN_CONTROLLER
+        help
+            This option sets the source of the shared msys mbuf memory between
+            the Host and the Controller. Allocate the memory from the heap if
+            this option is sets, from the mempool otherwise.
+
    config BT_LE_ACL_BUF_COUNT
        int "ACL Buffer count"
        default 10
@ -539,5 +548,5 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
        again.

 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
    default y
--- a/components/bt/controller/esp32c6/bt.c
+++ b/components/bt/controller/esp32c6/bt.c
@ -24,7 +24,7 @@
 #endif // ESP_PLATFORM

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif // CONFIG_SW_COEXIST_ENABLE

 #include "nimble/nimble_npl_os.h"
@ -1173,7 +1173,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
--- a/components/bt/controller/esp32h2/bt.c
+++ b/components/bt/controller/esp32h2/bt.c
@ -24,7 +24,7 @@
 #endif // ESP_PLATFORM

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif // CONFIG_SW_COEXIST_ENABLE

 #include "nimble/nimble_npl_os.h"
@ -1147,7 +1147,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@ -678,6 +678,13 @@ if BLE_MESH
            When the above situation is encountered, this option can be used to decide whether
            to perform the IV index recovery procedure.

+    config BLE_MESH_SAR_ENHANCEMENT
+        bool "Segmentation and reassembly enhancement"
+        default n
+        help
+            Enable this option to use the enhanced segmentation and reassembly
+            mechanism introduced in Bluetooth Mesh Protocol 1.1.
+
    config BLE_MESH_TX_SEG_MSG_COUNT
        int "Maximum number of simultaneous outgoing segmented messages"
        default 1
@ -1091,6 +1098,16 @@ if BLE_MESH
                help
                    Maximum number of Bridging Table entries that the Bridge Configuration Server can support.

+            config BLE_MESH_BRIDGE_CRPL
+                int "Maximum capacity of bridge replay protection list"
+                default 5
+                range 1 255
+                help
+                    This option specifies the maximum capacity of the bridge replay
+                    protection list. The bridge replay protection list is used to
+                    prevent a bridged subnet from replay attack, which will store the
+                    source address and sequence number of the received bridge messages.
+
        endif #BLE_MESH_BRC_SRV

        config BLE_MESH_PRB_CLI
@ -1474,6 +1491,7 @@ if BLE_MESH

        config BLE_MESH_BQB_TEST
            bool "Enable BLE Mesh specific internal test"
+            select BLE_MESH_IV_UPDATE_TEST
            default n
            help
                This option is used to enable some internal functions for auto-pts test.
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
@ -53,6 +53,34 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+#if CONFIG_BLE_MESH_PRB_SRV
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
+
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
                                            esp_ble_mesh_addr_type_t addr_type,
                                            uint16_t net_idx)
--- a/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
+++ b/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
@ -48,6 +48,30 @@ esp_err_t esp_ble_mesh_proxy_gatt_enable(void);
 */
 esp_err_t esp_ble_mesh_proxy_gatt_disable(void);

+/**
+ * @brief   Enable advertising with Private Node Identity.
+ *
+ * @note    This API requires that GATT Proxy support be enabled. Once called,
+ *          each subnet starts advertising using Private Node Identity for the
+ *          next 60 seconds, and after 60s Private Network ID will be advertised.
+ *          Under normal conditions, the BLE Mesh Proxy Node Identity, Network
+ *          ID advertising, Proxy Private Node Identity and Private Network
+ *          ID advertising will be enabled automatically by BLE Mesh stack
+ *          after the device is provisioned.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void);
+
+/**
+ * @brief   Disable advertising with Private Node Identity.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void);
+
 /**
 * @brief        Proxy Client creates a connection with the Proxy Server.
 *
--- a/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
+++ b/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
@ -916,6 +916,8 @@ typedef enum {
    ESP_BLE_MESH_NODE_PROV_INPUT_NUMBER_COMP_EVT,               /*!< Node input number completion event */
    ESP_BLE_MESH_NODE_PROV_INPUT_STRING_COMP_EVT,               /*!< Node input string completion event */
    ESP_BLE_MESH_NODE_PROXY_IDENTITY_ENABLE_COMP_EVT,           /*!< Enable BLE Mesh Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT,   /*!< Enable BLE Mesh Private Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT,  /*!< Disable BLE Mesh Private Proxy Identity advertising completion event */
    ESP_BLE_MESH_NODE_PROXY_GATT_ENABLE_COMP_EVT,               /*!< Enable BLE Mesh GATT Proxy Service completion event */
    ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT,              /*!< Disable BLE Mesh GATT Proxy Service completion event */
    ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT,               /*!< Node add NetKey locally completion event */
@ -1109,6 +1111,18 @@ typedef union {
    struct ble_mesh_proxy_gatt_disable_comp_param {
        int err_code;                           /*!< Indicate the result of disabling Mesh Proxy Service */
    } node_proxy_gatt_disable_comp;             /*!< Event parameter of ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_enable_comp_param {
+        int err_code;                           /*!< Indicate the result of enabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_enable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_disable_comp_param {
+        int err_code;                           /*!< Indicate the result of disabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_disable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT */
    /**
     * @brief ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT
     */
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
@ -2368,6 +2368,16 @@ void btc_ble_mesh_prov_call_handler(btc_msg_t *msg)
        act = ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT;
        param.node_proxy_gatt_disable_comp.err_code = bt_mesh_proxy_server_gatt_disable();
        break;
+#if CONFIG_BLE_MESH_PRB_SRV
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT;
+        param.node_private_proxy_identity_enable_comp.err_code = bt_mesh_proxy_private_identity_enable();
+        break;
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT;
+        param.node_private_proxy_identity_disable_comp.err_code = bt_mesh_proxy_private_identity_disable();
+        break;
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #endif /* (CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_GATT) || CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #if CONFIG_BLE_MESH_PROVISIONER
--- a/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
+++ b/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
@ -28,6 +28,8 @@ typedef enum {
    BTC_BLE_MESH_ACT_INPUT_STRING,
    BTC_BLE_MESH_ACT_SET_DEVICE_NAME,
    BTC_BLE_MESH_ACT_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE,
    BTC_BLE_MESH_ACT_PROXY_GATT_ENABLE,
    BTC_BLE_MESH_ACT_PROXY_GATT_DISABLE,
    BTC_BLE_MESH_ACT_NODE_ADD_LOCAL_NET_KEY,
--- a/components/bt/esp_ble_mesh/common/timer.c
+++ b/components/bt/esp_ble_mesh/common/timer.c
@ -207,7 +207,7 @@ int k_delayed_work_free(struct k_delayed_work *work)

    alarm = hash_map_get(bm_alarm_hash_map, work);
    if (alarm == NULL) {
-        BT_WARN("Free, alarm not found");
+        BT_DBG("Free, alarm not found");
        bt_mesh_alarm_unlock();
        return -EINVAL;
    }
--- a/components/bt/esp_ble_mesh/core/access.c
+++ b/components/bt/esp_ble_mesh/core/access.c
@ -964,6 +964,9 @@ int bt_mesh_model_publish(struct bt_mesh_model *model)
    ctx.send_ttl = pub->ttl;
    ctx.send_cred = pub->cred ? BLE_MESH_FRIENDSHIP_CRED : BLE_MESH_FLOODING_CRED;
    ctx.send_szmic = pub->send_szmic;
+#if 0
+    ctx.send_tag |= BLE_MESH_TAG_IMMUTABLE_CRED;
+#endif
    if (pub->send_rel) {
        /* Tag with send-segmented */
        ctx.send_tag |= BLE_MESH_TAG_SEND_SEGMENTED;
--- a/components/bt/esp_ble_mesh/core/adv.c
+++ b/components/bt/esp_ble_mesh/core/adv.c
@ -32,8 +32,11 @@
 /* Pre-5.0 controllers enforce a minimum interval of 100ms
 * whereas 5.0+ controllers can go down to 20ms.
 */
-#define ADV_INT_DEFAULT_MS  100
-#define ADV_INT_FAST_MS     20
+#if CONFIG_BLE_MESH_HCI_5_0
+#define ADV_ITVL_MIN        20
+#else
+#define ADV_ITVL_MIN        100
+#endif

 static const uint8_t adv_type[] = {
    [BLE_MESH_ADV_PROV]   = BLE_MESH_DATA_MESH_PROV,
@ -141,10 +144,19 @@ static inline void adv_send_end(int err, const struct bt_mesh_send_cb *cb,
    }
 }

+uint16_t bt_mesh_pdu_duration(uint8_t xmit)
+{
+    uint16_t duration = 0U;
+    uint16_t adv_int = 0U;
+
+    adv_int = MAX(ADV_ITVL_MIN, BLE_MESH_TRANSMIT_INT(xmit));
+    duration = (BLE_MESH_TRANSMIT_COUNT(xmit) + 1) * (adv_int + 10);
+
+    return duration;
+}
+
 static inline int adv_send(struct net_buf *buf)
 {
-    const int32_t adv_int_min = ((bt_mesh_dev.hci_version >= BLE_MESH_HCI_VERSION_5_0) ?
-                                  ADV_INT_FAST_MS : ADV_INT_DEFAULT_MS);
    const struct bt_mesh_send_cb *cb = BLE_MESH_ADV(buf)->cb;
    void *cb_data = BLE_MESH_ADV(buf)->cb_data;
    struct bt_mesh_adv_param param = {0};
@ -158,7 +170,7 @@ static inline int adv_send(struct net_buf *buf)
 #if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
    if (BLE_MESH_ADV(buf)->type != BLE_MESH_ADV_BLE) {
 #endif
-        adv_int = MAX(adv_int_min,
+        adv_int = MAX(ADV_ITVL_MIN,
                      BLE_MESH_TRANSMIT_INT(BLE_MESH_ADV(buf)->xmit));
        duration = (BLE_MESH_TRANSMIT_COUNT(BLE_MESH_ADV(buf)->xmit) + 1) *
                   (adv_int + 10);
@ -180,7 +192,7 @@ static inline int adv_send(struct net_buf *buf)
            bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
            struct bt_mesh_adv_data solic_ad[3] = {
                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
-                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x29, 0x18),
+                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
                BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
            };
            err = bt_le_adv_start(&param, solic_ad, 3, NULL, 0);
--- a/components/bt/esp_ble_mesh/core/adv.h
+++ b/components/bt/esp_ble_mesh/core/adv.h
@ -25,6 +25,8 @@ extern "C" {

 #define BLE_MESH_ADV(buf)               (*(struct bt_mesh_adv **)net_buf_user_data(buf))

+uint16_t bt_mesh_pdu_duration(uint8_t xmit);
+
 typedef struct bt_mesh_msg {
    bool     relay;     /* Flag indicates if the packet is a relayed one */
    void    *arg;       /* Pointer to the struct net_buf */
--- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
@ -30,6 +30,7 @@
 #include "mesh/common.h"
 #include "prov_pvnr.h"
 #include "net.h"
+#include "beacon.h"

 #include "mesh_v1.1/utils.h"

@ -369,7 +370,15 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
    }

 #if CONFIG_BLE_MESH_PRB_SRV
-    addr_type_own = bt_mesh_private_beacon_update_addr_type(ad);
+    /* NOTE: When a Mesh Private beacon is advertised, the Mesh Private beacon shall
+     * use a resolvable private address or a non-resolvable private address in the
+     * AdvA field of the advertising PDU.
+     */
+    if (ad->type == BLE_MESH_DATA_MESH_BEACON && ad->data[0] == BEACON_TYPE_PRIVATE) {
+        addr_type_own = BLE_MESH_ADDR_RANDOM;
+    } else {
+        addr_type_own = BLE_MESH_ADDR_PUBLIC;
+    }
 #else
    addr_type_own = BLE_MESH_ADDR_PUBLIC;
 #endif
@ -1978,7 +1987,7 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)

    if ((sub_code > BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN) ||
        (sub_code < BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
-         type > BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV) ||
+         type >= BLE_MESH_EXCEP_LIST_TYPE_MAX) ||
        (sub_code == BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
         !(type & BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST))) {
        BT_ERR("%s, Invalid parameter", __func__);
@ -1990,6 +1999,16 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
            BT_ERR("Invalid Provisioning Link ID");
            return -EINVAL;
        }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
        sys_memcpy_swap(value, info, sizeof(uint32_t));
    }

--- a/components/bt/esp_ble_mesh/core/cfg_srv.c
+++ b/components/bt/esp_ble_mesh/core/cfg_srv.c
@ -2,7 +2,7 @@

 /*
 * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -2514,7 +2514,7 @@ static void node_identity_set(struct bt_mesh_model *model,
                 * any subnet is 0x01, then the value of the Private Node
                 * Identity state shall be Disable (0x00).
                 */
-                disable_all_private_node_identity();
+                bt_mesh_proxy_private_identity_disable();
 #endif
                bt_mesh_proxy_server_identity_start(sub);
            } else {
@ -3575,6 +3575,17 @@ uint8_t bt_mesh_net_transmit_get(void)
    return 0;
 }

+void bt_mesh_relay_local_set(bool enable)
+{
+    if (conf && conf->relay != BLE_MESH_RELAY_NOT_SUPPORTED) {
+        if (enable) {
+            conf->relay = BLE_MESH_RELAY_ENABLED;
+        } else {
+            conf->relay = BLE_MESH_RELAY_DISABLED;
+        }
+    }
+}
+
 uint8_t bt_mesh_relay_get(void)
 {
    if (conf) {
--- a/components/bt/esp_ble_mesh/core/foundation.h
+++ b/components/bt/esp_ble_mesh/core/foundation.h
@ -246,10 +246,10 @@ extern "C" {
 /* Defines the status codes for Opcodes Aggregator messages. */
 #define AGG_STATUS_SUCCESS                          0x00
 #define AGG_STATUS_INVALID_ADDRESS                  0x01
-#define AGG_STATUS_INVALID_MODEL                    0x02
-#define AGG_STATUS_WRONG_ACCESS_KEY                 0x03
-#define AGG_STATUS_WRONG_OPCODE                     0x04
-#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x05
+#define AGG_STATUS_WRONG_ACCESS_KEY                 0x02
+#define AGG_STATUS_WRONG_OPCODE                     0x03
+#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x04
+#define AGG_STATUS_RESPONSE_OVERFLOW                0x05

 enum {
    BLE_MESH_VA_CHANGED,    /* Label information changed */
--- a/components/bt/esp_ble_mesh/core/include/mesh/access.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/access.h
@ -4,7 +4,7 @@

 /*
 * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
--- a/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
@ -810,6 +810,9 @@ enum {
    BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON,
    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV,
    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_SOLIC_PDU,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_URI,
+    BLE_MESH_EXCEP_LIST_TYPE_MAX,
 };

 #define BLE_MESH_EXCEP_LIST_CLEAN_ADDR_LIST              BIT(0)
@ -817,8 +820,10 @@ enum {
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_BEACON_LIST       BIT(2)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROV_ADV_LIST     BIT(3)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROXY_ADV_LIST    BIT(4)
-#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | \
-                                                          BIT(2) | BIT(3) | BIT(4))
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_SOLIC_PDU_LIST    BIT(5)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_URI_LIST          BIT(6)
+#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | BIT(2) | BIT(3) | \
+                                                          BIT(4) | BIT(5) | BIT(6))

 int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info);

--- a/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
@ -212,6 +212,8 @@ typedef union {
    } cfg_net_transmit_set;
 } bt_mesh_cfg_server_state_change_t;

+void bt_mesh_relay_local_set(bool enable);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
@ -141,6 +141,11 @@ struct bt_mesh_uuid_128 {
 */
 #define BLE_MESH_UUID_MESH_PROXY                BLE_MESH_UUID_DECLARE_16(0x1828)
 #define BLE_MESH_UUID_MESH_PROXY_VAL            0x1828
+/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
+ *  @brief Mesh Proxy Solicitation UUID
+ */
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC          BLE_MESH_UUID_DECLARE_16(0x1859)
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x1859
 /** @def BLE_MESH_UUID_GATT_PRIMARY
 *  @brief GATT Primary Service
 */
@ -466,10 +471,6 @@ struct bt_mesh_uuid_128 {
 */
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT       BLE_MESH_UUID_DECLARE_16(0x2ade)
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT_VAL   0x2ade
-/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
- *  @brief Mesh Proxy Solicitation UUID
- */
-#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x7fcb

 /*
 * Protocol UUIDs
--- a/components/bt/esp_ble_mesh/core/local.c
+++ b/components/bt/esp_ble_mesh/core/local.c
@ -148,10 +148,9 @@ int bt_mesh_enable_directed_forwarding(uint16_t net_idx, bool directed_forwardin

    return 0;
 }
+#endif /* CONFIG_BLE_MESH_DF_SRV */

-#endif
 #if CONFIG_BLE_MESH_NODE
-
 const uint8_t *bt_mesh_node_get_local_net_key(uint16_t net_idx)
 {
    struct bt_mesh_subnet *sub = NULL;
@ -369,5 +368,4 @@ int bt_mesh_node_bind_app_key_to_model(uint16_t elem_addr, uint16_t mod_id,
    BT_ERR("Model bound is full!");
    return -ENOMEM;
 }
-
 #endif /* CONFIG_BLE_MESH_NODE */
--- a/components/bt/esp_ble_mesh/core/lpn.c
+++ b/components/bt/esp_ble_mesh/core/lpn.c
@ -238,6 +238,20 @@ static void clear_friendship(bool force, bool disable)
        lpn_cb(lpn->frnd, false);
    }

+    /* If the Low Power node supports directed forwarding functionality when
+     * the friendship is established in a subnet, the Low Power node shall
+     * store the current value of the Directed Forwarding state and shall set
+     * the state to 0x00 for that subnet. When that friendship is terminated,
+     * the Low Power node shall set the Directed Forwarding state to the stored
+     * value.
+     */
+#if CONFIG_BLE_MESH_DF_SRV
+    if (lpn->established) {
+        bt_mesh_restore_directed_forwarding_state(bt_mesh.sub[0].net_idx,
+                                                  lpn->old_directed_forwarding);
+    }
+#endif
+
    lpn->frnd = BLE_MESH_ADDR_UNASSIGNED;
    lpn->fsn = 0U;
    lpn->req_attempts = 0U;
@ -1027,9 +1041,9 @@ int bt_mesh_lpn_friend_update(struct bt_mesh_net_rx *rx,
         * the Low Power node shall set the Directed Forwarding state to the stored
         * value.
         */
-        /* TODO:
-         * Store - clear - restore directed forwarding state value of the subnet.
-         */
+#if CONFIG_BLE_MESH_DF_SRV
+        lpn->old_directed_forwarding = bt_mesh_get_and_disable_directed_forwarding_state(sub);
+#endif
    }

    friend_response_received(lpn);
--- a/components/bt/esp_ble_mesh/core/net.c
+++ b/components/bt/esp_ble_mesh/core/net.c
@ -606,6 +606,13 @@ bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, uint8_t new_kr, bool new_key)
        case BLE_MESH_KR_PHASE_2:
            BT_INFO("KR Phase 0x%02x -> Normal", sub->kr_phase);

+#if CONFIG_BLE_MESH_PRB_SRV
+            /* In this case, consider that kr_flag has changed, so
+             * need to modify the content of the random field.
+             */
+            bt_mesh_private_beacon_update_random(sub);
+#endif
+
            sub->kr_phase = BLE_MESH_KR_NORMAL;
            bt_mesh_net_revoke_keys(sub);

@ -669,13 +676,26 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
 {
    int i;

+    /* If a node in Normal Operation receives a Secure Network beacon or
+     * a Mesh Private beacon with an IV index less than the last known
+     * IV Index or greater than the last known IV Index + 42, the Secure
+     * Network beacon or the Mesh Private beacon shall be ignored.
+     */
+    if (iv_index < bt_mesh.iv_index ||
+        iv_index > bt_mesh.iv_index + 42) {
+        BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
+                iv_index, bt_mesh.iv_index);
+        return false;
+    }
+
    if (bt_mesh_atomic_test_bit(bt_mesh.flags, BLE_MESH_IVU_IN_PROGRESS)) {
        /* We're currently in IV Update mode */
-
-        if (iv_index != bt_mesh.iv_index) {
-            BT_WARN("IV Index mismatch: 0x%08x != 0x%08x",
-                    iv_index, bt_mesh.iv_index);
-            return false;
+        if (iv_index >= bt_mesh.iv_index + 1) {
+            BT_WARN("Performing IV Index Recovery");
+            (void)memset(bt_mesh.rpl, 0, sizeof(bt_mesh.rpl));
+            bt_mesh.iv_index = iv_index;
+            bt_mesh.seq = 0U;
+            goto do_update;
        }

        if (iv_update) {
@ -691,18 +711,6 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
            return false;
        }

-        /* If a node in Normal Operation receives a Secure Network beacon or
-         * a Mesh Private beacon with an IV index less than the last known
-         * IV Index or greater than the last known IV Index + 42, the Secure
-         * Network beacon or the Mesh Private beacon shall be ignored.
-         */
-        if (iv_index < bt_mesh.iv_index ||
-            iv_index > bt_mesh.iv_index + 42) {
-            BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
-                   iv_index, bt_mesh.iv_index);
-            return false;
-        }
-
        /* If a node in Normal Operation receives a Secure Network beacon
         * or a Mesh Private beacon with an IV index greater than the
         * last known IV Index + 1, it may initiate an IV Index Recovery
@ -1027,6 +1035,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
        tx->ctx->send_ttl = bt_mesh_default_ttl_get();
    }

+#if 0
    /* The output filter of the interface connected to advertising
     * or GATT bearers shall drop all messages with the TTL value
     * set to 1 unless they contain a network PDU that is tagged
@ -1038,6 +1047,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
        err = -EIO;
        goto done;
    }
+#endif

    /* Spec:
     * If the message security material is not set by the network
@ -1246,7 +1256,7 @@ int net_decrypt(struct bt_mesh_subnet *sub, const uint8_t *enc,

    rx->ctx.addr = BLE_MESH_NET_HDR_SRC(buf->data);
    if (!BLE_MESH_ADDR_IS_UNICAST(rx->ctx.addr)) {
-        BT_INFO("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
+        BT_DBG("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
        return -EINVAL;
    }

@ -1397,7 +1407,8 @@ static bool relay_to_adv(enum bt_mesh_net_if net_if)
    case BLE_MESH_NET_IF_ADV:
        return (bt_mesh_relay_get() == BLE_MESH_RELAY_ENABLED);
    case BLE_MESH_NET_IF_PROXY:
-        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED);
+        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
+                bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED);
    default:
        return false;
    }
@ -1465,6 +1476,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
        return;
    }

+#if CONFIG_BLE_MESH_BRC_SRV
+    if (rx->sbr_rpl) {
+        BT_ERR("Bridge RPL attack");
+        goto done;
+    }
+#endif
+
    if (cred != BLE_MESH_FLOODING_CRED
 #if CONFIG_BLE_MESH_DF_SRV
         && cred != BLE_MESH_DIRECTED_CRED
@ -1474,8 +1492,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
        return;
    }

-    if (rx->ctx.recv_ttl == 0x01 && bt_mesh_tag_relay(tag) == false) {
-        BT_DBG("Ignore PDU with TTL=1 but not tagged as relay");
+    if (rx->ctx.recv_ttl == 0x01) {
+        BT_DBG("Ignore PDU with TTL = 1");
+        return;
+    }
+
+    if (rx->ctx.recv_ttl == 0x02 && bt_mesh_tag_relay(tag) == false) {
+        BT_DBG("Ignore PDU with TTL = 2 but not tagged as relay");
        return;
    }

@ -1553,10 +1576,11 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,

    BT_DBG("Relaying packet. TTL is now %u", BLE_MESH_NET_HDR_TTL(buf->data));

-    /* 1. Update NID if RX or RX was with friend credentials.
+    /* 1. Update NID if RX or RX was with friend credentials(included by case 3).
     * 2. Update NID if the net_key has changed.
+     * 3. Update NID if credential has changed.
     */
-    if (rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED || netkey_changed) {
+    if (netkey_changed || cred != rx->ctx.recv_cred) {
        buf->data[0] &= 0x80; /* Clear everything except IVI */
        buf->data[0] |= nid;
    }
@ -1600,19 +1624,6 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
    if (((bearer & BLE_MESH_ADV_BEARER) && relay_to_adv(rx->net_if)) ||
        netkey_changed ||
        rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED) {
-        /* NOTE: temporary add for case MESH/NODE/SBR/NET/BV-01-C */
-#if CONFIG_BLE_MESH_BRC_SRV
-        if (bt_mesh_bridge_rpl_check(rx, NULL) && netkey_changed) {
-            BT_ERR("It is RPL attack, not bridge");
-            /**
-             * @todo:/NODE/DF/INIT/BV-TBD-C,
-             * The message from LT2 was double-checked,
-             * so the message was mistaken for an RPL attack.
-            */
-            goto done;
-        }
-#endif
-
 #if !CONFIG_BLE_MESH_RELAY_ADV_BUF
        bt_mesh_adv_send(buf, xmit, NULL, NULL);
 #else
--- a/components/bt/esp_ble_mesh/core/net.h
+++ b/components/bt/esp_ble_mesh/core/net.h
@ -58,7 +58,6 @@ struct bt_mesh_subnet {
    uint8_t  mpb_flags_last;            /* Flags of last sent private beacon */
    uint8_t  mpb_ivi_last: 1;           /* IV Index of last sent private beacon */
    uint8_t  mpb_random[13];            /* Random of current private beacon */
-    uint8_t  mpb_random_last[13];       /* Random of last sent private beacon */

    uint8_t  private_node_id;           /* Private Node Identity State */
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -274,6 +273,10 @@ struct bt_mesh_lpn {
    /* Previous Friend of this LPN */
    uint16_t old_friend;

+#if CONFIG_BLE_MESH_DF_SRV
+    uint8_t  old_directed_forwarding;
+#endif
+
    /* Duration reported for last advertising packet */
    uint16_t adv_duration;

@ -381,13 +384,14 @@ struct bt_mesh_net_rx {
    struct bt_mesh_subnet *sub;
    struct bt_mesh_msg_ctx ctx;
    uint32_t seq;            /* Sequence Number */
-    uint8_t  old_iv:1,       /* iv_index - 1 was used */
+    uint16_t old_iv:1,       /* iv_index - 1 was used */
             new_key:1,      /* Data was encrypted with updated key */
             friend_cred:1 __attribute__((deprecated)), /* Data was encrypted with friend cred */
             ctl:1,          /* Network Control */
             net_if:2,       /* Network interface */
             local_match:1,  /* Matched a local element */
-             friend_match:1; /* Matched an LPN we're friends for */
+             friend_match:1, /* Matched an LPN we're friends for */
+             sbr_rpl:1;      /* Bridge RPL attacker */
    uint16_t msg_cache_idx;  /* Index of entry in message cache */
 };

@ -406,7 +410,7 @@ extern struct bt_mesh_net bt_mesh;

 #define BLE_MESH_NET_IVI_TX         (bt_mesh.iv_index - \
                                     bt_mesh_atomic_test_bit(bt_mesh.flags, \
-                                     BLE_MESH_IVU_IN_PROGRESS))
+                                                             BLE_MESH_IVU_IN_PROGRESS))
 #define BLE_MESH_NET_IVI_RX(rx)     (bt_mesh.iv_index - (rx)->old_iv)

 #define BLE_MESH_NET_HDR_LEN        9
--- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
@ -1958,6 +1958,16 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
            BT_ERR("Invalid Provisioning Link ID");
            return -EINVAL;
        }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
        sys_memcpy_swap(value, info, sizeof(uint32_t));
    }

--- a/components/bt/esp_ble_mesh/core/prov_common.h
+++ b/components/bt/esp_ble_mesh/core/prov_common.h
@ -62,8 +62,8 @@ extern "C" {
 #define REC_RSP_REC_NOT_PRESENT         0x01
 #define REC_RSP_OFFSET_OUT_OF_BOUND     0x02

-#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT_MASK(7))
-#define PROV_REC_SUPPORT(oob)           ((oob) & BIT_MASK(8))
+#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT(7))
+#define PROV_REC_SUPPORT(oob)           ((oob) & BIT(8))

 #if CONFIG_BLE_MESH_PROV_EPA
 #define PROV_ENC_SIZE(link)             ((link)->algorithm == PROV_ALG_P256_HMAC_SHA256 ? 32 : 16)
--- a/components/bt/esp_ble_mesh/core/prov_pvnr.c
+++ b/components/bt/esp_ble_mesh/core/prov_pvnr.c
@ -371,8 +371,7 @@ static int provisioner_start_prov_pb_adv(const uint8_t uuid[16], const bt_mesh_a

    for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
        if (!bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
-            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)
-            ) {
+            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)) {
            memcpy(prov_links[i].uuid, uuid, 16);
            prov_links[i].oob_info = oob_info;
            if (addr) {
@ -1070,14 +1069,24 @@ static void reset_adv_link(struct bt_mesh_prov_link *link, uint8_t reason)

 static void send_link_open(struct bt_mesh_prov_link *link)
 {
+    uint8_t count;
    int i;

-    /* Generate link ID, and may need to check if this id is
-     * currently being used, which may will not happen ever.
-     */
-    bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+    link->link_id = 0;

    while (1) {
+        count = 0;
+
+        /* Make sure the generated Link ID is not 0 */
+        while(link->link_id == 0) {
+            bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+            if (count++ > 10) {
+                BT_ERR("Link ID error: all zero");
+                return;
+            }
+        }
+
+        /* Check if the generated Link ID is the same with other links */
        for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
            if (bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
                prov_links[i].link_id == link->link_id) {
@ -1085,6 +1094,7 @@ static void send_link_open(struct bt_mesh_prov_link *link)
                break;
            }
        }
+
        if (i == CONFIG_BLE_MESH_PBA_SAME_TIME) {
            break;
        }
@ -3037,8 +3047,8 @@ void bt_mesh_provisioner_prov_adv_recv(struct net_buf_simple *buf,

    uuid = buf->data;
    net_buf_simple_pull(buf, 16);
-    /* Mesh beacon uses big-endian to send beacon data */
-    oob_info = net_buf_simple_pull_be16(buf);
+    /* According CSS, all the field within adv data shall be little-endian */
+    oob_info = net_buf_simple_pull_le16(buf);

    if (provisioner_check_unprov_dev_info(uuid, BLE_MESH_PROV_GATT)) {
        return;
--- a/components/bt/esp_ble_mesh/core/proxy_server.c
+++ b/components/bt/esp_ble_mesh/core/proxy_server.c
@ -35,7 +35,8 @@ _Static_assert(!(IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) && IS_ENABLED(CON

 #define ADV_OPT     (BLE_MESH_ADV_OPT_CONNECTABLE | BLE_MESH_ADV_OPT_ONE_TIME)

-#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && \
+    (CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX)
 #define RAND_UPDATE_INTERVAL    K_MINUTES(10)

 /* The Random field of Private Network Identity
@ -438,12 +439,12 @@ static int beacon_send(struct bt_mesh_proxy_client *client, struct bt_mesh_subne

 #if CONFIG_BLE_MESH_PROXY_PRIVACY
    if (client->proxy_privacy == BLE_MESH_PROXY_PRIVACY_ENABLED) {
-        bt_mesh_private_beacon_create(sub, &buf);
-
        /* NOTE: Each time a Mesh Private beacon for a subnet is sent to a Proxy Client,
         * the Random field in the Mesh Private beacon shall be regenerated.
         */
        bt_mesh_private_beacon_update_random(sub);
+
+        bt_mesh_private_beacon_create(sub, &buf);
    } else
 #endif
    {
@ -476,22 +477,9 @@ static void proxy_send_beacons(struct k_work *work)
    for (i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];

-#if 0
-        if (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
-            sub->node_id == BLE_MESH_NODE_IDENTITY_RUNNING) {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_DISABLED;
-        } else if (true) {
-#if CONFIG_BLE_MESH_PRB_SRV
-            /* TODO: Check if Private GATT Proxy or Private Node Identity is enabled */
-#endif
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_ENABLED;
-        } else {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_NOT_SUPPORTED;
-        }
-#endif
-
        if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
            beacon_send(client, sub);
+
 #if CONFIG_BLE_MESH_DF_SRV
            if (sub->directed_proxy != BLE_MESH_DIRECTED_PROXY_NOT_SUPPORTED) {
                bt_mesh_directed_proxy_server_directed_proxy_caps_status_send(client->conn, sub);
@ -630,16 +618,58 @@ static bool is_exist_private_node_id_enable(void)
    return false;
 }

-void disable_all_private_node_identity(void)
+int bt_mesh_proxy_private_identity_disable(void)
 {
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
    for (size_t i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
        /* NOTE: Set private node identity state of all valid subnets disabled */
        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];

-        if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
-            bt_mesh_proxy_server_private_identity_stop(sub);
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
        }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_stop(sub);
    }
+
+    return 0;
+}
+
+int bt_mesh_proxy_private_identity_enable(void)
+{
+    int count = 0;
+
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
+    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
+        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
+
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
+        }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_start(sub);
+        count++;
+    }
+
+    if (count) {
+        bt_mesh_adv_update();
+    }
+
+    return 0;
 }
 #endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* GATT_PROXY */
@ -1373,7 +1403,7 @@ static const struct bt_mesh_adv_data net_id_ad[] = {
    BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, proxy_svc_data, NET_ID_LEN),
 };

-#if CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX
 static const struct bt_mesh_adv_data private_node_id_ad[] = {
    BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
    BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x28, 0x18),
@ -1533,23 +1563,6 @@ static int private_node_id_adv(struct bt_mesh_subnet *sub)

    return 0;
 }
-
-void bt_mesh_prb_pnid_adv_local_set(bool start)
-{
-    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
-        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
-
-        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
-            continue;
-        }
-
-        if (start) {
-            bt_mesh_proxy_server_private_identity_start(sub);
-        } else {
-            bt_mesh_proxy_server_private_identity_stop(sub);
-        }
-    }
-}
 #endif /* CONFIG_BLE_MESH_PRB_SRV */

 #if (CONFIG_BLE_MESH_PRB_SRV || \
@ -1751,7 +1764,8 @@ static size_t gatt_prov_adv_create(struct bt_mesh_adv_data prov_sd[2])
    }

    memcpy(prov_svc_data + 2, bt_mesh_prov_get()->uuid, 16);
-    sys_put_be16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);
+    /* According CSS, all the field within adv data shall be little-endian */
+    sys_put_le16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);

    if (bt_mesh_prov_get()->uri) {
        size_t uri_len = strlen(bt_mesh_prov_get()->uri);
--- a/components/bt/esp_ble_mesh/core/proxy_server.h
+++ b/components/bt/esp_ble_mesh/core/proxy_server.h
@ -107,9 +107,9 @@ void bt_mesh_disable_private_gatt_proxy(void);

 bool bt_mesh_proxy_server_is_node_id_enable(void);

-void disable_all_private_node_identity(void);
+int bt_mesh_proxy_private_identity_disable(void);

-void bt_mesh_prb_pnid_adv_local_set(bool start);
+int bt_mesh_proxy_private_identity_enable(void);
 #endif /* CONFIG_BLE_MESH_PRB_SRV */

 void bt_mesh_proxy_server_identity_start(struct bt_mesh_subnet *sub);
--- a/components/bt/esp_ble_mesh/core/rpl.c
+++ b/components/bt/esp_ble_mesh/core/rpl.c
@ -87,11 +87,6 @@ bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
    return rpl_check_and_store(rx, match);
 }

-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
-{
-    return rpl_check_and_store(rx, match);
-}
-
 void bt_mesh_rpl_update(void)
 {
    /* Discard "old old" IV Index entries from RPL and flag
--- a/components/bt/esp_ble_mesh/core/rpl.h
+++ b/components/bt/esp_ble_mesh/core/rpl.h
@ -20,8 +20,6 @@ void bt_mesh_update_rpl(struct bt_mesh_rpl *rpl, struct bt_mesh_net_rx *rx);

 bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);

-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);
-
 void bt_mesh_rpl_update(void);

 void bt_mesh_rpl_reset_single(uint16_t src, bool erase);
--- a/components/bt/esp_ble_mesh/core/transport.c
+++ b/components/bt/esp_ble_mesh/core/transport.c
@ -90,7 +90,7 @@ static struct seg_tx {
    uint8_t                tag;         /* Additional metadata */
    const struct bt_mesh_send_cb *cb;
    void                  *cb_data;
-    struct k_delayed_work  retransmit;  /* Retransmit timer */
+    struct k_delayed_work  rtx_timer;   /* Segment Retransmission timer */
 } seg_tx[CONFIG_BLE_MESH_TX_SEG_MSG_COUNT];

 static struct seg_rx {
@ -106,7 +106,7 @@ static struct seg_rx {
    uint16_t               dst;
    uint32_t               block;
    uint32_t               last;
-    struct k_delayed_work  ack;
+    struct k_delayed_work  ack_timer;
    struct net_buf_simple  buf;
 } seg_rx[CONFIG_BLE_MESH_RX_SEG_MSG_COUNT] = {
    [0 ... (CONFIG_BLE_MESH_RX_SEG_MSG_COUNT - 1)] = {
@ -145,7 +145,7 @@ uint8_t bt_mesh_get_seg_rtx_num(void)
    return SEG_RETRANSMIT_ATTEMPTS;
 }

-int32_t bt_mesh_get_seg_rtx_timeout(uint8_t ttl)
+int32_t bt_mesh_get_seg_rtx_timeout(uint16_t dst, uint8_t ttl)
 {
    /* This function will be used when a client model sending an
     * acknowledged message. And if the dst of a message is not
@ -322,7 +322,7 @@ static void seg_tx_reset(struct seg_tx *tx)

    bt_mesh_seg_tx_lock();

-    k_delayed_work_cancel(&tx->retransmit);
+    k_delayed_work_cancel(&tx->rtx_timer);

    tx->cb = NULL;
    tx->cb_data = NULL;
@ -360,6 +360,8 @@ static inline void seg_tx_complete(struct seg_tx *tx, int err)

    seg_tx_reset(tx);

+    /* TODO: notify the completion of sending segmented message */
+
    if (cb && cb->end) {
        cb->end(err, cb_data);
    }
@ -377,7 +379,7 @@ static void schedule_retransmit(struct seg_tx *tx)
        return;
    }

-    k_delayed_work_submit(&tx->retransmit, SEG_RETRANSMIT_TIMEOUT(tx));
+    k_delayed_work_submit(&tx->rtx_timer, SEG_RETRANSMIT_TIMEOUT(tx));
 }

 static void seg_first_send_start(uint16_t duration, int err, void *user_data)
@ -471,7 +473,7 @@ static void seg_tx_send_unacked(struct seg_tx *tx)

 static void seg_retransmit(struct k_work *work)
 {
-    struct seg_tx *tx = CONTAINER_OF(work, struct seg_tx, retransmit);
+    struct seg_tx *tx = CONTAINER_OF(work, struct seg_tx, rtx_timer);

    seg_tx_send_unacked(tx);
 }
@ -511,10 +513,6 @@ static int send_seg(struct bt_mesh_net_tx *net_tx, struct net_buf_simple *sdu,
    }

    tx->dst = net_tx->ctx->addr;
-    /* TODO:
-     * When SAR Transmitter is introduced, the xmit may be
-     * updated with "bt_mesh_get_sar_seg_transmit()".
-     */
    if (sdu->len) {
        tx->seg_n = (sdu->len - 1) / seg_len(!!ctl_op);
    } else {
@ -784,6 +782,12 @@ static int sdu_recv(struct bt_mesh_net_rx *rx, uint32_t seq, uint8_t hdr,
                   rx->ctl, rx->ctx.recv_ttl, rx->ctx.addr, rx->ctx.recv_dst,
                   bt_hex(sdu->data, sdu->len));

+            /* When the Device Key Candidate is available, and an access message
+             * is decrypted using the Device Key Candidate that was delivered to
+             * the access layer, then the node shall revoke the device key, the
+             * Device Key Candidate shall become the device key, and the Device
+             * Key Candidate shall become unavailable.
+             */
            revoke_dev_key(dev_key);

            rx->ctx.app_idx = BLE_MESH_KEY_DEV;
@ -942,7 +946,7 @@ static int trans_ack(struct bt_mesh_net_rx *rx, uint8_t hdr,
        return -EINVAL;
    }

-    k_delayed_work_cancel(&tx->retransmit);
+    k_delayed_work_cancel(&tx->rtx_timer);

    while ((bit = find_lsb_set(ack))) {
        if (tx->seg[bit - 1]) {
@ -1216,11 +1220,9 @@ static int send_ack(struct bt_mesh_subnet *sub, uint16_t src, uint16_t dst,

 static void seg_rx_reset(struct seg_rx *rx, bool full_reset)
 {
-    BT_DBG("rx %p", rx);
-
    bt_mesh_seg_rx_lock();

-    k_delayed_work_cancel(&rx->ack);
+    k_delayed_work_cancel(&rx->ack_timer);

    if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND) && rx->obo &&
        rx->block != BLOCK_COMPLETE(rx->seg_n)) {
@ -1267,9 +1269,7 @@ static uint32_t incomplete_timeout(struct seg_rx *rx)

 static void seg_ack(struct k_work *work)
 {
-    struct seg_rx *rx = CONTAINER_OF(work, struct seg_rx, ack);
-
-    BT_DBG("rx %p", rx);
+    struct seg_rx *rx = CONTAINER_OF(work, struct seg_rx, ack_timer);

    bt_mesh_seg_rx_lock();

@ -1291,14 +1291,14 @@ static void seg_ack(struct k_work *work)
    send_ack(rx->sub, rx->dst, rx->src, rx->ttl, &rx->seq_auth,
             rx->block, rx->obo);

-    k_delayed_work_submit(&rx->ack, ack_timeout(rx));
+    k_delayed_work_submit(&rx->ack_timer, ack_timeout(rx));

    bt_mesh_seg_rx_unlock();
 }

 static inline bool sdu_len_is_ok(bool ctl, uint8_t seg_n)
 {
-    return ((seg_n * seg_len(ctl) + 1) <= CONFIG_BLE_MESH_RX_SDU_MAX);
+    return ((seg_n + 1) * seg_len(ctl) <= CONFIG_BLE_MESH_RX_SDU_MAX);
 }

 static struct seg_rx *seg_rx_find(struct bt_mesh_net_rx *net_rx,
@ -1568,9 +1568,9 @@ found_rx:
    /* Reset the Incomplete Timer */
    rx->last = k_uptime_get_32();

-    if (!k_delayed_work_remaining_get(&rx->ack) &&
+    if (!k_delayed_work_remaining_get(&rx->ack_timer) &&
        !bt_mesh_lpn_established()) {
-        k_delayed_work_submit(&rx->ack, ack_timeout(rx));
+        k_delayed_work_submit(&rx->ack_timer, ack_timeout(rx));
    }

    /* Location in buffer can be calculated based on seg_o & rx->ctl */
@ -1594,7 +1594,7 @@ found_rx:

    *pdu_type = BLE_MESH_FRIEND_PDU_COMPLETE;

-    k_delayed_work_cancel(&rx->ack);
+    k_delayed_work_cancel(&rx->ack_timer);

    send_ack(net_rx->sub, net_rx->ctx.recv_dst, net_rx->ctx.addr,
             net_rx->ctx.send_ttl, seq_auth, rx->block, rx->obo);
@ -1754,11 +1754,11 @@ void bt_mesh_trans_init(void)
    bt_mesh_sar_init();

    for (i = 0; i < ARRAY_SIZE(seg_tx); i++) {
-        k_delayed_work_init(&seg_tx[i].retransmit, seg_retransmit);
+        k_delayed_work_init(&seg_tx[i].rtx_timer, seg_retransmit);
    }

    for (i = 0; i < ARRAY_SIZE(seg_rx); i++) {
-        k_delayed_work_init(&seg_rx[i].ack, seg_ack);
+        k_delayed_work_init(&seg_rx[i].ack_timer, seg_ack);
        seg_rx[i].buf.__buf = (seg_rx_buf_data +
                               (i * CONFIG_BLE_MESH_RX_SDU_MAX));
        seg_rx[i].buf.data = seg_rx[i].buf.__buf;
@ -1778,11 +1778,11 @@ void bt_mesh_trans_deinit(bool erase)
    bt_mesh_rpl_reset(erase);

    for (i = 0; i < ARRAY_SIZE(seg_tx); i++) {
-        k_delayed_work_free(&seg_tx[i].retransmit);
+        k_delayed_work_free(&seg_tx[i].rtx_timer);
    }

    for (i = 0; i < ARRAY_SIZE(seg_rx); i++) {
-        k_delayed_work_free(&seg_rx[i].ack);
+        k_delayed_work_free(&seg_rx[i].ack_timer);
    }

    bt_mesh_mutex_free(&seg_tx_lock);
--- a/components/bt/esp_ble_mesh/core/transport.enh.c
+++ b/components/bt/esp_ble_mesh/core/transport.enh.c
--- a/components/bt/esp_ble_mesh/core/transport.h
+++ b/components/bt/esp_ble_mesh/core/transport.h
@ -96,7 +96,7 @@ struct bt_mesh_ctl_friend_sub_confirm {

 uint8_t bt_mesh_get_seg_rtx_num(void);

-int32_t bt_mesh_get_seg_rtx_timeout(uint8_t ttl);
+int32_t bt_mesh_get_seg_rtx_timeout(uint16_t dst, uint8_t ttl);

 struct bt_mesh_app_key *bt_mesh_app_key_get(uint16_t app_idx);

--- a/components/bt/esp_ble_mesh/models/client/client_common.c
+++ b/components/bt/esp_ble_mesh/models/client/client_common.c
@ -198,7 +198,7 @@ static int32_t bt_mesh_client_calc_timeout(struct bt_mesh_msg_ctx *ctx,
         * All the messages sent from here are access messages.
         */
        seg_rtx_num = bt_mesh_get_seg_rtx_num();
-        seg_rtx_to = bt_mesh_get_seg_rtx_timeout(ctx->send_ttl);
+        seg_rtx_to = bt_mesh_get_seg_rtx_timeout(ctx->addr, ctx->send_ttl);
        seg_count = (msg->len + mic_size - 1) / 12U + 1U;

        duration = bt_mesh_get_adv_duration(ctx);
--- a/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
+++ b/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
@ -63,15 +63,16 @@ typedef struct {
            sar_unicast_retrans_interval_step:4;            /*!< SAR Unicast Retransmissions Interval Step state */
    uint8_t sar_unicast_retrans_interval_increment:4,       /*!< SAR Unicast Retransmissions Interval Increment state */
            sar_multicast_retrans_count:4;                  /*!< SAR Multicast Retransmissions Count state */
-    uint8_t sar_multicast_retrans_interval:4;               /*!< SAR Multicast Retransmissions Interval state */
+    uint8_t sar_multicast_retrans_interval_step:4;          /*!< SAR Multicast Retransmissions Interval state */
 } esp_ble_mesh_sar_transmitter_set_t;

 /** Parameters of SAR Receiver Set */
 typedef struct {
    uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
            sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_set_t;

 /**
@ -90,15 +91,16 @@ typedef struct {
            sar_unicast_retrans_interval_step:4;            /*!< SAR Unicast Retransmissions Interval Step state */
    uint8_t sar_unicast_retrans_interval_increment:4,       /*!< SAR Unicast Retransmissions Interval Increment state */
            sar_multicast_retrans_count:4;                  /*!< SAR Multicast Retransmissions Count state */
-    uint8_t sar_multicast_retrans_interval:4;               /*!< SAR Multicast Retransmissions Interval state */
+    uint8_t sar_multicast_retrans_interval_step:4;          /*!< SAR Multicast Retransmissions Interval state */
 } esp_ble_mesh_sar_transmitter_status_t;

 /** Parameters of SAR Receiver Status */
 typedef struct {
    uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
            sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_status_t;

 /** Result of sending SAR Configuration Client messages */
--- a/components/bt/esp_ble_mesh/v1.1/ext.c
+++ b/components/bt/esp_ble_mesh/v1.1/ext.c
@ -76,6 +76,7 @@
 #define CLI_PARAM(a)    ((bt_mesh_client_common_param_t *)(a))
 #define CLI_NODE(a)     ((bt_mesh_client_node_t *)(a))
 #define ADV_DATA(a)     ((const struct bt_mesh_adv_data *)(a))
+#define RPL(a)          ((struct bt_mesh_rpl *)(a))
 #define VOID(a)         ((void *)(a))

 /* Sys utilities */
@ -739,6 +740,11 @@ size_t bt_mesh_ext_comp_get_elem_count(const void *comp)
    return COMP(comp)->elem_count;
 }

+void *bt_mesh_ext_comp_get_elem_s(const void *comp)
+{
+    return COMP(comp)->elem;
+}
+
 void *bt_mesh_ext_comp_get_elem(const void *comp, uint8_t index)
 {
    return &COMP(comp)->elem[index];
@ -2228,6 +2234,56 @@ bool bt_mesh_ext_lpn_match(uint16_t addr)
 #endif /* CONFIG_BLE_MESH_LOW_POWER */
 }

+uint16_t bt_mesh_ext_lpn_frnd(void)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return bt_mesh.lpn.frnd;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+/* RPL */
+uint16_t bt_mesh_ext_rpl_get_src(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->src;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+bool bt_mesh_ext_rpl_get_old_iv(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->old_iv;
+#else
+    assert(0);
+    return false;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+uint32_t bt_mesh_ext_rpl_get_seq(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->seq;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+void bt_mesh_ext_update_rpl(void *rpl, void *rx)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    bt_mesh_update_rpl(RPL(rpl), NET_RX(rx));
+#else
+    assert(0);
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
 /* Adv */
 uint8_t bt_mesh_ext_adv_data_get_type(const void *ad)
 {
@ -2558,16 +2614,6 @@ uint8_t *bt_mesh_ext_sub_get_mpb_random(void *sub)
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
 }

-uint8_t *bt_mesh_ext_sub_get_mpb_random_last(void *sub)
-{
-#if CONFIG_BLE_MESH_PRIVATE_BEACON
-    return SUBNET(sub)->mpb_random_last;
-#else
-    assert(0);
-    return NULL;
-#endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
-}
-
 uint8_t bt_mesh_ext_sub_get_private_node_id(void *sub)
 {
 #if CONFIG_BLE_MESH_PRIVATE_BEACON
@ -3419,6 +3465,21 @@ void bt_mesh_ext_net_rx_set_net_if(void *rx, uint8_t net_if)
    NET_RX(rx)->net_if = net_if;
 }

+bool bt_mesh_ext_net_rx_get_old_iv(void *rx)
+{
+    return NET_RX(rx)->old_iv;
+}
+
+bool bt_mesh_ext_net_rx_get_sbr_rpl(void *rx)
+{
+    return NET_RX(rx)->sbr_rpl;
+}
+
+void bt_mesh_ext_net_rx_set_sbr_rpl(void *rx, bool sbr_rpl)
+{
+    NET_RX(rx)->sbr_rpl = sbr_rpl;
+}
+
 /* struct bt_mesh_msg_ctx */
 uint16_t bt_mesh_ext_msg_ctx_get_net_idx(void *ctx)
 {
@ -3674,12 +3735,6 @@ int bt_mesh_ext_client_send_msg(void *param, struct net_buf_simple *msg,
    return bt_mesh_client_send_msg(param, msg, need_ack, VOID(timeout_cb));
 }

-/* Bridge Configuration */
-bool bt_mesh_ext_bridge_rpl_check(void *rx, void **match)
-{
-    return bt_mesh_bridge_rpl_check(rx, (struct bt_mesh_rpl **)match);
-}
-
 #if CONFIG_BLE_MESH_BRC_SRV
 struct bt_mesh_subnet_bridge_table {
    uint8_t  bridge_direction;
@ -3695,6 +3750,8 @@ struct bt_mesh_bridge_cfg_srv {
    uint16_t bridging_table_size;
    struct bt_mesh_subnet_bridge_table bridge_table[CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT];
 };
+
+static struct bt_mesh_rpl bridge_rpl[CONFIG_BLE_MESH_BRIDGE_CRPL];
 #endif /* CONFIG_BLE_MESH_BRC_SRV */

 void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
@ -3707,6 +3764,16 @@ void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 }

+void *bt_mesh_ext_brc_srv_get_bridge_rpl(uint8_t index)
+{
+#if CONFIG_BLE_MESH_BRC_SRV
+    return &bridge_rpl[index];
+#else
+    assert(0);
+    return NULL;
+#endif /* CONFIG_BLE_MESH_BRC_SRV */
+}
+
 /* BTC */
 void bt_mesh_ext_agg_client_cb_evt_to_btc(uint32_t opcode, uint8_t event,
                                          void *model, void *ctx,
@ -3935,6 +4002,7 @@ typedef struct {
    uint16_t config_ble_mesh_proxy_solic_rx_crpl;
    uint16_t config_ble_mesh_proxy_solic_tx_src_count;
    uint16_t config_ble_mesh_max_bridging_table_entry_count;
+    uint16_t config_ble_mesh_bridge_crpl;
    uint16_t config_ble_mesh_max_disc_table_entry_count;
    uint16_t config_ble_mesh_max_forward_table_entry_count;
    uint16_t config_ble_mesh_max_deps_nodes_per_path;
@ -4105,6 +4173,7 @@ static const bt_mesh_ext_config_t bt_mesh_ext_cfg = {
 #endif /* CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX */
 #if CONFIG_BLE_MESH_BRC_SRV
    .config_ble_mesh_max_bridging_table_entry_count = CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT,
+    .config_ble_mesh_bridge_crpl                    = CONFIG_BLE_MESH_BRIDGE_CRPL,
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 #if CONFIG_BLE_MESH_DF_SRV
    .config_ble_mesh_max_disc_table_entry_count     = CONFIG_BLE_MESH_MAX_DISC_TABLE_ENTRY_COUNT,
@ -4328,6 +4397,7 @@ typedef struct {

 /* CONFIG_BLE_MESH_LOW_POWER */
    bool (*_bt_mesh_ext_lpn_match)(uint16_t addr);
+    uint16_t (*_bt_mesh_ext_lpn_frnd)(void);
 /* CONFIG_BLE_MESH_LOW_POWER */

 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@ -4448,7 +4518,6 @@ typedef struct {
    uint8_t (*_bt_mesh_ext_sub_get_mpb_ivi_last)(void *sub);
    void (*_bt_mesh_ext_sub_set_mpb_ivi_last)(void *sub, uint8_t mpb_ivi_last);
    uint8_t *(*_bt_mesh_ext_sub_get_mpb_random)(void *sub);
-    uint8_t *(*_bt_mesh_ext_sub_get_mpb_random_last)(void *sub);
    uint8_t (*_bt_mesh_ext_sub_get_private_node_id)(void *sub);
    uint8_t *(*_bt_mesh_ext_sub_get_keys_private_beacon)(void *sub, uint8_t index);
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -4457,6 +4526,7 @@ typedef struct {
    uint16_t (*_bt_mesh_ext_sub_get_sbr_net_idx)(void *sub);
    void (*_bt_mesh_ext_sub_set_sbr_net_idx)(void *sub, uint16_t sbr_net_idx);
    void *(*_bt_mesh_ext_brc_srv_get_bridge_table_entry)(void *srv, uint8_t index);
+    void *(*_bt_mesh_ext_brc_srv_get_bridge_rpl)(uint8_t index);
 /* CONFIG_BLE_MESH_BRC_SRV */

 /* CONFIG_BLE_MESH_AGG_CLI */
@ -4649,6 +4719,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {

 /* CONFIG_BLE_MESH_LOW_POWER */
    ._bt_mesh_ext_lpn_match                             = bt_mesh_ext_lpn_match,
+    ._bt_mesh_ext_lpn_frnd                              = bt_mesh_ext_lpn_frnd,
 /* CONFIG_BLE_MESH_LOW_POWER */

 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@ -4770,7 +4841,6 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
    ._bt_mesh_ext_sub_get_mpb_ivi_last                  = bt_mesh_ext_sub_get_mpb_ivi_last,
    ._bt_mesh_ext_sub_set_mpb_ivi_last                  = bt_mesh_ext_sub_set_mpb_ivi_last,
    ._bt_mesh_ext_sub_get_mpb_random                    = bt_mesh_ext_sub_get_mpb_random,
-    ._bt_mesh_ext_sub_get_mpb_random_last               = bt_mesh_ext_sub_get_mpb_random_last,
    ._bt_mesh_ext_sub_get_private_node_id               = bt_mesh_ext_sub_get_private_node_id,
    ._bt_mesh_ext_sub_get_keys_private_beacon           = bt_mesh_ext_sub_get_keys_private_beacon,
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -4779,6 +4849,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
    ._bt_mesh_ext_sub_get_sbr_net_idx                   = bt_mesh_ext_sub_get_sbr_net_idx,
    ._bt_mesh_ext_sub_set_sbr_net_idx                   = bt_mesh_ext_sub_set_sbr_net_idx,
    ._bt_mesh_ext_brc_srv_get_bridge_table_entry        = bt_mesh_ext_brc_srv_get_bridge_table_entry,
+    ._bt_mesh_ext_brc_srv_get_bridge_rpl                = bt_mesh_ext_brc_srv_get_bridge_rpl,
 /* CONFIG_BLE_MESH_BRC_SRV */

 /* CONFIG_BLE_MESH_AGG_CLI */
--- a/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
+++ b/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
@ -119,6 +119,11 @@ int bt_mesh_directed_update_dependent_node(void *sub, uint8_t type,
 int bt_mesh_directed_forwarding_ctl_recv(uint8_t ctl_op, void *rx,
                                         struct net_buf_simple *buf);

+void bt_mesh_restore_directed_forwarding_state(uint16_t net_idx,
+                                               uint8_t directed_forwarding);
+
+uint8_t bt_mesh_get_and_disable_directed_forwarding_state(void *sub);
+
 int bt_mesh_directed_forwarding_sub_init(void *sub);

 int bt_mesh_recovery_directed_forwarding_table(void *sub);
@ -182,6 +187,8 @@ bool bt_mesh_bridge_change_net_key(void *rx, const uint8_t **enc,
                                   const uint8_t **priv,
                                   uint8_t *nid, uint8_t cred);

+int bt_mesh_print_subnet_bridge_table(void);
+
 void bt_mesh_disable_directed_proxy_state(uint16_t net_idx);

 void bt_mesh_disable_directed_friend_state(uint16_t net_idx);
@ -241,6 +248,30 @@ uint8_t bt_mesh_net_retrans_match(void *rx, uint8_t *cred, uint8_t *tag);

 bool bt_mesh_dev_key_ca_valid(void);

+uint8_t bt_mesh_get_sar_sis(void);
+
+uint8_t bt_mesh_get_sar_urc(void);
+
+uint8_t bt_mesh_get_sar_urwpc(void);
+
+uint8_t bt_mesh_get_sar_uris(void);
+
+uint8_t bt_mesh_get_sar_urii(void);
+
+uint8_t bt_mesh_get_sar_mrc(void);
+
+uint8_t bt_mesh_get_sar_mris(void);
+
+uint8_t bt_mesh_get_sar_st(void);
+
+uint8_t bt_mesh_get_sar_adi(void);
+
+uint8_t bt_mesh_get_sar_arc(void);
+
+uint8_t bt_mesh_get_sar_dt(void);
+
+uint8_t bt_mesh_get_sar_rsis(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/lib_copy.sh
+++ b/components/bt/esp_ble_mesh/v1.1/lib/lib_copy.sh
@ -1,39 +0,0 @@
-#! /usr/bin/env bash
-
-echo "Copy Bluetooth Mesh v1.1 lib:"
-
-chip=$1
-
-if [[ $chip != "esp32" &&
-      $chip != "esp32s3" &&
-      $chip != "esp32c3" &&
-      $chip != "esp32c6" &&
-      $chip != "esp32h2" &&
-      $chip != "all" ]]; then
-    echo "Invalid Chip Target: $chip"
-    exit 0
-fi
-
-if [[ $chip == "esp32" ||
-      $chip == "esp32s3" ||
-      $chip == "esp32c3" ||
-      $chip == "esp32c6" ||
-      $chip == "esp32h2"  ]]; then
-    cp ./build/$chip/libmesh_v1.1.a ./$chip/
-    echo "Copy for $chip done!"
-elif [[ $chip == "all" ]]; then
-    cp ./build/esp32/libmesh_v1.1.a   ./esp32/
-    echo "Copy for esp32 done!"
-
-    cp ./build/esp32s3/libmesh_v1.1.a ./esp32s3/
-    echo "Copy for esp32s3 done!"
-
-    cp ./build/esp32c3/libmesh_v1.1.a ./esp32c3/
-    echo "Copy for esp32c3 done!"
-
-    cp ./build/esp32c6/libmesh_v1.1.a ./esp32c6/
-    echo "Copy for esp32c6 done!"
-
-    cp ./build/esp32h2/libmesh_v1.1.a ./esp32h2/
-    echo "Copy for esp32h2 done!"
-fi
--- a/components/bt/host/bluedroid/Kconfig.in
+++ b/components/bt/host/bluedroid/Kconfig.in
@ -49,7 +49,7 @@ config BT_BLUEDROID_ESP_COEX_VSC

 config BT_CLASSIC_ENABLED
    bool "Classic Bluetooth"
-    depends on BT_BLUEDROID_ENABLED && IDF_TARGET_ESP32
+    depends on BT_BLUEDROID_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BT_CLASSIC_SUPPORTED) || BT_CONTROLLER_DISABLED)
    default n
    help
        For now this option needs "SMP_ENABLE" to be set to yes
@ -83,21 +83,23 @@ config BT_L2CAP_ENABLED
        This enables the Logical Link Control and Adaptation Layer Protocol.
        Only supported classic bluetooth.

-config BT_HFP_ENABLE
+menuconfig BT_HFP_ENABLE
    bool "Hands Free/Handset Profile"
    depends on BT_CLASSIC_ENABLED
    default n
+    help
+        Hands Free Unit and Audio Gateway can be included simultaneously
+        but they cannot run simultaneously due to internal limitations.

-choice BT_HFP_ROLE
-    prompt "Hands-free Profile Role configuration"
+config BT_HFP_CLIENT_ENABLE
+    bool "Hands Free Unit"
    depends on BT_HFP_ENABLE
+    default y

-    config BT_HFP_CLIENT_ENABLE
-        bool "Hands Free Unit"
-
-    config BT_HFP_AG_ENABLE
-        bool "Audio Gateway"
-endchoice
+config BT_HFP_AG_ENABLE
+    bool "Audio Gateway"
+    depends on BT_HFP_ENABLE
+    default y

 choice BT_HFP_AUDIO_DATA_PATH
    prompt "audio(SCO) data path"
@ -121,26 +123,26 @@ config BT_HFP_WBS_ENABLE
        This enables Wide Band Speech. Should disable it when SCO data path is PCM.
        Otherwise there will be no data transmited via GPIOs.

-config BT_HID_ENABLED
+
+menuconfig BT_HID_ENABLED
    bool "Classic BT HID"
    depends on BT_CLASSIC_ENABLED
    default n
    help
        This enables the BT HID Host

-choice BT_HID_ROLE
-    prompt "Profile Role configuration"
+config BT_HID_HOST_ENABLED
+    bool "Classic BT HID Host"
    depends on BT_HID_ENABLED
-    config BT_HID_HOST_ENABLED
-        bool "Classic BT HID Host"
-        help
-            This enables the BT HID Host
+    default n
+    help
+        This enables the BT HID Host

-    config BT_HID_DEVICE_ENABLED
-        bool "Classic BT HID Device"
-        help
-            This enables the BT HID Device
-endchoice
+config BT_HID_DEVICE_ENABLED
+    bool "Classic BT HID Device"
+    depends on BT_HID_ENABLED
+    help
+        This enables the BT HID Device

 config BT_BLE_ENABLED
    bool "Bluetooth Low Energy"
@ -250,6 +252,14 @@ config BT_GATTC_MAX_CACHE_CHAR
    help
        Maximum GATTC cache characteristic count

+config BT_GATTC_NOTIF_REG_MAX
+    int "Max gattc notify(indication) register number"
+    depends on BT_GATTC_ENABLE
+    range 1 64
+    default 5
+    help
+        Maximum GATTC notify(indication) register number
+
 config BT_GATTC_CACHE_NVS_FLASH
    bool "Save gattc cache data to nvs flash"
    depends on BT_GATTC_ENABLE
@ -1106,8 +1116,9 @@ config BT_MAX_DEVICE_NAME_LEN

 config BT_BLE_RPA_SUPPORTED
    bool "Update RPA to Controller"
-    depends on BT_BLUEDROID_ENABLED && !SOC_BLE_DEVICE_PRIVACY_SUPPORTED
-    default n
+    depends on (BT_BLUEDROID_ENABLED && ((BT_CONTROLLER_ENABLED && !SOC_BLE_DEVICE_PRIVACY_SUPPORTED) || BT_CONTROLLER_DISABLED))
+    default n if (BT_CONTROLLER_ENABLED && !SOC_BLE_DEVICE_PRIVACY_SUPPORTED)
+    default y if BT_CONTROLLER_DISABLED
    help
        This enables controller RPA list function.
        For ESP32, ESP32 only support network privacy mode. If this option is enabled, ESP32 will only accept
@ -1131,28 +1142,28 @@ config BT_BLE_RPA_TIMEOUT

 config BT_BLE_50_FEATURES_SUPPORTED
    bool "Enable BLE 5.0 features"
-    depends on (BT_BLUEDROID_ENABLED && (IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3 || SOC_ESP_NIMBLE_CONTROLLER))
+    depends on (BT_BLUEDROID_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
    default y
    help
        This enables BLE 5.0 features, this option only support esp32c3/esp32s3 chip

 config BT_BLE_42_FEATURES_SUPPORTED
    bool "Enable BLE 4.2 features"
-    depends on (BT_BLUEDROID_ENABLED && (IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3 || SOC_ESP_NIMBLE_CONTROLLER))
+    depends on (BT_BLUEDROID_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_SUPPORTED) || BT_CONTROLLER_DISABLED))
    default n
    help
        This enables BLE 4.2 features.

 config BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
    bool "Enable BLE periodic advertising sync transfer feature"
-    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && SOC_ESP_NIMBLE_CONTROLLER)
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED))
    default n
    help
        This enables BLE periodic advertising sync transfer feature

 config BT_BLE_FEAT_PERIODIC_ADV_ENH
    bool "Enable periodic adv enhancements(adi support)"
-    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && SOC_ESP_NIMBLE_CONTROLLER)
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED))
    default n
    help
        Enable the periodic advertising enhancements
--- a/components/bt/host/bluedroid/api/esp_bluedroid_hci.c
+++ b/components/bt/host/bluedroid/api/esp_bluedroid_hci.c
@ -0,0 +1,89 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <string.h>
+#include "esp_log.h"
+#include "esp_bluedroid_hci.h"
+#include "common/bt_target.h"
+#include "hci/hci_trans_int.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+#include "esp_bt.h"
+#endif
+
+#define LOG_TAG "HCI_API"
+
+static esp_bluedroid_hci_driver_operations_t s_hci_driver_ops = { 0 };
+
+esp_err_t esp_bluedroid_attach_hci_driver(const esp_bluedroid_hci_driver_operations_t *p_ops)
+{
+    if (!p_ops) {
+        ESP_LOGE(LOG_TAG, "%s invalid function parameter", __func__);
+        return ESP_FAIL;
+    }
+
+    s_hci_driver_ops.send                   = p_ops->send;
+    s_hci_driver_ops.check_send_available   = p_ops->check_send_available;
+    s_hci_driver_ops.register_host_callback = p_ops->register_host_callback;
+
+    return ESP_OK;
+}
+
+esp_err_t esp_bluedroid_detach_hci_driver(void)
+{
+    s_hci_driver_ops.send                   = NULL;
+    s_hci_driver_ops.check_send_available   = NULL;
+    s_hci_driver_ops.register_host_callback = NULL;
+
+    return ESP_OK;
+}
+
+/****************************************************************
+ *                         INTERNAL USE                         *
+ ****************************************************************/
+
+bool hci_host_check_send_available(void)
+{
+    bool can_send = false;
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+    can_send = esp_vhci_host_check_send_available();
+#else /* BT_CONTROLLER_INCLUDED == TRUE */
+    if (s_hci_driver_ops.check_send_available) {
+        can_send = s_hci_driver_ops.check_send_available();
+    }
+#endif /* BT_CONTROLLER_INCLUDED == TRUE */
+    return can_send;
+}
+
+void hci_host_send_packet(uint8_t *data, uint16_t len)
+{
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+    esp_vhci_host_send_packet(data, len);
+#else /* BT_CONTROLLER_INCLUDED == TRUE */
+    if (s_hci_driver_ops.send) {
+        s_hci_driver_ops.send(data, len);
+    }
+#endif /* BT_CONTROLLER_INCLUDED == TRUE */
+}
+
+esp_err_t hci_host_register_callback(const esp_bluedroid_hci_driver_callbacks_t *callback)
+{
+    esp_err_t ret = ESP_FAIL;
+
+    if (!callback) {
+        ESP_LOGE(LOG_TAG, "%s invalid function parameter", __func__);
+        return ESP_FAIL;
+    }
+
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+    ret = esp_vhci_host_register_callback((esp_vhci_host_callback_t *)callback);
+#else /* BT_CONTROLLER_INCLUDED == TRUE */
+    if (s_hci_driver_ops.register_host_callback) {
+        ret = s_hci_driver_ops.register_host_callback(callback);
+    }
+#endif /* BT_CONTROLLER_INCLUDED == TRUE */
+
+    return ret;
+}
--- a/components/bt/host/bluedroid/api/esp_bt_main.c
+++ b/components/bt/host/bluedroid/api/esp_bt_main.c
@ -5,10 +5,13 @@
 */


+#include "common/bt_target.h"
 #include "esp_bt_main.h"
 #include "btc/btc_task.h"
 #include "btc/btc_main.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif
 #include "osi/future.h"
 #include "osi/allocator.h"
 #include "config/stack_config.h"
@ -123,10 +126,12 @@ esp_err_t esp_bluedroid_init_with_cfg(esp_bluedroid_config_t *cfg)
        return ESP_ERR_INVALID_ARG;
    }

+#if (BT_CONTROLLER_INCLUDED == TRUE)
    if (esp_bt_controller_get_status() != ESP_BT_CONTROLLER_STATUS_ENABLED) {
        LOG_ERROR("Controller not initialised\n");
        return ESP_ERR_INVALID_STATE;
    }
+#endif

    if (bd_already_init) {
        LOG_ERROR("Bluedroid already initialised\n");
--- a/components/bt/host/bluedroid/api/esp_gap_ble_api.c
+++ b/components/bt/host/bluedroid/api/esp_gap_ble_api.c
@ -122,6 +122,19 @@ esp_err_t esp_ble_gap_stop_advertising(void)

    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+
+esp_err_t esp_ble_gap_clear_advertising(void)
+{
+    btc_msg_t msg;
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_ACT_CLEAR_ADV;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)

 esp_err_t esp_ble_gap_update_conn_params(esp_ble_conn_update_params_t *params)
@ -576,7 +589,11 @@ esp_err_t esp_ble_gap_set_security_param(esp_ble_sm_param_t param_type,
        LOG_ERROR("ESP_BLE_APP_ENC_KEY_SIZE is deprecated, use ESP_GATT_PERM_ENCRYPT_KEY_SIZE in characteristic definition");
        return ESP_ERR_NOT_SUPPORTED;
    }
-
+    if (param_type == ESP_BLE_SM_MAX_KEY_SIZE || param_type == ESP_BLE_SM_MIN_KEY_SIZE) {
+        if (((uint8_t *)value)[0] > 16 || ((uint8_t *)value)[0] < 7) {
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
    btc_msg_t msg = {0};
    btc_ble_gap_args_t arg;

--- a/components/bt/host/bluedroid/api/esp_hf_ag_api.c
+++ b/components/bt/host/bluedroid/api/esp_hf_ag_api.c
@ -21,7 +21,9 @@
 #include "common/bt_target.h"
 #include "common/bt_defs.h"
 #include "device/bdaddr.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif
 #include "esp_hf_ag_api.h"
 #include "esp_err.h"
 #include "esp_bt_main.h"
--- a/components/bt/host/bluedroid/api/include/api/esp_bluedroid_hci.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_bluedroid_hci.h
@ -0,0 +1,84 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef __ESP_BLUEDROID_HCI_H__
+#define __ESP_BLUEDROID_HCI_H__
+
+#include <stdbool.h>
+#include "esp_err.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* HCI driver callbacks */
+typedef struct esp_bluedroid_hci_driver_callbacks {
+    /**
+     * @brief callback used to notify that the host can send packet to controller
+     */
+    void (*notify_host_send_available)(void);
+
+    /**
+     * @brief callback used to notify that the controller has a packet to send to the host
+     *
+     * @param[in] data  pointer to data buffer
+     * @param[in] len   length of data
+     *
+     * @return 0 received successfully, failed otherwise
+     */
+    int (*notify_host_recv)(uint8_t *data, uint16_t len);
+} esp_bluedroid_hci_driver_callbacks_t;
+
+/* HCI driver operations */
+typedef struct esp_bluedroid_hci_driver_operations {
+    /**
+     * @brief send data from host to controller
+     *
+     * @param[in] data  pointer to data buffer
+     * @param[in] len   length of data
+     */
+    void (*send)(uint8_t *data, uint16_t len);
+
+    /**
+     * @brief host checks whether it can send data to controller
+     *
+     * @return true if host can send data, false otherwise
+     */
+    bool (*check_send_available)(void);
+
+    /**
+     * @brief register host callback
+     *
+     * @param[in] callback  HCI driver callbacks
+     */
+    esp_err_t (* register_host_callback)(const esp_bluedroid_hci_driver_callbacks_t *callback);
+} esp_bluedroid_hci_driver_operations_t;
+
+/**
+ * @brief get the operations of HCI transport layer. This API should only be used in
+ *        Bluedroid Host-only mode before Bluedroid initialization.
+ *
+ * @param[in] ops struct containing operations of HCI transport layer
+ *
+ * @return ESP_OK if get successfully, ESP_FAIL otherwise
+ */
+esp_err_t esp_bluedroid_attach_hci_driver(const esp_bluedroid_hci_driver_operations_t *ops);
+
+/**
+ * @brief remove the operations of HCI transport layer. This API should only be used in
+ *        Bluedroid Host-only mode before Bluedroid initialization.
+ *
+ * @param[in] ops struct containing operations of HCI transport layer
+ *
+ * @return ESP_OK if get successfully, ESP_FAIL otherwise
+ */
+esp_err_t esp_bluedroid_detach_hci_driver(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __ESP_BLUEDROID_HCI_H__ */
--- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
@ -222,6 +222,8 @@ typedef enum {
    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT,                /*!< when periodic advertising sync transfer received, the event comes */
    // DTM
    ESP_GAP_BLE_DTM_TEST_UPDATE_EVT,                             /*!< when direct test mode state changes, the event comes */
+    // BLE_INCLUDED
+    ESP_GAP_BLE_ADV_CLEAR_COMPLETE_EVT,                          /*!< When clear advertising complete, the event comes */
    ESP_GAP_BLE_EVT_MAX,                                         /*!< when maximum advertising event complete, the event comes */
 } esp_gap_ble_cb_event_t;

@ -1086,6 +1088,12 @@ typedef union {
    struct ble_adv_stop_cmpl_evt_param {
        esp_bt_status_t status;                     /*!< Indicate adv stop operation success status */
    } adv_stop_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_ADV_CLEAR_COMPLETE_EVT
+     */
+    struct ble_adv_clear_cmpl_evt_param {
+        esp_bt_status_t status;                     /*!< Indicate adv clear operation success status */
+    } adv_clear_cmpl;                                /*!< Event parameter of ESP_GAP_BLE_ADV_CLEAR_COMPLETE_EVT */
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
    /**
     * @brief ESP_GAP_BLE_SET_STATIC_RAND_ADDR_EVT
@ -2499,6 +2507,16 @@ esp_err_t esp_ble_dtm_enh_rx_start(const esp_ble_dtm_enh_rx_t *rx_params);
 */
 esp_err_t esp_ble_dtm_stop(void);

+/**
+* @brief           This function is used to clear legacy advertising
+*
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_gap_clear_advertising(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
@ -46,6 +46,9 @@
 #if (GAP_INCLUDED == TRUE)
 #include "stack/gap_api.h"
 #endif
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+#include "esp_bt.h"
+#endif

 static void bta_dm_inq_results_cb (tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir);
 static void bta_dm_inq_cmpl_cb (void *p_result);
@ -136,7 +139,6 @@ static void bta_dm_observe_discard_cb (uint32_t num_dis);
 static void bta_dm_delay_role_switch_cback(TIMER_LIST_ENT *p_tle);
 extern void sdpu_uuid16_to_uuid128(UINT16 uuid16, UINT8 *p_uuid128);
 static void bta_dm_disable_timer_cback(TIMER_LIST_ENT *p_tle);
-extern int bredr_txpwr_get(int *min_power_level, int *max_power_level);

 const UINT16 bta_service_id_to_uuid_lkup_tbl [BTA_MAX_SERVICE_ID] = {
    UUID_SERVCLASS_PNP_INFORMATION,         /* Reserved */
@ -4313,7 +4315,14 @@ static void bta_dm_set_eir (char *local_name)
    if (p_bta_dm_eir_cfg->bta_dm_eir_included_tx_power) {
        if (free_eir_length >= 3) {
            int min_power_level, max_power_level;
-            if (bredr_txpwr_get(&min_power_level, &max_power_level) == 0) {
+#if (BT_CONTROLLER_INCLUDED == TRUE)
+            if (esp_bredr_tx_power_get((esp_power_level_t *)&min_power_level, (esp_power_level_t *)&max_power_level) == ESP_OK) {
+#else
+            {
+                min_power_level = 0;
+                max_power_level = 0;
+                UNUSED(min_power_level);
+#endif
                INT8 btm_tx_power[BTM_TX_POWER_LEVEL_MAX + 1] = BTM_TX_POWER;
                p_bta_dm_eir_cfg->bta_dm_eir_inq_tx_power = btm_tx_power[max_power_level];
                UINT8_TO_STREAM(p, 2);      /* Length field */
@ -5702,6 +5711,15 @@ void bta_dm_ble_gap_dtm_stop(tBTA_DM_MSG *p_data)
    BTM_BleTestEnd(p_data->dtm_stop.p_dtm_cmpl_cback);
 }

+void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data)
+{
+    if (BTM_BleClearAdv(p_data->ble_clear_adv.p_clear_adv_cback) == FALSE) {
+        if (p_data->ble_clear_adv.p_clear_adv_cback) {
+            (*p_data->ble_clear_adv.p_clear_adv_cback)(BTA_FAILURE);
+        }
+    }
+}
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data)
 {
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
@ -1813,6 +1813,29 @@ extern void BTA_DmBleBroadcast (BOOLEAN start, tBTA_START_STOP_ADV_CMPL_CBACK *p
    }
 }

+/*******************************************************************************
+**
+** Function         BTA_DmBleClearAdv
+**
+** Description      This function is called to clear Advertising
+**
+** Parameters       p_adv_data_cback : clear adv complete callback.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_DmBleClearAdv (tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback)
+{
+    tBTA_DM_API_CLEAR_ADV  *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_CLEAR_ADV *)
+                 osi_malloc(sizeof(tBTA_DM_API_CLEAR_ADV))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_BLE_CLEAR_ADV_EVT;
+        p_msg->p_clear_adv_cback = p_clear_adv_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
 #endif
 /*******************************************************************************
 **
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_co.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_co.c
@ -356,7 +356,7 @@ void bta_dm_co_ble_io_req(BD_ADDR bd_addr,  tBTA_IO_CAP *p_io_cap,
        *p_resp_key = bte_appl_cfg.ble_resp_key;
    }

-    if (bte_appl_cfg.ble_max_key_size > 7 && bte_appl_cfg.ble_max_key_size <= 16) {
+    if (bte_appl_cfg.ble_max_key_size >= 7 && bte_appl_cfg.ble_max_key_size <= 16) {
        *p_max_key_size = bte_appl_cfg.ble_max_key_size;
    }
 #endif  ///SMP_INCLUDED == TRUE
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c
@ -224,6 +224,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_gap_dtm_tx_start, /* BTA_DM_API_DTM_TX_START_EVT */
    bta_dm_ble_gap_dtm_rx_start, /* BTA_DM_API_DTM_RX_START_EVT */
    bta_dm_ble_gap_dtm_stop, /* BTA_DM_API_DTM_STOP_EVT */
+    bta_dm_ble_gap_clear_adv, /* BTA_DM_API_BLE_CLEAR_ADV_EVT */
 #endif
 };

--- a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h
+++ b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h
@ -217,6 +217,7 @@ enum {
    BTA_DM_API_DTM_TX_START_EVT,
    BTA_DM_API_DTM_RX_START_EVT,
    BTA_DM_API_DTM_STOP_EVT,
+    BTA_DM_API_BLE_CLEAR_ADV_EVT,
 #endif
    BTA_DM_MAX_EVT
 };
@ -896,6 +897,11 @@ typedef struct {
    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
 } tBTA_DM_API_BLE_DTM_STOP;

+typedef struct {
+    BT_HDR                  hdr;
+    tBTA_CLEAR_ADV_CMPL_CBACK       *p_clear_adv_cback;
+} tBTA_DM_API_CLEAR_ADV;
+
 #endif /* BLE_INCLUDED */

 /* data type for BTA_DM_API_REMOVE_ACL_EVT */
@ -1293,6 +1299,7 @@ typedef union {
    tBTA_DM_API_BLE_DTM_TX_START    dtm_tx_start;
    tBTA_DM_API_BLE_DTM_RX_START    dtm_rx_start;
    tBTA_DM_API_BLE_DTM_STOP        dtm_stop;
+    tBTA_DM_API_CLEAR_ADV           ble_clear_adv;
 #endif

    tBTA_DM_API_REMOVE_ACL              remove_acl;
@ -1732,6 +1739,7 @@ extern void bta_dm_ble_multi_adv_enb(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_dtm_tx_start(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_dtm_rx_start(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_dtm_stop(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data);

 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 extern void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data);
--- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c
+++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c
@ -932,7 +932,7 @@ tBTA_GATT_STATUS BTA_GATTC_RegisterForNotifications (tBTA_GATTC_IF client_if,
            }
            if (i == BTA_GATTC_NOTIF_REG_MAX) {
                status = BTA_GATT_NO_RESOURCES;
-                APPL_TRACE_ERROR("Max Notification Reached, registration failed.");
+                APPL_TRACE_ERROR("Max Notification Reached, registration failed,see CONFIG_BT_GATTC_NOTIF_REG_MAX in menuconfig");
            }
        }
    } else {
--- a/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h
+++ b/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h
@ -319,10 +319,6 @@ typedef struct {
    bool                update_incl_srvc;
 } tBTA_GATTC_SERV;

-#ifndef BTA_GATTC_NOTIF_REG_MAX
-#define BTA_GATTC_NOTIF_REG_MAX     BTA_GATTC_CONN_MAX
-#endif
-
 typedef struct {
    BOOLEAN             in_use;
    BD_ADDR             remote_bda;
--- a/components/bt/host/bluedroid/bta/hf_client/include/bta_hf_client_at.h
+++ b/components/bt/host/bluedroid/bta/hf_client/include/bta_hf_client_at.h
@ -26,15 +26,6 @@
 /* ASCII character string of arguments to the AT command */
 #define BTA_HF_CLIENT_AT_MAX_LEN        512

-/* AT command table element */
-typedef struct {
-    const char  *p_cmd;         /* AT command string */
-    UINT8       arg_type;       /* allowable argument type syntax */
-    UINT8       fmt;            /* whether arg is int or string */
-    UINT8       min;            /* minimum value for int arg */
-    INT16       max;            /* maximum value for int arg */
-} tBTA_AG_AT_CMD;
-
 /* callback function executed when command is parsed */
 typedef void (tBTA_AG_AT_CMD_CBACK)(void *p_user, UINT16 cmd, UINT8 arg_type,
                                    char *p_arg, INT16 int_arg);
--- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h
+++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h
@ -1243,6 +1243,8 @@ typedef void (tBTA_START_STOP_SCAN_CMPL_CBACK) (tBTA_STATUS status);

 typedef void (tBTA_START_STOP_ADV_CMPL_CBACK) (tBTA_STATUS status);

+typedef void (tBTA_CLEAR_ADV_CMPL_CBACK) (tBTA_STATUS status);
+
 typedef void (tBTA_BLE_TRACK_ADV_CMPL_CBACK)(int action, tBTA_STATUS status,
        tBTA_DM_BLE_PF_AVBL_SPACE avbl_space,
        tBTA_DM_BLE_REF_VALUE ref_value);
@ -2654,6 +2656,19 @@ extern void BTA_DmBleSetAdvConfigRaw (UINT8 *p_raw_adv, UINT32 raw_adv_len,
 void BTA_DmBleSetLongAdv (UINT8 *adv_data, UINT32 adv_data_len,
                            tBTA_SET_ADV_DATA_CMPL_CBACK *p_adv_data_cback);

+/*******************************************************************************
+**
+** Function         BTA_DmBleClearAdv
+**
+** Description      This function is called to clear Advertising
+**
+** Parameters       p_adv_data_cback : clear adv complete callback.
+**
+** Returns          None
+**
+*******************************************************************************/
+void BTA_DmBleClearAdv (tBTA_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleSetScanRsp
--- a/components/bt/host/bluedroid/btc/core/btc_ble_storage.c
+++ b/components/bt/host/bluedroid/btc/core/btc_ble_storage.c
@ -380,7 +380,7 @@ static bt_status_t _btc_storage_remove_ble_bonding_keys(bt_bdaddr_t *remote_bd_a

    BTIF_TRACE_DEBUG(" %s in bd addr:%s",__FUNCTION__, bdstr);

-    _btc_storage_remove_all_ble_keys(bdstr);
+    ret = _btc_storage_remove_all_ble_keys(bdstr);

    //here don't remove section, because config_save will check it
    _btc_storage_save();
--- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
+++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
@ -9,6 +9,7 @@
 #include "osi/allocator.h"
 #include "stack/bt_types.h"
 #include "common/bt_defs.h"
+#include "common/bt_target.h"
 #include "bta/bta_api.h"
 #include "bta/bta_dm_co.h"
 #include "btc/btc_task.h"
@ -23,7 +24,9 @@
 #include "osi/mutex.h"
 #include "osi/thread.h"
 #include "osi/pkt_queue.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif

 #if (BLE_INCLUDED == TRUE)
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
@ -187,7 +190,11 @@ static void btc_to_bta_adv_data(esp_ble_adv_data_t *p_adv_data, tBTA_BLE_ADV_DAT

    if (p_adv_data->include_txpower) {
        mask |= BTM_BLE_AD_BIT_TX_PWR;
+#if (BT_CONTROLLER_INCLUDED == TRUE)
        bta_adv_data->tx_power = esp_ble_tx_power_get(ESP_BLE_PWR_TYPE_ADV);
+#else
+        bta_adv_data->tx_power = 0;
+#endif
    }

    if (p_adv_data->min_interval > 0 && p_adv_data->max_interval > 0 &&
@ -470,6 +477,25 @@ static void btc_stop_adv_callback(uint8_t status)
    }
 }

+static void btc_clear_adv_callback(uint8_t status)
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg = {0};
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_ADV_CLEAR_COMPLETE_EVT;
+    param.adv_clear_cmpl.status = btc_hci_to_esp_status(status);
+
+    ret = btc_transfer_context(&msg, &param,
+                               sizeof(esp_ble_gap_cb_param_t), NULL, NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
 void btc_update_duplicate_exceptional_list_callback(tBTA_STATUS status, uint8_t subcode, uint32_t length, uint8_t *device_info)
 {
    esp_ble_gap_cb_param_t param;
@ -1257,13 +1283,17 @@ static void btc_ble_stop_scanning(tBTA_START_STOP_SCAN_CMPL_CBACK *stop_scan_cb)
    BTA_DmBleScan(false, duration, NULL, stop_scan_cb);
 }

-
 static void btc_ble_stop_advertising(tBTA_START_STOP_ADV_CMPL_CBACK *stop_adv_cb)
 {
    bool stop_adv = false;

    BTA_DmBleBroadcast(stop_adv, stop_adv_cb);
 }
+
+static void btc_ble_clear_advertising(tBTA_CLEAR_ADV_CMPL_CBACK *clear_adv_cb)
+{
+    BTA_DmBleClearAdv(clear_adv_cb);
+}
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 static void btc_ble_update_conn_params(BD_ADDR bd_addr, uint16_t min_int,
                                       uint16_t max_int, uint16_t latency, uint16_t timeout)
@ -1731,6 +1761,9 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
    case BTC_GAP_BLE_ACT_STOP_ADV:
        btc_ble_stop_advertising(btc_stop_adv_callback);
        break;
+    case BTC_GAP_BLE_ACT_CLEAR_ADV:
+        btc_ble_clear_advertising(btc_clear_adv_callback);
+        break;
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
    case BTC_GAP_BLE_ACT_UPDATE_CONN_PARAM:
        btc_ble_update_conn_params(arg->conn_update_params.conn_params.bda,
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
@ -29,7 +29,9 @@
 #include "common/bt_trace.h"
 #include "common/bt_defs.h"
 #include "device/bdaddr.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif
 #include "esp_hf_ag_api.h"
 #include "osi/allocator.h"

@ -328,12 +330,14 @@ bt_status_t btc_hf_init(void)
    // custom initialization here
    hf_local_param[idx].btc_hf_cb.initialized = true;
 // set audio path
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #if BTM_SCO_HCI_INCLUDED
    uint8_t data_path = ESP_SCO_DATA_PATH_HCI;
 #else
    uint8_t data_path = ESP_SCO_DATA_PATH_PCM;
 #endif
    esp_bredr_sco_datapath_set(data_path);
+#endif
    return BT_STATUS_SUCCESS;
 }

--- a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c
@ -25,7 +25,9 @@
 #include "btc/btc_util.h"
 #include "esp_hf_client_api.h"
 #include "bta/bta_hf_client_api.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif
 #include <assert.h>

 #if BT_HF_CLIENT_BQB_INCLUDED
@ -167,19 +169,20 @@ bt_status_t btc_hf_client_init(void)
 {
    BTC_TRACE_EVENT("%s", __FUNCTION__);

-    uint8_t data_path;
    btc_dm_enable_service(BTA_HFP_HS_SERVICE_ID);

    clear_state();

    hf_client_local_param.btc_hf_client_cb.initialized = true;

+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #if BTM_SCO_HCI_INCLUDED
-    data_path = ESP_SCO_DATA_PATH_HCI;
+    uint8_t data_path = ESP_SCO_DATA_PATH_HCI;
 #else
-    data_path = ESP_SCO_DATA_PATH_PCM;
+    uint8_t data_path = ESP_SCO_DATA_PATH_PCM;
 #endif
    esp_bredr_sco_datapath_set(data_path);
+#endif
    return BT_STATUS_SUCCESS;
 }

--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h
@ -99,6 +99,9 @@ typedef enum {
    BTC_GAP_BLE_DTM_RX_START,
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
    BTC_GAP_BLE_DTM_STOP,
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+    BTC_GAP_BLE_ACT_CLEAR_ADV,
+#endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 } btc_gap_ble_act_t;

 /* btc_ble_gap_args_t */
--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_hd.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_hd.h
@ -63,7 +63,7 @@ typedef struct {
 /* btc_hidd_args_t */
 typedef union {
    // BTC_HD_CONNECT_EVT
-    struct connect_arg {
+    struct hd_connect_arg {
        BD_ADDR bd_addr;
    } connect;

--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_hf_ag.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_hf_ag.h
@ -184,13 +184,13 @@ typedef union
    } phone;

    // BTC_HF_REGISTER_DATA_CALLBACK_EVT
-    struct reg_data_callback {
+    struct ag_reg_data_callback {
        esp_hf_incoming_data_cb_t recv;
        esp_hf_outgoing_data_cb_t send;
    } reg_data_cb;

    // BTC_HF_REQUEST_PKT_STAT_EVT
-    struct req_pkt_stat_sync_handle {
+    struct ag_req_pkt_stat_sync_handle {
        UINT16            sync_conn_handle;
    } pkt_sync_hd;

--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_hf_client.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_hf_client.h
@ -102,7 +102,7 @@ typedef union {
    } send_dtmf;

    // BTC_HF_CLIENT_REGISTER_DATA_CALLBACK_EVT
-    struct reg_data_callback {
+    struct hf_client_reg_data_callback {
        esp_hf_client_incoming_data_cb_t recv;
        esp_hf_client_outgoing_data_cb_t send;
    } reg_data_cb;
@ -120,7 +120,7 @@ typedef union {
    } send_iphoneaccev;

    // BTC_HF_CLIENT_REQUEST_PKT_STAT_EVT
-    struct req_pkt_stat_sync_handle {
+    struct hf_client_req_pkt_stat_sync_handle {
        UINT16            sync_conn_handle;
    } pkt_sync_hd;

--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_hh.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_hh.h
@ -103,7 +103,7 @@ typedef struct {
 /* btc_spp_args_t */
 typedef union {
    // BTC_HH_CONNECT_EVT
-    struct connect_arg {
+    struct hh_connect_arg {
        BD_ADDR bd_addr;
    } connect;

--- a/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h
+++ b/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h
@ -105,7 +105,7 @@
 #ifdef CONFIG_BT_BLE_RPA_SUPPORTED
 #define UC_BT_BLE_RPA_SUPPORTED            CONFIG_BT_BLE_RPA_SUPPORTED
 #else
-#if SOC_BLE_DEVICE_PRIVACY_SUPPORTED
+#if (CONFIG_BT_CONTROLLER_ENABLED && SOC_BLE_DEVICE_PRIVACY_SUPPORTED)
 #define UC_BT_BLE_RPA_SUPPORTED            TRUE
 #else
 #define UC_BT_BLE_RPA_SUPPORTED            FALSE
@ -163,6 +163,13 @@
 #define UC_BT_GATTC_MAX_CACHE_CHAR      40
 #endif

+//GATTC NOTIF
+#ifdef CONFIG_BT_GATTC_NOTIF_REG_MAX
+#define UC_BT_GATTC_NOTIF_REG_MAX      CONFIG_BT_GATTC_NOTIF_REG_MAX
+#else
+#define UC_BT_GATTC_NOTIF_REG_MAX      5
+#endif
+
 #ifdef CONFIG_BT_GATTC_CACHE_NVS_FLASH
 #define UC_BT_GATTC_CACHE_NVS_FLASH_ENABLED    CONFIG_BT_GATTC_CACHE_NVS_FLASH
 #else
@ -454,13 +461,15 @@
 #ifdef CONFIG_BT_LOG_HID_TRACE_LEVEL
 #if UC_BT_HID_HOST_ENABLED
 #define UC_BT_LOG_HIDH_TRACE_LEVEL           CONFIG_BT_LOG_HID_TRACE_LEVEL
-#elif UC_BT_HID_DEVICE_ENABLED
+#endif
+#if UC_BT_HID_DEVICE_ENABLED
 #define UC_BT_LOG_HIDD_TRACE_LEVEL           CONFIG_BT_LOG_HID_TRACE_LEVEL
 #endif
 #else
 #if UC_BT_HID_HOST_ENABLED
 #define UC_BT_LOG_HIDH_TRACE_LEVEL           UC_TRACE_LEVEL_WARNING
-#elif UC_BT_HID_DEVICE_ENABLED
+#endif
+#if UC_BT_HID_DEVICE_ENABLED
 #define UC_BT_LOG_HIDD_TRACE_LEVEL           UC_TRACE_LEVEL_WARNING
 #endif
 #endif
--- a/components/bt/host/bluedroid/common/include/common/bt_target.h
+++ b/components/bt/host/bluedroid/common/include/common/bt_target.h
@ -51,6 +51,12 @@
 #define ESP_COEX_VSC_INCLUDED        FALSE
 #endif

+#if (UC_BT_CONTROLLER_INCLUDED == TRUE)
+#define BT_CONTROLLER_INCLUDED       TRUE
+#else
+#define BT_CONTROLLER_INCLUDED       FALSE
+#endif
+
 /******************************************************************************
 **
 ** Classic BT features
@ -96,49 +102,50 @@
 #define VND_BT_JV_BTA_L2CAP         TRUE
 #endif /* UC_BT_L2CAP_ENABLED */

+#if (UC_BT_HFP_AG_ENABLED == TRUE) || (UC_BT_HFP_CLIENT_ENABLED == TRUE)
+#ifndef RFCOMM_INCLUDED
+#define RFCOMM_INCLUDED             TRUE
+#endif
+#ifndef BTM_SCO_INCLUDED
+#define BTM_SCO_INCLUDED            TRUE
+#endif
+#ifndef SBC_DEC_INCLUDED
+#define SBC_DEC_INCLUDED            TRUE
+#endif
+#ifndef SBC_ENC_INCLUDED
+#define SBC_ENC_INCLUDED            TRUE
+#endif
+#ifndef PLC_INCLUDED
+#define PLC_INCLUDED                TRUE
+#endif
+
 #if (UC_BT_HFP_AG_ENABLED == TRUE)
+#ifndef BTM_MAX_SCO_LINKS_AG
+#define BTM_MAX_SCO_LINKS_AG        (1)
+#endif
 #define BTC_HF_INCLUDED             TRUE
 #define BTA_AG_INCLUDED             TRUE
-#define PLC_INCLUDED                TRUE
-#define BTA_JV_RFCOMM_INCLUDED      TRUE
-#ifndef RFCOMM_INCLUDED
-#define RFCOMM_INCLUDED             TRUE
+#else
+#ifndef BTM_MAX_SCO_LINKS_AG
+#define BTM_MAX_SCO_LINKS_AG        (0)
 #endif
-#ifndef BTM_SCO_INCLUDED
-#define BTM_SCO_INCLUDED            TRUE
-#endif
-#ifndef BTM_MAX_SCO_LINKS
-#define BTM_MAX_SCO_LINKS           (1)
-#endif
-#ifndef SBC_DEC_INCLUDED
-#define SBC_DEC_INCLUDED            TRUE
-#endif
-#ifndef SBC_ENC_INCLUDED
-#define SBC_ENC_INCLUDED            TRUE
-#endif
-#endif  /* UC_BT_HFP_AG_ENABLED */
-
+#endif /* (UC_BT_HFP_AG_ENABLED == TRUE) */
 #if (UC_BT_HFP_CLIENT_ENABLED == TRUE)
+#ifndef BTM_MAX_SCO_LINKS_CLIENT
+#define BTM_MAX_SCO_LINKS_CLIENT    (1)
+#endif
 #define BTC_HF_CLIENT_INCLUDED      TRUE
 #define BTA_HF_INCLUDED             TRUE
-#define PLC_INCLUDED                TRUE
-#ifndef RFCOMM_INCLUDED
-#define RFCOMM_INCLUDED             TRUE
-#endif
-#ifndef BTM_SCO_INCLUDED
-#define BTM_SCO_INCLUDED            TRUE
-#endif
-#ifndef BTM_MAX_SCO_LINKS
-#define BTM_MAX_SCO_LINKS           (1)
+#else
+#ifndef BTM_MAX_SCO_LINKS_CLIENT
+#define BTM_MAX_SCO_LINKS_CLIENT    (0)
 #endif
+#endif /* (UC_BT_HFP_CLIENT_ENABLED == TRUE) */

-#ifndef SBC_DEC_INCLUDED
-#define SBC_DEC_INCLUDED            TRUE
+#ifndef BTM_MAX_SCO_LINKS
+#define BTM_MAX_SCO_LINKS           (BTM_MAX_SCO_LINKS_AG + BTM_MAX_SCO_LINKS_CLIENT)
 #endif
-#ifndef SBC_ENC_INCLUDED
-#define SBC_ENC_INCLUDED            TRUE
-#endif
-#endif  /* UC_BT_HFP_CLIENT_ENABLED */
+#endif /* (UC_BT_HFP_AG_ENABLED == TRUE) || (UC_BT_HFP_CLIENT_ENABLED == TRUE) */

 #if UC_BT_HID_ENABLED
 #define BT_HID_INCLUDED             TRUE
@ -248,6 +255,12 @@
 #define GATTC_CONNECT_RETRY_EN     FALSE
 #endif

+#ifdef UC_BT_GATTC_NOTIF_REG_MAX
+#define BTA_GATTC_NOTIF_REG_MAX     UC_BT_GATTC_NOTIF_REG_MAX
+#else
+#define BTA_GATTC_NOTIF_REG_MAX     5
+#endif
+
 #if (UC_BT_SMP_ENABLE)
 #define SMP_INCLUDED                TRUE
 #if (BLE_INCLUDED == TRUE)
--- a/components/bt/host/bluedroid/hci/hci_hal_h4.c
+++ b/components/bt/host/bluedroid/hci/hci_hal_h4.c
@ -22,16 +22,20 @@
 #include "hci/hci_hal.h"
 #include "hci/hci_internals.h"
 #include "hci/hci_layer.h"
+#include "hci/hci_trans_int.h"
 #include "osi/thread.h"
 #include "osi/pkt_queue.h"
 #if (BLE_ADV_REPORT_FLOW_CONTROL == TRUE)
 #include "osi/mutex.h"
 #include "osi/alarm.h"
 #endif
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif
+#include "esp_bluedroid_hci.h"
 #include "stack/hcimsgs.h"

-#if SOC_ESP_NIMBLE_CONTROLLER
+#if ((BT_CONTROLLER_INCLUDED == TRUE) && SOC_ESP_NIMBLE_CONTROLLER)
 #include "nimble/ble_hci_trans.h"
 #endif

@ -87,7 +91,7 @@ typedef struct {

 static hci_hal_env_t hci_hal_env;
 static const hci_hal_t interface;
-static const esp_vhci_host_callback_t vhci_host_cb;
+static const esp_bluedroid_hci_driver_callbacks_t hci_host_cb;

 static void host_send_pkt_available_cb(void);
 static int host_recv_pkt_cb(uint8_t *data, uint16_t len);
@ -167,7 +171,7 @@ static bool hal_open(const hci_hal_callbacks_t *upper_callbacks, void *task_thre
    hci_hal_env_init(upper_callbacks, (osi_thread_t *)task_thread);

    //register vhci host cb
-    if (esp_vhci_host_register_callback(&vhci_host_cb) != ESP_OK) {
+    if (hci_host_register_callback(&hci_host_cb) != ESP_OK) {
        return false;
    }

@ -207,7 +211,7 @@ static uint16_t transmit_data(serial_data_type_t type,
    BTTRC_DUMP_BUFFER("Transmit Pkt", data, length);

    // TX Data to target
-    esp_vhci_host_send_packet(data, length);
+    hci_host_send_packet(data, length);

    // Be nice and restore the old value of that byte
    *(data) = previous_byte;
@ -590,7 +594,7 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)

    return 0;
 }
-#if SOC_ESP_NIMBLE_CONTROLLER
+#if ((BT_CONTROLLER_INCLUDED == TRUE) && SOC_ESP_NIMBLE_CONTROLLER)

 int
 ble_hs_hci_rx_evt(uint8_t *hci_ev, void *arg)
@ -625,7 +629,7 @@ ble_hs_rx_data(struct os_mbuf *om, void *arg)
 }

 #endif
-static const esp_vhci_host_callback_t vhci_host_cb = {
+static const esp_bluedroid_hci_driver_callbacks_t hci_host_cb = {
    .notify_host_send_available = host_send_pkt_available_cb,
    .notify_host_recv = host_recv_pkt_cb,
 };
--- a/components/bt/host/bluedroid/hci/hci_layer.c
+++ b/components/bt/host/bluedroid/hci/hci_layer.c
@ -17,7 +17,10 @@
 ******************************************************************************/
 #include <string.h>
 #include "sdkconfig.h"
+#include "common/bt_target.h"
+#if (BT_CONTROLLER_INCLUDED == TRUE)
 #include "esp_bt.h"
+#endif

 #include "common/bt_defs.h"
 #include "common/bt_trace.h"
@ -28,6 +31,7 @@
 #include "hci/hci_internals.h"
 #include "hci/hci_hal.h"
 #include "hci/hci_layer.h"
+#include "hci/hci_trans_int.h"
 #include "osi/allocator.h"
 #include "hci/packet_fragmenter.h"
 #include "osi/list.h"
@ -226,7 +230,7 @@ static void hci_downstream_data_handler(void *arg)
     * All packets will be directly copied to single queue in driver layer with
     * H4 type header added (1 byte).
     */
-    while (esp_vhci_host_check_send_available()) {
+    while (hci_host_check_send_available()) {
        /*Now Target only allowed one packet per TX*/
        BT_HDR *pkt = packet_fragmenter->fragment_current_packet();
        if (pkt != NULL) {
--- a/components/bt/host/bluedroid/hci/include/hci/hci_hal.h
+++ b/components/bt/host/bluedroid/hci/include/hci/hci_hal.h
@ -21,9 +21,10 @@

 #include <stdbool.h>
 #include <stdint.h>
+#include "common/bt_target.h"
 #include "osi/pkt_queue.h"
 #include "stack/bt_types.h"
-#if SOC_ESP_NIMBLE_CONTROLLER
+#if ((BT_CONTROLLER_INCLUDED == TRUE) && SOC_ESP_NIMBLE_CONTROLLER)
 #include "os/os_mbuf.h"
 #endif
 typedef enum {
@ -85,7 +86,7 @@ typedef struct hci_hal_t {

 // Gets the correct hal implementation, as compiled for.
 const hci_hal_t *hci_hal_h4_get_interface(void);
-#if SOC_ESP_NIMBLE_CONTROLLER
+#if ((BT_CONTROLLER_INCLUDED == TRUE) && SOC_ESP_NIMBLE_CONTROLLER)
 int ble_hs_hci_rx_evt(uint8_t *hci_ev, void *arg);

 int ble_hs_rx_data(struct os_mbuf *om, void *arg);
--- a/components/bt/host/bluedroid/hci/include/hci/hci_trans_int.h
+++ b/components/bt/host/bluedroid/hci/include/hci/hci_trans_int.h
@ -0,0 +1,47 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef __HCI_TRANS_INT_H__
+#define __HCI_TRANS_INT_H__
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "esp_err.h"
+#include "esp_bluedroid_hci.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief host checks whether it can send data to controller
+ *
+ * @return true if host can send data, false otherwise
+ */
+bool hci_host_check_send_available(void);
+
+/**
+ * @brief host sends packet to controller
+ *
+ * @param[in] data pointer to data buffer
+ * @param[in] len  length of data in byte
+ */
+void hci_host_send_packet(uint8_t *data, uint16_t len);
+
+/**
+ * @brief register the HCI function interface
+ *
+ * @param[in] callback HCI function interface
+ *
+ * @return ESP_OK register successfully, ESP_FAIL otherwise
+ */
+esp_err_t hci_host_register_callback(const esp_bluedroid_hci_driver_callbacks_t *callback);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __HCI_TRANS_INT_H__ */
--- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
@ -3355,7 +3355,11 @@ BOOLEAN btm_ble_update_inq_result(BD_ADDR bda, tINQ_DB_ENT *p_i, UINT8 addr_type
    if (evt_type != BTM_BLE_SCAN_RSP_EVT) {
        p_cur->ble_evt_type     = evt_type;
    }
-
+#if BTM_BLE_ACTIVE_SCAN_REPORT_ADV_SCAN_RSP_INDIVIDUALLY
+    if (evt_type == BTM_BLE_SCAN_RSP_EVT) {
+        p_cur->ble_evt_type = evt_type;
+    }
+#endif
    p_i->inq_count = p_inq->inq_counter;   /* Mark entry for current inquiry */

    if (p_le_inq_cb->adv_len != 0) {
@ -4669,6 +4673,28 @@ BOOLEAN BTM_Ble_Authorization(BD_ADDR bd_addr, BOOLEAN authorize)
    return FALSE;
 }

+/*******************************************************************************
+**
+** Function         BTM_BleClearAdv
+**
+** Description      This function is called to clear legacy advertising
+**
+** Parameter        p_clear_adv_cback - Command complete callback
+**
+*******************************************************************************/
+BOOLEAN BTM_BleClearAdv(tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cback)
+{
+    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
+
+    if (btsnd_hcic_ble_clear_adv() == FALSE) {
+        BTM_TRACE_ERROR("%s: Unable to Clear Advertising", __FUNCTION__);
+        return FALSE;
+    }
+
+    p_cb->inq_var.p_clear_adv_cb = p_clear_adv_cback;
+    return TRUE;
+}
+
 bool btm_ble_adv_pkt_ready(void)
 {
    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
--- a/components/bt/host/bluedroid/stack/btm/btm_devctl.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_devctl.c
@ -731,6 +731,14 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
            }
            break;
        }
+        case HCI_VENDOR_BLE_CLEAR_ADV: {
+            uint8_t status;
+            STREAM_TO_UINT8(status, p);
+            if (ble_cb && ble_cb->inq_var.p_clear_adv_cb) {
+                ble_cb->inq_var.p_clear_adv_cb(status);
+            }
+            break;
+        }
        default:
        break;
    }
--- a/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h
+++ b/components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h
@ -159,6 +159,7 @@ typedef struct {
    tBTM_BLE_SFP sfp; /* scanning filter policy */
    tBTM_START_ADV_CMPL_CBACK *p_adv_cb;
    tBTM_START_STOP_ADV_CMPL_CBACK *p_stop_adv_cb;
+    tBTM_CLEAR_ADV_CMPL_CBACK *p_clear_adv_cb;
    tBLE_ADDR_TYPE adv_addr_type;
    UINT8 evt_type;
    UINT8 adv_mode;
--- a/components/bt/host/bluedroid/stack/gatt/gatt_db.c
+++ b/components/bt/host/bluedroid/stack/gatt/gatt_db.c
@ -1173,39 +1173,39 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code,

                if ((op_code == GATT_SIGN_CMD_WRITE) && !(perm & GATT_WRITE_SIGNED_PERM)) {
                    status = GATT_WRITE_NOT_PERMIT;
-                    GATT_TRACE_DEBUG( "gatts_write_attr_perm_check - sign cmd write not allowed");
+                    GATT_TRACE_DEBUG( "gatts_write_attr_perm_check - sign cmd write not allowed,handle:0x%04x",handle);
                }
                if ((op_code == GATT_SIGN_CMD_WRITE) && (sec_flag & GATT_SEC_FLAG_ENCRYPTED)) {
                    status = GATT_INVALID_PDU;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - Error!! sign cmd write sent on a encypted link");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - Error!! sign cmd write sent on a encypted link,handle:0x%04x",handle);
                } else if (!(perm & GATT_WRITE_ALLOWED)) {
                    status = GATT_WRITE_NOT_PERMIT;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_WRITE_NOT_PERMIT");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_WRITE_NOT_PERMIT,handle:0x%04x",handle);
                }
                /* require authentication, but not been authenticated */
                else if ((perm & GATT_WRITE_AUTH_REQUIRED ) && !(sec_flag & GATT_SEC_FLAG_LKEY_UNAUTHED)) {
                    status = GATT_INSUF_AUTHENTICATION;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION,handle:0x%04x",handle);
                } else if ((perm & GATT_WRITE_MITM_REQUIRED ) && !(sec_flag & GATT_SEC_FLAG_LKEY_AUTHED)) {
                    status = GATT_INSUF_AUTHENTICATION;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION: MITM required");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION: MITM required,handle:0x%04x",handle);
                } else if ((perm & GATT_WRITE_ENCRYPTED_PERM ) && !(sec_flag & GATT_SEC_FLAG_ENCRYPTED)) {
                    status = GATT_INSUF_ENCRYPTION;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_ENCRYPTION");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_ENCRYPTION,handle:0x%04x",handle);
                } else if ((perm & GATT_WRITE_ENCRYPTED_PERM ) && (sec_flag & GATT_SEC_FLAG_ENCRYPTED) && (key_size < min_key_size)) {
                    status = GATT_INSUF_KEY_SIZE;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_KEY_SIZE");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_KEY_SIZE,handle:0x%04x",handle);
                }
                /* LE Authorization check*/
                else if ((perm & GATT_WRITE_AUTHORIZATION) && (!(sec_flag & GATT_SEC_FLAG_LKEY_AUTHED) || !(sec_flag & GATT_SEC_FLAG_AUTHORIZATION))){
                    status = GATT_INSUF_AUTHORIZATION;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHORIZATION");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHORIZATION,handle:0x%04x",handle);
                }
                /* LE security mode 2 attribute  */
                else if (perm & GATT_WRITE_SIGNED_PERM && op_code != GATT_SIGN_CMD_WRITE && !(sec_flag & GATT_SEC_FLAG_ENCRYPTED)
                         &&  (perm & GATT_WRITE_ALLOWED) == 0) {
                    status = GATT_INSUF_AUTHENTICATION;
-                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION: LE security mode 2 required");
+                    GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INSUF_AUTHENTICATION: LE security mode 2 required,handle:0x%04x",handle);
                } else { /* writable: must be char value declaration or char descritpors */
                    if (p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) {
                        switch (p_attr->uuid) {
@ -1246,10 +1246,10 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code,
                    {
                        if (op_code == GATT_REQ_PREPARE_WRITE && offset != 0) { /* does not allow write blob */
                            status = GATT_NOT_LONG;
-                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_NOT_LONG");
+                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_NOT_LONG,handle:0x%04x",handle);
                        } else if (len != max_size) { /* data does not match the required format */
                            status = GATT_INVALID_ATTR_LEN;
-                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INVALID_PDU");
+                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INVALID_PDU,handle:0x%04x",handle);
                        } else {
                            status = GATT_SUCCESS;
                        }
--- a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c
+++ b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c
@ -1084,6 +1084,27 @@ BOOLEAN btsnd_hcic_ble_set_channels (BLE_CHANNELS channels)
    return (TRUE);
 }

+BOOLEAN btsnd_hcic_ble_clear_adv (void)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    if ((p = HCI_GET_CMD_BUF (HCIC_PARAM_SIZE_BLE_CLEAR_ADV)) == NULL) {
+        return (FALSE);
+    }
+
+    pp = (UINT8 *)(p + 1);
+
+    p->len = HCIC_PREAMBLE_SIZE + HCIC_PARAM_SIZE_BLE_CLEAR_ADV;
+    p->offset = 0;
+
+    UINT16_TO_STREAM (pp, HCI_VENDOR_BLE_CLEAR_ADV);
+    UINT8_TO_STREAM (pp, HCIC_PARAM_SIZE_BLE_CLEAR_ADV);
+
+    btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
+    return TRUE;
+}
+
 #define HCIC_BLE_CMD_CREATED(p, pp, size) do{\
    if ((p = HCI_GET_CMD_BUF(size)) == NULL) { \
        return FALSE; \
--- a/Show More
+++ b/Show More