change(version): Update version to 5.4.1

Feature/add vendor ble cmd definitions (v5.4)

See merge request espressif/esp-idf!37956

.codespellrc

@@ -1,4 +1,4 @@
 [codespell]
 skip = build,*.yuv,components/fatfs/src/*,alice.txt,*.rgb,components/wpa_supplicant/*,components/esp_wifi/*,*.pem
-ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn,registr,oen
+ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn,registr,oen,parms
 write-changes = true

.gitlab/CODEOWNERS

@@ -2,248 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#
 
-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.codespellrc                         @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/ROADMAP*.md                          @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_driver_*/             @esp-idf-codeowners/peripherals
-/components/esp_driver_sdmmc/         @esp-idf-codeowners/peripherals @esp-idf-codeowners/storage
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_hw_support/lowpower/  @esp-idf-codeowners/power-management
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_security/             @esp-idf-codeowners/security
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_vfs_*/                @esp-idf-codeowners/storage
-/components/esp_vfs_console/          @esp-idf-codeowners/storage @esp-idf-codeowners/system
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/hal/test_apps/crypto/     @esp-idf-codeowners/peripherals @esp-idf-codeowners/security
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/rt/                       @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                      @esp-idf-codeowners/docs
-/docs/docs_not_updated/                     @esp-idf-codeowners/all-maintainers
-/docs/**/api-guides/tools/                  @esp-idf-codeowners/tools
-/docs/en/api-guides/core_dump.rst           @esp-idf-codeowners/debugging
-/docs/**/api-guides/wifi*                   @esp-idf-codeowners/wifi
-/docs/**/api-guides/esp-wifi-mesh.rst       @esp-idf-codeowners/wifi
-/docs/en/api-guides/jtag-debugging/         @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/           @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/             @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/         @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb*     @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/peripherals/usb*/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/           @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/             @esp-idf-codeowners/storage
-/docs/**/api-reference/system/              @esp-idf-codeowners/system
-/docs/**/security/                          @esp-idf-codeowners/security
-/docs/**/migration-guides/                  @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-/docs/**/contribute/install-pre-commit-hook.rst @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/ieee802154/         @esp-idf-codeowners/ieee802154
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-/tools/test_apps/                    @esp-idf-codeowners/ci
-/tools/test_apps/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/configs/            @esp-idf-codeowners/system
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/peripherals/        @esp-idf-codeowners/peripherals
-/tools/test_apps/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/storage/            @esp-idf-codeowners/storage
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers

.gitlab/ci/build.yml

@@ -1,7 +1,7 @@
 .build_template:
   stage: build
   extends:
-    - .after_script:build:ccache:upload-when-fail
+    - .after_script:build:ccache-show-stats:upload-failed-job-logs
   image: $ESP_ENV_IMAGE
   tags:
     - build
@@ -12,11 +12,11 @@
     IDF_CCACHE_ENABLE: "1"
   dependencies: []
 
-.build_cmake_template:
+.build_cmake_clang_template:
   extends:
     - .build_template
     - .before_script:build
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
   dependencies: # set dependencies to null to avoid missing artifacts issue
   needs:
     - job: fast_template_app
@@ -34,29 +34,11 @@
       - "**/build*/size.json"
     expire_in: 1 week
     when: always
-  script:
-    # CI specific options start from "--parallel-count xxx". could ignore when running locally
-    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
-      -t $IDF_TARGET
-      --copy-sdkconfig
-      --parallel-count ${CI_NODE_TOTAL:-1}
-      --parallel-index ${CI_NODE_INDEX:-1}
-      --extra-preserve-dirs
-        examples/bluetooth/esp_ble_mesh/ble_mesh_console
-        examples/bluetooth/hci/controller_hci_uart_esp32
-        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
-    - python tools/ci/artifacts_handler.py upload
-
-.build_cmake_clang_template:
-  extends:
-    - .build_cmake_template
   variables:
     IDF_TOOLCHAIN: clang
     TEST_BUILD_OPTS_EXTRA: ""
     TEST_DIR: tools/test_apps/system/clang_build_test
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
   script:
     # CI specific options start from "--parallel-count xxx". could ignore when running locally
     - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
@@ -126,7 +108,7 @@ gcc_static_analyzer:
     ANALYZING_APP: "examples/get-started/hello_world"
   script:
     - echo "CONFIG_COMPILER_STATIC_ANALYZER=y" >> ${ANALYZING_APP}/sdkconfig.defaults
-    - python -m idf_build_apps build -vv -p ${ANALYZING_APP} -t all
+    - python -m idf_build_apps build -v -p ${ANALYZING_APP} -t all
 
 ########################################
 # Clang Build Apps Without Tests Cases #
@@ -246,15 +228,16 @@ pytest_build_system_macos:
   extends:
     - .test_build_system_template
     - .before_script:build:macos
-    - .after_script:build:macos:upload-when-fail
+    - .after_script:build:macos:upload-failed-job-logs:ccache-show-stats
     - .rules:build:macos
   tags:
     - macos_shell
   parallel: 3
   variables:
     PYENV_VERSION: "3.8"
-    CI_CCACHE_DISABLE: "1"  # ccache: error: Read-only file system
-
+    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
+    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
+    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
 build_docker:
   extends:
     - .before_script:minimal

.gitlab/ci/common.yml

@@ -6,9 +6,9 @@ stages:
   - pre_check
   - build
   - assign_test
+  - build_doc
   - target_test
   - host_test
-  - build_doc
   - test_deploy
   - deploy
   - post_deploy
@@ -40,7 +40,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.4-dev
+  LATEST_GIT_TAG: v5.4.1
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules
@@ -57,7 +57,7 @@ variables:
   # Docker images
   ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:1"
   ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:1-1"
-  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:1"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:2"
   SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
   PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"
 
@@ -88,7 +88,7 @@ variables:
   CI_CLANG_DISTRO_URL: ""
 
   # Set this variable to specify the file name for the known failure cases.
-  KNOWN_FAILURE_CASES_FILE_NAME: "master.txt"
+  KNOWN_FAILURE_CASES_FILE_NAME: "5.4.txt"
 
   IDF_CI_BUILD: 1
 
@@ -141,40 +141,48 @@ variables:
     export IDF_MIRROR_PREFIX_MAP=
   fi
 
-  # install latest python packages
-  # target test jobs
-  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
-  elif [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-docs
-  elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
-    run_cmd bash install.sh --enable-ci
-  else
-    if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+  if [[ "${CI_JOB_STAGE}" != "target_test" ]]; then
+    section_start "running_install_sh" "Running install.sh"
+    if [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
+      run_cmd bash install.sh --enable-ci --enable-docs
+    elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
       run_cmd bash install.sh --enable-ci
     else
-      run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+        run_cmd bash install.sh --enable-ci
+      else
+        run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      fi
     fi
+    section_end "running_install_sh"
+  else
+    section_start "install_python_env" "Install Python environment"
+    run_cmd python tools/idf_tools.py install-python-env --features ci,pytest,test-specific
+    section_end "install_python_env"
   fi
 
-  # Install esp-clang if necessary
+  if [[ ! -z "$INSTALL_EXTRA_TOOLS" ]]; then
+    section_start "installing_optional_tools" "Install optional tools ${INSTALL_EXTRA_TOOLS}"
+    $IDF_PATH/tools/idf_tools.py --non-interactive install $INSTALL_EXTRA_TOOLS
+    section_end "installing_optional_tools"
+  fi
+
+  # Install esp-clang if necessary (esp-clang is separately installed)
   if [[ "$IDF_TOOLCHAIN" == "clang" && -z "$CI_CLANG_DISTRO_URL" ]]; then
     $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
   fi
 
-  # Install QEMU if necessary
-  if [[ ! -z "$INSTALL_QEMU" ]]; then
-    $IDF_PATH/tools/idf_tools.py --non-interactive install qemu-xtensa qemu-riscv32
+  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
+    section_start "IDF_SKIP_TOOLS_CHECK" "Skip required tools check"
+    export IDF_SKIP_TOOLS_CHECK=1
+    section_end "IDF_SKIP_TOOLS_CHECK"
   fi
-
-  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
-  # Needed for pytest junit reports.
-  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
-
+  section_start "source_export" "Source export.sh"
   source ./export.sh
+  section_end "source_export"
 
   # Custom clang toolchain
-  if [[ ! -z "$CI_CLANG_DISTRO_URL" ]]; then
+  if [[ "$IDF_TOOLCHAIN" == "clang" && ! -z "$CI_CLANG_DISTRO_URL" ]]; then
     echo "Using custom clang from ${CI_CLANG_DISTRO_URL}"
     wget $CI_CLANG_DISTRO_URL
     ARCH_NAME=$(basename $CI_CLANG_DISTRO_URL)
@@ -198,6 +206,8 @@ variables:
     rm -rf ${CI_PYTHON_TOOL_REPO}
   fi
 
+  info "setup tools and python venv done"
+
 .show_ccache_statistics: &show_ccache_statistics |
   # Show ccache statistics if enabled globally
   test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats -vv || true
@@ -222,18 +232,20 @@ variables:
     - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
     # remove idf-env.json, since it may contains enabled "features"
     - rm -f $IDF_TOOLS_PATH/idf-env.json
-    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
     # This adds tools (compilers) and the version-specific Python environment to PATH
     - *setup_tools_and_idf_python_venv
     - fetch_submodules
+  variables:
+    INSTALL_EXTRA_TOOLS: cmake ninja
 
-.after_script:build:macos:upload-when-fail:
+.after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
   after_script:
     # macos is running shell executor, which means it would use
     # the system installed /usr/local/bin/python3 by default.
     # Ensure pyenv and PYENV_VERSION installed
     - eval "$(pyenv init -)"
     - *upload_failed_job_log_artifacts
+    - *show_ccache_statistics
 
 .before_script:build:
   before_script:
@@ -244,11 +256,11 @@ variables:
     - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
     - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}
 
-.after_script:build:ccache:
+.after_script:build:ccache-show-stats:
   after_script:
     - *show_ccache_statistics
 
-.after_script:build:ccache:upload-when-fail:
+.after_script:build:ccache-show-stats:upload-failed-job-logs:
   after_script:
     - *show_ccache_statistics
     - *upload_failed_job_log_artifacts

.gitlab/ci/docs.yml

@@ -37,25 +37,16 @@
 .if-dev-push: &if-dev-push
   if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
 
-.if-schedule: &if-schedule
-  if: '$CI_PIPELINE_SOURCE == "schedule"'
-
 .doc-rules:build:docs-full:
   rules:
     - <<: *if-qa-test-tag
       when: never
-    - <<: *if-schedule
+    - <<: *if-protected
     - <<: *if-label-build_docs
     - <<: *if-label-docs_full
     - <<: *if-dev-push
       changes: *patterns-docs-full
 
-.doc-rules:build:docs-full-prod:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-
 .doc-rules:build:docs-partial:
   rules:
     - <<: *if-qa-test-tag
@@ -92,13 +83,14 @@ check_docs_lang_sync:
   stage: build_doc
   tags:
     - build_docs
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
   script:
     - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
     - cd docs
     - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
-  artifacts:
-    expire_in: 4 days
-    when: always
   parallel:
     matrix:
       - DOCLANG: ["en", "zh_CN"]
@@ -119,26 +111,12 @@ build_docs_html_full:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    paths:
-      - docs/_build/*/*/*.txt
-      - docs/_build/*/*/html/*
-  variables:
-    DOC_BUILDERS: "html"
-
-build_docs_html_full_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/html/*
+    expire_in: 4 days
   variables:
     DOC_BUILDERS: "html"
 
@@ -146,14 +124,12 @@ build_docs_html_partial:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-partial
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/html/*
+    expire_in: 4 days
   variables:
     DOC_BUILDERS: "html"
   parallel:
@@ -163,33 +139,6 @@ build_docs_html_partial:
       - DOCLANG: "zh_CN"
         DOCTGT: "esp32p4"
 
-build_docs_pdf:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
-build_docs_pdf_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
 .deploy_docs_template:
   image: $ESP_IDF_DOC_ENV_IMAGE
   variables:
@@ -218,8 +167,6 @@ deploy_docs_preview:
       optional: true
     - job: build_docs_html_full
       optional: true
-    - job: build_docs_pdf
-      optional: true
   variables:
     TYPE: "preview"
     # older branches use DOCS_DEPLOY_KEY, DOCS_SERVER, DOCS_SERVER_USER, DOCS_PATH for preview server so we keep these names for 'preview'
@@ -234,12 +181,12 @@ deploy_docs_production:
   # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
   extends:
     - .deploy_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   dependencies:  # set dependencies to null to avoid missing artifacts issue
   needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full_prod
-    - build_docs_pdf_prod
+    - build_docs_html_full
     - job: push_to_github
       artifacts: false
   variables:
@@ -254,16 +201,19 @@ deploy_docs_production:
 check_doc_links:
   extends:
     - .build_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   needs:
     - job: deploy_docs_production
       artifacts: false
   tags: ["build", "amd64", "internet"]
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/linkcheck/*.txt
+    expire_in: 1 week
   allow_failure: true
   script:
     - cd docs

.gitlab/ci/host-test.yml

@@ -195,7 +195,7 @@ test_tools:
       junit: ${IDF_PATH}/XUNIT_*.xml
   variables:
     LC_ALL: C.UTF-8
-    INSTALL_QEMU: 1  # for test_idf_qemu.py
+    INSTALL_EXTRA_TOOLS: "qemu-xtensa qemu-riscv32"  # for test_idf_qemu.py
   script:
     - stat=0
     - cd ${IDF_PATH}/tools/ci/test_autocomplete
@@ -282,9 +282,10 @@ test_pytest_qemu:
       junit: XUNIT_RESULT.xml
   parallel:
     matrix:
-      - IDF_TARGET: [esp32, esp32c3]
-  variables:
-    INSTALL_QEMU: 1
+      - IDF_TARGET: "esp32"
+        INSTALL_EXTRA_TOOLS: "qemu-xtensa"
+      - IDF_TARGET: "esp32c3"
+        INSTALL_EXTRA_TOOLS: "qemu-riscv32"
   script:
     - run_cmd python tools/ci/ci_build_apps.py . -v
       --target $IDF_TARGET
@@ -348,7 +349,7 @@ test_pytest_macos:
   variables:
     PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
   script:
-    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -vv
+    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -v
       --target linux
       --pytest-apps
       -m \"host_test and macos_shell\"
@@ -397,6 +398,17 @@ test_nvs_gen_check:
     - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
     - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml
 
+test_esp_rom:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+    reports:
+      junit: XUNIT_RESULT.xml
+  script:
+    - cd ${IDF_PATH}/components/esp_rom/
+    - pytest --noconftest test_esp_rom.py --junitxml=XUNIT_RESULT.xml
+
 make_sure_soc_caps_compatible_in_idf_build_apps:
     extends:
       - .host_test_template

.gitlab/ci/pre_check.yml

@@ -183,12 +183,24 @@ baseline_manifest_sha:
   tags: [fast_run, shiny]
   script:
     - |
-      if [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
+      # merged results pipelines, by default
+      # diff between target-branch-head and merged-result-head
+      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_SHA" ]; then
+        git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_SHA --depth=1
+        git checkout FETCH_HEAD
+        idf-build-apps dump-manifest-sha \
+          --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
+          --output .manifest_sha
+      # merge request pipelines, when the mr got conflicts
+      # diff between diff-base-sha and merge-request-head
+      elif [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
         git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1
         git checkout FETCH_HEAD
         idf-build-apps dump-manifest-sha \
           --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
           --output .manifest_sha
+      # other pipelines, like the protected branches pipelines
+      # not triggered in this job
       fi
   artifacts:
     paths:

.pre-commit-config.yaml

@@ -154,7 +154,7 @@ repos:
         require_serial: true
         additional_dependencies:
           - PyYAML == 5.3.1
-          - idf-build-apps~=2.0
+          - idf-build-apps~=2.5
       - id: sort-yaml-files
         name: sort yaml files
         entry: tools/ci/sort_yaml.py
@@ -241,6 +241,6 @@ repos:
         name: Lint rST files in docs folder using Sphinx Lint
         files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
   - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.3.0
+    rev: v2.4.1
     hooks:
       - id: check-kconfig-files

components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c

@@ -3,7 +3,7 @@
  *
  * SPDX-License-Identifier: BSD-1-Clause
  *
- * SPDX-FileContributor: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2017-2024 Espressif Systems (Shanghai) CO LTD
  */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
@@ -58,6 +58,7 @@ File    : SEGGER_SYSVIEW_Config_FreeRTOS.c
 Purpose : Sample setup configuration of SystemView with FreeRTOS.
 Revision: $Rev: 7745 $
 */
+#include <string.h>
 #include "sdkconfig.h"
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
@@ -156,15 +157,16 @@ static esp_apptrace_lock_t s_sys_view_lock = {.mux = portMUX_INITIALIZER_UNLOCKE
 *    Sends SystemView description strings.
 */
 static void _cbSendSystemDesc(void) {
-    char irq_str[32];
+    char irq_str[32] = "I#";
     SEGGER_SYSVIEW_SendSysDesc("N="SYSVIEW_APP_NAME",D="SYSVIEW_DEVICE_NAME",C="SYSVIEW_CORE_NAME",O=FreeRTOS");
-    snprintf(irq_str, sizeof(irq_str), "I#%d=SysTick", SYSTICK_INTR_ID);
+    strcat(itoa(SYSTICK_INTR_ID, irq_str + 2, 10), "=SysTick");
     SEGGER_SYSVIEW_SendSysDesc(irq_str);
     size_t isr_count = sizeof(esp_isr_names)/sizeof(esp_isr_names[0]);
     for (size_t i = 0; i < isr_count; ++i) {
         if (esp_isr_names[i] == NULL || (ETS_INTERNAL_INTR_SOURCE_OFF + i) == SYSTICK_INTR_ID)
             continue;
-        snprintf(irq_str, sizeof(irq_str), "I#%d=%s", ETS_INTERNAL_INTR_SOURCE_OFF + i, esp_isr_names[i]);
+        strcat(itoa(ETS_INTERNAL_INTR_SOURCE_OFF + i, irq_str + 2, 10), "=");
+        strncat(irq_str, esp_isr_names[i], sizeof(irq_str) - strlen(irq_str) - 1);
         SEGGER_SYSVIEW_SendSysDesc(irq_str);
     }
 }

components/app_trace/sys_view/ext/heap_trace_module.c

@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif
 
 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
     .NumEvents = 2,
 };
 

components/bootloader/Kconfig.projbuild

@@ -1134,6 +1134,44 @@ menu "Security features"
 
             If not set, the app does not care if the flash encryption eFuse bit is set or not.
 
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
     config SECURE_ROM_DL_MODE_ENABLED
         bool
         default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT

components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -13,6 +13,7 @@
 #include <spi_flash_mmap.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "bootloader_flash.h"
+#include "soc/ext_mem_defs.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -20,8 +21,11 @@ extern "C" {
 
 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 	0x10000
+
 #define MMAP_ALIGNED_MASK 	(SPI_FLASH_MMU_PAGE_SIZE - 1)
 #define MMU_FLASH_MASK    (~(SPI_FLASH_MMU_PAGE_SIZE - 1))
+#define MMU_FLASH_MASK_FROM_VAL(PAGE_SZ) (~((PAGE_SZ) - 1))
+#define MMU_DROM_END_ENTRY_VADDR_FROM_VAL(PAGE_SZ) (SOC_DRAM_FLASH_ADDRESS_HIGH - (PAGE_SZ))
 
 /**
  * MMU mapping must always be in the unit of a SPI_FLASH_MMU_PAGE_SIZE
@@ -89,7 +93,7 @@ uint32_t bootloader_mmap_get_free_pages(void);
  * @param length - Length of data to map.
  *
  * @return Pointer to mapped data memory (at src_addr), or NULL
- * if an allocation error occured.
+ * if an allocation error occurred.
  */
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size);
 

components/bootloader_support/include/bootloader_memory_utils.h

@@ -28,7 +28,12 @@ extern "C" {
  */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    bool dram_match_iram = (SOC_DRAM_LOW == SOC_IRAM_LOW) &&
+                             (SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+#if SOC_RTC_FAST_MEM_SUPPORTED
+        dram_match_iram &= (SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW);
+#endif
+    return dram_match_iram;
 }
 
 /**
@@ -97,7 +102,7 @@ inline static bool esp_ptr_in_diram_iram(const void *p) {
  */
 __attribute__((always_inline))
 inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
-#if SOC_RTC_FAST_MEM_SUPPORTED
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
     return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
     return false;
@@ -151,6 +156,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }
 
+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM
 
    - Address must be word aligned

components/bootloader_support/include/esp_image_format.h

@@ -34,6 +34,7 @@ typedef struct {
   uint32_t image_len; /* Length of image on flash, in bytes */
   uint8_t image_digest[32]; /* appended SHA-256 digest */
   uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
+  uint32_t mmu_page_size; /* Flash MMU page size per binary header */
 } esp_image_metadata_t;
 
 typedef enum {

components/bootloader_support/src/bootloader_console.c

@@ -74,6 +74,12 @@ void bootloader_console_init(void)
         // Enable the peripheral
         uart_ll_enable_bus_clock(uart_num, true);
         uart_ll_reset_register(uart_num);
+        // Set clock source
+#if SOC_UART_SUPPORT_XTAL_CLK
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_XTAL);
+#else
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_APB);
+#endif
         // Reset TX and RX FIFOs
         uart_ll_txfifo_rst(UART_LL_GET_HW(uart_num));
         uart_ll_rxfifo_rst(UART_LL_GET_HW(uart_num));

components/bootloader_support/src/bootloader_utility.c

@@ -20,6 +20,7 @@
 #include "esp_rom_spiflash.h"
 
 #include "soc/soc.h"
+#include "soc/soc_caps.h"
 #include "soc/rtc.h"
 #include "soc/efuse_periph.h"
 #include "soc/rtc_periph.h"
@@ -66,7 +67,7 @@ static void set_cache_and_start_app(uint32_t drom_addr,
                                     uint32_t irom_addr,
                                     uint32_t irom_load_addr,
                                     uint32_t irom_size,
-                                    uint32_t entry_addr);
+                                    const esp_image_metadata_t *data);
 
 esp_err_t bootloader_common_read_otadata(const esp_partition_pos_t *ota_info, esp_ota_select_entry_t *two_otadata)
 {
@@ -789,7 +790,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                             rom_addr[1],
                             rom_load_addr[1],
                             rom_size[1],
-                            data->image.entry_addr);
+                            data);
 }
 
 #else  //!SOC_MMU_DI_VADDR_SHARED
@@ -834,7 +835,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                             irom_addr,
                             irom_load_addr,
                             irom_size,
-                            data->image.entry_addr);
+                            data);
 }
 #endif  //#if SOC_MMU_DI_VADDR_SHARED
 
@@ -859,9 +860,11 @@ static void set_cache_and_start_app(
     uint32_t irom_addr,
     uint32_t irom_load_addr,
     uint32_t irom_size,
-    uint32_t entry_addr)
+    const esp_image_metadata_t *data)
 {
     int rc __attribute__((unused));
+    const uint32_t entry_addr = data->image.entry_addr;
+    const uint32_t mmu_page_size = data->mmu_page_size;
 
     ESP_EARLY_LOGD(TAG, "configure drom and irom and start");
     //-----------------------Disable Cache to do the mapping---------
@@ -871,12 +874,18 @@ static void set_cache_and_start_app(
 #else
     cache_hal_disable(CACHE_LL_LEVEL_EXT_MEM, CACHE_TYPE_ALL);
 #endif
+
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    // re-configure MMU page size
+    mmu_ll_set_page_size(0, mmu_page_size);
+#endif //SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
     //reset MMU table first
     mmu_hal_unmap_all();
 
     //-----------------------MAP DROM--------------------------
-    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
-    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK;
+    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
     ESP_EARLY_LOGV(TAG, "rodata starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, drom_addr, drom_load_addr, drom_size);
     //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
     drom_size = (drom_load_addr - drom_load_addr_aligned) + drom_size;
@@ -894,13 +903,13 @@ static void set_cache_and_start_app(
         ESP_EARLY_LOGV(TAG, "after mapping rodata, starting from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, drom_load_addr_aligned, actual_mapped_len);
     }
     //we use the MMU_LL_END_DROM_ENTRY_ID mmu entry as a map page for app to find the boot partition
-    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_LL_END_DROM_ENTRY_VADDR, drom_addr_aligned, CONFIG_MMU_PAGE_SIZE, &actual_mapped_len);
+    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_DROM_END_ENTRY_VADDR_FROM_VAL(mmu_page_size), drom_addr_aligned, mmu_page_size, &actual_mapped_len);
     ESP_EARLY_LOGV(TAG, "mapped one page of the rodata, from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, MMU_LL_END_DROM_ENTRY_VADDR, actual_mapped_len);
 #endif
 
     //-----------------------MAP IROM--------------------------
-    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
-    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK;
+    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
     ESP_EARLY_LOGV(TAG, "text starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, irom_addr, irom_load_addr, irom_size);
     //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
     irom_size = (irom_load_addr - irom_load_addr_aligned) + irom_size;

components/bootloader_support/src/esp32h2/bootloader_esp32h2.c

@@ -92,6 +92,8 @@ static inline void bootloader_hardware_init(void)
 
     regi2c_ctrl_ll_master_enable_clock(true);
     regi2c_ctrl_ll_master_configure_clock();
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }
 
 static inline void bootloader_ana_reset_config(void)

components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c

@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"
 
 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
 
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
 
+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
     // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
     // otherwise the Flash Encryption key cannot be read protected

components/bootloader_support/src/esp_image_format.c

@@ -22,6 +22,7 @@
 #include "bootloader_memory_utils.h"
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
+#include "spi_flash_mmap.h"
 
 #define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
@@ -77,7 +78,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
 
 /* Verify a segment header */
-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent);
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent);
 
 /* Log-and-fail macro for use in esp_image_load */
 #define FAIL_LOAD(...) do {                         \
@@ -559,7 +560,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
 
     ESP_LOGV(TAG, "segment data length 0x%"PRIx32" data starts 0x%"PRIx32, data_len, data_addr);
 
-    CHECK_ERR(verify_segment_header(index, header, data_addr, silent));
+    CHECK_ERR(verify_segment_header(index, header, data_addr, metadata, silent));
 
     if (data_len % 4 != 0) {
         FAIL_LOAD("unaligned segment length 0x%"PRIx32, data_len);
@@ -748,7 +749,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
     return ESP_OK;
 }
 
-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent)
 {
     if ((segment->data_len & 3) != 0
             || segment->data_len >= SIXTEEN_MB) {
@@ -761,13 +762,39 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
     uint32_t load_addr = segment->load_addr;
     bool map_segment = should_map(load_addr);
 
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    /* ESP APP descriptor is present in the DROM segment #0 */
+    if (index == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+        const esp_app_desc_t *app_desc = (const esp_app_desc_t *)bootloader_mmap(segment_data_offs, sizeof(esp_app_desc_t));
+        if (!app_desc || app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
+            ESP_LOGE(TAG, "Failed to fetch app description header!");
+            return ESP_FAIL;
+        }
+
+        // Convert from log base 2 number to actual size while handling legacy image case (value 0)
+        metadata->mmu_page_size = (app_desc->mmu_page_size > 0) ? (1UL << app_desc->mmu_page_size) : SPI_FLASH_MMU_PAGE_SIZE;
+        if (metadata->mmu_page_size != SPI_FLASH_MMU_PAGE_SIZE) {
+            ESP_LOGI(TAG, "MMU page size mismatch, configured: 0x%x, found: 0x%"PRIx32, SPI_FLASH_MMU_PAGE_SIZE, metadata->mmu_page_size);
+        }
+        bootloader_munmap(app_desc);
+    } else if (index == 0 && metadata->start_addr == ESP_BOOTLOADER_OFFSET) {
+        // Bootloader always uses the default MMU page size
+        metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#else // SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+#endif // !SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
+    const int mmu_page_size = metadata->mmu_page_size;
+    ESP_LOGV(TAG, "MMU page size 0x%x", mmu_page_size);
+
     /* Check that flash cache mapped segment aligns correctly from flash to its mapped address,
-       relative to the 64KB page mapping size.
+       relative to the MMU page mapping size.
     */
     ESP_LOGV(TAG, "segment %d map_segment %d segment_data_offs 0x%"PRIx32" load_addr 0x%"PRIx32,
              index, map_segment, segment_data_offs, load_addr);
     if (map_segment
-            && ((segment_data_offs % SPI_FLASH_MMU_PAGE_SIZE) != (load_addr % SPI_FLASH_MMU_PAGE_SIZE))) {
+            && ((segment_data_offs % mmu_page_size) != (load_addr % mmu_page_size))) {
         if (!silent) {
             ESP_LOGE(TAG, "Segment %d load address 0x%08"PRIx32", doesn't match data 0x%08"PRIx32,
                      index, load_addr, segment_data_offs);

components/bootloader_support/src/flash_encrypt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"
 
 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@@ -207,6 +210,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32
 
+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
     esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -468,6 +478,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
     }
     result &= secure;
 
+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
     return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32

components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c

@@ -154,13 +154,12 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
     ets_secure_boot_key_digests_t trusted_key_digests = {0};
     bool valid_sig_blk = false;
     for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
         if (sig_block->block[i].version != ESP_SECURE_BOOT_SCHEME) {
             ESP_LOGD(TAG, "%s signing scheme selected but signature block %d generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), i, esp_secure_boot_get_scheme_name(sig_block->block[i].version));
-            continue;
         } else {
             valid_sig_blk = true;
         }
-        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
     }
     if (valid_sig_blk != true) {
         ESP_LOGE(TAG, "No signature block generated for valid scheme");

components/bt/CMakeLists.txt

@@ -24,6 +24,7 @@ set(common_include_dirs
     common/btc/profile/esp/blufi/include
     common/btc/profile/esp/include
     common/hci_log/include
+    common/ble_log/include
 )
 
 set(ble_mesh_include_dirs
@@ -85,8 +86,13 @@ if(CONFIG_BT_ENABLED)
         elseif(CONFIG_IDF_TARGET_ESP32S3)
             list(APPEND ldscripts "linker_rw_bt_controller.lf")
         elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/ble.c")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+                list(APPEND srcs "controller/esp32c2/dummy.c")
+            endif()
             set(ldscripts "linker_esp32c2.lf")
         else()
+            list(APPEND srcs "controller/${target_name}/ble.c")
             list(APPEND ldscripts "linker_esp_ble_controller.lf")
         endif()
 
@@ -127,6 +133,7 @@ if(CONFIG_BT_ENABLED)
          "common/osi/osi.c"
          "common/osi/semaphore.c"
          "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
          )
 
     # Host Bluedroid
@@ -734,6 +741,7 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                 )
 
             if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
@@ -853,6 +861,7 @@ idf_component_register(SRCS "${srcs}"
                        PRIV_INCLUDE_DIRS "${priv_include_dirs}"
                        REQUIRES esp_timer esp_wifi
                        PRIV_REQUIRES nvs_flash soc esp_pm esp_phy esp_coex mbedtls esp_driver_uart vfs esp_ringbuf
+                                     esp_driver_spi esp_driver_gpio
                        LDFRAGMENTS "${ldscripts}")
 
 if(CONFIG_BT_ENABLED)
@@ -865,12 +874,23 @@ if(CONFIG_BT_ENABLED)
     elseif(CONFIG_IDF_TARGET_ESP32C3)
         target_link_directories(${COMPONENT_LIB} INTERFACE
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32c3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
     elseif(CONFIG_IDF_TARGET_ESP32S3)
         target_link_directories(${COMPONENT_LIB} INTERFACE
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
+        endif()
         if(CONFIG_IDF_TARGET_ESP32C6)
             add_prebuilt_library(libble_app
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c6/libble_app.a")
@@ -878,8 +898,13 @@ if(CONFIG_BT_ENABLED)
             add_prebuilt_library(libble_app
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c61/libble_app.a")
         else()
-            add_prebuilt_library(libble_app
-                 "controller/lib_${target_name}/${target_name}-bt-lib/libble_app.a")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
+                add_prebuilt_library(libble_app
+                    "controller/lib_${target_name}/${target_name}-bt-lib/libble_app_flash.a")
+            else()
+                add_prebuilt_library(libble_app
+                    "controller/lib_${target_name}/${target_name}-bt-lib/libble_app.a")
+            endif()
         endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
     endif()

components/bt/common/Kconfig.in

@@ -4,3 +4,58 @@ config BT_ALARM_MAX_NUM
     help
         This option decides the maximum number of alarms which
         could be used by Bluetooth host.
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    int "Number of ble log async SPI output queues"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 4
+    help
+            The number of ble log async SPI output queues
+
+config BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE
+    int "Size of ble log async SPI output transaction buffer size"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2048
+    help
+            The size of ble log async SPI output transaction buffer size
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+            GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+            GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+            GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+            Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+            GPIO number of SYNC IO

components/bt/common/ble_log/ble_log_spi_out.c

@@ -0,0 +1,401 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_spi_out.h"
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+// Private defines
+#define SPI_OUT_BUS SPI2_HOST
+#define SPI_OUT_TAIL 0xAA
+#define SPI_OUT_FLUSHOUT_TIMEOUT (1000 * 1000)
+#define SPI_OUT_TS_SYNC_TIMEOUT (1000 * 1000)
+
+// Private typedefs
+typedef struct spi_out_trans {
+    spi_transaction_t trans;
+    struct spi_out_trans *next;
+} spi_out_trans_t;
+
+// Private variables
+static spi_device_handle_t spi_handle = NULL;
+static spi_out_trans_t *trans_head = NULL;
+static SemaphoreHandle_t mutex_handle = NULL;
+static bool spi_out_inited = false;
+static esp_timer_handle_t flushout_timer_handle = NULL;
+static uint32_t loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static bool sync_io_level = false;
+static esp_timer_handle_t ts_sync_timer_handle = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private function declarations
+static void spi_out_init_trans(void);
+static void spi_out_deinit_trans(void);
+static void spi_out_recycle_trans(uint32_t ms_to_wait);
+static void spi_out_append_trans(void);
+static int spi_out_write(const uint8_t *addr, uint16_t len);
+static void esp_timer_cb_flushout(void);
+static void esp_timer_cb_ts_sync(void);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+extern uint32_t r_ble_lll_timer_current_tick_get(void);
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+extern uint32_t r_os_cputime_get32(void);
+#endif // CONFIG_IDF_TARGET_ESP32C2
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private functions
+static void spi_out_init_trans(void)
+{
+    for (int i = 0; i < CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE; i++) {
+        // Allocate memory for SPI transaction
+        uint8_t *buf = (uint8_t *)spi_bus_dma_memory_alloc(SPI_OUT_BUS, CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE, 0);
+        assert(buf);
+
+        // Initialize new trans
+        spi_out_trans_t *new_trans = (spi_out_trans_t *)malloc(sizeof(spi_out_trans_t));
+        assert(new_trans);
+        memset(new_trans, 0, sizeof(spi_out_trans_t));
+        new_trans->trans.tx_buffer = buf;
+        new_trans->trans.length = 0;
+
+        // Append new trans to free trans list
+        new_trans->next = trans_head;
+        trans_head = new_trans;
+    }
+    return;
+}
+
+static void spi_out_deinit_trans(void)
+{
+    // Wait up to QUEUE_SIZE * 100 ms for all transactions to complete and be recycled
+    spi_out_recycle_trans(100);
+
+    // Release memory
+    spi_out_trans_t *next;
+    while (trans_head != NULL) {
+        next = trans_head->next;
+        free((uint8_t *)trans_head->trans.tx_buffer);
+        free(trans_head);
+        trans_head = next;
+    }
+    trans_head = NULL;
+    return;
+}
+
+// CRITICAL: Do not recycle trans when trans_head is not empty!
+IRAM_ATTR static void spi_out_recycle_trans(uint32_t ms_to_wait)
+{
+    // Try to recycle transaction
+    spi_transaction_t *ret_trans;
+    spi_out_trans_t *recycled_trans;
+    while (ESP_OK == spi_device_get_trans_result(spi_handle, &ret_trans, pdMS_TO_TICKS(ms_to_wait))) {
+        recycled_trans = __containerof(ret_trans, spi_out_trans_t, trans);
+        recycled_trans->next = trans_head;
+        trans_head = recycled_trans;
+        trans_head->trans.length = 0;
+        trans_head->trans.rxlength = 0;
+    }
+}
+
+IRAM_ATTR static void spi_out_append_trans(void)
+{
+    // Stop flushout timer
+    esp_timer_stop(flushout_timer_handle);
+
+    // Transaction head shall not be NULL for appending
+    if (trans_head) {
+        // Detach transaction head
+        spi_out_trans_t *trans_to_append = trans_head;
+        trans_head = trans_head->next;
+        trans_to_append->next = NULL;
+
+        // CRITICAL: Length unit conversion from bytes to bits
+        trans_to_append->trans.length *= 8;
+        ESP_ERROR_CHECK(spi_device_queue_trans(spi_handle, &trans_to_append->trans, 0));
+    }
+
+    // Try to recycle trans
+    spi_out_recycle_trans(0);
+
+    // Restart flushout timer
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+}
+
+IRAM_ATTR static int spi_out_write(const uint8_t *addr, uint16_t len)
+{
+    // Recycle trans if free buffer list is empty
+    if (!trans_head) {
+        spi_out_recycle_trans(0);
+    }
+
+    // Copy user data to buffer
+    uint16_t copy_buf_len;
+    uint16_t data_left_len = len;
+    uint16_t empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE - trans_head->trans.length;
+    while (data_left_len) {
+        // There shall always be available buffer in free buffer list during write operation
+        if (!trans_head) {
+            return -1;
+        }
+
+        // Copy data to buffer and update length
+        copy_buf_len = (data_left_len > empty_buf_len) ? empty_buf_len : data_left_len;
+        memcpy((uint8_t *)trans_head->trans.tx_buffer + trans_head->trans.length, addr + (len - data_left_len), copy_buf_len);
+        trans_head->trans.length += copy_buf_len;
+        data_left_len -= copy_buf_len;
+
+        // If buffer is full, append transaction and reset buffer length
+        if (trans_head->trans.length == CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE) {
+            spi_out_append_trans();
+            empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE;
+        }
+    }
+    return 0;
+}
+
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_flushout(void)
+{
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Flushout
+    if (trans_head) {
+        // Make sure there's enough space for loss frame counter
+        if (trans_head->next && loss_frame_cnt) {
+            ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_LOSS, (uint8_t *)&loss_frame_cnt, sizeof(loss_frame_cnt));
+            loss_frame_cnt = 0;
+        }
+        if (trans_head->trans.length) {
+            spi_out_append_trans();
+        }
+    }
+    else {
+        // Restart flushout timer
+        esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    }
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_ts_sync(void)
+{
+    // Initialize variables
+    uint32_t lc_ts = 0;
+    uint32_t esp_ts = 0;
+
+    // Enter critical
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+    // Get LC timestamp
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+    lc_ts = r_ble_lll_timer_current_tick_get();
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+    lc_ts = r_os_cputime_get32();
+#endif // CONFIG_IDF_TARGET_ESP32C2
+
+    // Toggle Sync IO
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+
+    // Get ESP timestamp
+    esp_ts = esp_timer_get_time();
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    // Exit critical
+
+    // Write timestamp sync log
+    uint8_t sync_frame[9];
+    sync_frame[0] = ((uint8_t)sync_io_level & 0xFF);
+    memcpy(sync_frame + 1, &lc_ts, sizeof(lc_ts));
+    memcpy(sync_frame + 5, &esp_ts, sizeof(esp_ts));
+    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_SYNC, sync_frame, 9);
+
+    // Update IO level
+    sync_io_level = !sync_io_level;
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Public functions
+void ble_log_spi_out_init(void)
+{
+    // Avoid double init
+    if (spi_out_inited) {
+        return;
+    }
+
+    // Initialize mutex
+    mutex_handle = xSemaphoreCreateRecursiveMutex();
+
+    // Initialize SPI
+    spi_bus_config_t bus_config = {
+        .miso_io_num = -1,
+        .mosi_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM,
+        .sclk_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM,
+        .quadwp_io_num = -1,
+        .quadhd_io_num = -1,
+        .max_transfer_sz = 10240
+    };
+    spi_device_interface_config_t dev_config = {
+        .clock_speed_hz = SPI_MASTER_FREQ_20M,
+        .mode = 0,
+        .spics_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_CS_IO_NUM,
+        .queue_size = CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    };
+    ESP_ERROR_CHECK(spi_bus_initialize(SPI_OUT_BUS, &bus_config, SPI_DMA_CH_AUTO));
+    ESP_ERROR_CHECK(spi_bus_add_device(SPI_OUT_BUS, &dev_config, &spi_handle));
+
+    // Initialize transaction link nodes
+    spi_out_init_trans();
+
+    // Initialize flushout timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_flushout,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&timer_args, &flushout_timer_handle));
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Initialize timestamp synchronizer
+    gpio_config_t io_conf = {
+        .intr_type = GPIO_INTR_DISABLE,
+        .mode = GPIO_MODE_OUTPUT,
+        .pin_bit_mask = (1UL << CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM),
+        .pull_down_en = 0,
+        .pull_up_en = 0
+    };
+    ESP_ERROR_CHECK(gpio_config(&io_conf));
+    sync_io_level = false;
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, sync_io_level);
+    esp_timer_create_args_t ts_sync_timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ts_sync,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&ts_sync_timer_args, &ts_sync_timer_handle));
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Set init flag
+    spi_out_inited = true;
+}
+
+void ble_log_spi_out_deinit(void)
+{
+    // Avoid double deinit
+    if (!spi_out_inited) {
+        return;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Deinitialize timestamp synchronizer
+    esp_timer_stop(ts_sync_timer_handle);
+    esp_timer_delete(ts_sync_timer_handle);
+    gpio_reset_pin(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Deinitialize flushout timer
+    esp_timer_stop(flushout_timer_handle);
+    esp_timer_delete(flushout_timer_handle);
+
+    // Deinitialize transaction link nodes
+    spi_out_deinit_trans();
+
+    // Deinitialize SPI
+    ESP_ERROR_CHECK(spi_bus_remove_device(spi_handle));
+    ESP_ERROR_CHECK(spi_bus_free(SPI_OUT_BUS));
+    spi_handle = NULL;
+
+    // Deinitialize mutex
+    vSemaphoreDelete(mutex_handle);
+    mutex_handle = NULL;
+
+    // Reset init flag
+    spi_out_inited = false;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+void ble_log_spi_out_ts_sync_start(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Start timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (!esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_start_periodic(ts_sync_timer_handle, SPI_OUT_TS_SYNC_TIMEOUT);
+        }
+    }
+}
+
+void ble_log_spi_out_ts_sync_stop(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Stop timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_stop(ts_sync_timer_handle);
+        }
+    }
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+IRAM_ATTR void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end)
+{
+    return ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP, addr, len);
+}
+
+IRAM_ATTR void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    // Initialize frame sequence number
+    static uint8_t frame_sn = 0;
+
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Prepare frame head and frame tail
+    const uint8_t head[4] = {len & 0xFF, (len >> 8) & 0xFF, (uint8_t)source, frame_sn};
+    const uint8_t tail = SPI_OUT_TAIL;
+
+    // Write frame head first, then payload, finally frame tail
+    do
+    {
+        if (spi_out_write(head, 4) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(addr, len) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(&tail, 1) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+    } while (0);
+
+    // Update frame sequence number
+    frame_sn++;
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+    return;
+}
+
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -0,0 +1,33 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+
+// Public typedefs
+#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
+#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
+#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
+#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
+#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+
+// Public functions
+void ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+
+#endif // __BT_SPI_OUT_H__

components/bt/common/btc/core/btc_task.c

@@ -382,7 +382,7 @@ static void btc_deinit_mem(void) {
         btc_profile_cb_tab = NULL;
     }
 
-#if (BLE_INCLUDED == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
     if (gl_bta_adv_data_ptr) {
         osi_free(gl_bta_adv_data_ptr);
         gl_bta_adv_data_ptr = NULL;
@@ -392,7 +392,7 @@ static void btc_deinit_mem(void) {
         osi_free(gl_bta_scan_rsp_data_ptr);
         gl_bta_scan_rsp_data_ptr = NULL;
     }
-#endif  ///BLE_INCLUDED == TRUE
+#endif // BLE_42_FEATURE_SUPPORT
 
 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
     if (btc_creat_tab_env_ptr) {
@@ -444,7 +444,8 @@ static bt_status_t btc_init_mem(void) {
     }
     memset((void *)btc_profile_cb_tab, 0, sizeof(void *) * BTC_PID_NUM);
 
-#if (BLE_INCLUDED == TRUE)
+#if BTC_DYNAMIC_MEMORY == TRUE
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
     if ((gl_bta_adv_data_ptr = (tBTA_BLE_ADV_DATA *)osi_malloc(sizeof(tBTA_BLE_ADV_DATA))) == NULL) {
         goto error_exit;
     }
@@ -454,7 +455,8 @@ static bt_status_t btc_init_mem(void) {
         goto error_exit;
     }
     memset((void *)gl_bta_scan_rsp_data_ptr, 0, sizeof(tBTA_BLE_ADV_DATA));
-#endif  ///BLE_INCLUDED == TRUE
+#endif // (BLE_42_FEATURE_SUPPORT == TRUE)
+#endif // BTC_DYNAMIC_MEMORY == TRUE
 
 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
     if ((btc_creat_tab_env_ptr = (esp_btc_creat_tab_t *)osi_malloc(sizeof(esp_btc_creat_tab_t))) == NULL) {

components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         if (p_data->req_data.p_data->write_req.is_prep) {
             tBTA_GATT_STATUS status = GATT_SUCCESS;
 
-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                 if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                 }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);
 
             memset(&rsp, 0, sizeof(tGATTS_RSP));
             rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     uint16_t checksum, checksum_pkt;
     int ret;
 

components/bt/common/btc/profile/esp/blufi/include/blufi_int.h

@@ -36,7 +36,9 @@ typedef struct {
     UINT32                  trans_id;
     UINT8                   congest;
     UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
     uint8_t                 *prepare_buf;
     int                     prepare_len;
     /* Control reference */

components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h

@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a
 
 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -240,6 +240,32 @@ static void init_gatt_values(void)
 
 }
 
+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
     int rc;
@@ -260,6 +286,18 @@ int esp_blufi_gatt_svr_init(void)
     return 0;
 }
 
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
 static int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {

components/bt/common/osi/allocator.c

@@ -241,5 +241,8 @@ void *osi_calloc_func(size_t size)
 
 void osi_free_func(void *ptr)
 {
+#if HEAP_MEMORY_DEBUG
+    osi_mem_dbg_clean(ptr, __func__, __LINE__);
+#endif
     free(ptr);
 }

components/bt/common/osi/include/osi/allocator.h

@@ -29,6 +29,15 @@ void *osi_malloc_func(size_t size);
 void *osi_calloc_func(size_t size);
 void osi_free_func(void *ptr);
 
+// Memory alloc function without print and assertion
+#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
+#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#else
+#define osi_malloc_base(size)             malloc((size))
+#define osi_calloc_base(size)             calloc(1, (size))
+#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
+
 #if HEAP_MEMORY_DEBUG
 
 void osi_mem_dbg_init(void);
@@ -41,13 +50,10 @@ void osi_men_dbg_set_section_start(uint8_t index);
 void osi_men_dbg_set_section_end(uint8_t index);
 uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
 #define osi_malloc(size)                                \
 ({                                                      \
     void *p;                                            \
-    p = heap_caps_malloc_prefer(size, 2,                \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_malloc_base(size);                          \
     osi_mem_dbg_record(p, size, __func__, __LINE__);    \
     (void *)p;                                          \
 })
@@ -55,34 +61,11 @@ uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 #define osi_calloc(size)                                \
 ({                                                      \
     void *p;                                            \
-    p = heap_caps_calloc_prefer(1, size, 2,             \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_calloc_base(size);                          \
     osi_mem_dbg_record(p, size, __func__, __LINE__);    \
     (void *)p;                                          \
 })
 
-#else
-
-#define osi_malloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = malloc((size));                                 \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#define osi_calloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = calloc(1, (size));                              \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
-
 #if 0
 #define osi_malloc(size)                                \
 do {                                                    \
@@ -122,15 +105,6 @@ do {                                                    \
 
 #else
 
-// Memory alloc function without print and assertion
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#else
-#define osi_malloc_base(size)             malloc((size))
-#define osi_calloc_base(size)             calloc(1, (size))
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
 // Memory alloc function with print and assertion when fails
 #define osi_malloc(size)                  osi_malloc_func((size))
 #define osi_calloc(size)                  osi_calloc_func((size))

components/bt/common/osi/include/osi/fixed_pkt_queue.h

@@ -76,4 +76,8 @@ void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
 
 void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif

components/bt/common/osi/pkt_queue.c

@@ -25,6 +25,7 @@ struct pkt_queue *pkt_queue_create(void)
     }
     if (osi_mutex_new(&queue->lock) != 0) {
         osi_free(queue);
+        return NULL;
     }
     struct pkt_queue_header *p = &queue->header;
     STAILQ_INIT(p);

components/bt/controller/esp32/Kconfig.in

@@ -23,6 +23,14 @@ config BTDM_CTRL_BLE_MAX_CONN
         BLE maximum connections of bluetooth controller.
         Each connection uses 1KB static DRAM whenever the BT controller is enabled.
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT
+    int "BR/EDR default minimum size of encryption key"
+    depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 7
+    range 7 16
+    help
+        BR/EDR default minimum size of encryption key when start encryption.
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN
     int "BR/EDR ACL Max Connections"
     depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -177,6 +185,11 @@ config BTDM_CTRL_BLE_MAX_CONN_EFF
     default BTDM_CTRL_BLE_MAX_CONN if BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM
     default 0
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT_EFF
+    int
+    default BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 0
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN_EFF
     int
     default BTDM_CTRL_BR_EDR_MAX_ACL_CONN if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -320,7 +333,7 @@ choice BTDM_BLE_SLEEP_CLOCK_ACCURACY
         needs a larger RX window to synchronize with master in each anchor point, thus resulting in an
         increase of power consumption but a higher level of robustness in keeping connected. According
         to the requirements of Bluetooth Core specification 4.2, the worst-case accuracy of Classic
-        Bluetooth low power oscialltor(LPO) is +/-250ppm in STANDBY and in low power modes such as
+        Bluetooth Low Power Oscillator (LPO) is +/-250ppm in STANDBY and in low power modes such as
         sniff. For BLE the worst-case SCA is +/-500ppm.
 
         - "151ppm to 250ppm" option is the default value for Bluetooth Dual mode
@@ -444,6 +457,15 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
         minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
         scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
 
+config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+
 config BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
     depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
@@ -478,14 +500,14 @@ config BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD
         If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
         may cause adv packets lost more.
 
-menu "BLE disconnect when instant passed"
+menu "BLE disconnects when Instant Passed (0x28) occurs"
     config BTDM_BLE_LLCP_CONN_UPDATE
         bool "BLE ACL connection update procedure"
         depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed during connection update procedure.
+            when Instant Passed (0x28) error occurs during connection update procedure.
 
     config BTDM_BLE_LLCP_CHAN_MAP_UPDATE
         bool "BLE ACL channel map update procedure"
@@ -493,9 +515,35 @@ menu "BLE disconnect when instant passed"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in channel map update procedure.
+            when Instant Passed (0x28) error occurs in channel map update procedure.
 endmenu
 
+config BTDM_BLE_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BTDM_BLE_PING_EN
+    bool "Enable LE Ping procedure"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+config BTDM_CTRL_CONTROLLER_DEBUG_MODE_1
+    visible if 0
+    bool "Enable Bluetooth controller debugging mode 1 (for internal use only)"
+    default n
+    depends on BT_ENABLED
+    help
+        Enables specific debugging features for the Bluetooth controller.
+        This option is strictly for internal debugging purposes and should not be enabled in production environments,
+        as it may impact performance and stability.
+
 config BTDM_RESERVE_DRAM
     hex
     default 0xdb5c if BT_ENABLED

components/bt/controller/esp32/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -48,6 +48,10 @@
 #include "esp_rom_sys.h"
 #include "hli_api.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -249,6 +253,16 @@ extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+extern void bt_stack_enableSecCtrlVsCmd(bool en);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+extern void bt_stack_enableCoexVsCmd(bool en);
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
 /* Local Function Declare
  *********************************************************************
  */
@@ -449,7 +463,11 @@ static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit f
 
 #if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
 // used low power clock
-static DRAM_ATTR uint8_t btdm_lpclk_sel;
+#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL;
+#else
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL;
+#endif /* CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL */
 #endif /* #ifdef CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG */
 
 static DRAM_ATTR QueueHandle_t s_wakeup_req_sem = NULL;
@@ -1345,7 +1363,8 @@ static esp_err_t esp_bt_controller_rom_mem_release(esp_bt_mode_t mode)
 
     //already released
     if (!(mode & btdm_dram_available_region[0].mode)) {
-        return ESP_ERR_INVALID_STATE;
+        ESP_LOGW(BTDM_LOG_TAG, "%s already released, mode %d",__func__, mode);
+        return ESP_OK;
     }
 
     for (int i = 0; i < sizeof(btdm_dram_available_region)/sizeof(btdm_dram_available_region_t); i++) {
@@ -1490,6 +1509,117 @@ static void hli_queue_setup_pinned_to_core(int core_id)
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
+// init low-power control resources
+static esp_err_t btdm_low_power_mode_init(void)
+{
+    esp_err_t err = ESP_OK;
+
+#ifdef CONFIG_PM_ENABLE
+    s_btdm_allow_light_sleep = false;
+#endif
+
+    // set default sleep clock cycle and its fractional bits
+    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        // check whether or not EXT_CRYS is working
+        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
+#ifdef CONFIG_PM_ENABLE
+            s_btdm_allow_light_sleep = true;
+#endif
+        } else {
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
+                    "light sleep mode will not be able to apply when bluetooth is enabled");
+            btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL; // set default value
+        }
+    } else if (btdm_lpclk_sel != ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        assert(0);
+    }
+
+    bool select_src_ret __attribute__((unused));
+    bool set_div_ret __attribute__((unused));
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
+        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
+        set_div_ret = btdm_lpclk_set_div(0);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
+            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
+        assert(btdm_lpcycle_us != 0);
+    }
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
+
+#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
+#else
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+#endif
+
+#ifdef CONFIG_PM_ENABLE
+    if (!s_btdm_allow_light_sleep) {
+        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+            return err;
+        }
+    }
+    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+        return err;
+    }
+    esp_timer_create_args_t create_args = {
+        .callback = btdm_slp_tmr_callback,
+        .arg = NULL,
+        .name = "btSlp"
+    };
+    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
+        return err;
+    }
+
+    s_pm_lock_acquired = true;
+#endif
+
+    return err;
+}
+
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_INITED &&
+            btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return ESP_BT_SLEEP_CLOCK_NONE;
+    }
+    return btdm_lpclk_sel;
+#else
+    return ESP_BT_SLEEP_CLOCK_NONE;
+#endif
+}
+
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (lpclk < ESP_BT_SLEEP_CLOCK_MAIN_XTAL || lpclk > ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (btdm_controller_status == ESP_BT_CONTROLLER_STATUS_INITED ||
+            btdm_controller_status == ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        ESP_LOGW(BTDM_LOG_TAG, "Please set the Bluetooth sleep clock source before Bluetooth initialization");
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    btdm_lpclk_sel = lpclk;
+    return ESP_OK;
+#else
+    return ESP_ERR_NOT_SUPPORTED;
+#endif
+}
+
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 {
     esp_err_t err;
@@ -1552,58 +1682,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     btdm_controller_mem_init();
 
     periph_module_enable(PERIPH_BT_MODULE);
-
-#ifdef CONFIG_PM_ENABLE
-    s_btdm_allow_light_sleep = false;
-#endif
-
-    // set default sleep clock cycle and its fractional bits
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-
-#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
-
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-    // check whether or not EXT_CRYS is working
-    if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32kHz XTAL
-#ifdef CONFIG_PM_ENABLE
-        s_btdm_allow_light_sleep = true;
-#endif
-    } else {
-        ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-    }
-#else
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#endif
-
-    bool select_src_ret __attribute__((unused));
-    bool set_div_ret __attribute__((unused));
-    if (btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
-        set_div_ret = btdm_lpclk_set_div(0);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
-            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
-        assert(btdm_lpcycle_us != 0);
-    }
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
-
-#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
-#else
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-#endif
+    periph_module_reset(PERIPH_BT_MODULE);
 
 #if CONFIG_BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
     sdk_config_set_uart_flow_ctrl_enable(true);
@@ -1611,31 +1690,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     sdk_config_set_uart_flow_ctrl_enable(false);
 #endif
 
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
-            goto error;
-        }
-    }
-    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+    if ((err = btdm_low_power_mode_init()) != ESP_OK) {
+        ESP_LOGE(BTDM_LOG_TAG, "Low power module initialization failed");
         goto error;
     }
-    esp_timer_create_args_t create_args = {
-        .callback = btdm_slp_tmr_callback,
-        .arg = NULL,
-        .name = "btSlp"
-    };
-    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
-        goto error;
-    }
-
-    s_pm_lock_acquired = true;
-#endif
 
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_cfg_mask = btdm_config_mask_load();
 
     err = btdm_controller_init(btdm_cfg_mask, cfg);
@@ -1646,6 +1713,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(true);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(true);
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
@@ -1663,17 +1740,30 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(false);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(false);
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     return ESP_OK;
 }
 
-static void bt_controller_deinit_internal(void)
+// deinit low power control resources
+static void btdm_low_power_mode_deinit(void)
 {
-    periph_module_disable(PERIPH_BT_MODULE);
-
 #ifdef CONFIG_PM_ENABLE
     if (!s_btdm_allow_light_sleep) {
         esp_pm_lock_delete(s_light_sleep_pm_lock);
@@ -1694,6 +1784,16 @@ static void bt_controller_deinit_internal(void)
     s_pm_lock_acquired = false;
 #endif
 
+    btdm_lpcycle_us = 0;
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+}
+
+static void bt_controller_deinit_internal(void)
+{
+    periph_module_disable(PERIPH_BT_MODULE);
+
+    btdm_low_power_mode_deinit();
+
     if (s_wakeup_req_sem) {
         semphr_delete_wrapper(s_wakeup_req_sem);
         s_wakeup_req_sem = NULL;
@@ -1706,9 +1806,6 @@ static void bt_controller_deinit_internal(void)
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
-    btdm_lpcycle_us = 0;
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-
     esp_bt_power_domain_off();
 
     esp_phy_modem_deinit();
@@ -1931,7 +2028,7 @@ esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path)
     return ESP_OK;
 }
 
-esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+esp_err_t esp_ble_scan_duplicate_list_flush(void)
 {
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
@@ -1940,6 +2037,11 @@ esp_err_t esp_ble_scan_dupilcate_list_flush(void)
     return ESP_OK;
 }
 
+esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+{
+    return esp_ble_scan_duplicate_list_flush();
+}
+
 /**
  * This function re-write controller's function,
  * As coredump can not show parameters in function which is in a .a file.

components/bt/controller/esp32c2/Kconfig.in

@@ -109,86 +109,100 @@ menuconfig BT_LE_50_FEATURE_SUPPORT
     help
         Enable BLE 5 feature
 
-config BT_LE_LL_CFG_FEAT_LE_2M_PHY
-    bool "Enable 2M Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable 2M-PHY
-
-config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
-    bool "Enable coded Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable coded-PHY
-
-config BT_LE_EXT_ADV
-    bool "Enable extended advertising"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable this option to do extended advertising. Extended advertising
-        will be supported from BLE 5.0 onwards.
-
-if BT_LE_EXT_ADV
-    config BT_LE_MAX_EXT_ADV_INSTANCES
-        int "Maximum number of extended advertising instances."
-        range 0 4
-        default 1
-        depends on BT_LE_EXT_ADV
-        help
-            Change this option to set maximum number of extended advertising
-            instances. Minimum there is always one instance of
-            advertising. Enter how many more advertising instances you
-            want.
-            Each extended advertising instance will take about 0.5k DRAM.
-
-    config BT_LE_EXT_ADV_MAX_SIZE
-        int "Maximum length of the advertising data."
-        range 0 1650
-        default 1650
-        depends on BT_LE_EXT_ADV
-        help
-            Defines the length of the extended adv data. The value should not
-            exceed 1650.
-
-    config BT_LE_ENABLE_PERIODIC_ADV
-        bool "Enable periodic advertisement."
-        default y
-        depends on BT_LE_EXT_ADV
-        help
-            Enable this option to start periodic advertisement.
-
-    config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
-        bool "Enable Transfer Sync Events"
-        depends on BT_LE_ENABLE_PERIODIC_ADV
+if BT_LE_50_FEATURE_SUPPORT
+    config BT_LE_LL_CFG_FEAT_LE_2M_PHY
+        bool "Enable 2M Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
         default y
         help
-            This enables controller transfer periodic sync events to host
+            Enable 2M-PHY
 
+    config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
+        bool "Enable coded Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable coded-PHY
+
+    config BT_LE_EXT_ADV
+        bool "Enable extended advertising"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable this option to do extended advertising. Extended advertising
+            will be supported from BLE 5.0 onwards.
+
+    if BT_LE_EXT_ADV
+        config BT_LE_MAX_EXT_ADV_INSTANCES
+            int "Maximum number of extended advertising instances."
+            range 0 4
+            default 1
+            depends on BT_LE_EXT_ADV
+            help
+                Change this option to set maximum number of extended advertising
+                instances. Minimum there is always one instance of
+                advertising. Enter how many more advertising instances you
+                want.
+                Each extended advertising instance will take about 0.5k DRAM.
+
+        config BT_LE_EXT_ADV_MAX_SIZE
+            int "Maximum length of the advertising data."
+            range 0 1650
+            default 1650
+            depends on BT_LE_EXT_ADV
+            help
+                Defines the length of the extended adv data. The value should not
+                exceed 1650.
+
+        config BT_LE_ENABLE_PERIODIC_ADV
+            bool "Enable periodic advertisement."
+            default y
+            depends on BT_LE_EXT_ADV
+            help
+                Enable this option to start periodic advertisement.
+
+        config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
+            bool "Enable Transfer Sync Events"
+            depends on BT_LE_ENABLE_PERIODIC_ADV
+            default y
+            help
+                This enables controller transfer periodic sync events to host
+    endif
+
+    config BT_LE_EXT_SCAN
+        bool "Enable extended scanning"
+        depends on BT_LE_50_FEATURE_SUPPORT && BT_LE_ROLE_OBSERVER_ENABLE
+        default y
+        help
+            Enable this option to do extended scanning.
+
+    config BT_LE_ENABLE_PERIODIC_SYNC
+        bool "Enable periodic sync"
+        default y
+        depends on BT_LE_EXT_SCAN
+        help
+            Enable this option to receive periodic advertisement.
+
+    if BT_LE_ENABLE_PERIODIC_SYNC
+        config BT_LE_MAX_PERIODIC_SYNCS
+            int "Maximum number of periodic advertising syncs"
+            range 0 3
+            default 1 if BT_LE_ENABLE_PERIODIC_ADV
+            default 0
+            help
+                Set this option to set the upper limit for number of periodic sync
+                connections. This should be less than maximum connections allowed by
+                controller.
+
+        config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
+            int "Maximum number of periodic advertiser list"
+            range 1 5
+            default 5
+            help
+                Set this option to set the upper limit for number of periodic advertiser list.
+    endif
 endif
 
-config BT_LE_MAX_PERIODIC_SYNCS
-    int "Maximum number of periodic advertising syncs"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-
-    range 0 3
-    default 1 if BT_LE_ENABLE_PERIODIC_ADV
-    default 0
-    help
-        Set this option to set the upper limit for number of periodic sync
-        connections. This should be less than maximum connections allowed by
-        controller.
-
-config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
-    int "Maximum number of periodic advertiser list"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-    range 1 5
-    default 5
-    help
-        Set this option to set the upper limit for number of periodic advertiser list.
-
 menu "Memory Settings"
     depends on !BT_NIMBLE_ENABLED
 
@@ -294,6 +308,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -333,6 +356,19 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -523,6 +559,10 @@ config BT_LE_TX_CCA_ENABLED
     help
         Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
 
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
+
 config BT_LE_CCA_RSSI_THRESH
     int "CCA RSSI threshold value"
     depends on BT_LE_TX_CCA_ENABLED
@@ -531,6 +571,10 @@ config BT_LE_CCA_RSSI_THRESH
     help
         Power threshold of CCA in unit of -1 dBm.
 
+config BT_LE_FEAT_LL_ENCRYPTION
+    bool "Enable controller ACL encryption"
+    default y
+
 config BT_LE_ROLE_CENTROL_ENABLE
     bool "Enable BLE Centrol role function"
     depends on !BT_NIMBLE_ENABLED
@@ -617,3 +661,31 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+        - Only one Tx-Rx can be performed in each connection interval. Therefore, reduce the connection interval
+          as much as possible to improve the throughput. If you want higher connection performance, you can
+          enable BT_LE_PLACE_CONN_RELATED_INTO_IRAM to put the connection-related code into iram.
+        - For HCI_LE_Extended_Create_Connection command, only 1M phy's connection parameters will be applied.
+          Other phys' will be ignored.
+        - For extended scanning, we may be unable to receive the extended adv with 300us MAFS.
+
+config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
+    bool "Place the connection-related code into IRAM"
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    default n
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c2/ble.c

@@ -0,0 +1,58 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+#if DEFAULT_BT_LE_ROLE_BROADCASTER
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if DEFAULT_BT_LE_ROLE_OBSERVER
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_OBSERVER
+
+    chanSel_stack_enableSetCsaVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_enable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+}

components/bt/controller/esp32c2/ble_priv.h

@@ -0,0 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef _BLE_PRIV_H_
+#define _BLE_PRIV_H_
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);
+
+#endif // _BLE_PRIV_H_

components/bt/controller/esp32c2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -64,6 +65,12 @@
 #include "hal/efuse_ll.h"
 #include "soc/rtc.h"
 
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -156,6 +163,10 @@ extern int ble_get_npl_element_info(esp_bt_controller_config_t *cfg, ble_npl_cou
 extern void bt_track_pll_cap(void);
 extern char *ble_controller_get_compile_version(void);
 extern const char *r_ble_controller_get_rom_compile_version(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void ble_ll_supported_features_init(void);
+#endif //CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
 #if CONFIG_BT_RELEASE_IRAM
 extern uint32_t _iram_bt_text_start;
 extern uint32_t _bss_bt_end;
@@ -195,6 +206,9 @@ static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 /* Local variable definition
  ***************************************************************************
  */
+#if (CONFIG_ESP32C2_REV_MIN_FULL < 200) && (!CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+void *g_ble_lll_rfmgmt_env_p;
+#endif
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -203,6 +217,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -211,6 +226,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -258,6 +275,13 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
@@ -273,6 +297,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -430,6 +457,21 @@ void esp_ble_controller_log_dump_all(bool output)
         portEXIT_CRITICAL_SAFE(&spinlock);
     }
 }
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -442,6 +484,17 @@ static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_
 
 #define BLE_RTC_DELAY_US                    (1800)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -534,7 +587,12 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler, void *arg, void **ret_handle_in)
 {
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
     int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
+
     return rc;
 }
 
@@ -743,6 +801,8 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         return ret;
     }
 
+    /* If we place the ble code into flash, don't need to initialize ROM. */
+#if !CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if DEFAULT_BT_LE_50_FEATURE_SUPPORT || DEFAULT_BT_LE_ROLE_CENTROL || DEFAULT_BT_LE_ROLE_OBSERVER
     extern int esp_ble_rom_func_ptr_init_all(void);
     esp_ble_rom_func_ptr_init_all();
@@ -751,6 +811,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     extern int esp_ble_rom_func_ptr_init_legacy_adv_and_slave(void);
     esp_ble_rom_func_ptr_init_legacy_adv_and_slave();
 #endif
+#endif //!CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 
     /* Initialize the function pointers for OS porting */
     npl_freertos_funcs_init();
@@ -800,6 +861,11 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
 #endif
+
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    ble_ll_supported_features_init();
+#endif //CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
     ret = ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
@@ -934,6 +1000,12 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -943,6 +1015,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -965,7 +1038,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
-
+    ble_stack_disable();
     if (s_ble_active) {
         esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
@@ -1116,12 +1189,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1148,9 +1229,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1173,11 +1258,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1206,9 +1295,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32c2/dummy.c

@@ -0,0 +1,320 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_bt_cfg.h"
+
+#define BLE_ERR_UNKNOWN_HCI_CMD         (0x01)
+/* LL Features */
+#define BLE_LL_FEAT_LE_ENCRYPTION       (0x0000000001)
+#define BLE_LL_FEAT_CONN_PARM_REQ       (0x0000000002)
+#define BLE_LL_FEAT_EXTENDED_REJ        (0x0000000004)
+#define BLE_LL_FEAT_PERIPH_INIT         (0x0000000008)
+#define BLE_LL_FEAT_LE_PING             (0x0000000010)
+#define BLE_LL_FEAT_DATA_LEN_EXT        (0x0000000020)
+#define BLE_LL_FEAT_LL_PRIVACY          (0x0000000040)
+#define BLE_LL_FEAT_EXT_SCAN_FILT       (0x0000000080)
+#define BLE_LL_FEAT_LE_2M_PHY           (0x0000000100)
+#define BLE_LL_FEAT_STABLE_MOD_ID_TX    (0x0000000200)
+#define BLE_LL_FEAT_STABLE_MOD_ID_RX    (0x0000000400)
+#define BLE_LL_FEAT_LE_CODED_PHY        (0x0000000800)
+#define BLE_LL_FEAT_EXT_ADV             (0x0000001000)
+#define BLE_LL_FEAT_PERIODIC_ADV        (0x0000002000)
+#define BLE_LL_FEAT_CSA2                (0x0000004000)
+#define BLE_LL_FEAT_LE_POWER_CLASS_1    (0x0000008000)
+#define BLE_LL_FEAT_MIN_USED_CHAN       (0x0000010000)
+#define BLE_LL_FEAT_CTE_REQ             (0x0000020000)
+#define BLE_LL_FEAT_CTE_RSP             (0x0000040000)
+#define BLE_LL_FEAT_CTE_TX              (0x0000080000)
+#define BLE_LL_FEAT_CTE_RX              (0x0000100000)
+#define BLE_LL_FEAT_CTE_AOD             (0x0000200000)
+#define BLE_LL_FEAT_CTE_AOA             (0x0000400000)
+#define BLE_LL_FEAT_CTE_RECV            (0x0000800000)
+#define BLE_LL_FEAT_SYNC_TRANS_SEND     (0x0001000000)
+#define BLE_LL_FEAT_SYNC_TRANS_RECV     (0x0002000000)
+#define BLE_LL_FEAT_SCA_UPDATE          (0x0004000000)
+#define BLE_LL_FEAT_REM_PKEY            (0x0008000000)
+#define BLE_LL_FEAT_CIS_CENTRAL         (0x0010000000)
+#define BLE_LL_FEAT_CIS_PERIPH          (0x0020000000)
+#define BLE_LL_FEAT_ISO_BROADCASTER     (0x0040000000)
+#define BLE_LL_FEAT_SYNC_RECV           (0x0080000000)
+#define BLE_LL_FEAT_CIS_HOST            (0x0100000000)
+#define BLE_LL_FEAT_POWER_CTRL_REQ      (0x0200000000)
+#define BLE_LL_FEAT_POWER_CHANGE_IND    (0x0400000000)
+#define BLE_LL_FEAT_PATH_LOSS_MON       (0x0800000000)
+#define BLE_LL_FEAT_PERIODIC_ADV_ADI    (0x1000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING      (0x2000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING_HOST (0x4000000000)
+#define BLE_LL_FEAT_CHANNEL_CLASS       (0x8000000000)
+
+uint64_t ble_ll_supported_features;
+
+void
+ble_ll_supported_features_init(void)
+{
+    ble_ll_supported_features = BLE_LL_FEAT_EXTENDED_REJ;
+    ble_ll_supported_features |= BLE_LL_FEAT_DATA_LEN_EXT;
+
+#if DEFAULT_BT_LE_ROLE_CENTROL || DEFAULT_BT_LE_ROLE_PERIPHERAL
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIPH_INIT;
+    ble_ll_supported_features |= BLE_LL_FEAT_CONN_PARM_REQ;
+#endif
+
+#if CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_ENCRYPTION;
+#endif
+
+    ble_ll_supported_features |= (BLE_LL_FEAT_LL_PRIVACY | BLE_LL_FEAT_EXT_SCAN_FILT);
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_PING;
+
+#if DEFAULT_BT_LE_EXT_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_EXT_ADV;
+#endif
+
+#if DEFAULT_BT_LE_PERIODIC_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV;
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV_ADI;
+#endif
+
+#if DEFAULT_BT_LE_PAST
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_RECV;
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_SEND;
+#endif
+
+#if DEGAULT_BT_LE_2M_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_2M_PHY;
+#endif
+
+#if DEGAULT_BT_LE_CODED_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_CODED_PHY;
+#endif
+
+#if DEFAULT_BT_LE_50_FEATURE_SUPPORT
+    ble_ll_supported_features |= BLE_LL_FEAT_CSA2;
+    ble_ll_supported_features |= BLE_LL_FEAT_SCA_UPDATE;
+    ble_ll_supported_features |= BLE_LL_FEAT_REM_PKEY;
+    ble_ll_supported_features |= BLE_LL_FEAT_CHANNEL_CLASS;
+#endif
+}
+
+#if !DEFAULT_BT_LE_ROLE_BROADCASTER
+void r_ble_ll_adv_rpa_timeout(void) { }
+void r_ble_lll_adv_halt(void) { }
+void r_ble_lll_adv_event_rmvd_from_sched(void) { }
+void r_ble_lll_adv_ext_event_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_enabled(void) { return 0; }
+int  r_ble_ll_adv_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_adv_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+void r_ble_ll_adv_reset(void) { }
+void r_ble_ll_adv_init(void) { }
+void r_ble_ll_adv_deinit(void) { }
+int  r_ble_ll_adv_env_init(void) { return 0; }
+void r_ble_ll_adv_env_deinit(void) { }
+int  r_ble_lll_adv_rx_pkt_isr(void) { return -1; }
+void r_ble_ll_adv_rx_pkt_in(void) { }
+int  r_ble_ll_adv_set_adv_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_read_txpwr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_scan_rsp_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_adv_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_vendor_hci_legacy_adv_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_set_data_related_addr_change(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif // !DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if !DEFAULT_BT_LE_EXT_ADV
+bool r_ble_ll_adv_ext_check_data_itvl(void) { return true; }
+void r_ble_lll_adv_coex_dpc_update_on_aux_scheduled(void) { }
+void r_ble_lll_adv_coex_dpc_calc_pti_update_itvl(void) { }
+void r_ble_lll_adv_sec_done(void) { }
+int r_ble_lll_adv_sec_schedule_next_aux(void) { return 0; }
+void r_ble_lll_adv_sec_event_done(void) { }
+int  r_ble_lll_adv_secondary_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_aux_schedule(void) { }
+void r_ble_lll_adv_update_rsp_offset(void) { }
+int  r_ble_ll_adv_hci_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_scan_rsp(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_max_adv_data_len(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_sup_adv_sets(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_clear_all(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_ADV
+
+#if !DEFAULT_BT_LE_PERIODIC_ADV
+void r_ble_ll_adv_sm_stop_periodic(void) { }
+void r_ble_lll_adv_periodic_event_done(void) { }
+int  r_ble_lll_adv_sync_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_sync_tx_end(void) { }
+int  r_ble_lll_adv_periodic_start(void) { return 0; }
+void r_ble_lll_adv_periodic_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_periodic_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_set_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_ROLE_OBSERVER
+void r_ble_lll_scan_halt(void) { }
+void r_ble_ll_scan_end_adv_evt(void) { }
+void r_ble_ll_scan_rx_pkt_in(void) { }
+int  r_ble_lll_scan_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_scan_env_init(void) { return 0; }
+void r_ble_ll_scan_env_deinit(void) {  }
+void r_ble_ll_scan_init(void) { }
+void r_ble_ll_scan_deinit(void) { }
+void r_ble_ll_scan_reset(void) { }
+int  r_ble_ll_scan_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_scan_enabled(void) { return false; }
+int  r_ble_lll_scan_chk_resume(void) { return -1; }
+int  r_ble_ll_scan_set_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_update_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_set_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_OBSERVER
+
+#if !DEFAULT_BT_LE_EXT_SCAN
+void r_ble_lll_scan_duration_period_timers_restart(void) { }
+void r_ble_lll_scan_duration_period_timers_stop(void) { }
+int r_ble_ll_hci_send_legacy_ext_adv_report(void) { return -1; }
+void r_ble_lll_sched_rmv_elem_type(void) { }
+void r_ble_ll_scan_send_truncated(void) { }
+void r_ble_ll_scan_aux_data_unref(void) { }
+void r_ble_lll_scan_sched_remove(void) { }
+void r_ble_lll_scan_aux_data_free(void) { }
+void r_ble_lll_aux_scan_drop(void) { }
+int r_ble_lll_sched_aux_scan(void) { return -1; }
+int r_ble_lll_scan_rx_isr_on_aux(void) { return -1; }
+void r_ble_lll_scan_period_timer_cb(void) { }
+void r_ble_lll_scan_duration_timer_cb(void) { }
+void r_ble_ll_scan_rx_pkt_in_on_aux(void) { }
+int  r_ble_ll_set_ext_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_ext_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL
+void r_ble_ll_init_rx_pkt_in(void) { }
+int  r_ble_lll_init_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_create_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+int  r_ble_ll_ext_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL
+int r_ble_ll_conn_slave_start(void) { return 0; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+void r_ble_ll_conn_rx_data_pdu(void) { }
+int  r_ble_lll_conn_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_hci_disconnect(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_rem_ver_cmd(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_update(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_chan_map(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_read_rem_features(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_rr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_nrr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+int r_ble_ll_conn_chk_phy_upd_start(void) { return -1; }
+void r_ble_ll_hci_ev_encrypt_chg(void) { }
+int r_ble_ll_ctrl_enc_allowed_pdu_rx(void) { return 1; }
+int r_ble_ll_ctrl_enc_allowed_pdu_tx(void) { return 1; }
+uint8_t r_ble_ll_ctrl_rx_start_enc_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_pause_enc_rsp(void) { return 0x07; }
+int  r_ble_ll_hci_le_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_pause_enc_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_enc_req(void) { return 0x07; }
+int r_ble_ll_conn_hci_le_ltk_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int r_ble_ll_conn_hci_le_ltk_neg_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_start_enc_req(void) { return 0x07; }
+void r_ble_ll_ctrl_rx_enc_rsp(void) { }
+void r_ble_ll_ctrl_enc_req_make(void) { }
+int r_ble_ll_conn_hci_le_start_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEGAULT_BT_LE_2M_PHY && !DEGAULT_BT_LE_CODED_PHY
+void r_ble_ll_ctrl_phy_update_proc_complete(void) { }
+void r_ble_ll_ctrl_phy_update_cancel(void) { }
+uint8_t r_ble_ll_ctrl_rx_phy_update_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_req(void) { return 0x07; }
+void r_ble_ll_ctrl_phy_req_rsp_make(void) { }
+#endif //DEGAULT_BT_LE_2M_PHY && DEGAULT_BT_LE_CODED_PHY
+
+#if !DEFAULT_BT_LE_PERIODIC_SYNC
+void r_ble_lll_sync_halt(void) { }
+void r_ble_lll_sync_rmvd_from_sched(void) { }
+int  r_ble_ll_sync_list_search(void) { return -1; }
+uint8_t r_ble_ll_ctrl_rx_periodic_sync_ind(void) { return 0x07; }
+void r_ble_ll_sync_rx_pkt_in(void) {  }
+int  r_ble_lll_sync_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_sync_env_init(void) { return 0; }
+void r_ble_ll_sync_env_deinit(void) {  }
+void r_ble_ll_sync_init(void) {  }
+void r_ble_ll_sync_deinit(void) {  }
+void r_ble_ll_sync_reset(void) {  }
+bool r_ble_ll_sync_enabled(void) { return false; }
+int  r_ble_ll_sync_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_terminate(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_add(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_size(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_receive_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+int  r_ble_ll_adv_periodic_set_info_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+int  r_ble_ll_sync_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_default_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+uint8_t r_ble_ll_ctrl_rx_channel_reporting_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_channel_status_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_rsp(void) { return 0x07; }
+void r_ble_ll_ctrl_channel_class_reporting_make(void) { }
+void r_ble_ll_ctrl_channel_class_enable_make(void) { }
+void r_ble_ll_ctrl_sca_req_rsp_make(void) { }
+int  r_ble_ll_modify_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_req_peer_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+int  r_ble_ll_conn_hci_le_rd_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_le_set_def_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_le_set_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !CONFIG_BT_LE_DTM_ENABLED
+void r_ble_lll_dtm_rx_pkt_in(void) {  }
+int  r_ble_lll_dtm_rx_isr_end(void) { return -1; }
+void r_ble_lll_dtm_reset(void) { }
+void r_ble_lll_dtm_init(void) { }
+void r_ble_lll_dtm_deinit(void) { }
+int  r_ble_lll_dtm_env_init(void) { return 0; }
+void r_ble_lll_dtm_env_deinit(void) { }
+int  r_ble_lll_hci_dtm_tx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_dtm_end_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_tx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_DTM_ENABLED

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -45,6 +45,14 @@ extern "C" {
     #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
     #endif
 
+    #define DEGAULT_BT_LE_2M_PHY                         (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_2M_PHY)
+    #define DEGAULT_BT_LE_CODED_PHY                      (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_CODED_PHY)
+    #define DEFAULT_BT_LE_EXT_ADV                        (CONFIG_BT_NIMBLE_EXT_ADV)
+    #define DEFAULT_BT_LE_PERIODIC_ADV                   (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_ADV)
+    #define DEFAULT_BT_LE_EXT_SCAN                       (CONFIG_BT_NIMBLE_EXT_SCAN)
+    #define DEFAULT_BT_LE_PERIODIC_SYNC                  (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_SYNC)
+    #define DEFAULT_BT_LE_PAST                           (CONFIG_BT_NIMBLE_PERIODIC_ADV_SYNC_TRANSFER)
+
     #define DEFAULT_BT_LE_ROLE_OBSERVER                  MYNEWT_VAL(BLE_ROLE_OBSERVER)
     #define DEFAULT_BT_LE_ROLE_CENTROL                   MYNEWT_VAL(BLE_ROLE_CENTRAL)
     #define DEFAULT_BT_LE_ROLE_PERIPHERAL                MYNEWT_VAL(BLE_ROLE_PERIPHERAL)
@@ -122,12 +130,55 @@ extern "C" {
     #else
         #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT (8)
     #endif
+
     #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
         #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
     #else
         #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
     #endif
 
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+        #define DEGAULT_BT_LE_2M_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+    #else
+        #define DEGAULT_BT_LE_2M_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+        #define DEGAULT_BT_LE_CODED_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+    #else
+        #define DEGAULT_BT_LE_CODED_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_ADV)
+        #define DEFAULT_BT_LE_EXT_ADV       (CONFIG_BT_LE_EXT_ADV)
+    #else
+        #define DEFAULT_BT_LE_EXT_ADV       (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_SCAN)
+        #define DEFAULT_BT_LE_EXT_SCAN      (CONFIG_BT_LE_EXT_SCAN)
+    #else
+        #define DEFAULT_BT_LE_EXT_SCAN      (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (0)
+    #endif
+
+    #if defined(BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+        #define DEFAULT_BT_LE_PAST          (BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+    #else
+        #define DEFAULT_BT_LE_PAST          (0)
+    #endif
+
     #if defined(CONFIG_BT_LE_ROLE_CENTROL_ENABLE)
         #define DEFAULT_BT_LE_ROLE_CENTROL (1)
     #else
@@ -169,12 +220,24 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/controller/esp32c3/Kconfig.in

@@ -66,7 +66,7 @@ endchoice
 config BT_CTRL_HCI_TL
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
     help
         HCI mode as VHCI or UART(H4)
@@ -76,7 +76,7 @@ config BT_CTRL_ADV_DUP_FILT_MAX
     range 1 500
     default 30
     help
-        The maximum number of suplicate scan filter
+        The maximum number of 5.0 extend duplicate
 
 choice BT_BLE_CCA_MODE
     prompt "BLE CCA mode"
@@ -226,6 +226,7 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
+    depends on (!BT_CTRL_RUN_IN_FLASH_ONLY) || (BT_CTRL_RUN_IN_FLASH_ONLY && BT_CTRL_BLE_SCAN)
     default y
     help
         The function is mainly used to enable flow control for advertising reports. When it is enabled,
@@ -444,7 +445,7 @@ config BT_CTRL_SLEEP_CLOCK_EFF
 config BT_CTRL_HCI_TL_EFF
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
 
 config BT_CTRL_AGC_RECORRECT_EN
@@ -490,25 +491,68 @@ config BT_CTRL_LE_PING_EN
         If this option is disabled, The Controller will not start the LE authenticated payload timer.
         This option is used for some compatibility problems related to LE ping procedure.
 
-menu "BLE disconnect when instant passed"
+menu "BLE disconnects when Instant Passed (0x28) occurs"
     config BT_CTRL_BLE_LLCP_CONN_UPDATE
         bool "BLE ACL connection update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed during connection update procedure.
+            when Instant Passed (0x28) error occurs during connection update procedure.
 
     config BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE
         bool "BLE ACL channel map update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in channel map update procedure.
+            when Instant Passed (0x28) error occurs in channel map update procedure.
 
     config BT_CTRL_BLE_LLCP_PHY_UPDATE
         bool "BLE ACL PHY update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in PHY update procedure.
+            when Instant Passed (0x28) error occurs in PHY update procedure.
 endmenu
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Put all BLE Controller code in flash"
+    default n
+    help
+        If this option is enabled, all code for the Bluetooth controller will be moved from ROM and IRAM
+        to flash, saving over 20K bytes of memory. However, it will require more flash resources and the
+        performance of Bluetooth will decrease If this option is enabled, Bluetooth may not work properly
+        during erasing flash. It is recommended to turn on the auto suspend function of flash. After auto
+        suspend is turned on, Bluetooth interrupts can be executed normally during erasing flash, with less
+        impact on Bluetooth performance.
+
+config BT_CTRL_DTM_ENABLE
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable direct test mode feature"
+    default n
+
+config BT_CTRL_BLE_MASTER
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE master role feature"
+    default y
+
+config BT_CTRL_BLE_TEST
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE QA test feature"
+    default n
+
+config BT_CTRL_BLE_SCAN
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE scan feature"
+    default y
+
+config BT_CTRL_BLE_SECURITY_ENABLE
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_CONTROLLER_ONLY
+    bool "Enable BLE security feature"
+    default y
+
+config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -49,6 +49,9 @@
 #else //CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/rom_layout.h"
 #endif
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -260,7 +263,6 @@ extern int API_vhci_host_register_callback(const vhci_host_callback_t *callback)
 extern int ble_txpwr_set(int power_type, uint16_t handle, int power_level);
 extern int ble_txpwr_get(int power_type, uint16_t handle);
 
-extern uint16_t l2c_ble_link_get_tx_buf_num(void);
 extern void coex_pti_v2(void);
 
 extern bool btdm_deep_sleep_mem_init(void);
@@ -276,6 +278,14 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
 #endif
 
 extern void btdm_cca_feature_enable(void);
+extern void btdm_aa_check_enhance_enable(void);
+
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+extern void chanSel_stack_enableSetCsaVsCmd(bool en);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
 
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
@@ -499,7 +509,11 @@ static int interrupt_alloc_wrapper(int cpu_id, int source, intr_handler_t handle
 {
     btdm_isr_alloc_t p;
     p.source = source;
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    p.flags = ESP_INTR_FLAG_LEVEL3;
+#else
     p.flags = ESP_INTR_FLAG_LEVEL3 | ESP_INTR_FLAG_IRAM;
+#endif
     p.fn = handler;
     p.arg = arg;
     p.handle = (intr_handle_t *)ret_handle;
@@ -961,6 +975,9 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BT_BLE_CCA_MODE == 2
     btdm_cca_feature_enable();
 #endif
+#if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 bool bt_async_wakeup_request(void)
@@ -1426,6 +1443,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     ESP_LOGI(BT_LOG_TAG, "BT controller compile version [%s]", btdm_controller_get_compile_version());
 
+#if (CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+    ESP_LOGI(BT_LOG_TAG,"Put all controller code in flash");
+#endif
+
     if ((err = btdm_low_power_mode_init(cfg)) != ESP_OK) {
         ESP_LOGE(BT_LOG_TAG, "Low power module initialization failed");
         goto error;
@@ -1435,6 +1456,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
@@ -1446,6 +1471,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+    chanSel_stack_enableSetCsaVsCmd(true);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
@@ -1463,6 +1495,17 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+    chanSel_stack_enableSetCsaVsCmd(false);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();
@@ -1869,11 +1912,6 @@ int IRAM_ATTR esp_bt_h4tl_eif_io_event_notify(int event)
     return btdm_hci_tl_io_event_post(event);
 }
 
-uint16_t esp_bt_get_tx_buf_num(void)
-{
-    return l2c_ble_link_get_tx_buf_num();
-}
-
 static void coex_wifi_sleep_set_hook(bool sleep)
 {
 

components/bt/controller/esp32c5/Kconfig.in

@@ -283,54 +283,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Store ble controller logs to flash memory.
+
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -477,6 +544,7 @@ config BT_LE_USE_ESP_TIMER
     help
         Set this option to use Esp Timer which has higher priority timer
         instead of FreeRTOS timer
+
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
     default y
@@ -575,3 +643,134 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
 config BT_LE_MSYS_INIT_IN_CONTROLLER
     bool "Msys Mbuf Init in Controller"
     default y
+
+config BT_LE_TX_CCA_ENABLED
+    bool "Enable TX CCA feature"
+    default n
+    help
+        Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
+
+config BT_LE_CCA_RSSI_THRESH
+    int "CCA RSSI threshold value"
+    depends on BT_LE_TX_CCA_ENABLED
+    range 20 100
+    default 20
+    help
+        Power threshold of CCA in unit of -1 dBm.
+
+choice BT_LE_DFT_TX_POWER_LEVEL_DBM
+    prompt "BLE default Tx power level(dBm)"
+    default BT_LE_DFT_TX_POWER_LEVEL_P9
+    help
+        Specify default Tx power level(dBm).
+    config BT_LE_DFT_TX_POWER_LEVEL_N24
+        bool "-24dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N21
+        bool "-21dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N18
+        bool "-18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N15
+        bool "-15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N12
+        bool "-12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N9
+        bool "-9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N6
+        bool "-6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N3
+        bool "-3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N0
+        bool "0dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P3
+        bool "+3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P6
+        bool "+6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P9
+        bool "+9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P12
+        bool "+12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P15
+        bool "+15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P18
+        bool "+18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
+endchoice
+
+config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
+    int
+    default -15 if BT_LE_DFT_TX_POWER_LEVEL_N15
+    default -12 if BT_LE_DFT_TX_POWER_LEVEL_N12
+    default -9 if BT_LE_DFT_TX_POWER_LEVEL_N9
+    default -6 if BT_LE_DFT_TX_POWER_LEVEL_N6
+    default -3 if BT_LE_DFT_TX_POWER_LEVEL_N3
+    default 0 if BT_LE_DFT_TX_POWER_LEVEL_N0
+    default 3 if BT_LE_DFT_TX_POWER_LEVEL_P3
+    default 6 if BT_LE_DFT_TX_POWER_LEVEL_P6
+    default 9 if BT_LE_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_LE_DFT_TX_POWER_LEVEL_P12
+    default 15 if BT_LE_DFT_TX_POWER_LEVEL_P15
+    default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
+    default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
+    default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32c5/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32c5/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32c5/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -34,6 +34,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -104,12 +105,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -127,6 +131,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -170,6 +178,9 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
+#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
@@ -178,6 +189,224 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
+enum log_out_mode {
+    LOG_DUMP_MEMORY,
+    LOG_ASYNC_OUT,
+    LOG_STORAGE_TO_FLASH,
+};
+
+bool log_is_inited = false;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+uint8_t log_output_mode = LOG_DUMP_MEMORY;
+#else
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#else
+uint8_t log_output_mode = LOG_ASYNC_OUT;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+
+void esp_bt_log_output_mode_set(uint8_t output_mode)
+{
+    log_output_mode = output_mode;
+}
+
+uint8_t esp_bt_log_output_mode_get(void)
+{
+    return log_output_mode;
+}
+
+esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
+{
+    esp_err_t ret = ESP_OK;
+    interface_func_t bt_controller_log_interface;
+    bt_controller_log_interface = esp_bt_controller_log_interface;
+    bool task_create;
+    uint8_t buffers = 0;
+
+    if (log_is_inited) {
+        return ret;
+    }
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_HCI;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+
+    switch (log_output_mode) {
+        case LOG_DUMP_MEMORY:
+            task_create = false;
+            break;
+        case LOG_ASYNC_OUT:
+        case LOG_STORAGE_TO_FLASH:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+                esp_bt_ctrl_log_partition_get_and_erase_first_block();
+            }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+            break;
+        default:
+            assert(0);
+    }
+
+    ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
+    if (ret == ESP_OK) {
+        log_is_inited = true;
+    }
+    return ret;
+}
+
+void esp_bt_ontroller_log_deinit(void)
+{
+    r_ble_log_deinit_async();
+    log_is_inited = false;
+}
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#include "esp_partition.h"
+#include "hal/wdt_hal.h"
+
+#define MAX_STORAGE_SIZE          (CONFIG_BT_LE_CONTROLLER_LOG_PARTITION_SIZE)
+#define BLOCK_SIZE                (4096)
+#define THRESHOLD                 (3072)
+#define PARTITION_NAME            "bt_ctrl_log"
+
+static const esp_partition_t *log_partition;
+static uint32_t write_index = 0;
+static uint32_t next_erase_index = BLOCK_SIZE;
+static bool block_erased = false;
+static bool stop_write = false;
+static bool is_filled = false;
+
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void)
+{
+    log_partition = NULL;
+    assert(MAX_STORAGE_SIZE % BLOCK_SIZE == 0);
+    // Find the partition map in the partition table
+    log_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, PARTITION_NAME);
+    assert(log_partition != NULL);
+    // Prepare data to be read later using the mapped address
+    ESP_ERROR_CHECK(esp_partition_erase_range(log_partition, 0, BLOCK_SIZE));
+    write_index = 0;
+    next_erase_index = BLOCK_SIZE;
+    block_erased = false;
+    is_filled = false;
+    stop_write = false;
+}
+
+static int esp_bt_controller_log_storage(uint32_t len, const uint8_t *addr, bool end)
+{
+    if (len > MAX_STORAGE_SIZE) {
+        return -1;
+    }
+
+    if (stop_write) {
+        return 0;
+    }
+
+    if (((write_index) % BLOCK_SIZE) >= THRESHOLD && !block_erased) {
+        // esp_rom_printf("Ers nxt: %d,%d\n", next_erase_index, write_index);
+        esp_partition_erase_range(log_partition, next_erase_index, BLOCK_SIZE);
+        next_erase_index = (next_erase_index + BLOCK_SIZE) % MAX_STORAGE_SIZE;
+        block_erased = true;
+    }
+
+    if (((write_index + len) / BLOCK_SIZE) >  (write_index / BLOCK_SIZE)) {
+        block_erased = false;
+    }
+
+    if (write_index + len <= MAX_STORAGE_SIZE) {
+        esp_partition_write(log_partition, write_index, addr, len);
+        write_index = (write_index + len) % MAX_STORAGE_SIZE;
+    } else {
+        uint32_t first_part_len = MAX_STORAGE_SIZE - write_index;
+        esp_partition_write(log_partition, write_index, addr, first_part_len);
+        esp_partition_write(log_partition, 0, addr + first_part_len, len - first_part_len);
+        write_index = len - first_part_len;
+        is_filled = true;
+        // esp_rom_printf("old idx: %d,%d\n",next_erase_index, write_index);
+    }
+
+    return 0;
+}
+
+void esp_bt_read_ctrl_log_from_flash(bool output)
+{
+    esp_partition_mmap_handle_t mmap_handle;
+    uint32_t read_index;
+    const void *mapped_ptr;
+    const uint8_t *buffer;
+    uint32_t print_len;
+    uint32_t max_print_len;
+    esp_err_t err;
+
+    print_len = 0;
+    max_print_len = 4096;
+    err = esp_partition_mmap(log_partition, 0, MAX_STORAGE_SIZE, ESP_PARTITION_MMAP_DATA, &mapped_ptr, &mmap_handle);
+    if (err != ESP_OK) {
+        ESP_LOGE("FLASH", "Mmap failed: %s", esp_err_to_name(err));
+        return;
+    }
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
+    r_ble_log_async_output_dump_all(true);
+    esp_bt_ontroller_log_deinit();
+    stop_write = true;
+
+    buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_reconfigure_wdts(5000);
+    if (is_filled) {
+        read_index = next_erase_index;
+    } else {
+        read_index = 0;
+    }
+
+    esp_rom_printf("\r\nREAD_CHECK:%ld,%ld,%d\r\n",read_index, write_index, is_filled);
+    esp_rom_printf("\r\n[DUMP_START:");
+    while (read_index != write_index) {
+        esp_rom_printf("%02x ", buffer[read_index]);
+        if (print_len > max_print_len) {
+            esp_panic_handler_reconfigure_wdts(5000);
+            print_len = 0;
+        }
+
+        print_len++;
+        read_index = (read_index + 1) % MAX_STORAGE_SIZE;
+    }
+
+    esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    esp_partition_munmap(mmap_handle);
+    err = esp_bt_controller_log_init(log_output_mode);
+    assert(err == ESP_OK);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -186,10 +415,20 @@ static bool s_ble_active = false;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -283,8 +522,11 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
                                   void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -377,7 +619,6 @@ static esp_err_t sleep_modem_ble_mac_retention_init(void *arg)
         ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Modem BLE MAC retention initialization");
     }
     return err;
-    return ESP_OK;
 }
 
 static esp_err_t sleep_modem_ble_mac_modem_state_init(uint8_t extra)
@@ -385,7 +626,7 @@ static esp_err_t sleep_modem_ble_mac_modem_state_init(uint8_t extra)
     int retention_args = extra;
     sleep_retention_module_init_param_t init_param = {
         .cbs     = { .create = { .handle = sleep_modem_ble_mac_retention_init, .arg = &retention_args } },
-        .depends = BIT(SLEEP_RETENTION_MODULE_BT_BB)
+        .depends = RETENTION_MODULE_BITMAP_INIT(BT_BB)
     };
     esp_err_t err = sleep_retention_module_init(SLEEP_RETENTION_MODULE_BLE_MAC, &init_param);
     if (err == ESP_OK) {
@@ -409,6 +650,7 @@ void IRAM_ATTR sleep_modem_light_sleep_overhead_set(uint32_t overhead)
 }
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
 
+
 esp_err_t controller_sleep_init(void)
 {
     esp_err_t rc = 0;
@@ -423,13 +665,13 @@ esp_err_t controller_sleep_init(void)
                                 BLE_RTC_DELAY_US_MODEM_SLEEP);
 #endif /* FREERTOS_USE_TICKLESS_IDLE */
 #endif // CONFIG_BT_LE_SLEEP_ENABLE
+
 #ifdef CONFIG_PM_ENABLE
     rc = esp_pm_lock_create(ESP_PM_CPU_FREQ_MAX, 0, "bt", &s_pm_lock);
     if (rc != ESP_OK) {
         goto error;
     }
 #endif // CONFIG_PM_ENABLE
-
 #if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
     /* Create a new regdma link for BLE related register restoration */
     rc = sleep_modem_ble_mac_modem_state_init(0);
@@ -611,7 +853,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     uint8_t hci_transport_mode;
 
     memset(&npl_info, 0, sizeof(ble_npl_count_info_t));
-
     if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "invalid controller state");
         return ESP_ERR_INVALID_STATE;
@@ -674,20 +915,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_SW_COEXIST_ENABLE
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    uint8_t buffers = 0;
-#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_HCI;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    ret = r_ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
-#else
-    ret = r_ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
-#endif // CONFIG_BT_CONTROLLER_LOG_DUMP
+    ret = esp_bt_controller_log_init(log_output_mode);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto modem_deint;
@@ -699,13 +927,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -720,6 +954,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
         goto free_controller;
     }
+
     ESP_ERROR_CHECK(esp_read_mac((uint8_t *)mac, ESP_MAC_BT));
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
              mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
@@ -744,11 +979,12 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_ontroller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     esp_phy_modem_deinit();
     // modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
@@ -781,10 +1017,11 @@ esp_err_t esp_bt_controller_deinit(void)
     // modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_ontroller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 #if CONFIG_BT_NIMBLE_ENABLED
@@ -830,6 +1067,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -838,6 +1085,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -861,6 +1109,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -990,12 +1239,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1023,9 +1280,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1048,11 +1309,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1082,9 +1347,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1104,24 +1371,40 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }
-    if (end) {
-        esp_rom_printf("\n");
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        esp_bt_controller_log_storage(len, addr, end);
+#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_reconfigure_wdts(1000);
+        for (int i = 0; i < len; i++) {
+            esp_rom_printf("%02x ", addr[i]);
+        }
+
+        if (end) {
+            esp_rom_printf("\n");
+        }
+        portEXIT_CRITICAL_SAFE(&spinlock);
     }
 }
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-
-    portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
-    BT_ASSERT_PRINT("\r\n[DUMP_START:");
-    r_ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT(":DUMP_END]\r\n");
-    portEXIT_CRITICAL_SAFE(&spinlock);
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        esp_bt_read_ctrl_log_from_flash(output);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_reconfigure_wdts(5000);
+        BT_ASSERT_PRINT("\r\n[DUMP_START:");
+        r_ble_log_async_output_dump_all(output);
+        BT_ASSERT_PRINT(":DUMP_END]\r\n");
+        portEXIT_CRITICAL_SAFE(&spinlock);
+    }
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
@@ -1336,3 +1619,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32c5/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -148,12 +148,62 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
@@ -216,8 +266,7 @@ extern "C" {
 
 #define RTC_FREQ_N                          (32768) /* in Hz */
 
-#define BLE_LL_TX_PWR_DBM_N                 (9)
-
+#define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)

components/bt/controller/esp32c6/Kconfig.in

@@ -315,72 +315,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
             Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
             The size of ble controller log partition shall be a multiples of 4K.
             The name of log partition shall be "bt_ctrl_log".
             The partition type shall be ESP_PARTITION_TYPE_DATA.
             The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -689,3 +738,64 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32c6/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32c6/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32c6/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,7 @@
 
 #include "esp_bt.h"
 #include "esp_intr_alloc.h"
+#include "ble_priv.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
 #ifdef CONFIG_ESP_PHY_ENABLED
@@ -56,6 +57,13 @@
 
 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -107,12 +115,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -130,6 +141,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -188,6 +203,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -196,6 +212,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -243,21 +261,35 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
-
     return ret;
 }
 
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -382,6 +414,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -390,10 +438,20 @@ static bool s_ble_active = false;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -484,11 +542,13 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
     return rc;
 }
 
-static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
-                                  void *arg, void **ret_handle_in)
+static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler, void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -506,12 +566,16 @@ void esp_bt_rtc_slow_clk_select(uint8_t slow_clk_src)
     switch (slow_clk_src) {
         case MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source");
+#if SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             uint32_t chip_version = efuse_hal_chip_revision();
             if (chip_version == 0) {
                 modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (400 - 1));
             } else{
                 modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (5 - 1));
             }
+#else
+            modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (400 - 1));
+#endif // SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             break;
         case MODEM_CLOCK_LPCLK_SRC_RC_SLOW:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, can only run legacy ADV or SCAN due to low clock accuracy!");
@@ -593,7 +657,7 @@ static esp_err_t sleep_modem_ble_mac_modem_state_init(uint8_t extra)
     int retention_args = extra;
     sleep_retention_module_init_param_t init_param = {
         .cbs     = { .create = { .handle = sleep_modem_ble_mac_retention_init, .arg = &retention_args } },
-        .depends = BIT(SLEEP_RETENTION_MODULE_BT_BB)
+        .depends = RETENTION_MODULE_BITMAP_INIT(BT_BB)
     };
     esp_err_t err = sleep_retention_module_init(SLEEP_RETENTION_MODULE_BLE_MAC, &init_param);
     if (err == ESP_OK) {
@@ -901,13 +965,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -950,6 +1020,7 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
@@ -987,6 +1058,7 @@ esp_err_t esp_bt_controller_deinit(void)
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -1036,6 +1108,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1044,6 +1126,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1067,6 +1150,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1196,12 +1280,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1229,9 +1321,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1254,11 +1350,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1288,9 +1388,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1558,3 +1660,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -148,12 +148,62 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
@@ -218,7 +268,6 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
-
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/controller/esp32h2/Kconfig.in

@@ -306,72 +306,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
             Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
             The size of ble controller log partition shall be a multiples of 4K.
             The name of log partition shall be "bt_ctrl_log".
             The partition type shall be ESP_PARTITION_TYPE_DATA.
             The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -615,7 +664,7 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
         again.
 
 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
     default y
 
 config BT_LE_TX_CCA_ENABLED
@@ -690,3 +739,64 @@ config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
     default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
     default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
     default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32h2/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32h2/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32h2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -34,6 +34,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -52,6 +53,13 @@
 #include "esp_private/periph_ctrl.h"
 #include "esp_sleep.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -102,12 +110,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -125,6 +136,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -186,6 +201,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -194,6 +210,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -241,11 +259,23 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+        if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
@@ -255,6 +285,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -379,6 +412,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -388,6 +437,17 @@ static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP                    (5100)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP                    (1500)
 
@@ -484,8 +544,11 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
                                   void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -585,7 +648,7 @@ static esp_err_t sleep_modem_ble_mac_modem_state_init(uint8_t extra)
     int retention_args = extra;
     sleep_retention_module_init_param_t init_param = {
         .cbs     = { .create = { .handle = sleep_modem_ble_mac_retention_init, .arg = &retention_args } },
-        .depends = BIT(SLEEP_RETENTION_MODULE_BT_BB)
+        .depends = RETENTION_MODULE_BITMAP_INIT(BT_BB)
     };
     esp_err_t err = sleep_retention_module_init(SLEEP_RETENTION_MODULE_BLE_MAC, &init_param);
     if (err == ESP_OK) {
@@ -878,13 +941,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -899,6 +968,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
         goto free_controller;
     }
+
     ESP_ERROR_CHECK(esp_read_mac((uint8_t *)mac, ESP_MAC_BT));
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
              mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
@@ -926,6 +996,7 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
@@ -961,6 +1032,7 @@ esp_err_t esp_bt_controller_deinit(void)
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -1010,6 +1082,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1018,6 +1100,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1041,6 +1124,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1170,12 +1254,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1203,9 +1295,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1228,11 +1324,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1262,9 +1362,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1531,3 +1633,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -148,12 +148,62 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/esp_ble_mesh/Kconfig.in

@@ -15,6 +15,7 @@ if BLE_MESH
     config BLE_MESH_RANDOM_ADV_INTERVAL
         bool "Support using random adv interval for mesh packets"
         select BT_BLE_HIGH_DUTY_ADV_INTERVAL if BT_BLUEDROID_ENABLED
+        select BT_NIMBLE_HIGH_DUTY_ADV_ITVL if BT_NIMBLE_ENABLED
         default n
         help
             Enable this option to allow using random advertising interval

components/bt/esp_ble_mesh/core/beacon.c

@@ -35,7 +35,11 @@
 #define UNPROV_BEACON_INTERVAL     K_SECONDS(5)
 #endif
 
+#if CONFIG_BLE_MESH_BQB_TEST
+#define SECURE_BEACON_INTERVAL     K_SECONDS(3)
+#else
 #define SECURE_BEACON_INTERVAL     K_SECONDS(10)
+#endif
 
 /* 3 transmissions, 20ms interval */
 #define UNPROV_XMIT                BLE_MESH_TRANSMIT(2, 20)

components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c

@@ -1198,6 +1198,7 @@ uint16_t bt_mesh_gattc_get_service_uuid(struct bt_mesh_conn *conn)
 
 int bt_mesh_gattc_conn_create(const bt_mesh_addr_t *addr, uint16_t service_uuid)
 {
+    tBTA_BLE_CONN_PARAMS  conn_1m_param = {0};
     uint8_t zero[6] = {0};
     int i;
 
@@ -1251,10 +1252,14 @@ int bt_mesh_gattc_conn_create(const bt_mesh_addr_t *addr, uint16_t service_uuid)
      * Slave_latency: 0x0
      * Supervision_timeout: 1s
      */
-    BTA_DmSetBlePrefConnParams(bt_mesh_gattc_info[i].addr.val, 0x18, 0x18, 0x00, 0x64);
+    conn_1m_param.interval_min = 0x18;
+    conn_1m_param.interval_max = 0x18;
+    conn_1m_param.latency = 0;
+    conn_1m_param.supervision_timeout = 0x64;
 
-    BTA_GATTC_Open(bt_mesh_gattc_if, bt_mesh_gattc_info[i].addr.val,
-                   bt_mesh_gattc_info[i].addr.type, true, BTA_GATT_TRANSPORT_LE, FALSE);
+    BTA_GATTC_Enh_Open(bt_mesh_gattc_if, bt_mesh_gattc_info[i].addr.val,
+                   bt_mesh_gattc_info[i].addr.type, true, BTA_GATT_TRANSPORT_LE, FALSE, BLE_ADDR_UNKNOWN_TYPE,
+                   BTA_BLE_PHY_1M_MASK, &conn_1m_param, NULL, NULL);
 
     return 0;
 }

components/bt/esp_ble_mesh/core/cfg_srv.c

@@ -1287,7 +1287,7 @@ static struct label *va_find(const uint8_t *label_uuid,
     return match;
 }
 
-static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL, *free_slot = NULL;
 
@@ -1295,6 +1295,9 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     if (update) {
         update->ref++;
         va_store(update);
+        if (addr) {
+            *addr = update->addr;
+        }
         return STATUS_SUCCESS;
     }
 
@@ -1314,7 +1317,7 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     return STATUS_SUCCESS;
 }
 
-static uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL;
 

components/bt/esp_ble_mesh/core/prov_common.c

@@ -143,7 +143,7 @@ bool bt_mesh_prov_pdu_check(uint8_t type, uint16_t length, uint8_t *reason)
 
 static uint8_t bt_mesh_prov_buf_type_get(struct net_buf_simple *buf)
 {
-    return buf->data[PROV_BUF_HEADROOM];
+    return buf->__buf[PROV_BUF_HEADROOM];
 }
 
 uint8_t node_next_xact_id(struct bt_mesh_prov_link *link)

components/bt/esp_ble_mesh/core/storage/settings.c

@@ -1483,6 +1483,8 @@ int settings_core_commit(void)
         struct bt_mesh_hb_pub *hb_pub = NULL;
         struct bt_mesh_cfg_srv *cfg = NULL;
 
+        bt_mesh_atomic_set_bit(bt_mesh.flags, BLE_MESH_VALID);
+
         hb_pub = bt_mesh_hb_pub_get();
         if (hb_pub && hb_pub->dst != BLE_MESH_ADDR_UNASSIGNED &&
             hb_pub->count && hb_pub->period) {
@@ -1501,7 +1503,6 @@ int settings_core_commit(void)
             cfg->default_ttl = stored_cfg.cfg.default_ttl;
         }
 
-        bt_mesh_atomic_set_bit(bt_mesh.flags, BLE_MESH_VALID);
         bt_mesh_net_start();
     }
 #endif /* CONFIG_BLE_MESH_NODE */

components/bt/host/bluedroid/Kconfig.in

@@ -43,7 +43,8 @@ config BT_BLUEDROID_MEM_DEBUG
 config BT_BLUEDROID_ESP_COEX_VSC
     bool "Enable Espressif Vendor-specific HCI commands for coexist status configuration"
     depends on BT_BLUEDROID_ENABLED
-    default y
+    default y if (ESP_COEX_SW_COEXIST_ENABLE || BT_CONTROLLER_DISABLED)
+    default n
     help
         Enable Espressif Vendor-specific HCI commands for coexist status configuration
 
@@ -358,6 +359,13 @@ config BT_BLE_SMP_ID_RESET_ENABLE
         of a previously paired peer to be used to determine whether a device
         with which it previously shared an IRK is within range.
 
+config BT_BLE_SMP_BOND_NVS_FLASH
+    bool "Save SMP bonding keys to nvs flash"
+    depends on BT_BLE_SMP_ENABLE
+    default y
+    help
+        This select can save SMP bonding keys to nvs flash
+
 config BT_STACK_NO_LOG
     bool "Disable BT debug logs (minimize bin size)"
     depends on BT_BLUEDROID_ENABLED
@@ -1217,19 +1225,23 @@ config BT_BLE_RPA_TIMEOUT
         Default is 900 s (15 minutes). Range is 1 s to 1 hour (3600 s).
 
 config BT_BLE_50_FEATURES_SUPPORTED
-    bool "Enable BLE 5.0 features"
+    bool "Enable BLE 5.0 features(please disable BLE 4.2 if enable BLE 5.0)"
     depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
     default y
     help
         Enabling this option activates BLE 5.0 features.
         This option is universally supported in chips that support BLE, except for ESP32.
+        BLE 4.2 and BLE 5.0 cannot be used simultaneously.
+
 
 config BT_BLE_42_FEATURES_SUPPORTED
-    bool "Enable BLE 4.2 features"
-    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_SUPPORTED) || BT_CONTROLLER_DISABLED))
+    bool "Enable BLE 4.2 features(please disable BLE 5.0 if enable BLE 4.2)"
+    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
     default n
     help
         This enables BLE 4.2 features.
+        This option is universally supported by all ESP chips with BLE capabilities.
+        BLE 4.2 and BLE 5.0 cannot be used simultaneously.
 
 config BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
     bool "Enable BLE periodic advertising sync transfer feature"

components/bt/host/bluedroid/api/esp_gattc_api.c

@@ -67,46 +67,134 @@ esp_err_t esp_ble_gattc_app_unregister(esp_gatt_if_t gattc_if)
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
-#if (BLE_42_FEATURE_SUPPORT == TRUE)
-esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
+
+esp_err_t esp_ble_gattc_enh_open(esp_gatt_if_t gattc_if, esp_ble_gatt_creat_conn_params_t *creat_conn_params)
 {
     btc_msg_t msg = {0};
     btc_ble_gattc_args_t arg;
+    const esp_ble_conn_params_t *conn_params;
 
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
+    if (!creat_conn_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_GATTC;
     msg.act = BTC_GATTC_ACT_OPEN;
     arg.open.gattc_if = gattc_if;
-    memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
-    arg.open.remote_addr_type = remote_addr_type;
-    arg.open.is_direct = is_direct;
-    arg.open.is_aux = false;
+    memcpy(arg.open.remote_bda, creat_conn_params->remote_bda, ESP_BD_ADDR_LEN);
+    arg.open.remote_addr_type = creat_conn_params->remote_addr_type;
+    arg.open.is_direct = creat_conn_params->is_direct;
+    arg.open.is_aux= creat_conn_params->is_aux;
+    arg.open.own_addr_type = creat_conn_params->own_addr_type;
+    arg.open.phy_mask = creat_conn_params->phy_mask;
+
+    // If not aux open, shouldn't set 2M and coded PHY connection params
+    if (!creat_conn_params->is_aux &&
+        ((creat_conn_params->phy_mask & ESP_BLE_PHY_2M_PREF_MASK) ||
+        (creat_conn_params->phy_mask & ESP_BLE_PHY_CODED_PREF_MASK))) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_1M_PREF_MASK) {
+        if (!creat_conn_params->phy_1m_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_1m_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_1m_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid 1M PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_2M_PREF_MASK) {
+        if (!creat_conn_params->phy_2m_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_2m_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_2m_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid 2M PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
+
+    if (creat_conn_params->phy_mask & ESP_BLE_PHY_CODED_PREF_MASK) {
+        if (!creat_conn_params->phy_coded_conn_params) {
+            return ESP_ERR_INVALID_ARG;
+        }
+
+        conn_params = creat_conn_params->phy_coded_conn_params;
+        if (ESP_BLE_IS_VALID_PARAM(conn_params->interval_min, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->interval_max, ESP_BLE_CONN_INT_MIN, ESP_BLE_CONN_INT_MAX) &&
+            ESP_BLE_IS_VALID_PARAM(conn_params->supervision_timeout, ESP_BLE_CONN_SUP_TOUT_MIN, ESP_BLE_CONN_SUP_TOUT_MAX) &&
+            (conn_params->latency <= ESP_BLE_CONN_LATENCY_MAX) &&
+            ((conn_params->supervision_timeout * 10) >= ((1 + conn_params->latency) * ((conn_params->interval_max * 5) >> 1))) &&
+            (conn_params->interval_min <= conn_params->interval_max)) {
+            memcpy(&arg.open.phy_coded_conn_params, conn_params, sizeof(esp_ble_conn_params_t));
+        } else {
+            LOG_ERROR("%s, invalid Coded PHY connection params: min_int = %d, max_int = %d, latency = %d, timeout = %d", __func__,
+                                    conn_params->interval_min,
+                                    conn_params->interval_max,
+                                    conn_params->latency,
+                                    conn_params->supervision_timeout);
+            return ESP_ERR_INVALID_ARG;
+        }
+    }
 
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+esp_err_t esp_ble_gattc_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
+{
+    esp_ble_gatt_creat_conn_params_t creat_conn_params = {0};
+    memcpy(creat_conn_params.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    creat_conn_params.remote_addr_type = remote_addr_type;
+    creat_conn_params.is_direct = is_direct;
+    creat_conn_params.is_aux = false;
+    creat_conn_params.own_addr_type = 0xff; //undefined, will use local value
+    creat_conn_params.phy_mask = 0x0;
+    return esp_ble_gattc_enh_open(gattc_if, &creat_conn_params);
+}
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 esp_err_t esp_ble_gattc_aux_open(esp_gatt_if_t gattc_if, esp_bd_addr_t remote_bda, esp_ble_addr_type_t remote_addr_type, bool is_direct)
 {
-    btc_msg_t msg;
-    btc_ble_gattc_args_t arg;
-
-    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
-
-    msg.sig = BTC_SIG_API_CALL;
-    msg.pid = BTC_PID_GATTC;
-    msg.act = BTC_GATTC_ACT_AUX_OPEN;
-    arg.open.gattc_if = gattc_if;
-    memcpy(arg.open.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
-    arg.open.remote_addr_type = remote_addr_type;
-    arg.open.is_direct = is_direct;
-    arg.open.is_aux = true;
-
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gattc_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
-
+    esp_ble_gatt_creat_conn_params_t creat_conn_params = {0};
+    memcpy(creat_conn_params.remote_bda, remote_bda, ESP_BD_ADDR_LEN);
+    creat_conn_params.remote_addr_type = remote_addr_type;
+    creat_conn_params.is_direct = is_direct;
+    creat_conn_params.is_aux = true;
+    creat_conn_params.own_addr_type = 0xff; //undefined, will use local value
+    creat_conn_params.phy_mask = 0x0;
+    return esp_ble_gattc_enh_open(gattc_if, &creat_conn_params);
 }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -21,6 +21,10 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
     bool ret = true;
 
     if (record != NULL) {
+        if (record->hdr.type < ESP_SDP_TYPE_RAW || record->hdr.type > ESP_SDP_TYPE_DIP_SERVER) {
+            LOG_ERROR("Invalid type!\n");
+            return false;
+        }
         switch (record->hdr.type) {
         case ESP_SDP_TYPE_DIP_SERVER:
             if (record->dip.vendor_id_source != ESP_SDP_VENDOR_ID_SRC_BT &&
@@ -29,14 +33,28 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
                 ret = false;
             }
             break;
+        case ESP_SDP_TYPE_MAP_MAS:
+            if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) {
+                LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n");
+               ret = false;
+            }
+            break;
+        case ESP_SDP_TYPE_PBAP_PSE:
+            if (record->pse.supported_repositories >> 8) {
+                LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n");
+               ret = false;
+            }
+            break;
 
         default:
+            break;
+        }
+        if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) {
             if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
                 strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
                 LOG_ERROR("Invalid server name!\n");
                 ret = false;
             }
-            break;
         }
     } else {
         LOG_ERROR("record is NULL!\n");

components/bt/host/bluedroid/api/include/api/esp_bt_defs.h

@@ -145,6 +145,25 @@ typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
 #define ESP_BLE_CONN_SUP_TOUT_MIN           0x000A       /*!< relate to BTM_BLE_CONN_SUP_TOUT_MIN in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MAX           0x0C80       /*!< relate to ESP_BLE_CONN_SUP_TOUT_MAX in stack/btm_ble_api.h */
 
+#define ESP_BLE_PHY_1M_PREF_MASK       (1 << 0) /*!< The Host prefers use the LE1M transmitter or receiver PHY */
+#define ESP_BLE_PHY_2M_PREF_MASK       (1 << 1) /*!< The Host prefers use the LE2M transmitter or receiver PHY */
+#define ESP_BLE_PHY_CODED_PREF_MASK    (1 << 2) /*!< The Host prefers use the LE CODED transmitter or receiver PHY */
+typedef uint8_t esp_ble_phy_mask_t;
+
+/**
+* @brief create connection parameters
+*/
+typedef struct {
+    uint16_t scan_interval;       /*!< Initial scan interval, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
+    uint16_t scan_window;         /*!< Initial scan window, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
+    uint16_t interval_min;        /*!< Minimum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t interval_max;        /*!< Maximum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t latency;             /*!< Connection latency, the range is 0x0000(0) to 0x01F3(499). */
+    uint16_t supervision_timeout; /*!< Connection supervision timeout, in units of 10ms, the range is from 0x000A(100ms) to 0x0C80(32s). */
+    uint16_t min_ce_len;          /*!< Minimum connection event length, in units of 0.625ms, setting to 0 for no preferred parameters. */
+    uint16_t max_ce_len;          /*!< Maximum connection event length, in units of 0.625ms, setting to 0 for no preferred parameters. */
+} esp_ble_conn_params_t;
+
 /// Check the param is valid or not
 #define ESP_BLE_IS_VALID_PARAM(x, min, max)  (((x) >= (min) && (x) <= (max)) )
 

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -1593,6 +1593,8 @@ typedef void (* esp_gap_ble_cb_t)(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p
  *
  * @param[in]       callback: callback function
  *
+ * @note            Avoid performing time-consuming operations within the callback functions.
+ *
  * @return
  *                  - ESP_OK : success
  *                  - other  : failed

components/bt/host/bluedroid/api/include/api/esp_gatt_defs.h

@@ -682,6 +682,19 @@ typedef struct {
     esp_bt_uuid_t uuid;                       /*!< Included service UUID. */
 } esp_gattc_incl_svc_elem_t;
 
+/** @brief Represents a creat connection element. */
+typedef struct {
+    esp_bd_addr_t remote_bda;                              /*!< The Bluetooth address of the remote device */
+    esp_ble_addr_type_t remote_addr_type;                  /*!< Address type of the remote device */
+    bool is_direct;                                        /*!< Direct connection or background auto connection(by now, background auto connection is not supported */
+    bool is_aux;                                           /*!< Set to true for BLE 5.0 or higher to enable auxiliary connections; set to false for BLE 4.2 or lower. */
+    esp_ble_addr_type_t own_addr_type;                     /*!< Specifies the address type used in the connection request. Set to 0xFF if the address type is unknown. */
+    esp_ble_phy_mask_t phy_mask;                           /*!< Indicates which PHY connection parameters will be used. When is_aux is false, only the connection params for 1M PHY can be specified */
+    const esp_ble_conn_params_t *phy_1m_conn_params;       /*!< Connection parameters for the LE 1M PHY */
+    const esp_ble_conn_params_t *phy_2m_conn_params;       /*!< Connection parameters for the LE 2M PHY */
+    const esp_ble_conn_params_t *phy_coded_conn_params;    /*!< Connection parameters for the LE Coded PHY */
+} esp_ble_gatt_creat_conn_params_t;
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,580 +17,606 @@ extern "C" {
 
 /// GATT Server callback function events
 typedef enum {
-    ESP_GATTS_REG_EVT                 = 0,       /*!< When register application id, the event comes */
-    ESP_GATTS_READ_EVT                = 1,       /*!< When gatt client request read operation, the event comes */
-    ESP_GATTS_WRITE_EVT               = 2,       /*!< When gatt client request write operation, the event comes */
-    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< When gatt client request execute write, the event comes */
-    ESP_GATTS_MTU_EVT                 = 4,       /*!< When set mtu complete, the event comes */
-    ESP_GATTS_CONF_EVT                = 5,       /*!< When receive confirm, the event comes */
-    ESP_GATTS_UNREG_EVT               = 6,       /*!< When unregister application id, the event comes */
-    ESP_GATTS_CREATE_EVT              = 7,       /*!< When create service complete, the event comes */
-    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< When add included service complete, the event comes */
-    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< When add characteristic complete, the event comes */
-    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< When add descriptor complete, the event comes */
-    ESP_GATTS_DELETE_EVT              = 11,      /*!< When delete service complete, the event comes */
-    ESP_GATTS_START_EVT               = 12,      /*!< When start service complete, the event comes */
-    ESP_GATTS_STOP_EVT                = 13,      /*!< When stop service complete, the event comes */
-    ESP_GATTS_CONNECT_EVT             = 14,      /*!< When gatt client connect, the event comes */
-    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< When gatt client disconnect, the event comes */
-    ESP_GATTS_OPEN_EVT                = 16,      /*!< When connect to peer, the event comes */
-    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< When disconnect from peer, the event comes */
-    ESP_GATTS_CLOSE_EVT               = 18,      /*!< When gatt server close, the event comes */
-    ESP_GATTS_LISTEN_EVT              = 19,      /*!< When gatt listen to be connected the event comes */
-    ESP_GATTS_CONGEST_EVT             = 20,      /*!< When congest happen, the event comes */
+    ESP_GATTS_REG_EVT                 = 0,       /*!< This event is triggered when a GATT Server application is registered using `esp_ble_gatts_app_register`. */
+    ESP_GATTS_READ_EVT                = 1,       /*!< This event is triggered when the read request from the Client is received. */
+    ESP_GATTS_WRITE_EVT               = 2,       /*!< This event is triggered when the write request from the Client is received. */
+    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< This event is triggered when the write execution request from the Client is received. */
+    ESP_GATTS_MTU_EVT                 = 4,       /*!< This event is triggered when the MTU configuration request from the Client is received. */
+    ESP_GATTS_CONF_EVT                = 5,       /*!< This event is triggered when the confirmation from the Client is received. */
+    ESP_GATTS_UNREG_EVT               = 6,       /*!< This event is triggered when a GATT Server application is unregistered using `esp_ble_gatts_app_unregister`. */
+    ESP_GATTS_CREATE_EVT              = 7,       /*!< This event is triggered when a GATT Server service is created using `esp_ble_gatts_create_service`. */
+    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< This event is triggered when an included service is added using `esp_ble_gatts_add_included_service`. */
+    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< This event is triggered when a characteristic is added to the service using `esp_ble_gatts_add_char`. */
+    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< This event is triggered when a characteristic descriptor is added to the service using `esp_ble_gatts_add_char_descr`. */
+    ESP_GATTS_DELETE_EVT              = 11,      /*!< This event is triggered when the service is deleted using `esp_ble_gatts_delete_service`. */
+    ESP_GATTS_START_EVT               = 12,      /*!< This event is triggered when the service is started using `esp_ble_gatts_start_service`. */
+    ESP_GATTS_STOP_EVT                = 13,      /*!< This event is triggered when the service is stopped using `esp_ble_gatts_stop_service`.  */
+    ESP_GATTS_CONNECT_EVT             = 14,      /*!< This event is triggered when a physical connection is set up. */
+    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< This event is triggered when a physical connection is terminated. */
+    ESP_GATTS_OPEN_EVT                = 16,      /*!< This event is triggered when a virtual connection is created using `esp_ble_gatts_open`. */
+    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< Deprecated. */
+    ESP_GATTS_CLOSE_EVT               = 18,      /*!< This event is triggered when a virtual connection is closed using `esp_ble_gatts_close`. */
+    ESP_GATTS_LISTEN_EVT              = 19,      /*!< Deprecated. */
+    ESP_GATTS_CONGEST_EVT             = 20,      /*!< This event is triggered when the GATT connection is congested. */
     /* following is extra event */
-    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< When gatt send response complete, the event comes */
-    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< When gatt create table complete, the event comes */
-    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< When gatt set attr value complete, the event comes */
-    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< When gatt send service change indication complete, the event comes */
+    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< This event is triggered when a response is sent to the request using `esp_ble_gatts_send_response`. */
+    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< This event is triggered when a service attribute table is created using `esp_ble_gatts_create_attr_tab`. */
+    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< This event is triggered when an attribute value is set using `esp_ble_gatts_set_attr_value`. */
+    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< This event is triggered when a service change indication is sent using `esp_ble_gatts_send_service_change_indication`. */
 } esp_gatts_cb_event_t;
 
 /**
- * @brief Gatt server callback parameters union
+ * @brief GATT Server callback parameters
  */
 typedef union {
     /**
-     * @brief ESP_GATTS_REG_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_REG_EVT`
      */
     struct gatts_reg_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t app_id;                /*!< Application id which input in register API */
-    } reg;                              /*!< Gatt server callback param of ESP_GATTS_REG_EVT */
+        uint16_t app_id;                /*!< Application ID */
+    } reg;                              /*!< Callback parameter for the event `ESP_GATTS_REG_EVT` */
 
     /**
-     * @brief ESP_GATTS_READ_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_READ_EVT`
      */
     struct gatts_read_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been read */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to read */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool is_long;                   /*!< The value is too long or not */
-        bool need_rsp;                  /*!< The read operation need to do response */
-    } read;                             /*!< Gatt server callback param of ESP_GATTS_READ_EVT */
+        uint16_t offset;                /*!< The position offset to read. If the length of value is less than or equal to the MTU size, this value is 0. */
+        bool is_long;                   /*!< True indicates that the length of value is greater than the MTU size; false otherwise. */
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+    } read;                             /*!< Callback parameter for the event `ESP_GATTS_READ_EVT` */
 
 
     /**
-     * @brief ESP_GATTS_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_WRITE_EVT`
      */
     struct gatts_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to write */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool need_rsp;                  /*!< The write operation need to do response */
-        bool is_prep;                   /*!< This write operation is prepare write */
-        uint16_t len;                   /*!< The write attribute value length */
+        uint16_t offset;                /*!< The position offset to write. If the length of value is less than or equal to the MTU size, this value is 0.*/
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+        bool is_prep;                   /*!< True indicates the write operation is a prepared write operation */
+        uint16_t len;                   /*!< The length of the write attribute value in bytes */
         uint8_t *value;                 /*!< The write attribute value */
-    } write;                            /*!< Gatt server callback param of ESP_GATTS_WRITE_EVT */
+    } write;                            /*!< Callback parameter for the event `ESP_GATTS_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_EXEC_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT`
      */
     struct gatts_exec_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
-#define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Prepare write flag to indicate cancel prepare write */
-#define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Prepare write flag to indicate execute prepare write */
-        uint8_t exec_write_flag;        /*!< Execute write flag */
-    } exec_write;                       /*!< Gatt server callback param of ESP_GATTS_EXEC_WRITE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The bluetooth device address to write */
+        #define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Flag to indicate the cancellation of a prepare write operation */
+        #define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Flag to indicate the execution of a prepare write operation */
+        uint8_t exec_write_flag;        /*!< Execute write flag: `ESP_GATT_PREP_WRITE_CANCEL` or `ESP_GATT_PREP_WRITE_EXEC` */
+    } exec_write;                       /*!< Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_MTU_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_MTU_EVT`
      */
     struct gatts_mtu_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
+        uint16_t conn_id;               /*!< Connection ID */
         uint16_t mtu;                   /*!< MTU size */
-    } mtu;                              /*!< Gatt server callback param of ESP_GATTS_MTU_EVT */
+    } mtu;                              /*!< Callback parameter for the event `ESP_GATTS_MTU_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONF_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONF_EVT`
      */
     struct gatts_conf_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< attribute handle */
-        uint16_t len;                   /*!< The indication or notification value length, len is valid when send notification or indication failed */
-        uint8_t *value;                 /*!< The indication or notification value , value is valid when send notification or indication failed */
-    } conf;                             /*!< Gatt server callback param of ESP_GATTS_CONF_EVT (confirm) */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle */
+        uint16_t len;                   /*!< The length of indication or notification value in bytes. The length is invalid if the notification or indication failed. */
+        uint8_t *value;                 /*!< The indication or notification value. The value is invalid if the notification or indication failed. */
+    } conf;                             /*!< Callback parameter for the event `ESP_GATTS_CONF_EVT` */
 
     /**
-     * @brief ESP_GATTS_UNREG_EVT
-     */
-
-    /**
-     * @brief ESP_GATTS_CREATE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREATE_EVT`
      */
     struct gatts_create_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_gatt_srvc_id_t service_id;  /*!< Service id, include service uuid and other information */
-    } create;                           /*!< Gatt server callback param of ESP_GATTS_CREATE_EVT */
+        esp_gatt_srvc_id_t service_id;  /*!< Service ID, including service UUID and other information */
+    } create;                           /*!< Callback parameter for the event `ESP_GATTS_CREATE_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_INCL_SRVC_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT`
      */
     struct gatts_add_incl_srvc_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Included service attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } add_incl_srvc;                    /*!< Gatt server callback param of ESP_GATTS_ADD_INCL_SRVC_EVT */
+    } add_incl_srvc;                    /*!< Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT`
      */
     struct gatts_add_char_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Characteristic attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
-    } add_char;                         /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_EVT */
+        esp_bt_uuid_t char_uuid;        /*!< Characteristic UUID */
+    } add_char;                         /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_DESCR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT`
      */
     struct gatts_add_char_descr_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Descriptor attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
-    } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor UUID */
+    } add_char_descr;                   /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT` */
 
     /**
-     * @brief ESP_GATTS_DELETE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DELETE_EVT`
      */
     struct gatts_delete_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } del;                              /*!< Gatt server callback param of ESP_GATTS_DELETE_EVT */
+    } del;                              /*!< Callback parameter for the event `ESP_GATTS_DELETE_EVT` */
 
     /**
-     * @brief ESP_GATTS_START_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_START_EVT`
      */
     struct gatts_start_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } start;                            /*!< Gatt server callback param of ESP_GATTS_START_EVT */
+    } start;                            /*!< Callback parameter for the event `ESP_GATTS_START_EVT` */
 
     /**
-     * @brief ESP_GATTS_STOP_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_STOP_EVT`
      */
     struct gatts_stop_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } stop;                             /*!< Gatt server callback param of ESP_GATTS_STOP_EVT */
+    } stop;                             /*!< Callback parameter for the event `ESP_GATTS_STOP_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONNECT_EVT`
      */
     struct gatts_connect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint8_t link_role;              /*!< Link role : master role = 0  ; slave role = 1*/
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_params_t conn_params; /*!< current Connection parameters */
-        esp_ble_addr_type_t ble_addr_type;  /*!< Remote BLE device address type */
-        uint16_t conn_handle;           /*!< HCI connection handle */
-    } connect;                          /*!< Gatt server callback param of ESP_GATTS_CONNECT_EVT */
+        uint16_t conn_id;                   /*!< Connection ID */
+        uint8_t link_role;                  /*!< Link role: master role = 0; slave role = 1 */
+        esp_bd_addr_t remote_bda;           /*!< Remote device address */
+        esp_gatt_conn_params_t conn_params; /*!< Current connection parameters */
+        esp_ble_addr_type_t ble_addr_type;  /*!< Remote device address type */
+        uint16_t conn_handle;               /*!< HCI connection handle */
+    } connect;                              /*!< Callback parameter for the event `ESP_GATTS_CONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_DISCONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT`
      */
     struct gatts_disconnect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_reason_t reason;  /*!< Indicate the reason of disconnection */
-    } disconnect;                       /*!< Gatt server callback param of ESP_GATTS_DISCONNECT_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        esp_bd_addr_t remote_bda;       /*!< Remote device address */
+        esp_gatt_conn_reason_t reason;  /*!< The reason of disconnection */
+    } disconnect;                       /*!< Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_OPEN_EVT`
      */
     struct gatts_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } open;                             /*!< Gatt server callback param of ESP_GATTS_OPEN_EVT */
+    } open;                             /*!< Callback parameter for the event `ESP_GATTS_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CANCEL_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT`
      */
     struct gatts_cancel_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } cancel_open;                      /*!< Gatt server callback param of ESP_GATTS_CANCEL_OPEN_EVT */
+    } cancel_open;                      /*!< Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CLOSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CLOSE_EVT`
      */
     struct gatts_close_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-    } close;                            /*!< Gatt server callback param of ESP_GATTS_CLOSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+    } close;                            /*!< Callback parameter for the event `ESP_GATTS_CLOSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_LISTEN_EVT
-     */
-    /**
-     * @brief ESP_GATTS_CONGEST_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONGEST_EVT`
      */
     struct gatts_congest_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        bool congested;                 /*!< Congested or not */
-    } congest;                          /*!< Gatt server callback param of ESP_GATTS_CONGEST_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        bool congested;                 /*!< True indicates the connection is congested; false otherwise. */
+    } congest;                          /*!< Callback parameter for the event `ESP_GATTS_CONGEST_EVT` */
 
     /**
-     * @brief ESP_GATTS_RESPONSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_RESPONSE_EVT`
      */
     struct gatts_rsp_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< Attribute handle which send response */
-    } rsp;                              /*!< Gatt server callback param of ESP_GATTS_RESPONSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle which sends the response */
+    } rsp;                              /*!< Callback parameter for the event `ESP_GATTS_RESPONSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_CREAT_ATTR_TAB_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT`
      */
     struct gatts_add_attr_tab_evt_param{
         esp_gatt_status_t status;       /*!< Operation status */
-        esp_bt_uuid_t svc_uuid;         /*!< Service uuid type */
-        uint8_t svc_inst_id;            /*!< Service id */
-        uint16_t num_handle;            /*!< The number of the attribute handle to be added to the gatts database */
-        uint16_t *handles;              /*!< The number to the handles */
-    } add_attr_tab;                     /*!< Gatt server callback param of ESP_GATTS_CREAT_ATTR_TAB_EVT */
+        esp_bt_uuid_t svc_uuid;         /*!< Service UUID type */
+        uint8_t svc_inst_id;            /*!< Service ID */
+        uint16_t num_handle;            /*!< The number of the attribute handles which have been added to the GATT Service table */
+        uint16_t *handles;              /*!< The handles which have been added to the table */
+    } add_attr_tab;                     /*!< Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT` */
 
 
    /**
-    * @brief ESP_GATTS_SET_ATTR_VAL_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT`
     */
     struct gatts_set_attr_val_evt_param{
         uint16_t srvc_handle;           /*!< The service handle */
-        uint16_t attr_handle;           /*!< The attribute  handle */
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } set_attr_val;                     /*!< Gatt server callback param of ESP_GATTS_SET_ATTR_VAL_EVT */
+        uint16_t attr_handle;           /*!< The attribute handle */
+        esp_gatt_status_t status;       /*!< Operation status */
+    } set_attr_val;                     /*!< Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT` */
 
     /**
-    * @brief ESP_GATTS_SEND_SERVICE_CHANGE_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`
     */
     struct gatts_send_service_change_evt_param{
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } service_change;                    /*!< Gatt server callback param of ESP_GATTS_SEND_SERVICE_CHANGE_EVT */
+        esp_gatt_status_t status;        /*!< Operation status */
+    } service_change;                    /*!< Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT` */
 
 } esp_ble_gatts_cb_param_t;
 
 /**
  * @brief GATT Server callback function type
- * @param event : Event type
- * @param gatts_if : GATT server access interface, normally
- *                   different gatts_if correspond to different profile
- * @param param : Point to callback parameter, currently is union type
+ *
+ * @param[in] event    Event type
+ * @param[in] gatts_if GATT Server access interface. Typically, different `gatts_if` values correspond to different profiles.
+ * @param[in] param    The pointer to the callback parameter, which is of a union type.
  */
 typedef void (* esp_gatts_cb_t)(esp_gatts_cb_event_t event, esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param);
 
 /**
- * @brief           This function is called to register application callbacks
- *                  with BTA GATTS module.
+ * @brief  Register GATT Server application callbacks
+ *
+ * @param[in] callback The pointer to the application callback function
+ *
+ * @note            Avoid performing time-consuming operations within the callback functions.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback);
 
 /**
- * @brief           This function is called to get the current application callbacks
- *                  with BTA GATTS module.
+ * @brief  Get the current GATT Server application callback
  *
  * @return
- *                  - esp_gatts_cb_t : current callback
- *
+ *        - esp_gatts_cb_t: Current callback
  */
 esp_gatts_cb_t esp_ble_gatts_get_callback(void);
 
 /**
- * @brief           This function is called to register application identifier
+ * @brief  Register GATT Server application
+ *
+ * @param[in] app_id: The UUID for different application
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_REG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: The input `app_id` exceeds `ESP_APP_ID_MAX` (0x7fff) defined in esp_bt_defs.h.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_app_register(uint16_t app_id);
 
-
-
 /**
- * @brief           unregister with GATT Server.
+ * @brief  Unregister an GATT Server application
+ *
+ * @param[in]  gatts_if GATT Server access interface.
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_UNREG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
- * @param[in]       gatts_if: GATT server access interface
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if);
 
-
 /**
- * @brief           Create a service. When service creation is done, a callback
- *                  event ESP_GATTS_CREATE_EVT is called to report status
- *                  and service ID to the profile. The service ID obtained in
- *                  the callback function needs to be used when adding included
- *                  service and characteristics/descriptors into the service.
+ * @brief  Create a GATT Server service
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       service_id: service ID.
- * @param[in]       num_handle: number of handle requested for this service.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       service_id The pointer to the Service ID
+ * @param[in]       num_handle The number of handles requested for this service.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CREATE_EVT`.
+ *       2. `num_handle` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
                                        esp_gatt_srvc_id_t *service_id, uint16_t num_handle);
 
 
 /**
- * @brief               Create a service attribute tab.
- * @param[in]       gatts_attr_db: the pointer to the service attr tab
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       max_nb_attr: the number of attribute to be added to the service database.
- * @param[in]       srvc_inst_id: the instance id of the service
+ * @brief  Create a service attribute table
+ *
+ * @param[in]       gatts_attr_db The pointer to the service attribute table
+ * @param[in]       gatts_if      GATT Server access interface
+ * @param[in]       max_nb_attr   The number of attributes to be added to the service database
+ * @param[in]       srvc_inst_id  The instance ID of the service
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CREAT_ATTR_TAB_EVT`.
+ *      2. `max_nb_attr` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid `max_nb_attr`
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db,
                                             esp_gatt_if_t gatts_if,
                                             uint16_t max_nb_attr,
                                             uint8_t srvc_inst_id);
 /**
- * @brief           This function is called to add an included service. This function have to be called between
- *                  'esp_ble_gatts_create_service' and 'esp_ble_gatts_add_char'.  After included
- *                  service is included, a callback event ESP_GATTS_ADD_INCL_SRVC_EVT
- *                  is reported the included service ID.
+ * @brief  Add an included service
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       included_service_handle: the service ID to be included.
+ * @param[in]       service_handle  Target service handle to add
+ * @param[in]       included_service_handle The handle of included service to be added
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_ADD_INCL_SRVC_EVT`.
+ *       2. This function has to be called between `esp_ble_gatts_create_service` and `esp_ble_gatts_add_char`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t included_service_handle);
 
-
-
 /**
- * @brief           This function is called to add a characteristic into a service.
+ * @brief  Add a characteristic into a service.
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       char_uuid : Characteristic UUID.
- * @param[in]       perm      : Characteristic value declaration attribute permission.
- * @param[in]       property  : Characteristic Properties
- * @param[in]       char_val    : Characteristic value
- * @param[in]       control : attribute response control byte
+ * @param[in]       service_handle  Target service handle to add the characteristic
+ * @param[in]       char_uuid       The pointer to the characteristic UUID
+ * @param[in]       perm            Characteristic value declaration attribute permission
+ * @param[in]       property        Characteristic Properties
+ * @param[in]       char_val        The pointer to the characteristic value
+ * @param[in]       control         The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_uuid,
                                  esp_gatt_perm_t perm, esp_gatt_char_prop_t property, esp_attr_value_t *char_val,
                                  esp_attr_control_t *control);
 
-
 /**
- * @brief           This function is called to add characteristic descriptor. When
- *                  it's done, a callback event ESP_GATTS_ADD_DESCR_EVT is called
- *                  to report the status and an ID number for this descriptor.
+ * @brief  Add a characteristic descriptor
+ *
+ * @param[in]       service_handle Target service handle to add the characteristic descriptor
+ * @param[in]       descr_uuid     The pointer to the descriptor UUID
+ * @param[in]       perm           Descriptor access permission
+ * @param[in]       char_descr_val The pointer to the characteristic descriptor value
+ * @param[in]       control        The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_DESCR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
- * @param[in]       service_handle: service handle to which this characteristic descriptor is to
- *                              be added.
- * @param[in]       perm: descriptor access permission.
- * @param[in]       descr_uuid: descriptor UUID.
- * @param[in]       char_descr_val  : Characteristic descriptor value
- * @param[in]       control : attribute response control byte
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
                                         esp_bt_uuid_t   *descr_uuid,
                                         esp_gatt_perm_t perm, esp_attr_value_t *char_descr_val,
                                         esp_attr_control_t *control);
 
-
-
 /**
- * @brief           This function is called to delete a service. When this is done,
- *                  a callback event ESP_GATTS_DELETE_EVT is report with the status.
+ * @brief  Delete a service
  *
- * @param[in]       service_handle: service_handle to be deleted.
+ * @param[in]       service_handle Target service handle to delete
+ *
+ * @note    This function triggers `ESP_GATTS_DELETE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to start a service.
+ * @brief  Start a service
  *
- * @param[in]       service_handle: the service handle to be started.
+ * @param[in]       service_handle Target service handle to start
+ *
+ * @note      This function triggers `ESP_GATTS_START_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_start_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to stop a service.
+ * @brief  Stop a service.
  *
- * @param[in]       service_handle - service to be topped.
+ * @param[in]       service_handle Target service handle to stop
+ *
+ * @note            This function triggers `ESP_GATTS_STOP_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           Send indicate or notify to GATT client.
- *                  Set param need_confirm as false will send notification, otherwise indication.
- *                  Note: the size of indicate or notify data need less than MTU size,see "esp_ble_gattc_send_mtu_req".
+ * @brief  Send indication or notification to a GATT Client
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection id to indicate.
- * @param[in]       attr_handle - attribute handle to indicate.
- * @param[in]       value_len - indicate value length.
- * @param[in]       value: value to indicate.
- * @param[in]       need_confirm - Whether a confirmation is required.
- *                  false sends a GATT notification, true sends a GATT indication.
+ * @param[in]       gatts_if    GATT Server access interface
+ * @param[in]       conn_id     Connection ID
+ * @param[in]       attr_handle Attribute handle to indicate
+ * @param[in]       value_len   Indication value length in bytes
+ * @param[in]       value       Value to indicate
+ * @param[in]       need_confirm True if a confirmation is required, which is a GATT indication; false if the confirmation is not required, which is a GATT notification.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CONF_EVT`.
+ *       2. The size of indication or notification data must be less than or equal to MTU size, see `esp_ble_gattc_send_mtu_req`.
+ *       3. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm);
 
-
 /**
- * @brief           This function is called to send a response to a request.
+ * @brief  Send a response to a request
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection identifier.
- * @param[in]       trans_id - transfer id
- * @param[in]       status - response status
- * @param[in]       rsp - response data.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID
+ * @param[in]       trans_id Transfer ID
+ * @param[in]       status   Response status
+ * @param[in]       rsp      The pointer to the response data
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_RESPONSE_EVT`.
+ *      2. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, uint32_t trans_id,
                                       esp_gatt_status_t status, esp_gatt_rsp_t *rsp);
 
-
 /**
- * @brief           This function is called to set the attribute value by the application
+ * @brief  Set the attribute value
  *
- * @param[in]       attr_handle: the attribute handle which to be set
- * @param[in]       length: the value length
- * @param[in]       value: the pointer to the attribute value
+ * @param[in]       attr_handle Target attribute handle to set the value
+ * @param[in]       length      The value length in bytes
+ * @param[in]       value       The pointer to the attribute value
+ *
+ * @note    This function triggers `ESP_GATTS_SET_ATTR_VAL_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, const uint8_t *value);
 
 /**
- * @brief       Retrieve attribute value
+ * @brief  Retrieve attribute value
  *
- * @param[in]   attr_handle: Attribute handle.
- * @param[out]  length: pointer to the attribute value length
- * @param[out]  value:  Pointer to attribute value payload, the value cannot be modified by user
+ * @param[in]   attr_handle Attribute handle
+ * @param[out]  length      The pointer to the attribute value length in bytes
+ * @param[out]  value       The pointer to attribute value payload. This value cannot be modified by user.
+ *
+ * @note
+ *      1. This function does not trigger any event.
+ *      2. `attr_handle` must be greater than 0.
  *
  * @return
- *                  - ESP_GATT_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_GATT_INVALID_HANDLE: Invalid `attr_handle`
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_gatt_status_t esp_ble_gatts_get_attr_value(uint16_t attr_handle, uint16_t *length, const uint8_t **value);
 
-
 /**
- * @brief           Open a direct open connection or add a background auto connection
+ * @brief  Create an ACL connection when `BT_BLE_42_FEATURES_SUPPORTED` is enabled in the menuconfig
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
- * @param[in]       is_direct: direct connection or background auto connection
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote  device address
+ * @param[in]       is_direct `True` indicates a direct connection, while `False` indicates a background auto connection. Currently, background auto connection is not supported, so please always set this parameter to True.
+ *
+ * @note
+ *      1. The function always triggers `ESP_GATTS_CONNECT_EVT` and `ESP_GATTS_OPEN_EVT`.
+ *      2. When the device acts as GATT Server, besides the above two events, this function triggers `ESP_GATTS_CONNECT_EVT` as well.
+ *      3. This function will establish an ACL connection as a Central and a virtual connection as a GATT Server. If the ACL connection already exists, it will create a virtual connection only.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, bool is_direct);
 
 /**
- * @brief           Close a connection  a remote device.
+ * @brief  Close a connection with a remote device
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id: connection ID to be closed.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID to be closed
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CLOSE_EVT`.
+ *      2. There may be multiple virtual GATT server connections when multiple `app_id` got registered.
+ *      3. This API closes one virtual GATT server connection only, if there exist other virtual GATT server connections. It does not close the physical connection.
+ *      4. The API `esp_ble_gap_disconnect` can be used to disconnect the physical connection directly.
+ *      5. If there is only one virtual GATT connection left, this API will terminate the ACL connection in addition, and trigger `ESP_GATTS_DISCONNECT_EVT`. Then there is no need to call `esp_ble_gap_disconnect` anymore.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id);
 
 /**
- * @brief           Send service change indication
+ * @brief  Send service change indication
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote device address.
  *                  If remote_bda is NULL then it will send service change
  *                  indication to all the connected devices and if not then
- *                  to a specific device
+ *                  to a specific device.
+ *
+ * @note This function triggers `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda);
 
 /**
- * @brief           Print local database (GATT service table)
+ * @brief   Display the Server's local attribute database.
+ *
+ * This API prints the local attribute database of the BLE server, including details
+ * of all services, characteristics, and descriptors.
+ *
+ * @note
+ *    1. This function does not trigger any event.
+ *    2. It is primarily intended for debugging purposes to verify the server's current configuration.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_show_local_database(void);
 

components/bt/host/bluedroid/api/include/api/esp_hf_ag_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -63,6 +63,7 @@ typedef enum
     ESP_HF_WBS_RESPONSE_EVT,                  /*!< Codec Status */
     ESP_HF_BCS_RESPONSE_EVT,                  /*!< Final Codec Choice */
     ESP_HF_PKT_STAT_NUMS_GET_EVT,             /*!< Request number of packet different status */
+    ESP_HF_PROF_STATE_EVT,                    /*!< Indicate HF init or deinit complete */
 } esp_hf_cb_event_t;
 
 /// Dial type of ESP_HF_DIAL_EVT
@@ -223,6 +224,13 @@ typedef union
         uint32_t tx_discarded;    /*!< the total number of packets send lost */
     } pkt_nums;                   /*!< AG callback param of ESP_HF_PKT_STAT_NUMS_GET_EVT */
 
+    /**
+     * @brief ESP_HF_PROF_STATE_EVT
+     */
+    struct ag_prof_stat_param {
+        esp_hf_prof_state_t state;                /*!< hf profile state param */
+    } prof_stat;                                  /*!< status to indicate hf prof init or deinit */
+
 } esp_hf_cb_param_t;                              /*!< HFP AG callback param compound*/
 
 /**
@@ -284,6 +292,7 @@ esp_err_t esp_hf_ag_register_callback(esp_hf_cb_t callback);
  *
  * @brief           Initialize the bluetooth HF AG module.
  *                  This function should be called after esp_bluedroid_enable() completes successfully.
+ *                  ESP_HF_PROF_STATE_EVT with ESP_HF_INIT_SUCCESS will reported to the APP layer.
  *
  * @return
  *                  - ESP_OK: if the initialization request is sent successfully
@@ -297,6 +306,7 @@ esp_err_t esp_hf_ag_init(void);
  *
  * @brief           De-initialize for HF AG module.
  *                  This function should be called only after esp_bluedroid_enable() completes successfully.
+ *                  ESP_HF_PROF_STATE_EVT with ESP_HF_DEINIT_SUCCESS will reported to the APP layer.
  *
  * @return
  *                  - ESP_OK: success
@@ -504,13 +514,13 @@ esp_err_t esp_hf_ag_cind_response(esp_bd_addr_t remote_addr,
 
 /**
  *
- * @brief           Reponse for AT+COPS command from HF Client.
+ * @brief           Response for AT+COPS command from HF Client.
  *                  As a precondition to use this API, Service Level Connection shall exist with HFP client.
  *
  * @param[in]       remote_addr: remote bluetooth device address
  * @param[in]       name: current operator name
  * @return
- *                  - ESP_OK: reponse for AT+COPS command is sent to lower layer
+ *                  - ESP_OK: response for AT+COPS command is sent to lower layer
  *                  - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
  *                  - ESP_FAIL: others
  *
@@ -529,7 +539,7 @@ esp_err_t esp_hf_ag_cops_response(esp_bd_addr_t remote_addr, char *name);
  * @param[in]       mode: current call mode (voice/data/fax)
  * @param[in]       mpty: single or multi type
  * @param[in]       number: current call number
- * @param[in]       type: international type or unknow
+ * @param[in]       type: international type or unknown
  * @return
  *                  - ESP_OK: response to AT+CLCC command is sent to lower layer
  *                  - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled

components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -97,6 +97,7 @@ typedef enum {
     ESP_HF_CLIENT_BINP_EVT,                          /*!< requested number of last voice tag from AG */
     ESP_HF_CLIENT_RING_IND_EVT,                      /*!< ring indication event */
     ESP_HF_CLIENT_PKT_STAT_NUMS_GET_EVT,             /*!< requested number of packet different status */
+    ESP_HF_CLIENT_PROF_STATE_EVT,                    /*!< Indicate HF CLIENT init or deinit complete */
 } esp_hf_client_cb_event_t;
 
 /// HFP client callback parameters
@@ -266,6 +267,13 @@ typedef union {
         uint32_t tx_discarded;    /*!< the total number of packets send lost */
     } pkt_nums;                   /*!< HF callback param of ESP_HF_CLIENT_PKT_STAT_NUMS_GET_EVT */
 
+    /**
+     * @brief ESP_HF_CLIENT_PROF_STATE_EVT
+     */
+    struct hf_client_prof_stat_param {
+        esp_hf_prof_state_t state;               /*!< hf client profile state param */
+    } prof_stat;                                 /*!< status to indicate hf client prof init or deinit */
+
 } esp_hf_client_cb_param_t;                      /*!< HFP client callback parameters */
 
 /**
@@ -323,6 +331,7 @@ esp_err_t esp_hf_client_register_callback(esp_hf_client_cb_t callback);
  *
  * @brief           Initialize the bluetooth HFP client module.
  *                  This function should be called after esp_bluedroid_enable() completes successfully.
+ *                  ESP_HF_CLIENT_PROF_STATE_EVT with ESP_HF_INIT_SUCCESS will reported to the APP layer.
  *
  * @return
  *                  - ESP_OK: if the initialization request is sent successfully
@@ -336,6 +345,7 @@ esp_err_t esp_hf_client_init(void);
  *
  * @brief           De-initialize for HFP client module.
  *                  This function should be called only after esp_bluedroid_enable() completes successfully.
+ *                  ESP_HF_CLIENT_PROF_STATE_EVT with ESP_HF_DEINIT_SUCCESS will reported to the APP layer.
  *
  * @return
  *                  - ESP_OK: success
@@ -422,7 +432,7 @@ esp_err_t esp_hf_client_start_voice_recognition(void);
  *                  As a precondition to use this API, Service Level Connection shall exist with AG.
  *
  * @return
- *                  - ESP_OK: stoping voice recognition is sent to lower layer
+ *                  - ESP_OK: stopping voice recognition is sent to lower layer
  *                  - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
  *                  - ESP_FAIL: others
  *

components/bt/host/bluedroid/api/include/api/esp_hf_defs.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -13,6 +13,16 @@
 extern "C" {
 #endif
 
+/// profile states
+typedef enum {
+    ESP_HF_INIT_SUCCESS = 0,                /*!< Indicate init successful */
+    ESP_HF_INIT_ALREADY,                    /*!< Indicate init repeated */
+    ESP_HF_INIT_FAIL,                       /*!< Indicate init fail */
+    ESP_HF_DEINIT_SUCCESS,                  /*!< Indicate deinit successful */
+    ESP_HF_DEINIT_ALREADY,                  /*!< Indicate deinit repeated */
+    ESP_HF_DEINIT_FAIL,                     /*!< Indicate deinit fail */
+} esp_hf_prof_state_t;
+
 /// in-band ring tone state
 typedef enum {
     ESP_HF_IN_BAND_RINGTONE_NOT_PROVIDED = 0,
@@ -128,7 +138,7 @@ typedef enum {
 
 /// +CLCC address type
 typedef enum {
-    ESP_HF_CALL_ADDR_TYPE_UNKNOWN = 0x81,            /*!< unkown address type */
+    ESP_HF_CALL_ADDR_TYPE_UNKNOWN = 0x81,            /*!< unknown address type */
     ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL = 0x91,      /*!< international address */
 } esp_hf_call_addr_type_t;
 
@@ -160,7 +170,7 @@ typedef enum
     ESP_HF_NREC_START
 } esp_hf_nrec_t;
 
-///+CCWA resposne status
+///+CCWA response status
 typedef enum {
     ESP_HF_CALL_WAITING_INACTIVE,
     ESP_HF_CALL_WAITING_ACTIVE,

components/bt/host/bluedroid/bta/av/bta_av_ca_act.c

@@ -278,6 +278,7 @@ void bta_av_ca_api_get(tBTA_AV_RCB *p_rcb, tBTA_AV_DATA *p_data)
     GOEPC_RequestAddHeader(p_rcb->cover_art_goep_hdl, COVER_ART_HEADER_ID_IMG_HANDLE, (UINT8 *)image_handle_utf16, BTA_AV_CA_IMG_HDL_UTF16_LEN);
     if (p_data->api_ca_get.type == BTA_AV_CA_GET_IMAGE) {
         GOEPC_RequestAddHeader(p_rcb->cover_art_goep_hdl, COVER_ART_HEADER_ID_IMG_DESCRIPTOR, (UINT8 *)p_data->api_ca_get.image_descriptor, p_data->api_ca_get.image_descriptor_len);
+        osi_free(p_data->api_ca_get.image_descriptor);
     }
     /* always request to enable srm */
     GOEPC_RequestSetSRM(p_rcb->cover_art_goep_hdl, TRUE, FALSE);

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -4972,7 +4972,9 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         if (p_data->complt.reason != 0) {
             sec_event.auth_cmpl.fail_reason = BTA_DM_AUTH_CONVERT_SMP_CODE(((UINT8)p_data->complt.reason));
             /* delete this device entry from Sec Dev DB */
-            bta_dm_remove_sec_dev_entry (bda);
+            APPL_TRACE_WARNING("%s remove bond,rsn %d, BDA:0x%02X%02X%02X%02X%02X%02X", __func__, sec_event.auth_cmpl.fail_reason,
+                            bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+            bta_dm_remove_sec_dev_entry(bda);
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {
@@ -6049,7 +6051,7 @@ void bta_dm_ble_gap_set_prefer_ext_conn_params(tBTA_DM_MSG *p_data)
                sizeof(tBTA_DM_BLE_CONN_PARAMS));
     }
 
-    if (conn_params.phy_mask & BTAS_PHY_CODED_MASK) {
+    if (conn_params.phy_mask & BTA_PHY_CODED_MASK) {
         memcpy(&conn_params.phy_coded_conn_params, &p_data->ble_set_per_ext_conn_params.phy_coded_conn_params,
                sizeof(tBTA_DM_BLE_CONN_PARAMS));
     }
@@ -6673,7 +6675,9 @@ void btm_dm_start_gatt_discovery (BD_ADDR bd_addr)
         btm_dm_start_disc_gatt_services(bta_dm_search_cb.conn_id);
     } else {
         //TODO need to add addr_type in future
-        BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE, FALSE);
+        BTA_GATTC_Enh_Open(bta_dm_search_cb.client_if, bd_addr, BLE_ADDR_UNKNOWN_TYPE, TRUE,
+            BTA_GATT_TRANSPORT_LE, FALSE, BLE_ADDR_UNKNOWN_TYPE, 0, NULL, NULL, NULL);
+
     }
 }
 #endif /* #if (GATTC_INCLUDED == TRUE) */

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -1040,7 +1040,7 @@ typedef struct {
 
 #define BTA_PHY_1M_MASK                   (1 << 0)
 #define BTA_PHY_2M_MASK                   (1 << 1)
-#define BTAS_PHY_CODED_MASK               (1 << 2)
+#define BTA_PHY_CODED_MASK                (1 << 2)
 typedef struct {
     BT_HDR                          hdr;
     BD_ADDR                         bd_addr;

components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c

@@ -36,6 +36,7 @@
 #include "osi/allocator.h"
 #include "osi/mutex.h"
 #include "bta_hh_int.h"
+#include "btm_int.h"
 
 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
 #include "bta_hh_int.h"
@@ -70,6 +71,7 @@ static void bta_gattc_req_cback (UINT16 conn_id, UINT32 trans_id, tGATTS_REQ_TYP
 static tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_id, BD_ADDR remote_bda);
 
 extern void btc_gattc_congest_callback(tBTA_GATTC *param);
+extern uint32_t BTM_BleUpdateOwnType(uint8_t *own_bda_type, tBTM_START_ADV_CMPL_CBACK *cb);
 
 static const tGATT_CBACK bta_gattc_cl_cback = {
     bta_gattc_conn_cback,
@@ -336,6 +338,10 @@ void bta_gattc_process_api_open (tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
     UNUSED(p_cb);
 
     if (p_clreg != NULL) {
+        if (p_msg->api_conn.own_addr_type <= BLE_ADDR_TYPE_MAX) {
+            // update own address type for creating connection
+            BTM_BleUpdateOwnType(&p_msg->api_conn.own_addr_type, NULL);
+        }
         if (p_msg->api_conn.is_direct) {
             if ((p_clcb = bta_gattc_find_alloc_clcb(p_msg->api_conn.client_if,
                                                     p_msg->api_conn.remote_bda,
@@ -503,6 +509,7 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
     tBTA_GATTC_DATA gattc_data;
     BOOLEAN found_app = FALSE;
     tGATT_TCB *p_tcb;
+    tBTM_SEC_DEV_REC *p_dev_rec = NULL;
 
     if (!p_clcb || !p_data) {
         return;
@@ -512,6 +519,33 @@ void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
     if(p_tcb) {
         found_app = gatt_find_specific_app_in_hold_link(p_tcb, p_clcb->p_rcb->client_if);
     }
+
+    if (p_data->api_conn.phy_mask) {
+        p_dev_rec = btm_find_or_alloc_dev(p_data->api_conn.remote_bda);
+        if (p_dev_rec) {
+            if (p_data->api_conn.is_aux) {
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+                p_dev_rec->ext_conn_params.phy_mask = p_data->api_conn.phy_mask;
+                if (p_data->api_conn.phy_mask & BTA_BLE_PHY_1M_MASK) {
+                    memcpy(&p_dev_rec->ext_conn_params.phy_1m_conn_params, &p_data->api_conn.phy_1m_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+                }
+                if (p_data->api_conn.phy_mask & BTA_BLE_PHY_2M_MASK) {
+                    memcpy(&p_dev_rec->ext_conn_params.phy_2m_conn_params, &p_data->api_conn.phy_2m_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+                }
+                if (p_data->api_conn.phy_mask & BTA_BLE_PHY_CODED_MASK) {
+                    memcpy(&p_dev_rec->ext_conn_params.phy_coded_conn_params, &p_data->api_conn.phy_coded_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+                }
+#endif
+            } else {
+                if (p_data->api_conn.phy_mask & BTA_BLE_PHY_1M_MASK) {
+                    memcpy(&p_dev_rec->conn_params, &p_data->api_conn.phy_1m_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+                }
+            }
+        } else {
+            APPL_TRACE_ERROR("Unknown Device, setting rejected");
+        }
+    }
+
     /* open/hold a connection */
     if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda, p_data->api_conn.remote_addr_type,
                       TRUE, p_data->api_conn.transport, p_data->api_conn.is_aux)) {
@@ -1807,8 +1841,8 @@ static void bta_gattc_enc_cmpl_cback(tGATT_IF gattc_if, BD_ADDR bda)
 *******************************************************************************/
 void bta_gattc_process_api_refresh(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 {
-    tBTA_GATTC_SERV *p_srvc_cb = bta_gattc_find_srvr_cache(p_msg->api_conn.remote_bda);
-    tBTA_GATTC_CLCB      *p_clcb = &bta_gattc_cb.clcb[0];
+    tBTA_GATTC_SERV *p_srvc_cb = bta_gattc_find_srvr_cache(p_msg->api_refresh.remote_bda);
+    tBTA_GATTC_CLCB *p_clcb = &bta_gattc_cb.clcb[0];
     BOOLEAN         found = FALSE;
     UINT8           i;
     UNUSED(p_cb);
@@ -1928,7 +1962,7 @@ void bta_gattc_process_api_cache_get_addr_list(tBTA_GATTC_CB *p_cb, tBTA_GATTC_D
 *******************************************************************************/
 void bta_gattc_process_api_cache_clean(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 {
-    tBTA_GATTC_SERV *p_srvc_cb = bta_gattc_find_srvr_cache(p_msg->api_conn.remote_bda);
+    tBTA_GATTC_SERV *p_srvc_cb = bta_gattc_find_srvr_cache(p_msg->api_clean.remote_bda);
     UNUSED(p_cb);
 
     if (p_srvc_cb != NULL && p_srvc_cb->p_srvc_cache != NULL) {

components/bt/host/bluedroid/bta/gatt/bta_gattc_api.c

@@ -128,7 +128,7 @@ void BTA_GATTC_AppDeregister(tBTA_GATTC_IF client_if)
 
 /*******************************************************************************
 **
-** Function         BTA_GATTC_Open
+** Function         BTA_GATTC_Enh_Open
 **
 ** Description      Open a direct connection or add a background auto connection
 **                  bd address
@@ -142,8 +142,10 @@ void BTA_GATTC_AppDeregister(tBTA_GATTC_IF client_if)
 ** Returns          void
 **
 *******************************************************************************/
-void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
-                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport, BOOLEAN is_aux)
+void BTA_GATTC_Enh_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
+                        BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport, BOOLEAN is_aux, tBTA_ADDR_TYPE own_addr_type,
+                        UINT8 phy_mask, tBTA_BLE_CONN_PARAMS *phy_1m_conn_params, tBTA_BLE_CONN_PARAMS *phy_2m_conn_params,
+                        tBTA_BLE_CONN_PARAMS *phy_coded_conn_params)
 {
     tBTA_GATTC_API_OPEN  *p_buf;
 
@@ -155,8 +157,18 @@ void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE
         p_buf->transport = transport;
         p_buf->is_aux = is_aux;
         p_buf->remote_addr_type = remote_addr_type;
+        p_buf->own_addr_type = own_addr_type;
+        p_buf->phy_mask = phy_mask;
         memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);
-
+        if ((phy_mask & BTA_BLE_PHY_1M_MASK) && phy_1m_conn_params) {
+            memcpy(&p_buf->phy_1m_conn_params, phy_1m_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+        }
+        if ((phy_mask & BTA_BLE_PHY_2M_MASK) && phy_2m_conn_params) {
+            memcpy(&p_buf->phy_2m_conn_params, phy_2m_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+        }
+        if ((phy_mask & BTA_BLE_PHY_CODED_MASK) && phy_coded_conn_params) {
+            memcpy(&p_buf->phy_coded_conn_params, phy_coded_conn_params, sizeof(tBTA_BLE_CONN_PARAMS));
+        }
 
         bta_sys_sendmsg(p_buf);
     }
@@ -472,7 +484,7 @@ void  BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_handle
 ** Description      This function is called to read a characteristics value
 **
 ** Parameters       conn_id - connection ID.
-**                  handle - characteritic handle to read.
+**                  handle - characteristic handle to read.
 **
 ** Returns          None
 **
@@ -607,7 +619,7 @@ void BTA_GATTC_ReadMultipleVariable(UINT16 conn_id, tBTA_GATTC_MULTI *p_read_mul
 **
 ** Parameters       conn_id - connection ID.
 **                  s_handle - start handle.
-**                  e_handle - end hanle
+**                  e_handle - end handle
 **                  uuid - The attribute UUID.
 **
 ** Returns          None
@@ -687,7 +699,7 @@ void BTA_GATTC_WriteCharValue ( UINT16 conn_id,
 ** Description      This function is called to write descriptor value.
 **
 ** Parameters       conn_id - connection ID
-**                  handle - descriptor hadle to write.
+**                  handle - descriptor handle to write.
 **                  write_type - write type.
 **                  p_value - the value to be written.
 **
@@ -738,7 +750,7 @@ void BTA_GATTC_WriteCharDescr (UINT16 conn_id,
 ** Description      This function is called to prepare write a characteristic value.
 **
 ** Parameters       conn_id - connection ID.
-**                    p_char_id - GATT characteritic ID of the service.
+**                    p_char_id - GATT characteristic ID of the service.
 **                  offset - offset of the write value.
 **                  len: length of the data to be written.
 **                  p_value - the value to be written.
@@ -781,7 +793,7 @@ void BTA_GATTC_PrepareWrite  (UINT16 conn_id, UINT16 handle,
 ** Description      This function is called to prepare write a characteristic descriptor value.
 **
 ** Parameters       conn_id - connection ID.
-**                  p_char_descr_id - GATT characteritic descriptor ID of the service.
+**                  p_char_descr_id - GATT characteristic descriptor ID of the service.
 **                  offset - offset of the write value.
 **                  len: length of the data to be written.
 **                  p_value - the value to be written.
@@ -1010,9 +1022,9 @@ void BTA_GATTC_Refresh(BD_ADDR remote_bda, bool erase_flash)
     if(bta_sys_is_register(BTA_ID_GATTC) == FALSE) {
         return;
     }
-    tBTA_GATTC_API_OPEN  *p_buf;
+    tBTA_GATTC_API_CACHE_REFRESH  *p_buf;
 
-    if ((p_buf = (tBTA_GATTC_API_OPEN *) osi_malloc(sizeof(tBTA_GATTC_API_OPEN))) != NULL) {
+    if ((p_buf = (tBTA_GATTC_API_CACHE_REFRESH *) osi_malloc(sizeof(tBTA_GATTC_API_CACHE_REFRESH))) != NULL) {
         p_buf->hdr.event = BTA_GATTC_API_REFRESH_EVT;
         memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);
 
@@ -1068,9 +1080,9 @@ void BTA_GATTC_Clean(BD_ADDR remote_bda)
     bta_gattc_cache_reset(remote_bda);
 #endif
 
-    tBTA_GATTC_API_OPEN  *p_buf;
+    tBTA_GATTC_API_CACHE_CLEAN  *p_buf;
 
-    if ((p_buf = (tBTA_GATTC_API_OPEN *) osi_malloc(sizeof(tBTA_GATTC_API_OPEN))) != NULL) {
+    if ((p_buf = (tBTA_GATTC_API_CACHE_CLEAN *) osi_malloc(sizeof(tBTA_GATTC_API_CACHE_CLEAN))) != NULL) {
         p_buf->hdr.event = BTA_GATTC_API_CACHE_CLEAN_EVT;
         memcpy(p_buf->remote_bda, remote_bda, BD_ADDR_LEN);
 

components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c

@@ -723,8 +723,6 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 } else {
                     APPL_TRACE_ERROR("%s, malloc failed", __func__);
                 }
-            } else {
-                APPL_TRACE_ERROR("%s, incorrect length", __func__);
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
             if (cb_data.req_data.value != NULL) {
@@ -733,7 +731,7 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
             }
         }
     } else {
-        APPL_TRACE_ERROR("Not an registered servce attribute ID: 0x%04x",
+        APPL_TRACE_ERROR("Not a registered service attribute ID: 0x%04x",
                          p_msg->api_indicate.attr_id);
     }
 }
@@ -923,7 +921,7 @@ void bta_gatts_listen(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
 **
 ** Function         bta_gatts_show_local_database
 **
-** Description      print loacl service database
+** Description      print local service database
 **
 ** Returns          none.
 **

components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h

@@ -110,7 +110,7 @@ typedef enum {
 #define BTA_GATTC_WRITE_PREPARE          GATT_WRITE_PREPARE
 #define BTA_GATTC_INVALID_HANDLE         0
 
-/* internal strucutre for GATTC register API  */
+/* internal structure for GATTC register API  */
 typedef struct {
     BT_HDR                  hdr;
     tBT_UUID                app_uuid;
@@ -133,9 +133,20 @@ typedef struct {
     BOOLEAN                 is_direct;
     BOOLEAN                 is_aux;
     tBTA_TRANSPORT          transport;
+    tBTA_ADDR_TYPE          own_addr_type;
+    UINT8                   phy_mask;
+    tBTA_BLE_CONN_PARAMS    phy_1m_conn_params;
+    tBTA_BLE_CONN_PARAMS    phy_2m_conn_params;
+    tBTA_BLE_CONN_PARAMS    phy_coded_conn_params;
 } tBTA_GATTC_API_OPEN;
 
-typedef tBTA_GATTC_API_OPEN tBTA_GATTC_API_CANCEL_OPEN;
+typedef struct {
+    BT_HDR                  hdr;
+    BD_ADDR                 remote_bda;
+    tBTA_ADDR_TYPE          remote_addr_type;
+    tBTA_GATTC_IF           client_if;
+    BOOLEAN                 is_direct;
+} tBTA_GATTC_API_CANCEL_OPEN;
 
 typedef struct {
     BT_HDR                  hdr;
@@ -202,6 +213,11 @@ typedef struct {
     BT_HDR              hdr;
 } tBTA_GATTC_API_CFG_MTU;
 
+typedef struct {
+    BT_HDR             hdr;
+    BD_ADDR            remote_bda;
+} tBTA_GATTC_API_CACHE_REFRESH;
+
 typedef struct {
     BT_HDR             hdr;
     tBTA_GATTC_IF      client_if;
@@ -215,6 +231,11 @@ typedef struct {
     tBTA_GATTC_IF      client_if;
 } tBTA_GATTC_API_GET_ADDR;
 
+typedef struct {
+    BT_HDR             hdr;
+    BD_ADDR            remote_bda;
+} tBTA_GATTC_API_CACHE_CLEAN;
+
 typedef struct {
     BT_HDR                  hdr;
     BD_ADDR                 remote_bda;
@@ -247,8 +268,10 @@ typedef union {
     tBTA_GATTC_API_EXEC         api_exec;
     tBTA_GATTC_API_READ_MULTI   api_read_multi;
     tBTA_GATTC_API_CFG_MTU      api_mtu;
+    tBTA_GATTC_API_CACHE_REFRESH    api_refresh;
     tBTA_GATTC_API_CACHE_ASSOC  api_assoc;
     tBTA_GATTC_API_GET_ADDR     api_get_addr;
+    tBTA_GATTC_API_CACHE_CLEAN  api_clean;
     tBTA_GATTC_OP_CMPL          op_cmpl;
     tBTA_GATTC_INT_CONN         int_conn;
     tBTA_GATTC_ENC_CMPL         enc_cmpl;
@@ -313,7 +336,7 @@ typedef struct {
     UINT16               total_char;
     UINT16              total_attr;
     UINT8               srvc_hdl_chg;   /* service handle change indication pending */
-    UINT16              attr_index;     /* cahce NV saving/loading attribute index */
+    UINT16              attr_index;     /* cache NV saving/loading attribute index */
 
     UINT16              mtu;
     bool                update_incl_srvc;

components/bt/host/bluedroid/bta/hh/bta_hh_le.c

@@ -117,7 +117,7 @@ static void bta_hh_le_hid_report_dbg(tBTA_HH_DEV_CB *p_cb)
         if (p_cb->hid_srvc[i].in_use) {
             p_rpt = &p_cb->hid_srvc[i].report[0];
 
-            APPL_TRACE_DEBUG("\t HID serivce inst: %d", i);
+            APPL_TRACE_DEBUG("\t HID service inst: %d", i);
 
             for (j = 0; j < BTA_HH_LE_RPT_MAX; j ++, p_rpt++) {
                 rpt_name = "Unknown";
@@ -334,14 +334,15 @@ void bta_hh_le_open_conn(tBTA_HH_DEV_CB *p_cb, BD_ADDR remote_bda)
     bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
     p_cb->in_use = TRUE;
 
-    BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE, BTA_GATT_TRANSPORT_LE, FALSE);
+    BTA_GATTC_Enh_Open(bta_hh_cb.gatt_if, remote_bda, BLE_ADDR_UNKNOWN_TYPE, TRUE,
+            BTA_GATT_TRANSPORT_LE, FALSE, BLE_ADDR_UNKNOWN_TYPE, 0, NULL, NULL, NULL);
 }
 
 /*******************************************************************************
 **
 ** Function         bta_hh_le_fill_16bits_gatt_id
 **
-** Description      Utility function to fill a GATT ID strucure
+** Description      Utility function to fill a GATT ID structure
 **
 *******************************************************************************/
 void bta_hh_le_fill_16bits_gatt_id(UINT8 inst_id, UINT16 uuid,  tBTA_GATT_ID *p_output)
@@ -355,7 +356,7 @@ void bta_hh_le_fill_16bits_gatt_id(UINT8 inst_id, UINT16 uuid,  tBTA_GATT_ID *p_
 **
 ** Function         bta_hh_le_fill_16bits_srvc_id
 **
-** Description      Utility function to fill a service ID strucure with a 16 bits
+** Description      Utility function to fill a service ID structure with a 16 bits
 **                  service UUID.
 **
 *******************************************************************************/
@@ -372,7 +373,7 @@ void bta_hh_le_fill_16bits_srvc_id(BOOLEAN is_pri, UINT8 inst_id, UINT16 srvc_uu
 **
 ** Function         bta_hh_le_fill_16bits_char_id
 **
-** Description      Utility function to fill a char ID strucure with a 16 bits
+** Description      Utility function to fill a char ID structure with a 16 bits
 **                  char UUID.
 **
 *******************************************************************************/
@@ -624,7 +625,7 @@ tBTA_HH_STATUS bta_hh_le_read_char_dscrpt(tBTA_HH_DEV_CB *p_cb, UINT16 srvc_uuid
 **
 ** Function         bta_hh_le_read_rpt_ref_descr
 **
-** Description      read report refernece descriptors in service discovery process
+** Description      read report reference descriptors in service discovery process
 **
 *******************************************************************************/
 void bta_hh_le_read_rpt_ref_descr(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_LE_RPT *p_rpt)
@@ -841,7 +842,7 @@ void bta_hh_le_register_input_notif(tBTA_HH_DEV_CB *p_dev_cb, UINT8 srvc_inst,
                 }
             }
             /*
-            else unknow protocol mode */
+            else unknown protocol mode */
         }
     }
 }
@@ -1486,7 +1487,7 @@ void bta_hh_le_gatt_disc_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_STATUS status)
 {
     APPL_TRACE_DEBUG("bta_hh_le_gatt_disc_cmpl ");
 
-    /* if open sucessful or protocol mode not desired, keep the connection open but inform app */
+    /* if open successful or protocol mode not desired, keep the connection open but inform app */
     if (status == BTA_HH_OK || status == BTA_HH_ERR_PROTO) {
         /* assign a special APP ID temp, since device type unknown */
         p_cb->app_id = BTA_HH_APP_ID_LE;
@@ -1504,7 +1505,7 @@ void bta_hh_le_gatt_disc_cmpl(tBTA_HH_DEV_CB *p_cb, tBTA_HH_STATUS status)
 **
 ** Function         bta_hh_le_srvc_expl_srvc
 **
-** Description      This function discover the next avaible HID service.
+** Description      This function discover the next available HID service.
 **
 ** Parameters:
 **
@@ -2076,7 +2077,7 @@ void bta_hh_w4_le_read_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_buf)
 **
 ** Function         bta_hh_w4_le_write_cmpl
 **
-** Description      Write charactersitic complete event at W4_CONN st.
+** Description      Write characteristic complete event at W4_CONN st.
 **
 ** Parameters:
 **
@@ -2104,7 +2105,7 @@ void bta_hh_w4_le_write_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_buf)
 **
 ** Function         bta_hh_le_write_cmpl
 **
-** Description      Write charactersitic complete event at CONN st.
+** Description      Write characteristic complete event at CONN st.
 **
 ** Parameters:
 **
@@ -2162,7 +2163,7 @@ void bta_hh_le_write_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_buf)
 **
 ** Function         bta_hh_le_write_char_descr_cmpl
 **
-** Description      Write charactersitic descriptor complete event
+** Description      Write characteristic descriptor complete event
 **
 ** Parameters:
 **
@@ -2216,7 +2217,7 @@ void bta_hh_le_write_char_descr_cmpl(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_b
 **
 ** Function         bta_hh_le_input_rpt_notify
 **
-** Description      process the notificaton event, most likely for input report.
+** Description      process the notification event, most likely for input report.
 **
 ** Parameters:
 **
@@ -2357,7 +2358,7 @@ void bta_hh_gatt_close(tBTA_HH_DEV_CB *p_cb, tBTA_HH_DATA *p_data)
 **
 ** Function         bta_hh_le_api_disc_act
 **
-** Description      initaite a Close API to a remote HID device
+** Description      initiate a Close API to a remote HID device
 **
 ** Returns          void
 **
@@ -2601,7 +2602,8 @@ static void bta_hh_le_add_dev_bg_conn(tBTA_HH_DEV_CB *p_cb, BOOLEAN check_bond)
     if (/*p_cb->dscp_info.flag & BTA_HH_LE_NORMAL_CONN &&*/
         !p_cb->in_bg_conn && to_add) {
         /* add device into BG connection to accept remote initiated connection */
-        BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, BLE_ADDR_UNKNOWN_TYPE, FALSE, BTA_GATT_TRANSPORT_LE, FALSE);
+        BTA_GATTC_Enh_Open(bta_hh_cb.gatt_if, p_cb->addr, BLE_ADDR_UNKNOWN_TYPE, FALSE,
+                BTA_GATT_TRANSPORT_LE, FALSE, BLE_ADDR_UNKNOWN_TYPE, 0, NULL, NULL);
         p_cb->in_bg_conn = TRUE;
 
         BTA_DmBleSetBgConnType(BTA_DM_BLE_CONN_AUTO, NULL);
@@ -2682,7 +2684,7 @@ void bta_hh_le_update_scpp(tBTA_HH_DEV_CB *p_dev_cb, tBTA_HH_DATA *p_buf)
     if (!p_dev_cb->is_le_device ||
             p_dev_cb->mode != BTA_HH_PROTO_RPT_MODE ||
             p_dev_cb->scps_supported == FALSE) {
-        APPL_TRACE_ERROR("Can not set ScPP scan paramter as boot host, or remote does not support ScPP ");
+        APPL_TRACE_ERROR("Can not set ScPP scan parameter as boot host, or remote does not support ScPP ");
 
         cback_data.handle = p_dev_cb->hid_handle;
         cback_data.status = BTA_HH_ERR;
@@ -2908,7 +2910,7 @@ static void bta_hh_le_search_scps_chars(tBTA_HH_DEV_CB *p_cb)
 **
 ** Function         bta_hh_le_register_scpp_notif
 **
-** Description      register scan parameter refresh notitication complete
+** Description      register scan parameter refresh notification complete
 **
 **
 ** Parameters:
@@ -2919,7 +2921,7 @@ static void bta_hh_le_register_scpp_notif(tBTA_HH_DEV_CB *p_dev_cb, tBTA_GATT_ST
     UINT8               sec_flag = 0;
     tBTA_GATTC_CHAR_ID  char_id;
 
-    /* if write scan parameter sucessful */
+    /* if write scan parameter successful */
     /* if bonded and notification is not enabled, configure the client configuration */
     if (status == BTA_GATT_OK &&
             (p_dev_cb->scps_notify & BTA_HH_LE_SCPS_NOTIFY_SPT) != 0 &&
@@ -2949,7 +2951,7 @@ static void bta_hh_le_register_scpp_notif(tBTA_HH_DEV_CB *p_dev_cb, tBTA_GATT_ST
 **
 ** Function         bta_hh_le_register_scpp_notif_cmpl
 **
-** Description      action function to register scan parameter refresh notitication
+** Description      action function to register scan parameter refresh notification
 **
 ** Parameters:
 **

components/bt/host/bluedroid/bta/include/bta/bta_ar_api.h

@@ -18,7 +18,7 @@
 
 /******************************************************************************
  *
- *  This is the public interface file for the simulatenous advanced
+ *  This is the public interface file for the simultaneous advanced
  *  audio/video streaming (AV) source and sink of BTA, Broadcom's Bluetooth
  *  application layer for mobile phones.
  *
@@ -35,6 +35,10 @@
 
 #if (BTA_AR_INCLUDED == TRUE)
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/

components/bt/host/bluedroid/bta/include/bta/bta_gatt_api.h

@@ -180,7 +180,7 @@ typedef UINT8 tBTA_GATT_STATUS;
 #define BTA_GATTC_ADV_VSC_EVT           34 /* ADV VSC event */
 #define BTA_GATTC_CONNECT_EVT           35 /* GATTC CONNECT  event */
 #define BTA_GATTC_DISCONNECT_EVT        36 /* GATTC DISCONNECT  event */
-#define BTA_GATTC_READ_MULTIPLE_EVT     37 /* GATTC Read mutiple event */
+#define BTA_GATTC_READ_MULTIPLE_EVT     37 /* GATTC Read multiple event */
 #define BTA_GATTC_QUEUE_FULL_EVT        38 /* GATTC queue full event */
 #define BTA_GATTC_ASSOC_EVT             39 /* GATTC association address event */
 #define BTA_GATTC_GET_ADDR_LIST_EVT     40 /* GATTC get address list in the cache event */
@@ -728,6 +728,21 @@ typedef struct
     tBTA_GATTC_SERVICE     *included_service;
 } __attribute__((packed)) tBTA_GATTC_INCLUDED_SVC;
 
+typedef struct {
+    UINT16 scan_interval;
+    UINT16 scan_window;
+    UINT16 interval_min;
+    UINT16 interval_max;
+    UINT16 latency;
+    UINT16 supervision_timeout;
+    UINT16 min_ce_len;
+    UINT16 max_ce_len;
+} tBTA_BLE_CONN_PARAMS;
+
+#define BTA_BLE_PHY_1M_MASK     (1 << 0)
+#define BTA_BLE_PHY_2M_MASK     (1 << 1)
+#define BTA_BLE_PHY_CODED_MASK  (1 << 2)
+
 /*****************************************************************************
 **  External Function Declarations
 *****************************************************************************/
@@ -783,9 +798,10 @@ extern void BTA_GATTC_AppRegister(tBT_UUID *p_app_uuid, tBTA_GATTC_CBACK *p_clie
 *******************************************************************************/
 extern void BTA_GATTC_AppDeregister (tBTA_GATTC_IF client_if);
 
+
 /*******************************************************************************
 **
-** Function         BTA_GATTC_Open
+** Function         BTA_GATTC_Enh_Open
 **
 ** Description      Open a direct connection or add a background auto connection
 **                  bd address
@@ -793,13 +809,16 @@ extern void BTA_GATTC_AppDeregister (tBTA_GATTC_IF client_if);
 ** Parameters       client_if: server interface.
 **                  remote_bda: remote device BD address.
 **                  remote_addr_type: remote device BD address type.
-**                  is_direct: direct connection or background auto connection
+**                  is_direct: direct connection or background auto connection.
+**                  own_addr_type: own address type.
 **
 ** Returns          void
 **
 *******************************************************************************/
-extern void BTA_GATTC_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
-                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport, BOOLEAN is_aux);
+extern void BTA_GATTC_Enh_Open(tBTA_GATTC_IF client_if, BD_ADDR remote_bda, tBTA_ADDR_TYPE remote_addr_type,
+                    BOOLEAN is_direct, tBTA_GATT_TRANSPORT transport, BOOLEAN is_aux, tBTA_ADDR_TYPE own_addr_type,
+                    UINT8 phy_mask, tBTA_BLE_CONN_PARAMS *phy_1m_conn_params, tBTA_BLE_CONN_PARAMS *phy_2m_conn_params,
+                    tBTA_BLE_CONN_PARAMS *phy_coded_conn_params);
 
 /*******************************************************************************
 **
@@ -937,8 +956,8 @@ extern void BTA_GATTC_GetGattDb(UINT16 conn_id, UINT16 start_handle, UINT16 end_
 **
 ** Description      This function is called to read a characteristics value
 **
-** Parameters       conn_id - connectino ID.
-**                  handle - characteritic handle to read.
+** Parameters       conn_id - connection ID.
+**                  handle - characteristic handle to read.
 **
 ** Returns          None
 **
@@ -953,7 +972,7 @@ void BTA_GATTC_ReadCharacteristic(UINT16 conn_id, UINT16 handle, tBTA_GATT_AUTH_
 **
 ** Parameters       conn_id - connection ID.
 **                  s_handle - start handle.
-**                  e_handle - end hanle
+**                  e_handle - end handle
 **                  uuid - The attribute UUID.
 **
 ** Returns          None
@@ -1072,7 +1091,7 @@ extern tBTA_GATT_STATUS BTA_GATTC_DeregisterForNotifications (tBTA_GATTC_IF
 ** Description      This function is called to prepare write a characteristic value.
 **
 ** Parameters       conn_id - connection ID.
-**                  handle - GATT characteritic handle.
+**                  handle - GATT characteristic handle.
 **                  offset - offset of the write value.
 **                  len - length of the data to be written.
 **                  p_value - the value to be written.
@@ -1094,7 +1113,7 @@ extern void BTA_GATTC_PrepareWrite  (UINT16 conn_id,
 ** Description      This function is called to prepare write a characteristic descriptor value.
 **
 ** Parameters       conn_id - connection ID.
-**                  p_char_descr_id - GATT characteritic descriptor ID of the service.
+**                  p_char_descr_id - GATT characteristic descriptor ID of the service.
 **                  offset - offset of the write value.
 **                  len: length of the data to be written.
 **                  p_value - the value to be written.
@@ -1238,7 +1257,7 @@ extern void BTA_GATTC_ConfigureMTU (UINT16 conn_id);
 **
 ** Function         BTA_GATTS_Init
 **
-** Description      This function is called to initalize GATTS module
+** Description      This function is called to initialize GATTS module
 **
 ** Parameters       None
 **

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -40,31 +40,6 @@
 
 #if (SDP_INCLUDED == TRUE)
 
-/*****************************************************************************
-**  Constants
-*****************************************************************************/
-
-static const uint8_t  UUID_OBEX_OBJECT_PUSH[] = {0x00, 0x00, 0x11, 0x05, 0x00, 0x00, 0x10, 0x00,
-                                                 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                                };
-static const uint8_t  UUID_PBAP_PSE[] = {0x00, 0x00, 0x11, 0x2F, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_PBAP_PCE[] = {0x00, 0x00, 0x11, 0x2E, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_MAP_MAS[] = {0x00, 0x00, 0x11, 0x32, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_MAP_MNS[] = {0x00, 0x00, 0x11, 0x33, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_SPP[] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
-static const uint8_t  UUID_SAP[] = {0x00, 0x00, 0x11, 0x2D, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
 // TODO:
 // Both the fact that the UUIDs are declared in multiple places, plus the fact
 // that there is a mess of UUID comparison and shortening methods will have to
@@ -369,7 +344,7 @@ static void bta_create_sap_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     tSDP_PROTOCOL_ELEM pe;
     UINT16 pversion = -1;
 
-    record->sap.hdr.type = SDP_TYPE_MAP_MAS;
+    record->sap.hdr.type = SDP_TYPE_SAP_SERVER;
     record->sap.hdr.service_name_length = 0;
     record->sap.hdr.service_name = NULL;
     record->sap.hdr.rfcomm_channel_number = 0;
@@ -420,6 +395,15 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     record->raw.hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
+static bool check_if_uuid16_match(UINT16 uuid16, tBT_UUID *uuid)
+{
+    // Because it is converted to a short UUID, only uuid16 needs to be checked.
+    if (uuid->len == 2 && uuid->uu.uuid16 == uuid16) {
+        return TRUE;
+    } else {
+        return FALSE;
+    }
+}
 
 /*******************************************************************************
 **
@@ -456,25 +440,25 @@ static void bta_sdp_search_cback(UINT16 result, void *user_data)
             /* generate the matching record data pointer */
             if (p_rec != NULL) {
                 status = BTA_SDP_SUCCESS;
-                if (uuid->uu.uuid16 == UUID_SERVCLASS_PNP_INFORMATION) {
+                if (check_if_uuid16_match(UUID_SERVCLASS_PNP_INFORMATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found DIP uuid\n", __func__);
                     bta_create_dip_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MAS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_ACCESS, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MAS) uuid\n", __func__);
                     bta_create_mas_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MNS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_NOTIFICATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MNS) uuid\n", __func__);
                     bta_create_mns_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PSE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PSE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PSE) uuid\n", __func__);
                     bta_create_pse_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PCE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PCE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PCE) uuid\n", __func__);
                     bta_create_pce_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_OBEX_OBJECT_PUSH, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_OBEX_OBJECT_PUSH, &su)) {
                     APPL_TRACE_DEBUG("%s() - found Object Push Server (OPS) uuid\n", __func__);
                     bta_create_ops_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_SAP, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_SAP, &su)) {
                     APPL_TRACE_DEBUG("%s() - found SAP uuid\n", __func__);
                     bta_create_sap_sdp_record(&evt_data.records[count], p_rec);
                 } else {

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -182,11 +182,12 @@ static void btc_dm_remove_ble_bonding_keys(void)
     btc_storage_remove_ble_bonding_keys(&bd_addr);
 }
 
+#if BLE_SMP_BOND_NVS_FLASH
 static void btc_dm_save_ble_bonding_keys(void)
 {
     if (!(btc_dm_cb.pairing_cb.ble.is_penc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_pid_key_rcvd || btc_dm_cb.pairing_cb.ble.is_pcsrk_key_rcvd ||
-         btc_dm_cb.pairing_cb.ble.is_lenc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lcsrk_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd)) {
-        return ;
+        btc_dm_cb.pairing_cb.ble.is_lenc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lcsrk_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd)) {
+        return;
     }
     bt_bdaddr_t bd_addr;
 
@@ -244,13 +245,13 @@ static void btc_dm_save_ble_bonding_keys(void)
         btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd = false;
     }
 }
+#endif
 
 static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
     BTC_TRACE_DEBUG("%s, status = %d", __func__, p_auth_cmpl->success);
     bt_status_t status = BT_STATUS_FAIL;
-    int addr_type;
     bt_bdaddr_t bdaddr;
     bdcpy(bdaddr.address, p_auth_cmpl->bd_addr);
     bdcpy(btc_dm_cb.pairing_cb.bd_addr, p_auth_cmpl->bd_addr);
@@ -266,6 +267,9 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             return;
         }
 
+#if BLE_SMP_BOND_NVS_FLASH
+        int addr_type;
+
         if (btc_dm_cb.pairing_cb.ble.is_pid_key_rcvd) {
             // delete unused section in NVS
             btc_storage_remove_unused_sections(p_auth_cmpl->bd_addr, &btc_dm_cb.pairing_cb.ble.pid_key);
@@ -276,6 +280,7 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
         }
         btc_storage_set_ble_dev_auth_mode(&bdaddr, p_auth_cmpl->auth_mode, true);
         btc_dm_save_ble_bonding_keys();
+#endif
     } else {
         /*Map the HCI fail reason  to  bt status  */
         switch (p_auth_cmpl->fail_reason) {
@@ -288,6 +293,9 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             status = BT_STATUS_AUTH_REJECTED;
             break;
         default:
+            BTC_TRACE_WARNING ("%s, remove bond in flash bd_addr: %08x%04x", __func__,
+                                (p_auth_cmpl->bd_addr[0] << 24) + (p_auth_cmpl->bd_addr[1] << 16) + (p_auth_cmpl->bd_addr[2] << 8) + p_auth_cmpl->bd_addr[3],
+                                (p_auth_cmpl->bd_addr[4] << 8) + p_auth_cmpl->bd_addr[5]);
             btc_dm_remove_ble_bonding_keys();
             status =  BT_STATUS_FAIL;
             break;

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -122,6 +122,11 @@ uint32_t btc_get_ble_status(void)
 {
     uint32_t status = BTC_BLE_STATUS_IDLE;
 
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        BTC_TRACE_ERROR("%s Bluedroid not enabled", __func__);
+        return status;
+    }
+
     #if (BLE_INCLUDED == TRUE)
     // Number of active advertising
     extern uint8_t btm_ble_adv_active_count(void);

components/bt/host/bluedroid/btc/core/btc_util.c

@@ -349,7 +349,7 @@ esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
     return esp_status;
 }
 
-esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
+esp_bt_status_t btc_btm_status_to_esp_status(uint8_t btm_status)
 {
     esp_bt_status_t esp_status = ESP_BT_STATUS_FAIL;
     switch(btm_status) {
@@ -392,7 +392,7 @@ esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
     return esp_status;
 }
 
-esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status)
+esp_bt_status_t btc_bta_status_to_esp_status(uint8_t bta_status)
 {
     esp_bt_status_t esp_status = ESP_BT_STATUS_FAIL;
     switch(bta_status){
@@ -424,3 +424,36 @@ esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status)
 
     return esp_status;
 }
+
+void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src)
+{
+    p_dest->len = p_src->len;
+    if (p_src->len == LEN_UUID_16) {
+        p_dest->uuid.uuid16 = p_src->uu.uuid16;
+    } else if (p_src->len == LEN_UUID_32) {
+        p_dest->uuid.uuid32 = p_src->uu.uuid32;
+    } else if (p_src->len == LEN_UUID_128) {
+        memcpy(&p_dest->uuid.uuid128, p_src->uu.uuid128, p_dest->len);
+    } else if (p_src->len == 0) {
+        /* do nothing for now, there's some scenario will input 0
+           such as, receive notify, the descriptor may be 0 */
+    } else {
+        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
+    }
+}
+
+void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src)
+{
+    p_dest->len = p_src->len;
+    if (p_src->len == LEN_UUID_16) {
+        p_dest->uu.uuid16 = p_src->uuid.uuid16;
+    } else if (p_src->len == LEN_UUID_32) {
+        p_dest->uu.uuid32 = p_src->uuid.uuid32;
+    } else if (p_src->len == LEN_UUID_128) {
+        memcpy(&p_dest->uu.uuid128, p_src->uuid.uuid128, p_dest->len);
+    } else if (p_src->len == 0) {
+        /* do nothing for now, there's some scenario will input 0 */
+    } else {
+        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
+    }
+}

components/bt/host/bluedroid/btc/include/btc/btc_util.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -57,8 +57,11 @@ void uuid128_be_to_esp_uuid(esp_bt_uuid_t *u, uint8_t* uuid128);
 void uuid_to_string_legacy(bt_uuid_t *p_uuid, char *str);
 
 esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status);
-esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status);
-esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status);
+esp_bt_status_t btc_btm_status_to_esp_status(uint8_t btm_status);
+esp_bt_status_t btc_bta_status_to_esp_status(uint8_t bta_status);
+
+void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src);
+void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src);
 
 #ifdef __cplusplus
 }

components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -175,8 +175,7 @@ bool btc_avrc_ct_init_p(void)
 bool btc_avrc_tg_connected_p(void)
 {
     return (s_rc_tg_init == BTC_RC_TG_INIT_MAGIC) &&
-           (btc_rc_cb.rc_connected == TRUE) &&
-           (btc_rc_cb.rc_features & BTA_AV_FEAT_RCCT);
+           (btc_rc_cb.rc_connected == TRUE);
 }
 
 bool btc_avrc_ct_connected_p(void)
@@ -507,7 +506,7 @@ static void handle_rc_connect (tBTA_AV_RC_OPEN *p_rc_open)
             btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
         }
 
-        if (p_rc_open->peer_features & BTA_AV_FEAT_RCCT) {
+        if (btc_avrc_tg_init_p()) {
             esp_avrc_tg_cb_param_t param;
             memset(&param, 0, sizeof(esp_avrc_tg_cb_param_t));
             param.conn_stat.connected = true;
@@ -580,7 +579,7 @@ static void handle_rc_disconnect (tBTA_AV_RC_CLOSE *p_rc_close)
         btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
     }
 
-    if (rc_features & BTA_AV_FEAT_RCCT) {
+    if (btc_avrc_tg_init_p()) {
         esp_avrc_tg_cb_param_t param;
         memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
         param.conn_stat.connected = false;
@@ -1006,14 +1005,10 @@ void btc_rc_handler(tBTA_AV_EVT event, tBTA_AV *p_data)
                 memcpy(param.conn_stat.remote_bda, btc_rc_cb.rc_addr, sizeof(esp_bd_addr_t));
                 btc_avrc_ct_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
             }
-            if ((p_data->rc_feat.peer_features & BTA_AV_FEAT_RCCT) &&
-                !(old_feats & BTA_AV_FEAT_RCCT)) {
-                esp_avrc_tg_cb_param_t param;
-                memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
-                param.conn_stat.connected = true;
-                memcpy(param.conn_stat.remote_bda, btc_rc_cb.rc_addr, sizeof(esp_bd_addr_t));
-                btc_avrc_tg_cb_to_app(ESP_AVRC_TG_CONNECTION_STATE_EVT, &param);
-            }
+            /**
+             * @note ESP_AVRC_TG_CONNECTION_STATE_EVT has been reported on rc connect/disconnect event,
+             * it doesn't rely on the SDP results.
+             */
         } while (0);
         btc_rc_cb.rc_features = p_data->rc_feat.peer_features;
         btc_rc_cb.rc_ct_features = p_data->rc_feat.peer_ct_features;

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -82,23 +82,6 @@ void btc128_to_bta_uuid(tBT_UUID *p_dest, uint8_t *p_src)
 /*******************************************************************************
  * BTC -> BTA conversion functions
  *******************************************************************************/
-
-void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src)
-{
-    p_dest->len = p_src->len;
-    if (p_src->len == LEN_UUID_16) {
-        p_dest->uu.uuid16 = p_src->uuid.uuid16;
-    } else if (p_src->len == LEN_UUID_32) {
-        p_dest->uu.uuid32 = p_src->uuid.uuid32;
-    } else if (p_src->len == LEN_UUID_128) {
-        memcpy(&p_dest->uu.uuid128, p_src->uuid.uuid128, p_dest->len);
-    } else if (p_src->len == 0) {
-        /* do nothing for now, there's some scenario will input 0 */
-    } else {
-        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
-    }
-}
-
 void btc_to_bta_gatt_id(tBTA_GATT_ID *p_dest, esp_gatt_id_t *p_src)
 {
     p_dest->inst_id = p_src->inst_id;
@@ -115,23 +98,6 @@ void btc_to_bta_srvc_id(tBTA_GATT_SRVC_ID *p_dest, esp_gatt_srvc_id_t *p_src)
 /*******************************************************************************
  * BTA -> BTC conversion functions
  *******************************************************************************/
-void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src)
-{
-    p_dest->len = p_src->len;
-    if (p_src->len == LEN_UUID_16) {
-        p_dest->uuid.uuid16 = p_src->uu.uuid16;
-    } else if (p_src->len == LEN_UUID_32) {
-        p_dest->uuid.uuid32 = p_src->uu.uuid32;
-    } else if (p_src->len == LEN_UUID_128) {
-        memcpy(&p_dest->uuid.uuid128, p_src->uu.uuid128, p_dest->len);
-    } else if (p_src->len == 0) {
-        /* do nothing for now, there's some scenario will input 0
-           such as, receive notify, the descriptor may be 0 */
-    } else {
-        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
-    }
-}
-
 void bta_to_btc_gatt_id(esp_gatt_id_t *p_dest, tBTA_GATT_ID *p_src)
 {
     p_dest->inst_id = p_src->inst_id;