change(version): Update version to 5.3.4

feat(mbedtls): Add support for RSA decryption with DS peripheral (v5.3)

See merge request espressif/esp-idf!40451

.github/workflows/release_zips.yml

@@ -8,10 +8,11 @@ on:
 jobs:
   release_zips:
     name: Create release zip file
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Create a recursive clone source zip
-        uses: espressif/github-actions/release_zips@master
-        env:
-            RELEASE_PROJECT_NAME: ESP-IDF
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: espressif/release-zips-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_project_name: ESP-IDF
+          git_extra_args: --shallow-since="1 year ago"

.gitlab/ci/build.yml

@@ -219,7 +219,7 @@ pytest_build_system_macos:
     PYENV_VERSION: "3.8"
     # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
     CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
-    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
+
 build_docker:
   extends:
     - .before_script:minimal

.gitlab/ci/common.yml

@@ -39,7 +39,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.3.3
+  LATEST_GIT_TAG: v5.3.4
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules

.gitlab/ci/deploy.yml

@@ -19,6 +19,7 @@ check_submodule_sync:
   dependencies: []
   script:
     - git submodule deinit --force .
+    - rm -rf .git/modules  # remove all the cached metadata
     # setting the default remote URL to the public one, to resolve relative location URLs
     - git config remote.origin.url ${PUBLIC_IDF_URL}
     # check if all submodules are correctly synced to public repository

.gitlab/ci/docs.yml

@@ -144,11 +144,16 @@ build_docs_html_partial:
   variables:
     DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
     PYTHONUNBUFFERED: 1
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 0
   stage: test_deploy
   tags:
     - deploy
     - shiny
   script:
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    - git fetch --tags --prune
     - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
     - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
     - deploy-docs

.gitlab/ci/host-test.yml

@@ -133,7 +133,8 @@ test_cli_installer:
   script:
     # Tools must be downloaded for testing
     # We could use "idf_tools.py download all", but we don't want to install clang because of its huge size
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                      cmake@version that is supported
+    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}/tools/test_idf_tools
     - python3 -m pip install jsonschema
     - python3 ./test_idf_tools.py -v

.gitlab/ci/test-win.yml

@@ -31,7 +31,8 @@ test_cli_installer_win:
     IDF_PATH: "$CI_PROJECT_DIR"
   script:
     # Tools must be downloaded for testing
-    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                     cmake@version that is supported
+    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}\tools\test_idf_tools
     - python -m pip install jsonschema
     - python .\test_idf_tools.py

components/app_trace/app_trace_membufs_proto.c

@@ -92,7 +92,7 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
     // switch to new block
     proto->state.in_block++;
 
-    proto->hw->swap(new_block_num);
+    proto->hw->swap(new_block_num, proto->state.markers[prev_block_num]);
 
     // handle data from host
     esp_hostdata_hdr_t *hdr = (esp_hostdata_hdr_t *)proto->blocks[new_block_num].start;

components/app_trace/port/riscv/port.c

@@ -50,7 +50,7 @@ static uint8_t *esp_apptrace_riscv_down_buffer_get(esp_apptrace_riscv_data_t *hw
 static esp_err_t esp_apptrace_riscv_down_buffer_put(esp_apptrace_riscv_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_riscv_host_is_connected(esp_apptrace_riscv_data_t *hw_data);
 static esp_err_t esp_apptrace_riscv_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_riscv_host_data_pending(void);
 
@@ -353,7 +353,7 @@ static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint3
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
     /* do nothing */
     return ESP_OK;

components/app_trace/port/xtensa/port.c

@@ -208,7 +208,7 @@ static uint8_t *esp_apptrace_trax_down_buffer_get(esp_apptrace_trax_data_t *hw_d
 static esp_err_t esp_apptrace_trax_down_buffer_put(esp_apptrace_trax_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_trax_host_is_connected(esp_apptrace_trax_data_t *hw_data);
 static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_trax_host_data_pending(void);
 
@@ -526,21 +526,21 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
     uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
     uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
 
-    /* calculate CRC16 of the already switched block */
-    if (prev_block_len > 0) {
-        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
-        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
-        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
-        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
-    }
     eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
               host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
     esp_apptrace_trax_buffer_swap_unlock();
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
+    /* Before switching to the new block, calculate CRC16 of the current block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
     esp_apptrace_trax_select_memory_block(new_block_id);
     return ESP_OK;
 }

components/app_trace/private_include/esp_app_trace_membufs_proto.h

@@ -29,7 +29,7 @@ typedef struct {
 
 typedef struct {
     esp_err_t (*swap_start)(uint32_t curr_block_id);
-    esp_err_t (*swap)(uint32_t new_block_id);
+    esp_err_t (*swap)(uint32_t new_block_id, uint32_t prev_block_len);
     esp_err_t (*swap_end)(uint32_t new_block_id, uint32_t prev_block_len);
     bool (*host_data_pending)(void);
 } esp_apptrace_membufs_proto_hw_t;

components/bootloader/Kconfig.projbuild

@@ -1227,7 +1227,7 @@ menu "Security features"
                 It is also possible to enable secure download mode at runtime by calling
                 esp_efuse_enable_rom_secure_download_mode()
 
-                Note: Secure Download mode is not available for ESP32 (includes revisions till ECO3).
+                Note: Secure Download mode is not available for ESP32.
 
         config SECURE_INSECURE_ALLOW_DL_MODE
             bool "UART ROM download mode (Enabled (not recommended))"

components/bootloader_support/src/bootloader_common_loader.c

@@ -28,6 +28,7 @@
 
 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
 #define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
 static const char* TAG = "boot_comm";
 
@@ -242,7 +243,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
     #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
     static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
     return s_bootloader_retain_mem;

components/bootloader_support/src/esp32h2/secure_boot_secure_features.c

@@ -1,10 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
 #include <strings.h>
+#include "hal/ecdsa_ll.h"
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
     ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+    }
+#endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable hardware & software JTAG...");
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);

components/bootloader_support/src/secure_boot.c

@@ -12,6 +12,10 @@
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
 
+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static __attribute__((unused)) const char *TAG = "secure_boot";
 
@@ -331,6 +335,23 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
     }
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+        if (!secure) {
+            uint8_t current_curve;
+            esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+            if (err == ESP_OK) {
+                if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+                    // If not P256 mode
+                    result &= secure;
+                    ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+                }
+            }
+        }
+    }
+#endif
+
 #ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
     secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
     result &= secure;

components/bt/common/Kconfig.in

@@ -27,6 +27,21 @@ config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
     help
         Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
 
+config BT_BLE_LOG_SPI_OUT_HCI_BUF_SIZE
+    int "SPI transaction buffer size for HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for HCI logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_TASK_CNT
+    int "HCI task count"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1
+    help
+        HCI task count
+
 config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
     bool "Enable Host log output to SPI"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -35,6 +50,21 @@ config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
         This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
         When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
 
+config BT_BLE_LOG_SPI_OUT_HOST_BUF_SIZE
+    int "SPI transaction buffer size for host logs"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for host logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HOST_TASK_CNT
+    int "Host task count"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 2
+    help
+        Host task count.
+
 config BT_BLE_LOG_SPI_OUT_LL_ENABLED
     bool "Enable Controller log output to SPI"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -105,7 +135,7 @@ config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
 config BT_BLE_LOG_SPI_OUT_TS_SYNC_SLEEP_SUPPORT
     bool "Enable ble log & logic analyzer log time sync sleep support"
     depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
-    default n
+    default y
     help
         Enable ble log & logic analyzer log time sync sleep support
 
@@ -138,3 +168,32 @@ config BT_BLE_LOG_SPI_OUT_LE_AUDIO_BUF_SIZE
     help
         SPI transaction buffer size for LE Audio logs.
         There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_TASK_CNT
+    int "LE audio task count"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1
+    help
+        LE audio task count
+
+config BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    bool "Enable BLE mesh log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable BLE mesh log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_MESH_BUF_SIZE
+    int "SPI transaction buffer size for BLE mesh logs"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for BLE mesh logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MESH_TASK_CNT
+    int "Mesh task count"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 3
+    help
+        Mesh task count

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -11,8 +11,8 @@
 #include "driver/spi_master.h"
 #include "driver/gpio.h"
 #include "esp_timer.h"
-#include "esp_log.h"
 #include "freertos/semphr.h"
+#include "esp_heap_caps.h"
 
 // Public enums
 enum {
@@ -26,21 +26,22 @@ enum {
     BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR,
     BLE_LOG_SPI_OUT_SOURCE_LL_HCI,
     BLE_LOG_SPI_OUT_SOURCE_LE_AUDIO,
+    BLE_LOG_SPI_OUT_SOURCE_MESH,
     BLE_LOG_SPI_OUT_SOURCE_USER = 0x10,
     BLE_LOG_SPI_OUT_SOURCE_SSC = 0xFD,
     BLE_LOG_SPI_OUT_SOURCE_SYNC,
     BLE_LOG_SPI_OUT_SOURCE_LOSS,
 };
 
-enum {
-    BLE_LOG_SPI_OUT_LEVEL_NONE = 0,
-    BLE_LOG_SPI_OUT_LEVEL_ERROR,
-    BLE_LOG_SPI_OUT_LEVEL_WARN,
-    BLE_LOG_SPI_OUT_LEVEL_INFO,
-    BLE_LOG_SPI_OUT_LEVEL_DEBUG,
-    BLE_LOG_SPI_OUT_LEVEL_VERBOSE,
-    BLE_LOG_SPI_OUT_LEVEL_MAX,
-};
+#define BLE_LOG_SPI_OUT_LEVEL_NONE                  0
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR                 1
+#define BLE_LOG_SPI_OUT_LEVEL_WARN                  2
+#define BLE_LOG_SPI_OUT_LEVEL_INFO                  3
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG                 4
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE               5
+#define BLE_LOG_SPI_OUT_STR(x)                      #x
+#define BLE_LOG_SPI_OUT_XSTR(x)                     BLE_LOG_SPI_OUT_STR(x)
+#define BLE_LOG_SPI_OUT_BUILD_PREFIX(LEVEL, TAG)    "[" BLE_LOG_SPI_OUT_XSTR(LEVEL) "][" TAG "]"
 
 // Public functions
 int ble_log_spi_out_init(void);
@@ -52,12 +53,12 @@ void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_ap
 void ble_log_spi_out_ll_log_ev_proc(void);
 void ble_log_spi_out_ts_sync_start(void);
 void ble_log_spi_out_ts_sync_stop(void);
-int ble_log_spi_out_printf(uint8_t source, const char *format, ...);
-int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...);
-int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len);
 void ble_log_spi_out_dump_all(void);
 void ble_log_spi_out_enable(bool enable);
 void ble_log_spi_out_flush(void);
 void ble_log_spi_out_le_audio_write(const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_host_write(uint8_t source, const char *prefix, const char *format, ...);
+int ble_log_spi_out_hci_write(uint8_t source, const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_mesh_write(const char *prefix, const char *format, ...);
 
 #endif // __BT_SPI_OUT_H__

components/bt/common/btc/core/btc_task.c

@@ -484,10 +484,10 @@ static bt_status_t btc_init_mem(void) {
 #endif
 
 #if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
-    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(sizeof(hf_local_param_t))) == NULL) {
         goto error_exit;
     }
-    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+    memset((void *)hf_local_param_ptr, 0, sizeof(hf_local_param_t));
 #endif
 
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -298,7 +298,7 @@ int esp_blufi_gatt_svr_deinit(void)
     return 0;
 }
 
-static int
+int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
     struct ble_gap_conn_desc desc;
@@ -331,7 +331,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         }
         if (event->connect.status != 0) {
             /* Connection failed; resume advertising. */
-            esp_blufi_adv_start();
+           ((void(*)(void))arg)();
         }
         return 0;
     case BLE_GAP_EVENT_DISCONNECT:
@@ -366,7 +366,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
     case BLE_GAP_EVENT_ADV_COMPLETE:
         ESP_LOGI(TAG, "advertise complete; reason=%d",
                  event->adv_complete.reason);
-        esp_blufi_adv_start();
+        ((void(*)(void))arg)();
         return 0;
 
     case BLE_GAP_EVENT_SUBSCRIBE:
@@ -461,7 +461,7 @@ void esp_blufi_adv_start(void)
     adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
     adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
     rc = ble_gap_adv_start(own_addr_type, NULL, BLE_HS_FOREVER,
-                           &adv_params, esp_blufi_gap_event, NULL);
+                           &adv_params, esp_blufi_gap_event, esp_blufi_adv_start);
     if (rc != 0) {
         ESP_LOGE(TAG, "error enabling advertisement; rc=%d", rc);
         return;

components/bt/common/hci_log/bt_hci_log.c

@@ -10,6 +10,7 @@
 #include "bt_common.h"
 #include "osi/mutex.h"
 #include "esp_attr.h"
+#include "esp_timer.h"
 
 #if (BT_HCI_LOG_INCLUDED == TRUE)
 #define BT_HCI_LOG_PRINT_TAG                     (1)
@@ -208,6 +209,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 {
     osi_mutex_t mutex_lock;
     uint8_t *g_hci_log_buffer;
+    int64_t ts;
+    uint8_t *temp_buf;
 
     if (!p_hci_log_ctl->p_hci_log_buffer) {
         return ESP_FAIL;
@@ -219,6 +222,16 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         return ESP_FAIL;
     }
 
+    ts = esp_timer_get_time();
+
+    temp_buf = (uint8_t *)malloc(data_len + 8);
+    memset(temp_buf, 0x0, data_len + 8);
+
+    memcpy(temp_buf, &ts, 8);
+    memcpy(temp_buf + 8, data, data_len);
+
+    data_len += 8;
+
     mutex_lock = p_hci_log_ctl->mutex_lock;
     osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
 
@@ -250,7 +263,7 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         bt_hci_log_record_string(p_hci_log_ctl, str);
     }
 
-    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+    bt_hci_log_record_hex(p_hci_log_ctl, temp_buf, data_len);
 
     g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';
 
@@ -266,6 +279,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 
     osi_mutex_unlock(&mutex_lock);
 
+    free(temp_buf);
+
     return ESP_OK;
 }
 

components/bt/controller/esp32/Kconfig.in

@@ -421,6 +421,7 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
 
 config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
     default n
     help
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.

components/bt/controller/esp32/bt.c

@@ -252,6 +252,7 @@ extern uint32_t _bt_controller_data_end;
 extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
+extern void btdm_aa_check_enhance_enable(void);
 
 #ifdef CONFIG_BT_BLUEDROID_ENABLED
 extern void bt_stack_enableSecCtrlVsCmd(bool en);
@@ -965,7 +966,7 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
     assert(us_to_sleep > BTDM_MIN_TIMER_UNCERTAINTY_US);
     // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
     // and set the timer in advance
-    uint32_t uncertainty = (us_to_sleep >> 11);
+    uint32_t uncertainty = (us_to_sleep / 1000);
     if (uncertainty < BTDM_MIN_TIMER_UNCERTAINTY_US) {
         uncertainty = BTDM_MIN_TIMER_UNCERTAINTY_US;
     }
@@ -1540,12 +1541,14 @@ static esp_err_t btdm_low_power_mode_init(void)
     bool select_src_ret __attribute__((unused));
     bool set_div_ret __attribute__((unused));
     if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        ESP_LOGI(BTDM_LOG_TAG, "Using main XTAL as clock source");
         select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
         set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
         assert(select_src_ret && set_div_ret);
         btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
         btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
     } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        ESP_LOGI(BTDM_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
         select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
         set_div_ret = btdm_lpclk_set_div(0);
         assert(select_src_ret && set_div_ret);
@@ -1849,6 +1852,10 @@ static void patch_apply(void)
 #ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
     config_ble_funcs_reset();
 #endif
+
+#if BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)

components/bt/controller/esp32c2/Kconfig.in

@@ -281,94 +281,103 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable controller log module
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable hci log module
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Only operate in dump mode
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-    bool "Output ble controller logs to SPI bus (Experimental)"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    select BT_BLE_LOG_SPI_OUT_ENABLED
-    default n
-    help
-        Output ble controller logs to SPI bus
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-            Store ble controller logs to flash memory.
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+                Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
-            The size of ble controller log partition shall be a multiples of 4K.
-            The name of log partition shall be "bt_ctrl_log".
-            The partition type shall be ESP_PARTITION_TYPE_DATA.
-            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
+                The size of ble controller log partition shall be a multiples of 4K.
+                The name of log partition shall be "bt_ctrl_log".
+                The partition type shall be ESP_PARTITION_TYPE_DATA.
+                The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the first BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
-            Configure the size of the second BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
+                Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the BLE HCI LOG buffer.
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the BLE HCI LOG buffer.
 
-config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
-    bool "Enable wrap panic handler"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
+endmenu
 
-config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
-    bool "Enable esp_task_wdt_isr_user_handler implementation"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5

components/bt/controller/esp32c2/bt.c

@@ -141,7 +141,7 @@ extern void esp_panic_handler_feed_wdts(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
-extern int ble_controller_disable(void);
+extern void ble_controller_disable(void);
 extern int esp_register_ext_funcs (struct ext_funcs_t *);
 extern void esp_unregister_ext_funcs (void);
 extern int esp_ble_ll_set_public_addr(const uint8_t *addr);
@@ -1077,9 +1077,9 @@ esp_err_t esp_bt_controller_disable(void)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "invalid controller state");
         return ESP_FAIL;
     }
-    if (ble_controller_disable() != 0) {
-        return ESP_FAIL;
-    }
+    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
+
+    ble_controller_disable();
     ble_stack_disable();
     if (s_ble_active) {
         esp_phy_disable(PHY_MODEM_BT);
@@ -1091,7 +1091,6 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
-    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
     return ESP_OK;
 }
 
@@ -1574,3 +1573,10 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32c3/Kconfig.in

@@ -414,10 +414,10 @@ menu "MODEM SLEEP Options"
                 modem sleep to be used with both DFS and light sleep.
 
         config BT_CTRL_LPCLK_SEL_RTC_SLOW
-            bool "Internal 150kHz RC oscillator"
+            bool "Internal 136kHz RC oscillator"
             depends on RTC_CLK_SRC_INT_RC
             help
-                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
+                Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                 in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
     endchoice
 
@@ -597,6 +597,7 @@ menu "Controller debug log Options (Experimental)"
         depends on BT_CTRL_LE_LOG_EN
         depends on !BT_CTRL_LE_LOG_DUMP_ONLY
         select BT_BLE_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_SPI_OUT_LL_ENABLED
         default n
         help
             Output ble controller logs to SPI bus

components/bt/controller/esp32c3/bt.c

@@ -550,7 +550,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 #if CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
 static IRAM_ATTR void esp_bt_controller_spi_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
-    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY, addr, len);
+    ble_log_spi_out_ll_write(len, addr, 0, NULL, 0);
 }
 #endif // CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
 
@@ -1649,15 +1649,11 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
 #endif
                 }
             } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {  // Internal 136kHz RC oscillator
-                if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
-                    ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is "
-                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
-                } else {
+                if (rtc_clk_slow_src_get() != SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
                     ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator not detected.");
                     assert(0);
                 }
             } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
-                ESP_LOGI(BT_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
 #if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
                 s_lp_cntl.no_light_sleep = 1;
 #endif
@@ -1669,6 +1665,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
         bool select_src_ret __attribute__((unused));
         bool set_div_ret __attribute__((unused));
         if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using main XTAL as clock source");
 #ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
             ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
             s_lp_cntl.main_xtal_pu = 1;
@@ -1679,6 +1676,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
             btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
             btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
         } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
             select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
             set_div_ret = btdm_lpclk_set_div(0);
             assert(select_src_ret && set_div_ret);
@@ -1687,6 +1685,8 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
                 (1000000 >> (15 - RTC_CLK_CAL_FRACT));
             assert(btdm_lpcycle_us != 0);
         } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {
+            ESP_LOGW(BT_LOG_TAG, "Using 136 kHz RC as clock source. The accuracy of this clock is a lot larger than 500ppm which is "
+                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
             select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
             set_div_ret = btdm_lpclk_set_div(0);
             assert(select_src_ret && set_div_ret);
@@ -1808,6 +1808,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
     if (ble_log_spi_out_init() != 0) {
         ESP_LOGE(BT_LOG_TAG, "BLE Log SPI output init failed");
+        err = ESP_ERR_NO_MEM;
         goto error;
     }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

components/bt/controller/esp32c6/Kconfig.in

@@ -447,6 +447,12 @@ menu "Controller debug features"
     config BT_LE_PTR_CHECK_ENABLED
         bool "Enable boundary check for internal memory"
         default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -846,3 +852,38 @@ config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
     help
         If this option is enabled, The Controller will continue to
         Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            connection instances and the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n

components/bt/controller/esp32c6/ble.c

@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);
 
+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -104,6 +126,27 @@ int ble_stack_initEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
 
+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
     return 0;
 }
 
@@ -115,7 +158,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
     base_stack_deinitEnv();
 }
 
@@ -128,6 +176,28 @@ int ble_stack_enable(void)
         return rc;
     }
 
+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_enable();
     if (rc) {
@@ -166,6 +236,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
     base_stack_disable();
 }

components/bt/controller/esp32c6/bt.c

@@ -1770,3 +1770,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, ui
     }
     return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -283,6 +283,9 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/controller/esp32h2/Kconfig.in

@@ -441,6 +441,12 @@ menu "Controller debug features"
     config BT_LE_PTR_CHECK_ENABLED
         bool "Enable boundary check for internal memory"
         default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -850,3 +856,38 @@ config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
     help
         If this option is enabled, The Controller will continue to
         Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum connection instances and
+            the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n

components/bt/controller/esp32h2/ble.c

@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);
 
+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -85,6 +107,28 @@ int ble_stack_initEnv(void)
         return rc;
     }
 
+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_initEnv();
     if (rc) {
@@ -109,7 +153,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
     base_stack_deinitEnv();
 }
 
@@ -122,6 +171,28 @@ int ble_stack_enable(void)
         return rc;
     }
 
+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_enable();
     if (rc) {
@@ -160,6 +231,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
     base_stack_disable();
 }

components/bt/controller/esp32h2/bt.c

@@ -1693,3 +1693,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, ui
     }
     return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -280,6 +280,9 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/host/bluedroid/Kconfig.in

@@ -1227,7 +1227,7 @@ config BT_BLE_50_EXTEND_ADV_EN
 
 config BT_BLE_50_PERIODIC_ADV_EN
     bool "Enable BLE periodic advertising"
-    depends on BT_BLE_50_FEATURES_SUPPORTED
+    depends on BT_BLE_50_EXTEND_ADV_EN
     default y
     help
         This enables BLE periodic advertising
@@ -1241,7 +1241,7 @@ config BT_BLE_50_EXTEND_SCAN_EN
 
 config BT_BLE_50_EXTEND_SYNC_EN
     bool "Enable BLE periodic advertising sync"
-    depends on BT_BLE_50_FEATURES_SUPPORTED
+    depends on BT_BLE_50_EXTEND_SCAN_EN
     default y
     help
         This enables BLE periodic advertising sync
@@ -1255,21 +1255,21 @@ config BT_BLE_50_DTM_TEST_EN
 
 config BT_BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER
     bool "Enable BLE periodic advertising sync transfer feature"
-    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_PERIODIC_ADV_EN && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
     default n
     help
         This enables BLE periodic advertising sync transfer feature
 
 config BT_BLE_FEAT_PERIODIC_ADV_ENH
     bool "Enable periodic adv enhancements(adi support)"
-    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_PERIODIC_ADV_EN && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
     default n
     help
         Enable the periodic advertising enhancements
 
 config BT_BLE_FEAT_CREATE_SYNC_ENH
     bool "Enable create sync enhancements(reporting disable and duplicate filtering enable support)"
-    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
+    depends on (BT_BLUEDROID_ENABLED && BT_BLE_50_EXTEND_SYNC_EN && ((BT_CONTROLLER_ENABLED && SOC_ESP_NIMBLE_CONTROLLER) || BT_CONTROLLER_DISABLED)) # NOERROR
     default n
     help
         Enable the create sync enhancements

components/bt/host/bluedroid/api/esp_bluedroid_hci.c

@@ -67,9 +67,9 @@ void hci_host_send_packet(uint8_t *data, uint16_t len)
 #if (BT_HCI_LOG_INCLUDED == TRUE)
     bt_hci_log_record_hci_data(data[0], &data[1], len - 1);
 #endif
-#if (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
-    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
-#endif // (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    ble_log_spi_out_hci_write(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
 #if (BT_CONTROLLER_INCLUDED == TRUE)
     esp_vhci_host_send_packet(data, len);
 #else /* BT_CONTROLLER_INCLUDED == TRUE */

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -429,7 +429,7 @@ esp_err_t esp_ble_gap_get_local_used_addr(esp_bd_addr_t local_used_addr, uint8_t
     }
     return ESP_OK;
 }
-
+#if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE))
 uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_len, esp_ble_adv_data_type type, uint8_t *length)
 {
     if (length == NULL) {
@@ -460,7 +460,7 @@ uint8_t *esp_ble_resolve_adv_data( uint8_t *adv_data, uint8_t type, uint8_t *len
 {
     return esp_ble_resolve_adv_data_by_type( adv_data, ESP_BLE_ADV_DATA_LEN_MAX + ESP_BLE_SCAN_RSP_DATA_LEN_MAX, (esp_ble_adv_data_type) type, length);
 }
-
+#endif // #if ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE))
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
 #if (BLE_42_ADV_EN == TRUE)
 esp_err_t esp_ble_gap_config_adv_data_raw(uint8_t *raw_data, uint32_t raw_data_len)

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -186,7 +186,7 @@ uint32_t btc_get_ble_status(void)
     #endif
     #endif
 
-    #if (BLE_50_FEATURE_SUPPORT == TRUE)
+    #if (BLE_50_EXTEND_ADV_EN == TRUE)
     // Number of active extended advertsing
     extern uint8_t btm_ble_ext_adv_active_count(void);
     if (btm_ble_ext_adv_active_count()) {

components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c

@@ -66,7 +66,7 @@
 static UINT16 btc_max_hf_clients = BTC_HF_NUM_CB;
 /* HF Param Definition */
 #if HFP_DYNAMIC_MEMORY == FALSE
-static hf_local_param_t hf_local_param[BTC_HF_NUM_CB];
+static hf_local_param_t hf_local_param;
 #else
 hf_local_param_t *hf_local_param_ptr = NULL;
 #endif
@@ -117,7 +117,7 @@ do {
     if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) {                                        \
         return BT_STATUS_FAIL;                                                        \
     }                                                                                 \
-    if (!hf_local_param[idx].btc_hf_cb.initialized) {                                 \
+    if (!hf_local_param.initialized) {                                                \
         BTIF_TRACE_WARNING("CHECK_HF_INIT: %s: HF AG not initialized", __FUNCTION__); \
         return BT_STATUS_NOT_READY;                                                   \
     } else {                                                                          \
@@ -130,8 +130,8 @@ do {
     if ((idx < 0) || (idx >= BTC_HF_NUM_CB)) {                                                     \
         return BT_STATUS_FAIL;                                                                     \
     }                                                                                              \
-    if (!hf_local_param[idx].btc_hf_cb.initialized ||                                              \
-        hf_local_param[idx].btc_hf_cb.connection_state != ESP_HF_CONNECTION_STATE_SLC_CONNECTED) { \
+    if (!hf_local_param.initialized ||                                                             \
+        hf_local_param.btc_hf_cb[idx].connection_state != ESP_HF_CONNECTION_STATE_SLC_CONNECTED) { \
         BTIF_TRACE_WARNING("CHECK_HF_SLC_CONNECTED: %s: HF AG SLC not connected", __FUNCTION__);   \
         return BT_STATUS_NOT_READY;                                                                \
     } else {                                                                                       \
@@ -141,10 +141,10 @@ do {
 
 
 #define clear_phone_state() \
-    hf_local_param[idx].btc_hf_cb.call_state = ESP_HF_CALL_STATUS_NO_CALLS; \
-    hf_local_param[idx].btc_hf_cb.call_setup_state = ESP_HF_CALL_SETUP_STATUS_IDLE;\
-    hf_local_param[idx].btc_hf_cb.num_active = 0;  \
-    hf_local_param[idx].btc_hf_cb.num_held = 0;
+    hf_local_param.btc_hf_cb[idx].call_state = ESP_HF_CALL_STATUS_NO_CALLS; \
+    hf_local_param.btc_hf_cb[idx].call_setup_state = ESP_HF_CALL_SETUP_STATUS_IDLE;\
+    hf_local_param.btc_hf_cb[idx].num_active = 0;  \
+    hf_local_param.btc_hf_cb[idx].num_held = 0;
 
 #define CHECK_HF_IDX(idx)                                                        \
 do {                                                                             \
@@ -160,7 +160,7 @@ do {
 static int btc_hf_idx_by_bdaddr(bt_bdaddr_t *bd_addr)
 {
     for (int i = 0; i < btc_max_hf_clients; ++i) {
-        if (bdcmp(bd_addr->address, hf_local_param[i].btc_hf_cb.connected_bda.address) == 0) {
+        if (bdcmp(bd_addr->address, hf_local_param.btc_hf_cb[i].connected_bda.address) == 0) {
             return i;
         }
     }
@@ -170,8 +170,8 @@ static int btc_hf_idx_by_bdaddr(bt_bdaddr_t *bd_addr)
 static int btc_hf_find_free_idx(void)
 {
     for (int idx = 0; idx < btc_max_hf_clients; ++idx) {
-        if (hf_local_param[idx].btc_hf_cb.initialized &&
-            hf_local_param[idx].btc_hf_cb.connection_state == ESP_HF_CONNECTION_STATE_DISCONNECTED) {
+        if (hf_local_param.initialized &&
+            hf_local_param.btc_hf_cb[idx].connection_state == ESP_HF_CONNECTION_STATE_DISCONNECTED) {
             return idx;
         }
     }
@@ -180,9 +180,9 @@ static int btc_hf_find_free_idx(void)
 
 static BOOLEAN is_connected(int idx, bt_bdaddr_t *bd_addr)
 {
-    if ((bdcmp(bd_addr->address,hf_local_param[idx].btc_hf_cb.connected_bda.address) == 0) &&
-        ((hf_local_param[idx].btc_hf_cb.connection_state == ESP_HF_CONNECTION_STATE_CONNECTED) ||
-         (hf_local_param[idx].btc_hf_cb.connection_state == ESP_HF_CONNECTION_STATE_SLC_CONNECTED))) {
+    if ((bdcmp(bd_addr->address,hf_local_param.btc_hf_cb[idx].connected_bda.address) == 0) &&
+        ((hf_local_param.btc_hf_cb[idx].connection_state == ESP_HF_CONNECTION_STATE_CONNECTED) ||
+         (hf_local_param.btc_hf_cb[idx].connection_state == ESP_HF_CONNECTION_STATE_SLC_CONNECTED))) {
         return TRUE;
     }
     return FALSE;
@@ -196,9 +196,9 @@ static int btc_hf_latest_connected_idx(void)
     conn_time_delta.tv_sec = now.tv_sec;
 
     for (int i = 0; i < btc_max_hf_clients; i++) {
-        if (hf_local_param[i].btc_hf_cb.connection_state  == ESP_HF_CONNECTION_STATE_SLC_CONNECTED) {
-            if ((now.tv_sec - hf_local_param[i].btc_hf_cb.connected_timestamp.tv_sec) < conn_time_delta.tv_sec) {
-                conn_time_delta.tv_sec = now.tv_sec - hf_local_param[i].btc_hf_cb.connected_timestamp.tv_sec;
+        if (hf_local_param.btc_hf_cb[i].connection_state  == ESP_HF_CONNECTION_STATE_SLC_CONNECTED) {
+            if ((now.tv_sec - hf_local_param.btc_hf_cb[i].connected_timestamp.tv_sec) < conn_time_delta.tv_sec) {
+                conn_time_delta.tv_sec = now.tv_sec - hf_local_param.btc_hf_cb[i].connected_timestamp.tv_sec;
                 latest_conn_idx = i;
             }
         }
@@ -261,25 +261,23 @@ static void bte_hf_evt(tBTA_AG_EVT event, tBTA_AG *param)
 ************************************************************************************/
 void btc_hf_reg_data_cb(esp_hf_incoming_data_cb_t recv, esp_hf_outgoing_data_cb_t send)
 {
-    hf_local_param[0].btc_hf_incoming_data_cb = recv;
-    hf_local_param[0].btc_hf_outgoing_data_cb = send;
+    hf_local_param.btc_hf_incoming_data_cb = recv;
+    hf_local_param.btc_hf_outgoing_data_cb = send;
 }
 
 void btc_hf_incoming_data_cb_to_app(const uint8_t *data, uint32_t len)
 {
-    int idx = 0;
     // todo: critical section protection
-    if (hf_local_param[idx].btc_hf_incoming_data_cb) {
-        hf_local_param[idx].btc_hf_incoming_data_cb(data, len);
+    if (hf_local_param.btc_hf_incoming_data_cb) {
+        hf_local_param.btc_hf_incoming_data_cb(data, len);
     }
 }
 
 uint32_t btc_hf_outgoing_data_cb_to_app(uint8_t *data, uint32_t len)
 {
-    int idx = 0;
     // todo: critical section protection
-    if (hf_local_param[idx].btc_hf_outgoing_data_cb) {
-        return hf_local_param[idx].btc_hf_outgoing_data_cb(data, len);
+    if (hf_local_param.btc_hf_outgoing_data_cb) {
+        return hf_local_param.btc_hf_outgoing_data_cb(data, len);
     } else {
         return 0;
     }
@@ -298,7 +296,7 @@ bt_status_t btc_hf_execute_service(BOOLEAN b_enable)
     } else {
         /* De-register AG */
         for (idx = 0; idx < btc_max_hf_clients; idx++) {
-            BTA_AgDeregister(hf_local_param[idx].btc_hf_cb.handle);
+            BTA_AgDeregister(hf_local_param.btc_hf_cb[idx].handle);
         }
         /* Disable AG */
         BTA_AgDisable();
@@ -316,30 +314,29 @@ bt_status_t btc_hf_init(void)
 {
     int idx = 0;
 
-#if HFP_DYNAMIC_MEMORY == TRUE
-    if (hf_local_param)
-#endif
-    {
-        if (hf_local_param[idx].btc_hf_cb.initialized) {
-            esp_hf_cb_param_t param = {
-                .prof_stat.state = ESP_HF_INIT_ALREADY,
-            };
-            btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
-            return BT_STATUS_SUCCESS;
-        }
+    if (hf_local_param.initialized) {
+        esp_hf_cb_param_t param = {
+            .prof_stat.state = ESP_HF_INIT_ALREADY,
+        };
+        btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+        return BT_STATUS_SUCCESS;
     }
 
     BTC_TRACE_DEBUG("%s - max_hf_clients=%d", __func__, btc_max_hf_clients);
 
-#if HFP_DYNAMIC_MEMORY == TRUE
-    if (hf_local_param == NULL) {
-        if ((hf_local_param = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if (hf_local_param.btc_hf_cb == NULL) {
+        hf_local_param.btc_hf_cb = (btc_hf_cb_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(btc_hf_cb_t));
+        if (hf_local_param.btc_hf_cb == NULL) {
             BTC_TRACE_ERROR("%s malloc failed!", __func__);
             return BT_STATUS_NOMEM;
         }
     }
-    memset((void *)hf_local_param, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
-#endif
+
+    memset(hf_local_param.btc_hf_cb, 0, BTC_HF_NUM_CB * sizeof(btc_hf_cb_t));
+    for (int i = 0; i < BTC_HF_NUM_CB; i++) {
+        hf_local_param.btc_hf_cb[i].sync_conn_hdl = ESP_INVALID_CONN_HANDLE;
+    }
+    hf_local_param.hf_idx = BTC_HF_INVALID_IDX;
 
     /* Invoke the enable service API to the core to set the appropriate service_id
      * Internally, the HSP_SERVICE_ID shall also be enabled if HFP is enabled (phone)
@@ -350,10 +347,7 @@ bt_status_t btc_hf_init(void)
     btc_dm_enable_service(BTA_HSP_SERVICE_ID);
 #endif
     clear_phone_state();
-    memset(&hf_local_param[idx].btc_hf_cb, 0, sizeof(btc_hf_cb_t));
-    for (int i = 0; i < BTC_HF_NUM_CB; i++) {
-        hf_local_param[i].btc_hf_cb.sync_conn_hdl = ESP_INVALID_CONN_HANDLE;
-    }
+
 // set audio path
 #if (BT_CONTROLLER_INCLUDED == TRUE)
 #if BTM_SCO_HCI_INCLUDED
@@ -371,19 +365,12 @@ void btc_hf_deinit(void)
 {
     BTC_TRACE_EVENT("%s", __FUNCTION__);
 
-    int idx = 0;
-
-#if HFP_DYNAMIC_MEMORY == TRUE
-    if (hf_local_param)
-#endif
-    {
-        if (!hf_local_param[idx].btc_hf_cb.initialized) {
-            esp_hf_cb_param_t param = {
-                .prof_stat.state = ESP_HF_DEINIT_ALREADY,
-            };
-            btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
-            return;
-        }
+    if (!hf_local_param.initialized) {
+        esp_hf_cb_param_t param = {
+            .prof_stat.state = ESP_HF_DEINIT_ALREADY,
+        };
+        btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
+        return;
     }
 
     btc_dm_disable_service(BTA_HFP_SERVICE_ID);
@@ -391,12 +378,8 @@ void btc_hf_deinit(void)
 
 static void btc_hf_cb_release(void)
 {
-#if HFP_DYNAMIC_MEMORY == TRUE
-    if (hf_local_param) {
-        osi_free(hf_local_param);
-        hf_local_param = NULL;
-    }
-#endif
+    osi_free(hf_local_param.btc_hf_cb);
+    hf_local_param.btc_hf_cb = NULL;
 }
 
 static bt_status_t connect_init(bt_bdaddr_t *bd_addr, uint16_t uuid)
@@ -408,9 +391,9 @@ static bt_status_t connect_init(bt_bdaddr_t *bd_addr, uint16_t uuid)
     }
 
     if (!is_connected(idx, bd_addr)) {
-        hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_CONNECTING;
-        bdcpy(hf_local_param[idx].btc_hf_cb.connected_bda.address, bd_addr->address);
-        BTA_AgOpen(hf_local_param[idx].btc_hf_cb.handle, hf_local_param[idx].btc_hf_cb.connected_bda.address, BTC_HF_SECURITY, BTC_HF_SERVICES);
+        hf_local_param.btc_hf_cb[idx].connection_state  = ESP_HF_CONNECTION_STATE_CONNECTING;
+        bdcpy(hf_local_param.btc_hf_cb[idx].connected_bda.address, bd_addr->address);
+        BTA_AgOpen(hf_local_param.btc_hf_cb[idx].handle, hf_local_param.btc_hf_cb[idx].connected_bda.address, BTC_HF_SECURITY, BTC_HF_SERVICES);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_BUSY;
@@ -430,7 +413,7 @@ bt_status_t btc_hf_disconnect(bt_bdaddr_t *bd_addr)
     }
 
     if (is_connected(idx, bd_addr)) {
-        BTA_AgClose(hf_local_param[idx].btc_hf_cb.handle);
+        BTA_AgClose(hf_local_param.btc_hf_cb[idx].handle);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -442,13 +425,13 @@ bt_status_t btc_hf_connect_audio(bt_bdaddr_t *bd_addr)
     CHECK_HF_SLC_CONNECTED(idx);
 
     if (is_connected(idx, bd_addr)) {
-        BTA_AgAudioOpen(hf_local_param[idx].btc_hf_cb.handle);
+        BTA_AgAudioOpen(hf_local_param.btc_hf_cb[idx].handle);
         /* Inform the application that the audio connection has been initiated successfully */
         do {
             esp_hf_cb_param_t param;
             memset(&param, 0, sizeof(esp_hf_cb_param_t));
             param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTING;
-            memcpy(param.audio_stat.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda, sizeof(esp_bd_addr_t));
+            memcpy(param.audio_stat.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda, sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_AUDIO_STATE_EVT, &param);
         } while (0);
         return BT_STATUS_SUCCESS;
@@ -462,7 +445,7 @@ bt_status_t btc_hf_disconnect_audio(bt_bdaddr_t *bd_addr)
     CHECK_HF_SLC_CONNECTED(idx);
 
     if (is_connected(idx, bd_addr)) {
-        BTA_AgAudioClose(hf_local_param[idx].btc_hf_cb.handle);
+        BTA_AgAudioClose(hf_local_param.btc_hf_cb[idx].handle);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -476,7 +459,7 @@ static bt_status_t btc_hf_pkt_stat_nums_get(UINT16 sync_conn_handle)
     CHECK_HF_SLC_CONNECTED(idx);
 
     if (idx != BTC_HF_INVALID_IDX) {
-        BTA_AgPktStatsNumsGet(hf_local_param[idx].btc_hf_cb.handle, sync_conn_handle);
+        BTA_AgPktStatsNumsGet(hf_local_param.btc_hf_cb[idx].handle, sync_conn_handle);
         status = BT_STATUS_SUCCESS;
     }
 #endif /*#if (BTM_SCO_HCI_INCLUDED == TRUE) */
@@ -493,11 +476,11 @@ static bt_status_t btc_hf_vra(bt_bdaddr_t *bd_addr, esp_hf_vr_state_t value)
     CHECK_HF_SLC_CONNECTED(idx);
 
     if (is_connected(idx, bd_addr)) {
-        if (hf_local_param[idx].btc_hf_cb.peer_feat & BTA_AG_PEER_FEAT_VREC) {
+        if (hf_local_param.btc_hf_cb[idx].peer_feat & BTA_AG_PEER_FEAT_VREC) {
             tBTA_AG_RES_DATA ag_res;
             memset(&ag_res, 0, sizeof(ag_res));
             ag_res.state = value;
-            BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_BVRA_RES, &ag_res);
+            BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_BVRA_RES, &ag_res);
             return BT_STATUS_SUCCESS;
         } else {
             return BT_STATUS_UNSUPPORTED;
@@ -515,7 +498,7 @@ static bt_status_t btc_hf_volume_control(bt_bdaddr_t *bd_addr, esp_hf_volume_typ
 
     if (is_connected(idx, bd_addr)) {
         ag_res.num = volume;
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, (type == ESP_HF_VOLUME_TYPE_SPK) ? BTA_AG_SPK_RES : BTA_AG_MIC_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, (type == ESP_HF_VOLUME_TYPE_SPK) ? BTA_AG_SPK_RES : BTA_AG_MIC_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -539,7 +522,7 @@ static bt_status_t btc_hf_unat_response(bt_bdaddr_t *bd_addr, const char *unat)
             ag_res.errcode = BTA_AG_ERR_OP_NOT_SUPPORTED;
         }
 
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_UNAT_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_UNAT_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -560,7 +543,7 @@ static bt_status_t btc_hf_cmee_response(bt_bdaddr_t *bd_addr, esp_hf_at_response
             ag_res.ok_flag = BTA_AG_OK_ERROR;
             ag_res.errcode = error_code;
         }
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_UNAT_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_UNAT_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -621,7 +604,7 @@ static bt_status_t btc_hf_cind_response(bt_bdaddr_t *bd_addr,
                 batt_lev,                                              /* Battery level */
                 call_held_status                                       /* Callheld state */
         );
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_CIND_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CIND_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -639,7 +622,7 @@ static bt_status_t btc_hf_cops_response(bt_bdaddr_t *bd_addr, const char *name)
         /* Format the response */
         sprintf(ag_res.str, "0,0,\"%s\"", name);
         ag_res.ok_flag = BTA_AG_OK_DONE;
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_COPS_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_COPS_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -671,7 +654,7 @@ static bt_status_t btc_hf_clcc_response(bt_bdaddr_t *bd_addr, int index, esp_hf_
                 }
             }
         }
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_CLCC_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CLCC_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -693,7 +676,7 @@ static bt_status_t btc_hf_cnum_response(bt_bdaddr_t *bd_addr, const char *number
             sprintf(ag_res.str, ",\"%s\",%d,,",number, number_type);
         }
         ag_res.ok_flag = BTA_AG_OK_DONE;
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_CNUM_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CNUM_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -709,7 +692,7 @@ static bt_status_t btc_hf_inband_ring(bt_bdaddr_t *bd_addr, esp_hf_in_band_ring_
         tBTA_AG_RES_DATA    ag_res;
         memset (&ag_res, 0, sizeof (ag_res));
         ag_res.state = state;
-        BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_INBAND_RING_RES, &ag_res);
+        BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_INBAND_RING_RES, &ag_res);
         return BT_STATUS_SUCCESS;
     }
     return BT_STATUS_FAIL;
@@ -727,8 +710,8 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
     int idx = btc_hf_idx_by_bdaddr(bd_addr), i;
 
     /* hf_idx is index of connected HS that sent ATA/BLDN, otherwise index of latest connected HS */
-    if (hf_local_param->hf_idx != BTC_HF_INVALID_IDX) {
-        idx = hf_local_param->hf_idx;
+    if (hf_local_param.hf_idx != BTC_HF_INVALID_IDX) {
+        idx = hf_local_param.hf_idx;
     } else {
         idx = btc_hf_latest_connected_idx();
     }
@@ -736,28 +719,28 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
     BTC_TRACE_DEBUG("phone_state_change: idx = %d", idx);
     CHECK_HF_SLC_CONNECTED(idx);
     BTC_TRACE_DEBUG("phone_state_change: num_active=%d [prev: %d]  num_held=%d[prev: %d] call =%s [prev: %s] call_setup=%s [prev: %s]",
-                    num_active, hf_local_param[idx].btc_hf_cb.num_active,
-                    num_held, hf_local_param[idx].btc_hf_cb.num_held,
-                    dump_hf_call_state(call_state), dump_hf_call_state(hf_local_param[idx].btc_hf_cb.call_state),
-                    dump_hf_call_setup_state(call_setup_state), dump_hf_call_setup_state(hf_local_param[idx].btc_hf_cb.call_setup_state));
+                    num_active, hf_local_param.btc_hf_cb[idx].num_active,
+                    num_held, hf_local_param.btc_hf_cb[idx].num_held,
+                    dump_hf_call_state(call_state), dump_hf_call_state(hf_local_param.btc_hf_cb[idx].call_state),
+                    dump_hf_call_setup_state(call_setup_state), dump_hf_call_setup_state(hf_local_param.btc_hf_cb[idx].call_setup_state));
 
     /* If all indicators are 0, send end call and return */
     if (num_active == 0 && num_held == 0 && call_state == ESP_HF_CALL_STATUS_NO_CALLS && call_setup_state == ESP_HF_CALL_SETUP_STATUS_IDLE) {
         BTC_TRACE_DEBUG("%s: Phone on hook", __FUNCTION__);
 
         /* Record call termination timestamp if there was an active/held call or call_setup_state > ESP_HF_CALL_SETUP_STATUS_IDLE */
-        if ((hf_local_param[idx].btc_hf_cb.call_state != ESP_HF_CALL_STATUS_NO_CALLS) ||
-            (hf_local_param[idx].btc_hf_cb.call_setup_state != ESP_HF_CALL_SETUP_STATUS_IDLE) ||
-            (hf_local_param[idx].btc_hf_cb.num_active) ||
-            (hf_local_param[idx].btc_hf_cb.num_held)) {
+        if ((hf_local_param.btc_hf_cb[idx].call_state != ESP_HF_CALL_STATUS_NO_CALLS) ||
+            (hf_local_param.btc_hf_cb[idx].call_setup_state != ESP_HF_CALL_SETUP_STATUS_IDLE) ||
+            (hf_local_param.btc_hf_cb[idx].num_active) ||
+            (hf_local_param.btc_hf_cb[idx].num_held)) {
             BTC_TRACE_DEBUG("%s: Record call termination timestamp", __FUNCTION__);
-            clock_gettime(CLOCK_MONOTONIC, &hf_local_param[0].btc_hf_cb.call_end_timestamp);
+            clock_gettime(CLOCK_MONOTONIC, &hf_local_param.btc_hf_cb[idx].call_end_timestamp);
         }
         BTA_AgResult(BTA_AG_HANDLE_ALL, BTA_AG_END_CALL_RES, NULL);
-        hf_local_param->hf_idx = BTC_HF_INVALID_IDX;
+        hf_local_param.hf_idx = BTC_HF_INVALID_IDX;
 
         /* If held call was present, reset that as well. */
-        if (hf_local_param[idx].btc_hf_cb.num_held) {
+        if (hf_local_param.btc_hf_cb[idx].num_held) {
             send_indicator_update(BTA_AG_IND_CALLHELD, 0);
         }
         goto update_call_states;
@@ -771,13 +754,13 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
 
     /* Handle case(3) here prior to call setup handling.*/
     if (((num_active + num_held) > 0) &&
-        (hf_local_param[idx].btc_hf_cb.num_active == 0) &&
-        (hf_local_param[idx].btc_hf_cb.num_held == 0) &&
-        (hf_local_param[idx].btc_hf_cb.call_setup_state == ESP_HF_CALL_SETUP_STATUS_IDLE)) {
+        (hf_local_param.btc_hf_cb[idx].num_active == 0) &&
+        (hf_local_param.btc_hf_cb[idx].num_held == 0) &&
+        (hf_local_param.btc_hf_cb[idx].call_setup_state == ESP_HF_CALL_SETUP_STATUS_IDLE)) {
         BTC_TRACE_DEBUG("%s: Active/Held call notification received without call setup update", __FUNCTION__);
 
         memset(&ag_res, 0, sizeof(tBTA_AG_RES_DATA));
-        ag_res.audio_handle = hf_local_param[idx].btc_hf_cb.handle;
+        ag_res.audio_handle = hf_local_param.btc_hf_cb[idx].handle;
 
         /* Addition callsetup with the Active call. */
         if (call_setup_state != ESP_HF_CALL_SETUP_STATUS_IDLE) {
@@ -793,9 +776,9 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
     }
 
     /* Handle call_setup indicator change. */
-    if (call_setup_state != hf_local_param[idx].btc_hf_cb.call_setup_state) {
+    if (call_setup_state != hf_local_param.btc_hf_cb[idx].call_setup_state) {
         BTC_TRACE_DEBUG("%s: Call setup states changed. old: %s new: %s", __FUNCTION__,
-                        dump_hf_call_setup_state(hf_local_param[idx].btc_hf_cb.call_setup_state),
+                        dump_hf_call_setup_state(hf_local_param.btc_hf_cb[idx].call_setup_state),
                         dump_hf_call_setup_state(call_setup_state));
         memset(&ag_res, 0, sizeof(tBTA_AG_RES_DATA));
 
@@ -803,14 +786,14 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
         {
             case ESP_HF_CALL_SETUP_STATUS_IDLE:
             {
-                switch(hf_local_param[idx].btc_hf_cb.call_setup_state)
+                switch(hf_local_param.btc_hf_cb[idx].call_setup_state)
                 {
                     case ESP_HF_CALL_SETUP_STATUS_INCOMING:
                     {
-                        if (num_active > hf_local_param[idx].btc_hf_cb.num_active) {
+                        if (num_active > hf_local_param.btc_hf_cb[idx].num_active) {
                             res = BTA_AG_IN_CALL_CONN_RES;
-                            ag_res.audio_handle = hf_local_param[idx].btc_hf_cb.handle;
-                        } else if (num_held > hf_local_param[idx].btc_hf_cb.num_held) {
+                            ag_res.audio_handle = hf_local_param.btc_hf_cb[idx].handle;
+                        } else if (num_held > hf_local_param.btc_hf_cb[idx].num_held) {
                             res = BTA_AG_IN_CALL_HELD_RES;
                         } else {
                             res = BTA_AG_CALL_CANCEL_RES;
@@ -821,7 +804,7 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
                     case ESP_HF_CALL_SETUP_STATUS_OUTGOING_DIALING:
                     case ESP_HF_CALL_SETUP_STATUS_OUTGOING_ALERTING:
                     {
-                        if (num_active > hf_local_param[idx].btc_hf_cb.num_active) {
+                        if (num_active > hf_local_param.btc_hf_cb[idx].num_active) {
                             res = BTA_AG_OUT_CALL_CONN_RES;
                             ag_res.audio_handle = BTA_AG_HANDLE_SCO_NO_CHANGE;
                         } else {
@@ -864,7 +847,7 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
             case ESP_HF_CALL_SETUP_STATUS_OUTGOING_DIALING:
             {
                 if (!(num_active + num_held)) {
-                    ag_res.audio_handle = hf_local_param[idx].btc_hf_cb.handle;
+                    ag_res.audio_handle = hf_local_param.btc_hf_cb[idx].handle;
                 }
                 res = BTA_AG_OUT_CALL_ORIG_RES;
                 break;
@@ -872,9 +855,9 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
 
             case ESP_HF_CALL_SETUP_STATUS_OUTGOING_ALERTING:
             {
-                if ((hf_local_param[idx].btc_hf_cb.call_setup_state == ESP_HF_CALL_SETUP_STATUS_IDLE) &&
+                if ((hf_local_param.btc_hf_cb[idx].call_setup_state == ESP_HF_CALL_SETUP_STATUS_IDLE) &&
                     !(num_active + num_held)) {
-                    ag_res.audio_handle = hf_local_param[idx].btc_hf_cb.handle;
+                    ag_res.audio_handle = hf_local_param.btc_hf_cb[idx].handle;
                     /* Force SCO setup here.*/
                     BTA_AgAudioOpen(ag_res.audio_handle);
                 }
@@ -904,34 +887,34 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
 
     /* Handle call_state indicator change. */
     if (!activeCallUpdated &&
-        ((num_active + num_held) != (hf_local_param[idx].btc_hf_cb.num_active + hf_local_param[idx].btc_hf_cb.num_held))) {
-        BTC_TRACE_DEBUG("%s: Active call states changed. old: %d new: %d", __FUNCTION__, hf_local_param[idx].btc_hf_cb.num_active, num_active);
+        ((num_active + num_held) != (hf_local_param.btc_hf_cb[idx].num_active + hf_local_param.btc_hf_cb[idx].num_held))) {
+        BTC_TRACE_DEBUG("%s: Active call states changed. old: %d new: %d", __FUNCTION__, hf_local_param.btc_hf_cb[idx].num_active, num_active);
         send_indicator_update(BTA_AG_IND_CALL, ((num_active + num_held) > 0) ? 1 : 0);
     }
 
     /* Handle call_held_state indicator change. */
-    if (num_held != hf_local_param[idx].btc_hf_cb.num_held  ||
-        ((num_active == 0) && ((num_held + hf_local_param[idx].btc_hf_cb.num_held) > 1))) {
-        BTC_TRACE_DEBUG("%s: Held call states changed. old: %d new: %d", __FUNCTION__, hf_local_param[idx].btc_hf_cb.num_held, num_held);
+    if (num_held != hf_local_param.btc_hf_cb[idx].num_held  ||
+        ((num_active == 0) && ((num_held + hf_local_param.btc_hf_cb[idx].num_held) > 1))) {
+        BTC_TRACE_DEBUG("%s: Held call states changed. old: %d new: %d", __FUNCTION__, hf_local_param.btc_hf_cb[idx].num_held, num_held);
         send_indicator_update(BTA_AG_IND_CALLHELD, ((num_held == 0) ? 0 : ((num_active == 0) ? 2 : 1)));
     }
 
     /* Handle Call Active/Held Swap indicator update.*/
-    if ((call_setup_state == hf_local_param[idx].btc_hf_cb.call_setup_state) &&
+    if ((call_setup_state == hf_local_param.btc_hf_cb[idx].call_setup_state) &&
         (num_active) &&
         (num_held) &&
-        (num_active == hf_local_param[idx].btc_hf_cb.num_active) &&
-        (num_held == hf_local_param[idx].btc_hf_cb.num_held)) {
+        (num_active == hf_local_param.btc_hf_cb[idx].num_active) &&
+        (num_held == hf_local_param.btc_hf_cb[idx].num_held)) {
         BTC_TRACE_DEBUG("%s: Calls swapped", __FUNCTION__);
         send_indicator_update(BTA_AG_IND_CALLHELD, 1);
     }
 
 update_call_states:
     for (i = 0; i < btc_max_hf_clients; i++) {
-        hf_local_param[i].btc_hf_cb.num_active = num_active;
-        hf_local_param[i].btc_hf_cb.num_held = num_held;
-        hf_local_param[i].btc_hf_cb.call_state = call_state;
-        hf_local_param[i].btc_hf_cb.call_setup_state = call_setup_state;
+        hf_local_param.btc_hf_cb[i].num_active = num_active;
+        hf_local_param.btc_hf_cb[i].num_held = num_held;
+        hf_local_param.btc_hf_cb[i].call_state = call_state;
+        hf_local_param.btc_hf_cb[i].call_setup_state = call_setup_state;
     }
     return status;
 }
@@ -944,7 +927,7 @@ bt_status_t btc_hf_ci_sco_data(void)
     CHECK_HF_SLC_CONNECTED(idx);
 
     if (idx != BTC_HF_INVALID_IDX) {
-        BTA_AgCiData(hf_local_param[idx].btc_hf_cb.handle);
+        BTA_AgCiData(hf_local_param.btc_hf_cb[idx].handle);
         return status;
     }
     status = BT_STATUS_FAIL;
@@ -1298,17 +1281,11 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             break;
         case BTA_AG_DISABLE_EVT:
         {
-            idx = 0;
-#if HFP_DYNAMIC_MEMORY == TRUE
-            if (hf_local_param)
-#endif
-            {
-                if (hf_local_param[idx].btc_hf_cb.initialized) {
-                    hf_local_param[idx].btc_hf_cb.initialized = false;
-                    btc_hf_cb_release();
-                    param.prof_stat.state = ESP_HF_DEINIT_SUCCESS;
-                    btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
-                }
+            if (hf_local_param.initialized) {
+                hf_local_param.initialized = false;
+                btc_hf_cb_release();
+                param.prof_stat.state = ESP_HF_DEINIT_SUCCESS;
+                btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
             }
             break;
         }
@@ -1316,14 +1293,14 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            hf_local_param[idx].btc_hf_cb.handle = p_data->reg.hdr.handle;
-            BTC_TRACE_DEBUG("%s: BTA_AG_REGISTER_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d",
-                            __FUNCTION__, idx, hf_local_param[idx].btc_hf_cb.handle);
-            if (!hf_local_param[idx].btc_hf_cb.initialized) {
+            hf_local_param.btc_hf_cb[idx].handle = p_data->reg.hdr.handle;
+            BTC_TRACE_DEBUG("%s: BTA_AG_REGISTER_EVT," "hf_hf_cb[%d].btc_hf_cb.handle = %d",
+                            __FUNCTION__, idx, hf_local_param.btc_hf_cb[idx].handle);
+            if (!hf_local_param.initialized) {
                 param.prof_stat.state = ESP_HF_INIT_SUCCESS;
                 btc_hf_cb_to_app(ESP_HF_PROF_STATE_EVT, &param);
             }
-            hf_local_param[idx].btc_hf_cb.initialized = true;
+            hf_local_param.initialized = true;
             break;
         }
 
@@ -1333,30 +1310,30 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             if (p_data->open.hdr.status == BTA_AG_SUCCESS)
             {
-                bdcpy(hf_local_param[idx].btc_hf_cb.connected_bda.address, p_data->open.bd_addr);
-                hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_CONNECTED;
-                hf_local_param[idx].btc_hf_cb.peer_feat = 0;
-                hf_local_param[idx].btc_hf_cb.chld_feat = 0;
+                bdcpy(hf_local_param.btc_hf_cb[idx].connected_bda.address, p_data->open.bd_addr);
+                hf_local_param.btc_hf_cb[idx].connection_state  = ESP_HF_CONNECTION_STATE_CONNECTED;
+                hf_local_param.btc_hf_cb[idx].peer_feat = 0;
+                hf_local_param.btc_hf_cb[idx].chld_feat = 0;
                 //clear_phone_state();
-            } else if (hf_local_param[idx].btc_hf_cb.connection_state  == ESP_HF_CONNECTION_STATE_CONNECTING) {
-                hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
+            } else if (hf_local_param.btc_hf_cb[idx].connection_state  == ESP_HF_CONNECTION_STATE_CONNECTING) {
+                hf_local_param.btc_hf_cb[idx].connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
             } else {
                 BTC_TRACE_WARNING("%s: AG open failed, but another device connected. status=%d state=%d connected device=%s", __FUNCTION__,
-                                    p_data->open.hdr.status, hf_local_param[idx].btc_hf_cb.connection_state,
-                                    bdaddr_to_string(&hf_local_param[idx].btc_hf_cb.connected_bda, bdstr, sizeof(bdstr)));
+                                    p_data->open.hdr.status, hf_local_param.btc_hf_cb[idx].connection_state,
+                                    bdaddr_to_string(&hf_local_param.btc_hf_cb[idx].connected_bda, bdstr, sizeof(bdstr)));
                 break;
             }
 
             do {
-                memcpy(param.conn_stat.remote_bda, &hf_local_param[idx].btc_hf_cb.connected_bda, sizeof(esp_bd_addr_t));
-                param.conn_stat.state = hf_local_param[idx].btc_hf_cb.connection_state;
+                memcpy(param.conn_stat.remote_bda, &hf_local_param.btc_hf_cb[idx].connected_bda, sizeof(esp_bd_addr_t));
+                param.conn_stat.state = hf_local_param.btc_hf_cb[idx].connection_state;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
                 btc_hf_cb_to_app(ESP_HF_CONNECTION_STATE_EVT, &param);
             } while (0);
 
-            if (hf_local_param[idx].btc_hf_cb.connection_state  == ESP_HF_CONNECTION_STATE_DISCONNECTED)
-                bdsetany(hf_local_param[idx].btc_hf_cb.connected_bda.address);
+            if (hf_local_param.btc_hf_cb[idx].connection_state  == ESP_HF_CONNECTION_STATE_DISCONNECTED)
+                bdsetany(hf_local_param.btc_hf_cb[idx].connected_bda.address);
 
             if (p_data->open.hdr.status != BTA_AG_SUCCESS)
                 btc_queue_advance();
@@ -1367,20 +1344,20 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            clock_gettime(CLOCK_MONOTONIC, &(hf_local_param[idx].btc_hf_cb.connected_timestamp));
+            clock_gettime(CLOCK_MONOTONIC, &(hf_local_param.btc_hf_cb[idx].connected_timestamp));
             BTC_TRACE_DEBUG("%s: BTA_AG_CONN_EVT, idx = %d ", __FUNCTION__, idx);
-            hf_local_param[idx].btc_hf_cb.peer_feat = p_data->conn.peer_feat;
-            hf_local_param[idx].btc_hf_cb.chld_feat = p_data->conn.chld_feat;
-            hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_SLC_CONNECTED;
+            hf_local_param.btc_hf_cb[idx].peer_feat = p_data->conn.peer_feat;
+            hf_local_param.btc_hf_cb[idx].chld_feat = p_data->conn.chld_feat;
+            hf_local_param.btc_hf_cb[idx].connection_state  = ESP_HF_CONNECTION_STATE_SLC_CONNECTED;
 
             do {
-                param.conn_stat.state = hf_local_param[idx].btc_hf_cb.connection_state;
-                param.conn_stat.peer_feat = hf_local_param[idx].btc_hf_cb.peer_feat;
-                param.conn_stat.chld_feat = hf_local_param[idx].btc_hf_cb.chld_feat;
-                memcpy(param.conn_stat.remote_bda, &hf_local_param[idx].btc_hf_cb.connected_bda, sizeof(esp_bd_addr_t));
+                param.conn_stat.state = hf_local_param.btc_hf_cb[idx].connection_state;
+                param.conn_stat.peer_feat = hf_local_param.btc_hf_cb[idx].peer_feat;
+                param.conn_stat.chld_feat = hf_local_param.btc_hf_cb[idx].chld_feat;
+                memcpy(param.conn_stat.remote_bda, &hf_local_param.btc_hf_cb[idx].connected_bda, sizeof(esp_bd_addr_t));
                 btc_hf_cb_to_app(ESP_HF_CONNECTION_STATE_EVT, &param);
             } while(0);
-            hf_local_param[idx].hf_idx = btc_hf_latest_connected_idx();
+            hf_local_param.hf_idx = btc_hf_latest_connected_idx();
             btc_queue_advance();
             break;
         }
@@ -1389,20 +1366,20 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            hf_local_param[idx].btc_hf_cb.connected_timestamp.tv_sec = 0;
-            hf_local_param[idx].btc_hf_cb.connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
-            BTC_TRACE_DEBUG("%s: BTA_AG_CLOSE_EVT," "hf_local_param[%d].btc_hf_cb.handle = %d", __FUNCTION__,
-                            idx, hf_local_param[idx].btc_hf_cb.handle);
+            hf_local_param.btc_hf_cb[idx].connected_timestamp.tv_sec = 0;
+            hf_local_param.btc_hf_cb[idx].connection_state  = ESP_HF_CONNECTION_STATE_DISCONNECTED;
+            BTC_TRACE_DEBUG("%s: BTA_AG_CLOSE_EVT," "hf_local_param.btc_hf_cb[%d].handle = %d", __FUNCTION__,
+                            idx, hf_local_param.btc_hf_cb[idx].handle);
             do {
                 param.conn_stat.state = ESP_HF_CONNECTION_STATE_DISCONNECTED;
                 param.conn_stat.peer_feat = 0;
                 param.conn_stat.chld_feat = 0;
-                memcpy(param.conn_stat.remote_bda, &hf_local_param[idx].btc_hf_cb.connected_bda, sizeof(esp_bd_addr_t));
+                memcpy(param.conn_stat.remote_bda, &hf_local_param.btc_hf_cb[idx].connected_bda, sizeof(esp_bd_addr_t));
                 btc_hf_cb_to_app(ESP_HF_CONNECTION_STATE_EVT, &param);
             } while(0);
-            bdsetany(hf_local_param[idx].btc_hf_cb.connected_bda.address);
+            bdsetany(hf_local_param.btc_hf_cb[idx].connected_bda.address);
             clear_phone_state();
-            hf_local_param[idx].hf_idx = btc_hf_latest_connected_idx();
+            hf_local_param.hf_idx = btc_hf_latest_connected_idx();
             btc_queue_advance();
             break;
         }
@@ -1413,8 +1390,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED;
-                memcpy(param.audio_stat.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
-                hf_local_param[idx].btc_hf_cb.sync_conn_hdl = p_data->hdr.sync_conn_handle;
+                memcpy(param.audio_stat.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
+                hf_local_param.btc_hf_cb[idx].sync_conn_hdl = p_data->hdr.sync_conn_handle;
                 param.audio_stat.sync_conn_handle = p_data->hdr.sync_conn_handle;
                 btc_hf_cb_to_app(ESP_HF_AUDIO_STATE_EVT, &param);
             } while(0);
@@ -1427,8 +1404,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_CONNECTED_MSBC;
-                memcpy(param.audio_stat.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
-                hf_local_param[idx].btc_hf_cb.sync_conn_hdl = p_data->hdr.sync_conn_handle;
+                memcpy(param.audio_stat.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
+                hf_local_param.btc_hf_cb[idx].sync_conn_hdl = p_data->hdr.sync_conn_handle;
                 param.audio_stat.sync_conn_handle = p_data->hdr.sync_conn_handle;
                 btc_hf_cb_to_app(ESP_HF_AUDIO_STATE_EVT, &param);
             } while (0);
@@ -1440,8 +1417,8 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 param.audio_stat.state = ESP_HF_AUDIO_STATE_DISCONNECTED;
-                hf_local_param[idx].btc_hf_cb.sync_conn_hdl = ESP_INVALID_CONN_HANDLE;
-                memcpy(param.audio_stat.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda, sizeof(esp_bd_addr_t));
+                hf_local_param.btc_hf_cb[idx].sync_conn_hdl = ESP_INVALID_CONN_HANDLE;
+                memcpy(param.audio_stat.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda, sizeof(esp_bd_addr_t));
                 param.audio_stat.sync_conn_handle = p_data->hdr.sync_conn_handle;
                 btc_hf_cb_to_app(ESP_HF_AUDIO_STATE_EVT, &param);
             } while(0);
@@ -1454,12 +1431,12 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 param.vra_rep.value = p_data->val.num;
-                memcpy(param.vra_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.vra_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 btc_hf_cb_to_app(ESP_HF_BVRA_RESPONSE_EVT, &param);
                 if (p_data->val.num) {
-                    btc_hf_connect_audio(&hf_local_param[idx].btc_hf_cb.connected_bda);
+                    btc_hf_connect_audio(&hf_local_param.btc_hf_cb[idx].connected_bda);
                 } else {
-                    btc_hf_disconnect_audio(&hf_local_param[idx].btc_hf_cb.connected_bda);
+                    btc_hf_disconnect_audio(&hf_local_param.btc_hf_cb[idx].connected_bda);
                 }
             } while (0);
             break;
@@ -1471,7 +1448,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
             do {
-                memcpy(param.volume_control.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.volume_control.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.volume_control.type = (event == BTA_AG_SPK_EVT) ? ESP_HF_VOLUME_CONTROL_TARGET_SPK : ESP_HF_VOLUME_CONTROL_TARGET_MIC;
                 param.volume_control.volume = p_data->val.num;
                 btc_hf_cb_to_app(ESP_HF_VOLUME_CONTROL_EVT, &param);
@@ -1484,7 +1461,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
             do {
-                memcpy(param.unat_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.unat_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.unat_rep.unat = p_data->val.str;
                 btc_hf_cb_to_app(ESP_HF_UNAT_RESPONSE_EVT, &param);
             } while (0);
@@ -1495,7 +1472,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.ind_upd.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.ind_upd.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_IND_UPDATE_EVT, &param);
             break;
         }
@@ -1504,7 +1481,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.cind_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.cind_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_CIND_RESPONSE_EVT, &param);
             break;
         }
@@ -1513,7 +1490,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.cops_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.cops_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_COPS_RESPONSE_EVT, &param);
             break;
         }
@@ -1522,7 +1499,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.clcc_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.clcc_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_CLCC_RESPONSE_EVT, &param);
             break;
         }
@@ -1531,7 +1508,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.cnum_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.cnum_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_CNUM_RESPONSE_EVT, &param);
             break;
         }
@@ -1541,7 +1518,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
             do {
-                memcpy(param.vts_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.vts_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.vts_rep.code = p_data->val.str;
                 btc_hf_cb_to_app(ESP_HF_VTS_RESPONSE_EVT, &param);
             } while(0);
@@ -1553,7 +1530,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
             do {
-                memcpy(param.nrec.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.nrec.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.nrec.state = p_data->val.num;
                 btc_hf_cb_to_app(ESP_HF_NREC_RESPONSE_EVT, &param);
             } while(0);
@@ -1564,7 +1541,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.ata_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.ata_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_ATA_RESPONSE_EVT, &param);
             break;
         }
@@ -1573,7 +1550,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
         {
             idx = p_data->hdr.handle - 1;
             CHECK_HF_IDX(idx);
-            memcpy(param.chup_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+            memcpy(param.chup_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
             btc_hf_cb_to_app(ESP_HF_CHUP_RESPONSE_EVT, &param);
             break;
         }
@@ -1585,14 +1562,14 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 if (event == BTA_AG_AT_D_EVT) {           // dial_number_or_memory
-                    memcpy(param.out_call.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                    memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                     param.out_call.type = p_data->val.value;
                     param.out_call.num_or_loc = osi_malloc((strlen(p_data->val.str) + 1) * sizeof(char));
                     sprintf(param.out_call.num_or_loc, "%s", p_data->val.str);
                     btc_hf_cb_to_app(ESP_HF_DIAL_EVT, &param);
                     osi_free(param.out_call.num_or_loc);
                 } else if (event == BTA_AG_AT_BLDN_EVT) {                    //dial_last
-                    memcpy(param.out_call.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                    memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                     param.out_call.num_or_loc = NULL;
                     btc_hf_cb_to_app(ESP_HF_DIAL_EVT, &param);
                 }
@@ -1609,7 +1586,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             memset(&ag_res, 0, sizeof(ag_res));
             ag_res.ok_flag = BTA_AG_OK_ERROR;
             ag_res.errcode = BTA_AG_ERR_OP_NOT_SUPPORTED;
-            BTA_AgResult(hf_local_param[idx].btc_hf_cb.handle, BTA_AG_UNAT_RES, &ag_res);
+            BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_UNAT_RES, &ag_res);
             break;
         }
 
@@ -1624,11 +1601,11 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             ** of SCO connection establishment */
             if ((btc_conf_hf_force_wbs == TRUE) && (p_data->val.num & BTA_AG_CODEC_MSBC)) {
                   BTC_TRACE_DEBUG("%s btc_hf override-Preferred Codec to MSBC", __FUNCTION__);
-                  BTA_AgSetCodec(hf_local_param[idx].btc_hf_cb.handle,BTA_AG_CODEC_MSBC);
+                  BTA_AgSetCodec(hf_local_param.btc_hf_cb[idx].handle,BTA_AG_CODEC_MSBC);
             }
             else {
                   BTC_TRACE_DEBUG("%s btc_hf override-Preferred Codec to CVSD", __FUNCTION__);
-                  BTA_AgSetCodec(hf_local_param[idx].btc_hf_cb.handle,BTA_AG_CODEC_CVSD);
+                  BTA_AgSetCodec(hf_local_param.btc_hf_cb[idx].handle,BTA_AG_CODEC_CVSD);
             }
 #endif
             break;
@@ -1640,7 +1617,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 BTC_TRACE_DEBUG("Set codec status %d codec %d 1=CVSD 2=MSBC", p_data->val.hdr.status, p_data->val.num);
-                memcpy(param.wbs_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.wbs_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.wbs_rep.codec = p_data->val.num;
                 btc_hf_cb_to_app(ESP_HF_WBS_RESPONSE_EVT, &param);
             } while (0);
@@ -1653,7 +1630,7 @@ void btc_hf_cb_handler(btc_msg_t *msg)
             CHECK_HF_IDX(idx);
             do {
                 BTC_TRACE_DEBUG("AG final seleded codec is %d 1=CVSD 2=MSBC", p_data->val.num);
-                memcpy(param.bcs_rep.remote_addr, &hf_local_param[idx].btc_hf_cb.connected_bda,sizeof(esp_bd_addr_t));
+                memcpy(param.bcs_rep.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                 param.bcs_rep.mode = p_data->val.num;
                 /* No ESP_HF_WBS_NONE case, because HFP 1.6 supported device can send BCS */
                 btc_hf_cb_to_app(ESP_HF_BCS_RESPONSE_EVT, &param);
@@ -1677,18 +1654,16 @@ void btc_hf_get_profile_status(esp_hf_profile_status_t *param)
 {
     param->hfp_ag_inited = false; // Not initialized by default
 
-#if HFP_DYNAMIC_MEMORY == TRUE
-    if (hf_local_param)
-#endif
-    {
+    if (hf_local_param.initialized) {
+        param->hfp_ag_inited = true;
+    }
+
+    if (hf_local_param.btc_hf_cb != NULL) {
         for (int idx = 0; idx < BTC_HF_NUM_CB; idx++) {
-            if (hf_local_param[idx].btc_hf_cb.initialized) {
-                param->hfp_ag_inited = true;
-                if (hf_local_param[idx].btc_hf_cb.connection_state == ESP_HF_CONNECTION_STATE_SLC_CONNECTED) {
-                    param->slc_conn_num++;
-                    if (hf_local_param[idx].btc_hf_cb.sync_conn_hdl != ESP_INVALID_CONN_HANDLE) {
-                        param->sync_conn_num++;
-                    }
+            if (hf_local_param.btc_hf_cb[idx].connection_state == ESP_HF_CONNECTION_STATE_SLC_CONNECTED) {
+                param->slc_conn_num++;
+                if (hf_local_param.btc_hf_cb[idx].sync_conn_hdl != ESP_INVALID_CONN_HANDLE) {
+                    param->sync_conn_num++;
                 }
             }
         }

components/bt/host/bluedroid/btc/profile/std/include/btc_hf_ag.h

@@ -209,7 +209,6 @@ typedef union
 /* BTC-AG control block to map bdaddr to BTA handle */
 typedef struct
 {
-    bool                               initialized;
     UINT16                             handle;
     UINT16                             sync_conn_hdl;
     bt_bdaddr_t                        connected_bda;
@@ -227,16 +226,16 @@ typedef struct
 
 typedef struct
 {
+    bool                               initialized;
     int                                hf_idx;
-    UINT32                             btc_hf_features;
-    btc_hf_cb_t                        btc_hf_cb;
+    btc_hf_cb_t                       *btc_hf_cb;
     esp_hf_incoming_data_cb_t          btc_hf_incoming_data_cb;
     esp_hf_outgoing_data_cb_t          btc_hf_outgoing_data_cb;
 } hf_local_param_t;
 
 #if HFP_DYNAMIC_MEMORY == TRUE
 extern hf_local_param_t *hf_local_param_ptr;
-#define hf_local_param (hf_local_param_ptr)
+#define hf_local_param (*hf_local_param_ptr)
 #endif
 
 /*******************************************************************************

components/bt/host/bluedroid/common/include/common/bt_trace.h

@@ -223,20 +223,26 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 #define BTM_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_BTM"), fmt, ## args); \
     if (btm_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(BTM, ERROR)) BT_PRINT_E("BT_BTM", fmt, ## args); \
 }
 
 #define BTM_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_BTM"), fmt, ## args); \
     if (btm_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(BTM, WARNING)) BT_PRINT_W("BT_BTM", fmt, ## args); \
 }
 
 #define BTM_TRACE_API(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_BTM", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_BTM"), fmt, ## args); \
     if (btm_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(BTM, API)) BT_PRINT_I("BT_BTM", fmt, ## args); \
 }
 
 #define BTM_TRACE_EVENT(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM"), fmt, ## args); \
     if (btm_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(BTM, EVENT)) BT_PRINT_D("BT_BTM", fmt, ## args); \
 }
 
@@ -259,19 +265,26 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 #define L2CAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_L2CAP"), fmt, ## args); \
     if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(L2CAP, ERROR)) BT_PRINT_E("BT_L2CAP", fmt, ## args); \
 }
 
 #define L2CAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_L2CAP"), fmt, ## args); \
     if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(L2CAP, WARNING)) BT_PRINT_W("BT_L2CAP", fmt, ## args); \
 }
 
 #define L2CAP_TRACE_API(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_L2CAP", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_L2CAP"), fmt, ## args); \
     if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(L2CAP, API)) BT_PRINT_I("BT_L2CAP", fmt, ## args); \
 }
 
 #define L2CAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_L2CAP"), fmt, ## args); \
     if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(L2CAP, EVENT)) BT_PRINT_D("BT_L2CAP", fmt, ## args); \
 }
 
@@ -310,19 +323,26 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 #define GAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GAP"), fmt, ## args); \
     if (gap_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GAP, ERROR)) BT_PRINT_E("BT_GAP", fmt, ## args); \
 }
 
 #define GAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GAP"), fmt, ## args); \
     if (gap_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GAP, WARNING)) BT_PRINT_W("BT_GAP", fmt, ## args); \
 }
 
 #define GAP_TRACE_API(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GAP", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GAP"), fmt, ## args); \
     if (gap_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GAP, API)) BT_PRINT_I("BT_GAP", fmt, ## args); \
 }
 
 #define GAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GAP"), fmt, ## args); \
     if (gap_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GAP, EVENT)) BT_PRINT_D("BT_GAP", fmt, ## args); \
 }
 
@@ -412,19 +432,26 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 #define GATT_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GATT"), fmt, ## args); \
     if (gatt_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GATT, ERROR)) BT_PRINT_E("BT_GATT", fmt, ## args); \
 }
 
 #define GATT_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GATT"), fmt, ## args); \
     if (gatt_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GATT, WARNING)) BT_PRINT_W("BT_GATT", fmt, ## args); \
 }
 
 #define GATT_TRACE_API(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GATT", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GATT"), fmt, ## args); \
     if (gatt_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GATT, API)) BT_PRINT_I("BT_GATT", fmt, ## args); \
 }
 
 #define GATT_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GATT"), fmt, ## args); \
     if (gatt_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GATT, EVENT)) BT_PRINT_D("BT_GATT", fmt, ## args); \
 }
 
@@ -447,19 +474,26 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 #define SMP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_SMP"), fmt, ## args); \
     if (smp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SMP, ERROR)) BT_PRINT_E("BT_SMP", fmt, ## args); \
 }
 
 #define SMP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_SMP"), fmt, ## args); \
     if (smp_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(SMP, WARNING)) BT_PRINT_W("BT_SMP", fmt, ## args); \
 }
 
 #define SMP_TRACE_API(fmt, args...) { \
-    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_SMP", fmt, ## args); \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_SMP"), fmt, ## args); \
     if (smp_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(SMP, API)) BT_PRINT_I("BT_SMP", fmt, ## args); \
 }
 
 #define SMP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_host_write(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, \
+                               BLE_LOG_SPI_OUT_BUILD_PREFIX(BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_SMP"), fmt, ## args); \
     if (smp_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(SMP, EVENT)) BT_PRINT_D("BT_SMP", fmt, ## args); \
 }
 

components/bt/host/bluedroid/hci/hci_hal_h4.c

@@ -600,9 +600,9 @@ void bt_record_hci_data(uint8_t *data, uint16_t len)
 
 static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
 {
-#if (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
-    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
-#endif // (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    ble_log_spi_out_hci_write(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
     //Target has packet to host, malloc new buffer for packet
     BT_HDR *pkt = NULL;
 #if (BLE_42_SCAN_EN == TRUE)

components/bt/host/nimble/Kconfig.in

@@ -751,9 +751,11 @@ config BT_NIMBLE_GATT_CACHING_INCLUDE_SERVICES
         Enable this option to include *included services* (e.g., services referenced by other services)
         in the GATT database cache. Disabling this will skip caching of included service entries.
 config BT_NIMBLE_INCL_SVC_DISCOVERY
-    bool "Enable Included service discovery"
-    default y if BT_NIMBLE_GATT_CACHING_INCLUDE_SERVICES
-    default n
+    bool
+    default y if BT_NIMBLE_GATT_CACHING && BT_NIMBLE_GATT_CACHING_INCLUDE_SERVICES
+    default n if BT_NIMBLE_GATT_CACHING && !BT_NIMBLE_GATT_CACHING_INCLUDE_SERVICES
+    default n if !BT_NIMBLE_GATT_CACHING
+    prompt "Enable Included service discovery" if !BT_NIMBLE_GATT_CACHING
     help
         Enable this option to start discovery for included service.
 config BT_NIMBLE_GATT_CACHING_MAX_CONNS

components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c

@@ -72,9 +72,9 @@ void esp_vhci_host_send_packet_wrapper(uint8_t *data, uint16_t len)
 #if (BT_HCI_LOG_INCLUDED == TRUE)
     bt_hci_log_record_hci_data(data[0], &data[1], len - 1);
 #endif
-#if (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
-    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
-#endif // (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    ble_log_spi_out_hci_write(BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM, data, len);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
     esp_vhci_host_send_packet(data, len);
 }
 
@@ -231,9 +231,9 @@ static int dummy_host_rcv_pkt(uint8_t *data, uint16_t len)
  */
 static int host_rcv_pkt(uint8_t *data, uint16_t len)
 {
-#if (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
-    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
-#endif // (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    ble_log_spi_out_hci_write(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
 
     bt_record_hci_data(data, len);
 

components/bt/include/esp32c2/include/esp_bt.h

@@ -446,6 +446,10 @@ uint32_t esp_bt_get_lpclk_freq(void);
 
 void esp_bt_set_lpclk_freq(uint32_t clk_freq);
 
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit);
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
+
 #ifdef __cplusplus
 }
 #endif

components/bt/include/esp32c6/include/esp_bt.h

@@ -156,7 +156,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20250526
+#define CONFIG_VERSION  0x20250606
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -230,6 +230,8 @@ typedef struct {
                                                         - 0 - Disable
                                                         - 1 - Enable (default) */
     int8_t ch39_txpwr;                               /*!< BLE transmit power (in dBm) used for BLE advertising on channel 39. */
+    uint8_t adv_rsv_cnt;                             /*!< BLE adv state machine reserve count number */
+    uint8_t conn_rsv_cnt;                            /*!< BLE conn state machine reserve count number */
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
@@ -291,6 +293,8 @@ typedef struct {
     .skip_unnecessary_checks_en = 0,                                                    \
     .fast_conn_data_tx_en       = DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN,              \
     .ch39_txpwr                 = BLE_LL_TX_PWR_DBM_N,                                  \
+    .adv_rsv_cnt                = BLE_LL_ADV_SM_RESERVE_CNT_N,                          \
+    .conn_rsv_cnt               = BLE_LL_CONN_SM_RESERVE_CNT_N,                         \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 #elif CONFIG_IDF_TARGET_ESP32C61
@@ -350,6 +354,8 @@ typedef struct {
     .skip_unnecessary_checks_en = 0,                                                    \
     .fast_conn_data_tx_en       = DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN,              \
     .ch39_txpwr                 = BLE_LL_TX_PWR_DBM_N,                                  \
+    .adv_rsv_cnt                = BLE_LL_ADV_SM_RESERVE_CNT_N,                          \
+    .conn_rsv_cnt               = BLE_LL_CONN_SM_RESERVE_CNT_N,                         \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 #endif
@@ -515,6 +521,10 @@ uint32_t esp_bt_get_lpclk_freq(void);
 
 void esp_bt_set_lpclk_freq(uint32_t clk_freq);
 
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit);
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
+
 #ifdef __cplusplus
 }
 #endif

components/bt/include/esp32h2/include/esp_bt.h

@@ -161,7 +161,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20250526
+#define CONFIG_VERSION  0x20250606
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -234,6 +234,8 @@ typedef struct {
                                                         - 0 - Disable
                                                         - 1 - Enable (default) */
     int8_t ch39_txpwr;                              /*!< BLE transmit power (in dBm) used for BLE advertising on channel 39. */
+    uint8_t adv_rsv_cnt;                            /*!< BLE adv state machine reserve count number */
+    uint8_t conn_rsv_cnt;                           /*!< BLE conn state machine reserve count number */
     uint32_t config_magic;                          /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
@@ -294,6 +296,8 @@ typedef struct {
     .skip_unnecessary_checks_en = 0,                                                    \
     .fast_conn_data_tx_en       = DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN,              \
     .ch39_txpwr                 = BLE_LL_TX_PWR_DBM_N,                                  \
+    .adv_rsv_cnt                = BLE_LL_ADV_SM_RESERVE_CNT_N,                          \
+    .conn_rsv_cnt               = BLE_LL_CONN_SM_RESERVE_CNT_N,                         \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 
@@ -458,6 +462,10 @@ uint32_t esp_bt_get_lpclk_freq(void);
 
 void esp_bt_set_lpclk_freq(uint32_t clk_freq);
 
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit);
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
+
 #ifdef __cplusplus
 }
 #endif

components/bt/porting/include/bt_osi_mem.h

@@ -19,3 +19,7 @@ void *bt_osi_mem_malloc_internal(size_t size);
 void *bt_osi_mem_calloc_internal(size_t n, size_t size);
 
 void bt_osi_mem_free(void *ptr);
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void bt_osi_mem_count_limit_set(uint16_t count_limit);
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/porting/mem/bt_osi_mem.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -11,6 +11,10 @@
 #include <assert.h>
 
 static uint8_t log_count;
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+static uint16_t mem_count_limit = 0;
+static uint16_t curr_mem_count;
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
 IRAM_ATTR void *bt_osi_mem_malloc(size_t size)
 {
     void *mem = NULL;
@@ -49,11 +53,27 @@ IRAM_ATTR void *bt_osi_mem_calloc(size_t n, size_t size)
 
 IRAM_ATTR void *bt_osi_mem_malloc_internal(size_t size)
 {
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+    if (mem_count_limit) {
+        if (curr_mem_count > mem_count_limit) {
+            return NULL;
+        }
+        curr_mem_count ++;
+    }
+#endif  // CONFIG_BT_LE_MEM_CHECK_ENABLED
     return heap_caps_malloc(size, MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA);
 }
 
 IRAM_ATTR void *bt_osi_mem_calloc_internal(size_t n, size_t size)
 {
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+    if (mem_count_limit) {
+        if (curr_mem_count > mem_count_limit) {
+            return NULL;
+        }
+        curr_mem_count ++;
+    }
+#endif  // CONFIG_BT_LE_MEM_CHECK_ENABLED
     return heap_caps_calloc(n, size, MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA);
 }
 
@@ -61,3 +81,11 @@ IRAM_ATTR void bt_osi_mem_free(void *ptr)
 {
     heap_caps_free(ptr);
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void bt_osi_mem_count_limit_set(uint16_t count_limit)
+{
+    mem_count_limit = count_limit;
+    curr_mem_count = 0;
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/driver/test_apps/components/test_driver_utils/include/test_spi_utils.h

@@ -89,6 +89,7 @@
 #define WIRE_DELAY              12.5
 
 #else
+#define UNCONNECTED_PIN         8
 #define GPIO_DELAY              0
 #define ESP_SPI_SLAVE_TV        0
 #define WIRE_DELAY              12.5

components/efuse/include/esp_efuse.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -159,7 +159,7 @@ esp_err_t esp_efuse_write_field_cnt(const esp_efuse_desc_t* field[], size_t cnt)
  *
  * @return
  * - ESP_OK: The operation was successfully completed, or the bit was already set to value 1.
- * - ESP_ERR_INVALID_ARG: Error in the passed arugments, including if the efuse field is not 1 bit wide.
+ * - ESP_ERR_INVALID_ARG: Error in the passed arguments, including if the efuse field is not 1 bit wide.
  */
 esp_err_t esp_efuse_write_field_bit(const esp_efuse_desc_t* field[]);
 
@@ -468,7 +468,7 @@ esp_err_t esp_efuse_batch_write_begin(void);
  *
  * @return
  *          - ESP_OK: Successful.
- *          - ESP_ERR_INVALID_STATE: Tha batch mode was not set.
+ *          - ESP_ERR_INVALID_STATE: The batch mode was not set.
  */
 esp_err_t esp_efuse_batch_write_cancel(void);
 
@@ -806,6 +806,45 @@ esp_err_t esp_efuse_check_errors(void);
  */
 esp_err_t esp_efuse_destroy_block(esp_efuse_block_t block);
 
+#if SOC_ECDSA_SUPPORTED
+/**
+ * @brief Checks if 192-bit ECDSA curve operations are supported.
+ *
+ * This function checks if the current eFuse configuration supports 192-bit ECDSA curve operations.
+*/
+bool esp_efuse_is_ecdsa_p192_curve_supported(void);
+
+/**
+ * @brief Checks if 256-bit ECDSA curve operations are supported.
+ *
+ * This function checks if the current eFuse configuration supports 256-bit ECDSA curve operations.
+*/
+bool esp_efuse_is_ecdsa_p256_curve_supported(void);
+#endif /* SOC_ECDSA_SUPPORTED*/
+
+#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+typedef enum {
+    ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT = 0,
+    ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT = 1,
+    ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT = 2,
+    ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED = 3,
+} esp_efuse_ecdsa_curve_mode_t;
+
+/**
+ * @brief Enables 192-bit ECDSA curve operations by setting the appropriate eFuse value.
+ *
+ * This function enables support for 192-bit ECDSA curve operations by configuring the
+ * ECDSA curve mode eFuse. It checks the current curve mode and attempts to set it to
+ * allow both P192 and P256 operations if not already set.
+ *
+ * @return
+ *    - ESP_OK: Successfully enabled 192-bit ECDSA operations or already enabled
+ *    - ESP_FAIL: Failed to enable operations due to write protection
+ *    - Other error codes: Failed to read/write eFuse
+ */
+esp_err_t esp_efuse_enable_ecdsa_p192_curve_mode(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/efuse/src/esp_efuse_fields.c

@@ -16,6 +16,13 @@
 #include "esp_log.h"
 #include "soc/efuse_periph.h"
 #include "sys/param.h"
+#include "soc/soc_caps.h"
+#include "hal/efuse_ll.h"
+#include "hal/efuse_hal.h"
+
+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif /* SOC_ECDSA_SUPPORTED */
 
 static __attribute__((unused)) const char *TAG = "efuse";
 
@@ -81,3 +88,66 @@ esp_err_t esp_efuse_update_secure_version(uint32_t secure_version)
     }
     return ESP_OK;
 }
+
+#if SOC_ECDSA_SUPPORTED
+bool esp_efuse_is_ecdsa_p192_curve_supported(void)
+{
+#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        uint32_t current_curve = efuse_hal_get_ecdsa_curve_mode();
+        return (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
+    } else {
+        return true;
+    }
+#else
+    return true;
+#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */
+}
+
+bool esp_efuse_is_ecdsa_p256_curve_supported(void)
+{
+#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        uint32_t current_curve = efuse_hal_get_ecdsa_curve_mode();
+        return (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT);
+    } else {
+        return true;
+    }
+#else
+    return true;
+#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */
+}
+#endif /* SOC_ECDSA_SUPPORTED */
+
+#if SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+esp_err_t esp_efuse_enable_ecdsa_p192_curve_mode(void)
+{
+
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_err_t err;
+        uint8_t current_curve, next_curve;
+
+        current_curve = efuse_hal_get_ecdsa_curve_mode();
+        // Check if already in desired state
+        if (current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P192_BIT) {
+            ESP_EARLY_LOGD(TAG, "ECDSA P-192 curve mode is already enabled");
+            return ESP_OK;
+        }
+
+        // Check if write is disabled or already locked to P256
+        if (esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE) || current_curve == ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+            ESP_EARLY_LOGE(TAG, "ECDSA curve mode is locked, cannot enable P-192 curve");
+            return ESP_FAIL;
+        }
+
+        // Attempt to write new curve mode
+        next_curve = ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_BOTH_P192_P256_BIT;
+        err = esp_efuse_write_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &next_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+        if (err != ESP_OK) {
+            ESP_EARLY_LOGE(TAG, "Failed to enable ECDSA P-192 curve %d", err);
+            return err;
+        }
+    }
+    return ESP_OK;
+}
+#endif /* SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED */

components/efuse/src/esp_efuse_startup.c

@@ -122,6 +122,10 @@ static esp_err_t init_efuse_secure(void)
     // ESP32 only: Permanently disable BASIC ROM Console feature
     esp_efuse_disable_basic_rom_console();
 #endif
+
+#if CONFIG_ESP_ECDSA_ENABLE_P192_CURVE
+    ESP_RETURN_ON_ERROR(esp_efuse_enable_ecdsa_p192_curve_mode(), TAG, "Failed to enable ECDSA 192-curve operations");
+#endif
     return ESP_OK;
 }
 

components/esp-tls/Kconfig

@@ -115,4 +115,20 @@ menu "ESP-TLS"
         help
             Enable detailed debug prints for wolfSSL SSL library.
 
+    config ESP_TLS_OCSP_CHECKALL
+        bool "Enabled full OCSP checks for ESP-TLS"
+        depends on ESP_TLS_USING_WOLFSSL
+        default y
+        help
+            Enable a fuller set of OCSP checks: checking revocation status of intermediate certificates,
+            optional fallbacks to CRLs, etc.
+
+    config ESP_TLS_DYN_BUF_STRATEGY_SUPPORTED
+        bool
+        default y
+        help
+            Enable support for dynamic buffer strategy for ESP-TLS. This is the hidden config option kept
+            for external components like OTA, to find out whether the dynamic buffer strategy is supported
+            for particular ESP-IDF version.
+
 endmenu

components/esp-tls/esp_tls.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -91,6 +91,12 @@ typedef enum {
    ESP_TLS_VER_TLS_MAX,         /* to indicate max */
 } esp_tls_proto_ver_t;
 
+typedef enum {
+    ESP_TLS_DYN_BUF_RX_STATIC = 1,    /*!< Strategy to disable dynamic RX buffer allocations and convert to static allocation post-handshake, reducing memory fragmentation */
+    ESP_TLS_DYN_BUF_STRATEGY_MAX,     /*!< to indicate max */
+} esp_tls_dyn_buf_strategy_t;
+
+
 /**
  * @brief      ESP-TLS configuration parameters
  *
@@ -211,6 +217,11 @@ typedef struct esp_tls_cfg {
     const int *ciphersuites_list;           /*!< Pointer to a zero-terminated array of IANA identifiers of TLS ciphersuites.
                                                 Please check the list validity by esp_tls_get_ciphersuites_list() API */
     esp_tls_proto_ver_t tls_version;        /*!< TLS protocol version of the connection, e.g., TLS 1.2, TLS 1.3 (default - no preference) */
+
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+    esp_tls_dyn_buf_strategy_t esp_tls_dyn_buf_strategy; /*!< ESP-TLS dynamic buffer strategy */
+#endif
+
 } esp_tls_cfg_t;
 
 #if defined(CONFIG_ESP_TLS_SERVER_SESSION_TICKETS)
@@ -464,7 +475,7 @@ int esp_tls_conn_http_new_async(const char *url, const esp_tls_cfg_t *cfg, esp_t
  *             - >=0  if write operation was successful, the return value is the number
  *                   of bytes actually written to the TLS/SSL connection.
  *             - <0  if write operation was not successful, because either an
- *                   error occured or an action must be taken by the calling process.
+ *                   error occurred or an action must be taken by the calling process.
  *             - ESP_TLS_ERR_SSL_WANT_READ/
  *               ESP_TLS_ERR_SSL_WANT_WRITE.
  *                  if the handshake is incomplete and waiting for data to be available for reading.
@@ -485,7 +496,7 @@ ssize_t esp_tls_conn_write(esp_tls_t *tls, const void *data, size_t datalen);
  *             -  0  if read operation was not successful. The underlying
  *                   connection was closed.
  *             - <0  if read operation was not successful, because either an
- *                   error occured or an action must be taken by the calling process.
+ *                   error occurred or an action must be taken by the calling process.
  */
 ssize_t esp_tls_conn_read(esp_tls_t *tls, void  *data, size_t datalen);
 
@@ -537,7 +548,7 @@ esp_err_t esp_tls_get_conn_sockfd(esp_tls_t *tls, int *sockfd);
  *
  * @param[in]   sockfd       sockfd value to set.
  *
- * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
+ * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
  *             - ESP_ERR_INVALID_ARG if (tls == NULL || sockfd < 0)
  */
 esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
@@ -549,7 +560,7 @@ esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
  *
  * @param[out]   conn_state   pointer to the connection state value.
  *
- * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
+ * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
  *             - ESP_ERR_INVALID_ARG (Invalid arguments)
  */
 esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_state);
@@ -561,7 +572,7 @@ esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_stat
  *
  * @param[in]   conn_state   connection state value to set.
  *
- * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
+ * @return     - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
  *             - ESP_ERR_INVALID_ARG (Invalid arguments)
  */
 esp_err_t esp_tls_set_conn_state(esp_tls_t *tls, esp_tls_conn_state_t conn_state);
@@ -586,7 +597,7 @@ void *esp_tls_get_ssl_context(esp_tls_t *tls);
  *
  * @return
  *             - ESP_OK             if creating global CA store was successful.
- *             - ESP_ERR_NO_MEM     if an error occured when allocating the mbedTLS resources.
+ *             - ESP_ERR_NO_MEM     if an error occurred when allocating the mbedTLS resources.
  */
 esp_err_t esp_tls_init_global_ca_store(void);
 
@@ -605,7 +616,7 @@ esp_err_t esp_tls_init_global_ca_store(void);
  *
  * @return
  *             - ESP_OK  if adding certificates was successful.
- *             - Other   if an error occured or an action must be taken by the calling process.
+ *             - Other   if an error occurred or an action must be taken by the calling process.
  */
 esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const unsigned int cacert_pem_bytes);
 

components/esp-tls/esp_tls_mbedtls.c

@@ -19,7 +19,7 @@
 #include <errno.h>
 #include "esp_log.h"
 #include "esp_check.h"
-
+#include "mbedtls/esp_mbedtls_dynamic.h"
 #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN
 #include "ecdsa/ecdsa_alt.h"
 #endif
@@ -39,6 +39,7 @@ static esp_err_t esp_set_atecc608a_pki_context(esp_tls_t *tls, const void *pki);
 #endif /* CONFIG_ESP_TLS_USE_SECURE_ELEMENT */
 
 #if defined(CONFIG_ESP_TLS_USE_DS_PERIPHERAL)
+#include <pk_wrap.h>
 #include "rsa_sign_alt.h"
 static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki);
 #endif /* CONFIG_ESP_TLS_USE_DS_PERIPHERAL */
@@ -104,6 +105,10 @@ esp_err_t esp_create_mbedtls_handle(const char *hostname, size_t hostlen, const
 
     mbedtls_ssl_conf_rng(&tls->conf, mbedtls_ctr_drbg_random, &tls->ctr_drbg);
 
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+    tls->esp_tls_dyn_buf_strategy = ((esp_tls_cfg_t *)cfg)->esp_tls_dyn_buf_strategy;
+#endif
+
     if (tls->role == ESP_TLS_CLIENT) {
         esp_ret = set_client_config(hostname, hostlen, (esp_tls_cfg_t *)cfg, tls);
         if (esp_ret != ESP_OK) {
@@ -219,6 +224,15 @@ int esp_mbedtls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg)
 #endif
     ret = mbedtls_ssl_handshake(&tls->ssl);
     if (ret == 0) {
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+        if (tls->esp_tls_dyn_buf_strategy != 0) {
+            ret = esp_mbedtls_dynamic_set_rx_buf_static(&tls->ssl);
+            if (ret != 0) {
+                ESP_LOGE(TAG, "esp_mbedtls_dynamic_set_rx_buf_static returned -0x%04X", -ret);
+                return ret;
+            }
+        }
+#endif
         tls->conn_state = ESP_TLS_DONE;
 
 #ifdef CONFIG_ESP_TLS_USE_DS_PERIPHERAL
@@ -357,6 +371,28 @@ void esp_mbedtls_cleanup(esp_tls_t *tls)
     tls->cacert_ptr = NULL;
     mbedtls_x509_crt_free(&tls->cacert);
     mbedtls_x509_crt_free(&tls->clientcert);
+
+#ifdef CONFIG_ESP_TLS_USE_DS_PERIPHERAL
+    if (mbedtls_pk_get_type(&tls->clientkey) == MBEDTLS_PK_RSA_ALT) {
+        mbedtls_rsa_alt_context *rsa_alt = tls->clientkey.MBEDTLS_PRIVATE(pk_ctx);
+        if (rsa_alt && rsa_alt->key != NULL) {
+            mbedtls_rsa_free(rsa_alt->key);
+            mbedtls_free(rsa_alt->key);
+            rsa_alt->key = NULL;
+        }
+    }
+
+    // Similar cleanup for server key
+    if (mbedtls_pk_get_type(&tls->serverkey) == MBEDTLS_PK_RSA_ALT) {
+        mbedtls_rsa_alt_context *rsa_alt = tls->serverkey.MBEDTLS_PRIVATE(pk_ctx);
+        if (rsa_alt && rsa_alt->key != NULL) {
+            mbedtls_rsa_free(rsa_alt->key);
+            mbedtls_free(rsa_alt->key);
+            rsa_alt->key = NULL;
+        }
+    }
+#endif
+
     mbedtls_pk_free(&tls->clientkey);
     mbedtls_entropy_free(&tls->entropy);
     mbedtls_ssl_config_free(&tls->conf);
@@ -1103,12 +1139,18 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki)
 {
     int ret = -1;
     /* initialize the mbedtls pk context with rsa context */
-    mbedtls_rsa_context rsakey;
-    mbedtls_rsa_init(&rsakey);
-    if ((ret = mbedtls_pk_setup_rsa_alt(((const esp_tls_pki_t*)pki)->pk_key, &rsakey, NULL, esp_ds_rsa_sign,
+    mbedtls_rsa_context *rsakey = calloc(1, sizeof(mbedtls_rsa_context));
+    if (rsakey == NULL) {
+        ESP_LOGE(TAG, "Failed to allocate memory for mbedtls_rsa_context");
+        return ESP_ERR_NO_MEM;
+    }
+    mbedtls_rsa_init(rsakey);
+    if ((ret = mbedtls_pk_setup_rsa_alt(((const esp_tls_pki_t*)pki)->pk_key, rsakey, NULL, esp_ds_rsa_sign,
                                         esp_ds_get_keylen )) != 0) {
         ESP_LOGE(TAG, "Error in mbedtls_pk_setup_rsa_alt, returned -0x%04X", -ret);
         mbedtls_print_error_msg(ret);
+        mbedtls_rsa_free(rsakey);
+        free(rsakey);
         ret = ESP_FAIL;
         goto exit;
     }
@@ -1119,7 +1161,6 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki)
     }
     ESP_LOGD(TAG, "DS peripheral params initialized.");
 exit:
-    mbedtls_rsa_free(&rsakey);
     return ret;
 }
 #endif /* CONFIG_ESP_TLS_USE_DS_PERIPHERAL */

components/esp-tls/private_include/esp_tls_private.h

@@ -94,6 +94,10 @@ struct esp_tls {
 
     esp_tls_error_handle_t error_handle;                                        /*!< handle to error descriptor */
 
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+    esp_tls_dyn_buf_strategy_t esp_tls_dyn_buf_strategy;                        /*!< ESP-TLS dynamic buffer strategy */
+#endif
+
 };
 
 // Function pointer for the server configuration API

components/esp_adc/adc_common.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -16,6 +16,7 @@
 #include "hal/adc_hal.h"
 #include "hal/adc_hal_common.h"
 #include "soc/adc_periph.h"
+#include "hal/adc_ll.h"
 
 static const char *TAG = "adc_common";
 
@@ -56,9 +57,12 @@ esp_err_t adc_channel_to_io(adc_unit_t unit_id, adc_channel_t channel, int * con
 ---------------------------------------------------------------*/
 static __attribute__((constructor)) void adc_hw_calibration(void)
 {
-    adc_apb_periph_claim();
     //Calculate all ICode
     for (int i = 0; i < SOC_ADC_PERIPH_NUM; i++) {
+        if (ADC_LL_NEED_APB_PERIPH_CLAIM(i)) {
+            adc_apb_periph_claim();
+        }
+
         adc_hal_calibration_init(i);
         for (int j = 0; j < SOC_ADC_ATTEN_NUM; j++) {
             /**
@@ -73,6 +77,9 @@ static __attribute__((constructor)) void adc_hw_calibration(void)
             }
 #endif
         }
+        if (ADC_LL_NEED_APB_PERIPH_CLAIM(i)) {
+            adc_apb_periph_free();
+        }
     }
 }
 #endif //#if SOC_ADC_CALIBRATION_V1_SUPPORTED

components/esp_adc/adc_oneshot.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -115,13 +115,15 @@ esp_err_t adc_oneshot_new_unit(const adc_oneshot_unit_init_cfg_t *init_config, a
     };
     adc_oneshot_hal_init(&(unit->hal), &config);
 
-    //To enable the APB_SARADC periph if needed
-    _lock_acquire(&s_ctx.mutex);
-    s_ctx.apb_periph_ref_cnts++;
-    if (s_ctx.apb_periph_ref_cnts == 1) {
-        adc_apb_periph_claim();
+    if (ADC_LL_NEED_APB_PERIPH_CLAIM(unit->unit_id)) {
+        //To enable the APB_SARADC periph if needed
+        _lock_acquire(&s_ctx.mutex);
+        s_ctx.apb_periph_ref_cnts++;
+        if (s_ctx.apb_periph_ref_cnts == 1) {
+            adc_apb_periph_claim();
+        }
+        _lock_release(&s_ctx.mutex);
     }
-    _lock_release(&s_ctx.mutex);
 
     if (init_config->ulp_mode == ADC_ULP_MODE_DISABLE) {
         sar_periph_ctrl_adc_oneshot_power_acquire();
@@ -224,7 +226,6 @@ esp_err_t adc_oneshot_del_unit(adc_oneshot_unit_handle_t handle)
     _lock_release(&s_ctx.mutex);
 
     ESP_LOGD(TAG, "adc unit%"PRId32" is deleted", handle->unit_id);
-    free(handle);
 
     if (ulp_mode == ADC_ULP_MODE_DISABLE) {
         sar_periph_ctrl_adc_oneshot_power_release();
@@ -234,16 +235,18 @@ esp_err_t adc_oneshot_del_unit(adc_oneshot_unit_handle_t handle)
 #endif
     }
 
-#if SOC_ADC_DIG_CTRL_SUPPORTED && !SOC_ADC_RTC_CTRL_SUPPORTED
-    //To free the APB_SARADC periph if needed
-    _lock_acquire(&s_ctx.mutex);
-    s_ctx.apb_periph_ref_cnts--;
-    assert(s_ctx.apb_periph_ref_cnts >= 0);
-    if (s_ctx.apb_periph_ref_cnts == 0) {
-        adc_apb_periph_free();
+    if (ADC_LL_NEED_APB_PERIPH_CLAIM(handle->unit_id)) {
+        //To free the APB_SARADC periph if needed
+        _lock_acquire(&s_ctx.mutex);
+        s_ctx.apb_periph_ref_cnts--;
+        assert(s_ctx.apb_periph_ref_cnts >= 0);
+        if (s_ctx.apb_periph_ref_cnts == 0) {
+            adc_apb_periph_free();
+        }
+        _lock_release(&s_ctx.mutex);
     }
-    _lock_release(&s_ctx.mutex);
-#endif
+
+    free(handle);
 
     return ESP_OK;
 }

components/esp_coex/include/private/esp_coexist_internal.h

@@ -396,6 +396,15 @@ int coex_schm_flexible_period_set(uint8_t period);
 uint8_t coex_schm_flexible_period_get(void);
 #endif
 
+/**
+ * @brief     Get coexistence scheme phase by phase index.
+ *
+ * @param     phase_idx    Coexistence phase index
+ *
+ * @return    Coexistence scheme phase
+ */
+void * coex_schm_get_phase_by_idx(int phase_idx);
+
 /**
   * @brief     Check the MD5 values of the coexistence adapter header files in IDF and WiFi library
   *

components/esp_common/include/esp_idf_version.h

@@ -15,7 +15,7 @@ extern "C" {
 /** Minor version number (x.X.x) */
 #define ESP_IDF_VERSION_MINOR   3
 /** Patch version number (x.x.X) */
-#define ESP_IDF_VERSION_PATCH   3
+#define ESP_IDF_VERSION_PATCH   4
 
 /**
  * Macro to convert IDF version number into an integer

components/esp_driver_cam/dvp/include/esp_cam_ctlr_dvp.h

@@ -43,10 +43,12 @@ typedef struct esp_cam_ctlr_dvp_config {
         uint32_t bk_buffer_dis  : 1;            /*!< Disable backup buffer */
         uint32_t pin_dont_init : 1;             /*!< Don't initialize DVP pins if users have called "esp_cam_ctlr_dvp_init" before */
         uint32_t pic_format_jpeg : 1;           /*!< Input picture format is JPEG, if set this flag and "input_data_color_type" will be ignored */
+        uint32_t external_xtal : 1;             /*!< Using external XTAL, if set, xclk_io and dvp output clock will be ignored */
     };                                          /*!< Boolean Flags */
 
     uint32_t dma_burst_size;                    /*!< DVP DMA burst transmission block size, set to 0 means to disable the data burst,
                                                      other value must be power of 2, e.g., 4/8/16/32/64/128 */
+    uint32_t xclk_freq;                         /*!< DVP output clock frequency in HZ, only valid if `external_xtal` is set to true */
 
     const esp_cam_ctlr_dvp_pin_config_t *pin;   /*!< DVP pin configuration, this will be ignored by "esp_cam_new_dvp_ctlr" if "pin_dont_init" is set */
 } esp_cam_ctlr_dvp_config_t;

components/esp_driver_cam/dvp/src/esp_cam_ctlr_dvp_cam.c

@@ -136,7 +136,7 @@ static esp_err_t esp_cam_ctlr_dvp_config_input_gpio(int pin, int signal, bool in
 static IRAM_ATTR esp_err_t esp_cam_ctlr_dvp_start_trans(esp_cam_ctlr_dvp_cam_t *ctlr)
 {
     bool buffer_ready = false;
-    esp_cam_ctlr_trans_t trans;
+    esp_cam_ctlr_trans_t trans = {0};
 
     if (ctlr->cur_buf) {
         ctlr->cur_buf = NULL;
@@ -144,9 +144,14 @@ static IRAM_ATTR esp_err_t esp_cam_ctlr_dvp_start_trans(esp_cam_ctlr_dvp_cam_t *
         ESP_RETURN_ON_ERROR_ISR(esp_cam_ctlr_dvp_dma_stop(&ctlr->dma), TAG, "failed to stop DMA");
     }
 
-    if (ctlr->cbs.on_get_new_trans && ctlr->cbs.on_get_new_trans(&(ctlr->base), &trans, ctlr->cbs_user_data)) {
-        buffer_ready = true;
-    } else if (!ctlr->bk_buffer_dis) {
+    if (ctlr->cbs.on_get_new_trans) {
+        ctlr->cbs.on_get_new_trans(&(ctlr->base), &trans, ctlr->cbs_user_data);
+        if (trans.buffer) {
+            buffer_ready = true;
+        }
+    }
+
+    if (!buffer_ready && !ctlr->bk_buffer_dis) {
         trans.buffer = ctlr->backup_buffer;
         trans.buflen = ctlr->fb_size_in_bytes;
         buffer_ready = true;
@@ -684,6 +689,9 @@ esp_err_t esp_cam_new_dvp_ctlr(const esp_cam_ctlr_dvp_config_t *config, esp_cam_
     ESP_RETURN_ON_FALSE(config && ret_handle, ESP_ERR_INVALID_ARG, TAG, "invalid argument: config or ret_handle is null");
     ESP_RETURN_ON_FALSE(config->ctlr_id < CAP_DVP_PERIPH_NUM, ESP_ERR_INVALID_ARG, TAG, "invalid argument: ctlr_id >= %d", CAP_DVP_PERIPH_NUM);
     ESP_RETURN_ON_FALSE(config->pin_dont_init || config->pin, ESP_ERR_INVALID_ARG, TAG, "invalid argument: pin_dont_init is unset and pin is null");
+    ESP_RETURN_ON_FALSE(config->external_xtal || config->pin_dont_init || config->pin->xclk_io != GPIO_NUM_NC, ESP_ERR_INVALID_ARG, TAG, "invalid argument: xclk_io is not set");
+    ESP_RETURN_ON_FALSE(config->external_xtal || config->xclk_freq, ESP_ERR_INVALID_ARG, TAG, "invalid argument: xclk_freq is not set");
+
     ESP_RETURN_ON_ERROR(esp_cache_get_alignment(MALLOC_CAP_SPIRAM | MALLOC_CAP_DMA, &alignment_size), TAG, "failed to get cache alignment");
     ESP_RETURN_ON_ERROR(esp_cam_ctlr_dvp_cam_get_frame_size(config, &fb_size_in_bytes), TAG, "invalid argument: input frame pixel format is not supported");
     ESP_RETURN_ON_ERROR(dvp_shared_ctrl_claim_io_signals(), TAG, "failed to claim io signals");
@@ -716,13 +724,21 @@ esp_err_t esp_cam_new_dvp_ctlr(const esp_cam_ctlr_dvp_config_t *config, esp_cam_
         .port = config->ctlr_id,
         .byte_swap_en = config->byte_swap_en,
     };
-    cam_hal_init(&ctlr->hal, &cam_hal_config);
 
     if (!config->pin_dont_init) {
+        // Initialzie DVP clock and GPIO internally
         ESP_GOTO_ON_ERROR(esp_cam_ctlr_dvp_init(config->ctlr_id, config->clk_src, config->pin),
                           fail5, TAG, "failed to initialize clock and GPIO");
     }
 
+    if (!config->external_xtal) {
+        // Generate DVP xtal clock internally
+        ESP_GOTO_ON_ERROR(esp_cam_ctlr_dvp_output_clock(config->ctlr_id, config->clk_src, config->xclk_freq),
+                          fail5, TAG, "failed to generate xtal clock");
+    }
+
+    cam_hal_init(&ctlr->hal, &cam_hal_config);
+
     ctlr->ctlr_id = config->ctlr_id;
     ctlr->fb_size_in_bytes = fb_size_in_bytes;
     ctlr->dvp_fsm = ESP_CAM_CTLR_DVP_CAM_FSM_INIT;

components/esp_driver_cam/test_apps/dvp/main/test_dvp_driver.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -20,6 +20,7 @@ TEST_CASE("TEST DVP driver allocation", "[DVP]")
         .dma_burst_size = 128,
         .byte_swap_en = false,
         .pin_dont_init = true,
+        .external_xtal = true,
     };
     esp_cam_ctlr_handle_t handle = NULL;
     TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
@@ -45,6 +46,7 @@ TEST_CASE("TEST DVP driver allocation with JPEG input", "[DVP]")
         .byte_swap_en = false,
         .pin_dont_init = true,
         .pic_format_jpeg = true,
+        .external_xtal = true,
     };
     esp_cam_ctlr_handle_t handle = NULL;
     TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
@@ -71,6 +73,7 @@ TEST_CASE("TEST DVP driver no backup buffer usage", "[DVP]")
         .byte_swap_en = false,
         .bk_buffer_dis = true,
         .pin_dont_init = true,
+        .external_xtal = true,
     };
     esp_cam_ctlr_handle_t handle = NULL;
     TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
@@ -84,3 +87,87 @@ TEST_CASE("TEST DVP driver no backup buffer usage", "[DVP]")
     TEST_ASSERT_EQUAL((dvp_config.h_res * dvp_config.v_res * 2), bk_buffer_len); // out type RGB565 using 2 byte / pixel
     TEST_ESP_OK(esp_cam_ctlr_del(handle));
 }
+
+TEST_CASE("TEST DVP driver intern/extern init", "[DVP]")
+{
+    esp_cam_ctlr_dvp_config_t dvp_config = {
+        .ctlr_id = 0,
+        .clk_src = CAM_CLK_SRC_DEFAULT,
+        .h_res = 800,
+        .v_res = 640,
+        .input_data_color_type = CAM_CTLR_COLOR_RGB565,
+        .dma_burst_size = 128,
+        .byte_swap_en = false,
+        .external_xtal = true,
+    };
+    esp_cam_ctlr_handle_t handle = NULL;
+
+    //Init externally, do not check pin
+    dvp_config.pin_dont_init = true;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+
+    //Init internally but not set pin
+    dvp_config.pin_dont_init = false;
+    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+
+    //Init internally and set pin
+    esp_cam_ctlr_dvp_pin_config_t pin_cfg = {
+        .data_width = 8,
+    };
+    dvp_config.pin = &pin_cfg;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+}
+
+TEST_CASE("TEST DVP driver intern/extern generate xclk", "[DVP]")
+{
+    esp_cam_ctlr_dvp_config_t dvp_config = {
+        .ctlr_id = 0,
+        .clk_src = CAM_CLK_SRC_DEFAULT,
+        .h_res = 800,
+        .v_res = 640,
+        .input_data_color_type = CAM_CTLR_COLOR_RGB565,
+        .dma_burst_size = 128,
+        .byte_swap_en = false,
+        .external_xtal = true,
+    };
+    esp_cam_ctlr_handle_t handle = NULL;
+
+    //Init externally, generate xclk externally, check nothing
+    dvp_config.pin_dont_init = true;
+    dvp_config.external_xtal = true;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+
+    //Init externally, generate xclk internally, do not check pin, check xclk_freq
+    dvp_config.pin_dont_init = true;
+    dvp_config.external_xtal = false;
+    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    dvp_config.xclk_freq = 20000000;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+
+    esp_cam_ctlr_dvp_pin_config_t pin_cfg = {
+        .data_width = 8,
+        .xclk_io = GPIO_NUM_NC,
+    };
+
+    //Init internally, generate xclk externally, check nothing
+    dvp_config.pin = &pin_cfg;
+    dvp_config.pin_dont_init = false;
+    dvp_config.external_xtal = true;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+
+    //Init internally, generate xclk internally, check xclk_io and xclk_freq
+    dvp_config.pin = &pin_cfg;
+    dvp_config.pin_dont_init = false;
+    dvp_config.external_xtal = false;
+    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+
+    pin_cfg.xclk_io = 20;
+    dvp_config.pin = &pin_cfg;
+    TEST_ESP_OK(esp_cam_new_dvp_ctlr(&dvp_config, &handle));
+    TEST_ESP_OK(esp_cam_ctlr_del(handle));
+}

components/esp_driver_pcnt/README.md

@@ -0,0 +1,39 @@
+# PCNT Driver Design
+
+## Concurrency
+
+The count value and the overflow state of the count value are located in *different* registers, resulting in the software being unable to obtain information from both of them in the same read instruction.
+
+The race condition case is as follow:
+
+```mermaid
+sequenceDiagram
+    participant HW as PCNT Hardware
+    participant CPU0_ISR as CPU0_ISR
+    participant CPU1_Task as CPU1_Task (pcnt_unit_get_count)
+    participant REG as Reg and Soft accum counter State
+
+    CPU1_Task->>CPU1_Task: Call pcnt_unit_get_count()
+    Note over REG: intr_status = 0<br/>cnt_reg = cnt_value<br/>accum_value = old_value
+    CPU1_Task->>CPU1_Task: portENTER_CRITICAL_SAFE()
+    CPU1_Task->>REG: Read intr_status
+    Note over CPU1_Task: intr_status=0, no need to do compensation
+    HW->>REG: Overflow interrupt triggered
+    Note over REG: intr_status = 1<br/>cnt_reg = 0<br/>accum_value = old_value
+    REG->>CPU0_ISR: ISR is called
+    CPU0_ISR->>CPU0_ISR: try portENTER_CRITICAL_SAFE() but spin
+
+    CPU1_Task->>REG: Read cnt_reg(0) + accum_value(old)
+    CPU1_Task->>CPU1_Task: portEXIT_CRITICAL_SAFE()
+
+    CPU0_ISR->>CPU0_ISR: portENTER_CRITICAL_SAFE()
+    CPU0_ISR->>REG: Clear interrupt status and update accum_value
+    Note over REG: intr_status = 0<br/>accum_value = new_value
+    CPU0_ISR->>CPU0_ISR: portEXIT_CRITICAL_SAFE()
+    
+    Note over CPU0_ISR: Process events
+    Note over CPU1_Task: Return incorrect count ❌
+
+```
+
+In the software, we determine whether to perform compensation by checking whether the count value exceeds half of the limit. This can prevent counting errors when the overflow frequency is not high.

components/esp_driver_pcnt/src/pulse_cnt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -451,10 +451,32 @@ esp_err_t pcnt_unit_get_count(pcnt_unit_handle_t unit, int *value)
     pcnt_group_t *group = NULL;
     ESP_RETURN_ON_FALSE_ISR(unit && value, ESP_ERR_INVALID_ARG, TAG, "invalid argument");
     group = unit->group;
+    int temp_value = 0;
 
     // the accum_value is also accessed by the ISR, so adding a critical section
     portENTER_CRITICAL_SAFE(&unit->spinlock);
-    *value = pcnt_ll_get_count(group->hal.dev, unit->unit_id) + unit->accum_value;
+    temp_value = pcnt_ll_get_count(group->hal.dev, unit->unit_id) ;
+    // Check for pending overflow interrupts that haven't been processed yet
+    // Add compensation to get accurate count
+    if (unit->flags.accum_count) {
+        uint32_t intr_status = pcnt_ll_get_intr_status(group->hal.dev);
+        if (intr_status & PCNT_LL_UNIT_WATCH_EVENT(unit->unit_id)) {
+            uint32_t event_status = pcnt_ll_get_event_status(group->hal.dev, unit->unit_id);
+
+            // TODO: DIG-683
+            // Note, the overflow may be triggered between `pcnt_ll_get_count` and `pcnt_ll_get_event_status`
+            // In this case, we don't want to do the compensation.
+            // so we should check the count value is greater(less) than the low(high) limit / 2 to filter this case.
+            // This workaround is only valid for the case that the counter won't overflow twice between `pcnt_ll_get_count()` and `pcnt_ll_get_intr_status()`
+            if (event_status & BIT(PCNT_LL_WATCH_EVENT_LOW_LIMIT) && temp_value >= unit->low_limit / 2) {
+                temp_value += unit->low_limit;
+            } else if (event_status & BIT(PCNT_LL_WATCH_EVENT_HIGH_LIMIT) && temp_value <= unit->high_limit / 2) {
+                temp_value += unit->high_limit;
+            }
+        }
+    }
+
+    *value = temp_value + unit->accum_value;
     portEXIT_CRITICAL_SAFE(&unit->spinlock);
 
     return ESP_OK;
@@ -824,25 +846,27 @@ IRAM_ATTR static void pcnt_default_isr(void *args)
 
     uint32_t intr_status = pcnt_ll_get_intr_status(group->hal.dev);
     if (intr_status & PCNT_LL_UNIT_WATCH_EVENT(unit_id)) {
+        // event status word contains information about the real watch event type
+        uint32_t event_status = pcnt_ll_get_event_status(group->hal.dev, unit_id);
+
+        // clear interrupt status and update accum_value atomically
+        portENTER_CRITICAL_ISR(&unit->spinlock);
         pcnt_ll_clear_intr_status(group->hal.dev, PCNT_LL_UNIT_WATCH_EVENT(unit_id));
 
-        // points watcher event
-        uint32_t event_status = pcnt_ll_get_event_status(group->hal.dev, unit_id);
-        // iter on each event_id
+        if (unit->flags.accum_count) {
+            if (event_status & BIT(PCNT_LL_WATCH_EVENT_LOW_LIMIT)) {
+                unit->accum_value += unit->low_limit;
+            } else if (event_status & BIT(PCNT_LL_WATCH_EVENT_HIGH_LIMIT)) {
+                unit->accum_value += unit->high_limit;
+            }
+        }
+        portEXIT_CRITICAL_ISR(&unit->spinlock);
+
+        // using while loop so that we don't miss any event
         while (event_status) {
             int event_id = __builtin_ffs(event_status) - 1;
             event_status &= (event_status - 1); // clear the right most bit
 
-            portENTER_CRITICAL_ISR(&unit->spinlock);
-            if (unit->flags.accum_count) {
-                if (event_id == PCNT_LL_WATCH_EVENT_LOW_LIMIT) {
-                    unit->accum_value += unit->low_limit;
-                } else if (event_id == PCNT_LL_WATCH_EVENT_HIGH_LIMIT) {
-                    unit->accum_value += unit->high_limit;
-                }
-            }
-            portEXIT_CRITICAL_ISR(&unit->spinlock);
-
             // invoked user registered callback
             if (on_reach) {
                 pcnt_watch_event_data_t edata = {

components/esp_driver_spi/src/gpspi/spi_master.c

@@ -115,6 +115,7 @@ We have two bits to control the interrupt:
 #include "esp_private/periph_ctrl.h"
 #include "esp_private/spi_common_internal.h"
 #include "esp_private/spi_master_internal.h"
+#include "esp_private/esp_clk_tree_common.h"
 #include "driver/spi_master.h"
 #include "esp_clk_tree.h"
 #include "clk_ctrl_os.h"
@@ -139,6 +140,7 @@ We have two bits to control the interrupt:
 #define SPI_MASTER_MALLOC_CAPS    (MALLOC_CAP_DEFAULT)
 #endif
 
+#define SPI_PERIPH_SRC_FREQ_MAX     (80*1000*1000)    //peripheral hardware limitation for clock source into peripheral
 typedef struct spi_device_t spi_device_t;
 
 /// struct to hold private transaction data (like tx and rx buffer for DMA).
@@ -383,6 +385,25 @@ int spi_get_freq_limit(bool gpio_is_used, int input_delay_ns)
 #endif
 }
 
+#if SPI_LL_SUPPORT_CLK_SRC_PRE_DIV
+static uint32_t s_spi_find_clock_src_pre_div(uint32_t src_freq, uint32_t target_freq)
+{
+    // pre division must be even and at least 2
+    uint32_t min_div = ((src_freq / SPI_PERIPH_SRC_FREQ_MAX) + 1) & (~0x01UL);
+    min_div = min_div < 2 ? 2 : min_div;
+
+    uint32_t total_div = src_freq / target_freq;
+    // Loop the `div` to find a divisible value of `total_div`
+    for (uint32_t pre_div = min_div; pre_div <= total_div; pre_div += 2) {
+        if ((total_div % pre_div) || (total_div / pre_div) > SPI_LL_PERIPH_CLK_DIV_MAX) {
+            continue;
+        }
+        return pre_div;
+    }
+    return min_div;
+}
+#endif //SPI_LL_SUPPORT_CLK_SRC_PRE_DIV
+
 /*
  Add a device. This allocates a CS line for the device, allocates memory for the device structure and hooks
  up the CS pin to whatever is specified.
@@ -404,36 +425,21 @@ esp_err_t spi_bus_add_device(spi_host_device_t host_id, const spi_device_interfa
     spi_host_t *host = bus_driver_ctx[host_id];
     const spi_bus_attr_t* bus_attr = host->bus_attr;
     SPI_CHECK(dev_config->spics_io_num < 0 || GPIO_IS_VALID_OUTPUT_GPIO(dev_config->spics_io_num), "spics pin invalid", ESP_ERR_INVALID_ARG);
+    SPI_CHECK(dev_config->clock_speed_hz > 0, "invalid sclk speed", ESP_ERR_INVALID_ARG);
 #if SOC_SPI_SUPPORT_CLK_RC_FAST
     if (dev_config->clock_source == SPI_CLK_SRC_RC_FAST) {
         SPI_CHECK(periph_rtc_dig_clk8m_enable(), "the selected clock not available", ESP_ERR_INVALID_STATE);
     }
 #endif
-    spi_clock_source_t clk_src = SPI_CLK_SRC_DEFAULT;
     uint32_t clock_source_hz = 0;
     uint32_t clock_source_div = 1;
-    if (dev_config->clock_source) {
-        clk_src = dev_config->clock_source;
-    }
+    spi_clock_source_t clk_src = dev_config->clock_source ? dev_config->clock_source : SPI_CLK_SRC_DEFAULT;
     esp_clk_tree_src_get_freq_hz(clk_src, ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED, &clock_source_hz);
 #if SPI_LL_SUPPORT_CLK_SRC_PRE_DIV
-    SPI_CHECK((dev_config->clock_speed_hz > 0) && (dev_config->clock_speed_hz <= MIN(clock_source_hz / 2, (80 * 1000000))), "invalid sclk speed", ESP_ERR_INVALID_ARG);
-
-    if (clock_source_hz / 2 > (80 * 1000000)) {    //clock_source_hz beyond peripheral HW limitation, calc pre-divider
-        hal_utils_clk_info_t clk_cfg = {
-            .src_freq_hz = clock_source_hz,
-            .exp_freq_hz = dev_config->clock_speed_hz * 2,  //we have (hs_clk = 2*mst_clk), calc hs_clk first
-            .round_opt = HAL_DIV_ROUND,
-            .min_integ = 1,
-            .max_integ = SPI_LL_CLK_SRC_PRE_DIV_MAX / 2,
-        };
-        hal_utils_calc_clk_div_integer(&clk_cfg, &clock_source_div);
-    }
-    clock_source_div *= 2; //convert to mst_clk function divider
-    clock_source_hz /= clock_source_div;    //actual freq enter to SPI peripheral
-#else
-    SPI_CHECK((dev_config->clock_speed_hz > 0) && (dev_config->clock_speed_hz <= clock_source_hz), "invalid sclk speed", ESP_ERR_INVALID_ARG);
+    clock_source_div = s_spi_find_clock_src_pre_div(clock_source_hz, dev_config->clock_speed_hz);
+    clock_source_hz /= clock_source_div; //actual freq enter to SPI peripheral
 #endif
+    SPI_CHECK(dev_config->clock_speed_hz <= clock_source_hz, "invalid sclk speed", ESP_ERR_INVALID_ARG);
 #ifdef CONFIG_IDF_TARGET_ESP32
     //The hardware looks like it would support this, but actually setting cs_ena_pretrans when transferring in full
     //duplex mode does absolutely nothing on the ESP32.

components/esp_driver_spi/test_apps/components/spi_bench_mark/include/spi_performance.h

@@ -68,7 +68,7 @@
 #define IDF_PERFORMANCE_MAX_SPI_PER_TRANS_NO_POLLING_NO_DMA         54
 
 #elif CONFIG_IDF_TARGET_ESP32P4
-#define IDF_PERFORMANCE_MAX_SPI_CLK_FREQ                            26*1000*1000
+#define IDF_PERFORMANCE_MAX_SPI_CLK_FREQ                            40*1000*1000
 #define IDF_PERFORMANCE_MAX_SPI_PER_TRANS_NO_POLLING                44
 #define IDF_PERFORMANCE_MAX_SPI_PER_TRANS_POLLING                   28
 #define IDF_PERFORMANCE_MAX_SPI_PER_TRANS_NO_POLLING_NO_DMA         26

components/esp_driver_spi/test_apps/master/main/test_spi_master.c

@@ -150,7 +150,7 @@ TEST_CASE("SPI Master clk_source and divider accuracy", "[spi]")
             int real_freq_khz;
             spi_device_get_actual_freq(handle, &real_freq_khz);
             // (byte_len * 8 / real_freq_hz) * 1000 000, (unit)us
-            int trans_cost_us_predict = (float)TEST_CLK_BYTE_LEN * 8 * 1000 / real_freq_khz;
+            int trans_cost_us_predict = (float)TEST_CLK_BYTE_LEN * 8 * 1000 / real_freq_khz + IDF_PERFORMANCE_MAX_SPI_PER_TRANS_POLLING;
 
             // transaction and measure time
             start = esp_timer_get_time();

components/esp_driver_spi/test_apps/param/main/test_spi_param.c

@@ -3,6 +3,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  */
+#include <sys/param.h>
 #include "esp_log.h"
 #include "esp_attr.h"
 #include "soc/spi_periph.h"
@@ -21,10 +22,6 @@
 #if (TEST_SPI_PERIPH_NUM >= 2)
 //These will only be enabled on chips with 2 or more SPI peripherals
 
-#ifndef MIN
-#define MIN(a, b)((a) > (b)? (b): (a))
-#endif
-
 /********************************************************************************
  *      Test By Internal Connections
  ********************************************************************************/
@@ -109,10 +106,6 @@ static void local_test_start(spi_device_handle_t *spi, int freq, const spitest_p
         devcfg.flags |= SPI_DEVICE_NO_DUMMY;
     }
 
-#if CONFIG_IDF_TARGET_ESP32P4      //TODO: IDF-8313, update P4 defaulte clock source
-    devcfg.clock_source = SPI_CLK_SRC_SPLL;
-#endif
-
     //slave config
     slvcfg.mode = pset->mode;
     slave_pull_up(&buscfg, slvcfg.spics_io_num);
@@ -666,20 +659,10 @@ TEST_CASE("Slave receive correct data", "[spi]")
     }
 }
 
-#if !TEMPORARY_DISABLED_FOR_TARGETS(ESP32S2, ESP32S3, ESP32C3, ESP32C2)
-//These tests are ESP32 only due to lack of runners
+#else // #if (TEST_SPI_PERIPH_NUM >= 2)
+
 /********************************************************************************
- *      Test By Master & Slave (2 boards)
- *
- *  Wiring:
- * | Master | Slave |
- * | ------ | ----- |
- * | 12     | 19    |
- * | 13     | 23    |
- * | 14     | 18    |
- * | 15     | 5     |
- * | GND    | GND   |
- *
+ *      Test By Master & Slave (2 boards) using burger runner
  ********************************************************************************/
 static void test_master_init(void **context);
 static void test_master_deinit(void *context);
@@ -738,7 +721,7 @@ static void test_master_start(spi_device_handle_t *spi, int freq, const spitest_
         buspset.quadhd_io_num = UNCONNECTED_PIN;
     }
     spi_device_interface_config_t devpset = SPI_DEVICE_TEST_DEFAULT_CONFIG();
-    devpset.spics_io_num = SPI2_IOMUX_PIN_NUM_CS;
+    devpset.spics_io_num = PIN_NUM_CS;
     devpset.mode = pset->mode;
     const int cs_pretrans_max = 15;
     if (pset->dup == HALF_DUPLEX_MISO) {
@@ -882,7 +865,7 @@ static void timing_slave_start(int speed, const spitest_param_set_t *pset, spite
         slv_buscfg.quadhd_io_num = UNCONNECTED_PIN;
     }
     spi_slave_interface_config_t slvcfg = SPI_SLAVE_TEST_DEFAULT_CONFIG();
-    slvcfg.spics_io_num = SPI2_IOMUX_PIN_NUM_CS;
+    slvcfg.spics_io_num = PIN_NUM_CS;
     slvcfg.mode = pset->mode;
     //Enable pull-ups on SPI lines so we don't detect rogue pulses when no master is connected.
     slave_pull_up(&slv_buscfg, slvcfg.spics_io_num);
@@ -1267,9 +1250,6 @@ spitest_param_set_t mode_conf[] = {
     },
 };
 TEST_SPI_MASTER_SLAVE(MODE, mode_conf, "")
-
-#endif // !TEMPORARY_DISABLED_FOR_TARGETS(ESP32S2, ESP32S3, ESP32C3, ESP32C2)
-
 #endif // #if (TEST_SPI_PERIPH_NUM >= 2)
 
 #define TEST_STEP_LEN         96
@@ -1279,9 +1259,7 @@ static int s_spi_bus_freq[] = {
     IDF_PERFORMANCE_MAX_SPI_CLK_FREQ / 7,
     IDF_PERFORMANCE_MAX_SPI_CLK_FREQ / 4,
     IDF_PERFORMANCE_MAX_SPI_CLK_FREQ / 2,
-#if !CONFIG_IDF_TARGET_ESP32P4      //TODO: IDF-8313, update P4 defaulte clock source
     IDF_PERFORMANCE_MAX_SPI_CLK_FREQ,
-#endif
 };
 
 //------------------------------------------- Full Duplex with DMA Freq test --------------------------------------

components/esp_driver_touch_sens/common/touch_sens_common.c

@@ -133,22 +133,24 @@ esp_err_t touch_sensor_new_channel(touch_sensor_handle_t sens_handle, int chan_i
     TOUCH_NULL_POINTER_CHECK(chan_cfg);
     TOUCH_NULL_POINTER_CHECK(ret_chan_handle);
     TOUCH_CHANNEL_CHECK(chan_id);
+    uint32_t ch_offset = chan_id - TOUCH_MIN_CHAN_ID;
+
     ESP_RETURN_ON_FALSE(g_touch == sens_handle, ESP_ERR_INVALID_ARG, TAG, "The input touch sensor handle is unmatched");
 
     esp_err_t ret = ESP_OK;
     xSemaphoreTake(sens_handle->mutex, portMAX_DELAY);
 
     ESP_GOTO_ON_FALSE(!sens_handle->is_enabled, ESP_ERR_INVALID_STATE, err2, TAG, "Please disable the touch sensor first");
-    ESP_GOTO_ON_FALSE(!sens_handle->ch[chan_id], ESP_ERR_INVALID_STATE, err2, TAG, "The channel %d has been registered", chan_id);
+    ESP_GOTO_ON_FALSE(!sens_handle->ch[ch_offset], ESP_ERR_INVALID_STATE, err2, TAG, "The channel %d has been registered", chan_id);
 
-    sens_handle->ch[chan_id] = (touch_channel_handle_t)heap_caps_calloc(1, sizeof(struct touch_channel_s), TOUCH_MEM_ALLOC_CAPS);
-    ESP_GOTO_ON_FALSE(sens_handle->ch[chan_id], ESP_ERR_NO_MEM, err2, TAG, "No memory for touch channel");
-    sens_handle->ch[chan_id]->id = chan_id;
-    sens_handle->ch[chan_id]->base = sens_handle;
-    sens_handle->ch[chan_id]->is_prox_chan = false;
+    sens_handle->ch[ch_offset] = (touch_channel_handle_t)heap_caps_calloc(1, sizeof(struct touch_channel_s), TOUCH_MEM_ALLOC_CAPS);
+    ESP_GOTO_ON_FALSE(sens_handle->ch[ch_offset], ESP_ERR_NO_MEM, err2, TAG, "No memory for touch channel");
+    sens_handle->ch[ch_offset]->id = chan_id;
+    sens_handle->ch[ch_offset]->base = sens_handle;
+    sens_handle->ch[ch_offset]->is_prox_chan = false;
 
     /* Init the channel */
-    ESP_GOTO_ON_ERROR(touch_priv_config_channel(sens_handle->ch[chan_id], chan_cfg),
+    ESP_GOTO_ON_ERROR(touch_priv_config_channel(sens_handle->ch[ch_offset], chan_cfg),
                       err1, TAG, "Failed to configure the touch channel %d", chan_id);
     touch_channel_pin_init(chan_id);
     TOUCH_ENTER_CRITICAL(TOUCH_PERIPH_LOCK);
@@ -159,13 +161,13 @@ esp_err_t touch_sensor_new_channel(touch_sensor_handle_t sens_handle, int chan_i
     touch_ll_set_channel_mask(sens_handle->chan_mask);
     TOUCH_EXIT_CRITICAL(TOUCH_PERIPH_LOCK);
 
-    *ret_chan_handle = sens_handle->ch[chan_id];
+    *ret_chan_handle = sens_handle->ch[ch_offset];
 
     xSemaphoreGive(sens_handle->mutex);
     return ret;
 err1:
-    free(sens_handle->ch[chan_id]);
-    sens_handle->ch[chan_id] = NULL;
+    free(sens_handle->ch[ch_offset]);
+    sens_handle->ch[ch_offset] = NULL;
 err2:
     xSemaphoreGive(sens_handle->mutex);
     return ret;
@@ -188,14 +190,15 @@ esp_err_t touch_sensor_del_channel(touch_channel_handle_t chan_handle)
         ESP_GOTO_ON_ERROR(touch_sensor_config_sleep_channel(sens_handle, NULL), err, TAG, "Failed to disable sleep function on this channel");
     }
 #endif
-    int id = chan_handle->id;
+    int ch_offset = chan_handle->id - TOUCH_MIN_CHAN_ID;
+    assert(ch_offset >= 0);
     TOUCH_ENTER_CRITICAL(TOUCH_PERIPH_LOCK);
-    sens_handle->chan_mask &= ~(1UL << id);
+    sens_handle->chan_mask &= ~(1UL << chan_handle->id);
     touch_ll_set_channel_mask(sens_handle->chan_mask);
     TOUCH_EXIT_CRITICAL(TOUCH_PERIPH_LOCK);
 
-    free(g_touch->ch[id]);
-    g_touch->ch[id] = NULL;
+    free(g_touch->ch[ch_offset]);
+    g_touch->ch[ch_offset] = NULL;
 err:
     xSemaphoreGive(sens_handle->mutex);
     return ret;
@@ -358,7 +361,7 @@ esp_err_t touch_sensor_trigger_oneshot_scanning(touch_sensor_handle_t sens_handl
     FOR_EACH_TOUCH_CHANNEL(i) {
         if (sens_handle->ch[i]) {
             TOUCH_ENTER_CRITICAL(TOUCH_PERIPH_LOCK);
-            touch_ll_channel_sw_measure_mask(BIT(i));
+            touch_ll_channel_sw_measure_mask(BIT(sens_handle->ch[i]->id));
             touch_ll_trigger_oneshot_measurement();
             TOUCH_EXIT_CRITICAL(TOUCH_PERIPH_LOCK);
             while (!touch_ll_is_measure_done()) {

components/esp_driver_touch_sens/common/touch_sens_private.h

@@ -67,6 +67,7 @@ struct touch_sensor_s {
     touch_channel_handle_t  ch[SOC_TOUCH_SENSOR_NUM];   /*!< Touch sensor channel handles, will be NULL if the channel is not registered */
     uint32_t                chan_mask;                  /*!< Enabled channel mask, corresponding bit will be set if the channel is registered */
     uint32_t                src_freq_hz;                /*!< Source clock frequency */
+    uint32_t                interval_freq_hz;           /*!< Frequency of the interval clock */
     intr_handle_t           intr_handle;                /*!< Interrupt handle */
     touch_event_callbacks_t cbs;                        /*!< Event callbacks */
     touch_channel_handle_t  deep_slp_chan;              /*!< The configured channel for depp sleep, will be NULL if not enable the deep sleep */

components/esp_driver_touch_sens/hw_ver3/touch_version_specific.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -63,7 +63,8 @@ void IRAM_ATTR touch_priv_default_intr_handler(void *arg)
     touch_ll_intr_clear(status);
     touch_base_event_data_t data;
     touch_ll_get_active_channel_mask(&data.status_mask);
-    data.chan = g_touch->ch[touch_ll_get_current_meas_channel()];
+    int ch_offset = touch_ll_get_current_meas_channel() - TOUCH_MIN_CHAN_ID;
+    data.chan = g_touch->ch[ch_offset];
     /* If the channel is not registered, return directly */
     if (!data.chan) {
         return;
@@ -146,11 +147,17 @@ static esp_err_t s_touch_convert_to_hal_config(touch_sensor_handle_t sens_handle
                             TAG, "get clock frequency failed");
         ESP_LOGD(TAG, "touch rtc clock source: RTC_FAST, frequency: %"PRIu32" Hz", sens_handle->src_freq_hz);
     }
+    if (!sens_handle->interval_freq_hz) {
+        ESP_RETURN_ON_ERROR(esp_clk_tree_src_get_freq_hz(SOC_MOD_CLK_RTC_SLOW, ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED, &sens_handle->interval_freq_hz),
+                            TAG, "get interval clock frequency failed");
+    }
 
     uint32_t src_freq_hz = sens_handle->src_freq_hz;
     uint32_t src_freq_mhz = src_freq_hz / 1000000;
     hal_cfg->power_on_wait_ticks = (uint32_t)sens_cfg->power_on_wait_us * src_freq_mhz;
-    hal_cfg->meas_interval_ticks = (uint32_t)(sens_cfg->meas_interval_us * src_freq_mhz);
+    hal_cfg->power_on_wait_ticks = hal_cfg->power_on_wait_ticks > TOUCH_LL_PAD_MEASURE_WAIT_MAX ?
+                                   TOUCH_LL_PAD_MEASURE_WAIT_MAX : hal_cfg->power_on_wait_ticks;
+    hal_cfg->meas_interval_ticks = (uint32_t)(sens_cfg->meas_interval_us * sens_handle->interval_freq_hz / 1000000);
     hal_cfg->timeout_ticks = (uint32_t)sens_cfg->max_meas_time_us * src_freq_mhz;
     ESP_RETURN_ON_FALSE(hal_cfg->timeout_ticks <= TOUCH_LL_TIMEOUT_MAX, ESP_ERR_INVALID_ARG, TAG,
                         "max_meas_time_ms should within %"PRIu32, TOUCH_LL_TIMEOUT_MAX / src_freq_mhz);

components/esp_driver_touch_sens/test_apps/touch_sens/main/test_touch_sens_common.c

@@ -49,11 +49,11 @@ TEST_CASE("touch_sens_install_uninstall_test", "[touch]")
     TEST_ESP_OK(touch_sensor_config_filter(touch, &filter_cfg));
 
     for (int i = 0; i < TOUCH_TOTAL_CHAN_NUM; i++) {
-        TEST_ESP_OK(touch_sensor_new_channel(touch, i, &s_chan_cfg, &touch_chan[i]));
+        TEST_ESP_OK(touch_sensor_new_channel(touch, i + TOUCH_MIN_CHAN_ID, &s_chan_cfg, &touch_chan[i]));
     }
     touch_channel_handle_t fault_chan = NULL;
-    TEST_ASSERT(touch_sensor_new_channel(touch, TOUCH_TOTAL_CHAN_NUM, &s_chan_cfg, &fault_chan) == ESP_ERR_INVALID_ARG);
-    TEST_ASSERT(touch_sensor_new_channel(touch, 0, &s_chan_cfg, &fault_chan) == ESP_ERR_INVALID_STATE);
+    TEST_ASSERT(touch_sensor_new_channel(touch, TOUCH_TOTAL_CHAN_NUM + TOUCH_MIN_CHAN_ID, &s_chan_cfg, &fault_chan) == ESP_ERR_INVALID_ARG);
+    TEST_ASSERT(touch_sensor_new_channel(touch, TOUCH_MIN_CHAN_ID, &s_chan_cfg, &fault_chan) == ESP_ERR_INVALID_STATE);
 
     TEST_ESP_OK(touch_sensor_enable(touch));
     TEST_ASSERT(touch_sensor_del_channel(touch_chan[0]) == ESP_ERR_INVALID_STATE);

components/esp_driver_usb_serial_jtag/include/driver/usb_serial_jtag.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -96,6 +96,34 @@ esp_err_t usb_serial_jtag_driver_uninstall(void);
  */
 bool usb_serial_jtag_is_connected(void);
 
+/**
+ * @brief Get information whether the USB serial JTAG driver is installed or not
+ *
+ * @return True if driver is installed and False if driver not installed
+ */
+bool usb_serial_jtag_is_driver_installed(void);
+
+/**
+ * @brief Return the number of bytes available for reading
+ *
+ * @return the number of bytes available for reading in the buffer
+ */
+size_t usb_serial_jtag_get_read_bytes_available(void);
+
+/**
+ * @brief Return the readiness status of the driver for read operation
+ *
+ * @return true if driver read ready, false if not
+ */
+bool usb_serial_jtag_read_ready(void);
+
+/**
+ * @brief Return the readiness status of the driver for write operation
+ *
+ * @return true if driver is write ready, false if not
+ */
+bool usb_serial_jtag_write_ready(void);
+
 #ifdef __cplusplus
 }
 #endif

components/esp_driver_usb_serial_jtag/src/usb_serial_jtag.c

@@ -137,13 +137,13 @@ esp_err_t usb_serial_jtag_driver_install(usb_serial_jtag_driver_config_t *usb_se
     ESP_RETURN_ON_FALSE((usb_serial_jtag_config->rx_buffer_size > USB_SER_JTAG_RX_MAX_SIZE), ESP_ERR_INVALID_ARG, USB_SERIAL_JTAG_TAG, "RX buffer prepared is so small, should larger than 64");
     ESP_RETURN_ON_FALSE((usb_serial_jtag_config->tx_buffer_size > 0), ESP_ERR_INVALID_ARG, USB_SERIAL_JTAG_TAG, "TX buffer is not prepared");
     p_usb_serial_jtag_obj = (usb_serial_jtag_obj_t*) heap_caps_calloc(1, sizeof(usb_serial_jtag_obj_t), MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT);
-    p_usb_serial_jtag_obj->tx_stash_cnt = 0;
     if (p_usb_serial_jtag_obj == NULL) {
         ESP_LOGE(USB_SERIAL_JTAG_TAG, "memory allocate error");
         // no `goto _exit` here as there's nothing to clean up and that would make the uninstall
         // routine unhappy.
         return ESP_ERR_NO_MEM;
     }
+    p_usb_serial_jtag_obj->tx_stash_cnt = 0;
 
     p_usb_serial_jtag_obj->rx_ring_buf = xRingbufferCreate(usb_serial_jtag_config->rx_buffer_size, RINGBUF_TYPE_BYTEBUF);
     if (p_usb_serial_jtag_obj->rx_ring_buf == NULL) {
@@ -256,3 +256,33 @@ esp_err_t usb_serial_jtag_driver_uninstall(void)
     p_usb_serial_jtag_obj = NULL;
     return ESP_OK;
 }
+
+bool usb_serial_jtag_is_driver_installed(void)
+{
+    return (p_usb_serial_jtag_obj != NULL);
+}
+
+size_t usb_serial_jtag_get_read_bytes_available(void)
+{
+    // sign the the driver is read ready is that data is waiting in the RX ringbuffer
+    UBaseType_t bytes_available = 0;
+    if (usb_serial_jtag_is_driver_installed()) {
+        vRingbufferGetInfo(p_usb_serial_jtag_obj->rx_ring_buf, NULL, NULL, NULL, NULL, &bytes_available);
+        if (bytes_available <= 0) {
+            return 0;
+        }
+    }
+
+    return (size_t)bytes_available;
+}
+
+bool usb_serial_jtag_read_ready(void)
+{
+    return usb_serial_jtag_get_read_bytes_available() != 0;
+}
+
+bool usb_serial_jtag_write_ready(void)
+{
+    // sign that the driver is write ready is that the TX ring buffer is not full
+    return (xRingbufferGetCurFreeSize(p_usb_serial_jtag_obj->tx_ring_buf) > 0);
+}

components/esp_driver_usb_serial_jtag/src/usb_serial_jtag_vfs.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -191,38 +191,66 @@ static ssize_t usb_serial_jtag_read(int fd, void* data, size_t size)
 {
     char *data_c = (char *) data;
     size_t received = 0;
+    size_t available_size = 0;
+    int c = NONE; // store the read char
     _lock_acquire_recursive(&s_ctx.read_lock);
-    while (received < size) {
-        int c = usb_serial_jtag_read_char(fd);
-        if (c == '\r') {
-            if (s_ctx.rx_mode == ESP_LINE_ENDINGS_CR) {
-                c = '\n';
-            } else if (s_ctx.rx_mode == ESP_LINE_ENDINGS_CRLF) {
-                /* look ahead */
-                int c2 = usb_serial_jtag_read_char(fd);
-                if (c2 == NONE) {
-                    /* could not look ahead, put the current character back */
-                    usb_serial_jtag_return_char(fd, c);
-                    break;
-                }
-                if (c2 == '\n') {
-                    /* this was \r\n sequence. discard \r, return \n */
+
+    // if blocking read, wait for data to  be available
+    if (!s_ctx.non_blocking) {
+        c = usb_serial_jtag_read_char(fd);
+    }
+
+    // find the actual fetch size
+    available_size += usb_serial_jtag_get_read_bytes_available();
+    if (c != NONE) {
+        available_size++;
+    }
+    if (s_ctx.peek_char != NONE) {
+        available_size++;
+    }
+    size_t fetch_size = MIN(available_size, size);
+
+    if (fetch_size > 0) {
+        do {
+            if (c == NONE) { // for non-O_NONBLOCK mode, there is already a pre-fetched char
+                c = usb_serial_jtag_read_char(fd);
+            }
+            assert(c != NONE);
+
+            if (c == '\r') {
+                if (s_ctx.rx_mode == ESP_LINE_ENDINGS_CR) {
                     c = '\n';
-                } else {
-                    /* \r followed by something else. put the second char back,
-                     * it will be processed on next iteration. return \r now.
-                     */
-                    usb_serial_jtag_return_char(fd, c2);
+                } else if (s_ctx.rx_mode == ESP_LINE_ENDINGS_CRLF) {
+                    /* look ahead */
+                    int c2 = usb_serial_jtag_read_char(fd);
+                    fetch_size--;
+                    if (c2 == NONE) {
+                        /* could not look ahead, put the current character back */
+                        usb_serial_jtag_return_char(fd, c);
+                        c = NONE;
+                        break;
+                    }
+                    if (c2 == '\n') {
+                        /* this was \r\n sequence. discard \r, return \n */
+                        c = '\n';
+                    } else {
+                        /* \r followed by something else. put the second char back,
+                         * it will be processed on next iteration. return \r now.
+                         */
+                        usb_serial_jtag_return_char(fd, c2);
+                        fetch_size++;
+                    }
                 }
             }
-        } else if (c == NONE) {
-            break;
-        }
-        data_c[received] = (char) c;
-        ++received;
-        if (c == '\n') {
-            break;
-        }
+
+            data_c[received] = (char) c;
+            ++received;
+            c = NONE;
+        } while (received < fetch_size);
+    }
+
+    if (c != NONE) { // fetched, but not used
+        usb_serial_jtag_return_char(fd, c);
     }
     _lock_release_recursive(&s_ctx.read_lock);
     if (received > 0) {

components/esp_gdbstub/src/gdbstub.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -62,11 +62,11 @@ void esp_gdbstub_panic_handler(void *in_frame)
         esp_gdbstub_send_end();
     } else if (s_scratch.state == GDBSTUB_NOT_STARTED) {
         s_scratch.state = GDBSTUB_STARTED;
-        /* Save the paniced frame and get the list of tasks */
+        /* Save the panicked frame and get the list of tasks */
         memcpy(&s_scratch.paniced_frame, frame, sizeof(*frame));
         init_task_info();
         find_paniced_task_index();
-        /* Current task is the paniced task */
+        /* Current task is the panicked task */
         if (s_scratch.paniced_task_index == GDBSTUB_CUR_TASK_INDEX_UNKNOWN) {
             set_active_task(0);
         } else {
@@ -144,7 +144,7 @@ static inline void disable_all_wdts(void)
     }
 
     #if SOC_TIMER_GROUPS >= 2
-    /* Interupt WDT is the Main Watchdog Timer of Timer Group 1 */
+    /* Interrupt WDT is the Main Watchdog Timer of Timer Group 1 */
     if (true == wdt1_context_enabled) {
         wdt_hal_write_protect_disable(&wdt1_context);
         wdt_hal_disable(&wdt1_context);
@@ -173,7 +173,7 @@ static inline void enable_all_wdts(void)
         wdt_hal_write_protect_enable(&wdt0_context);
     }
     #if SOC_TIMER_GROUPS >= 2
-    /* Interupt WDT is the Main Watchdog Timer of Timer Group 1 */
+    /* Interrupt WDT is the Main Watchdog Timer of Timer Group 1 */
     if (false == wdt1_context_enabled) {
         wdt_hal_write_protect_disable(&wdt1_context);
         wdt_hal_enable(&wdt1_context);
@@ -208,7 +208,7 @@ static bool process_gdb_kill = false;
 static bool gdb_debug_int = false;
 
 /**
- * @breef Handle UART interrupt
+ * @brief Handle UART interrupt
  *
  * Handle UART interrupt for gdbstub. The function disable WDT.
  * If Ctrl+C combination detected (0x03), then application will start to process incoming GDB messages.
@@ -695,7 +695,7 @@ static void handle_P_command(const unsigned char *cmd, int len)
 static void handle_qSupported_command(const unsigned char *cmd, int len)
 {
     esp_gdbstub_send_start();
-    esp_gdbstub_send_str("qSupported:multiprocess+;swbreak-;hwbreak+;qRelocInsn+;fork-events+;vfork-events+;exec-events+;vContSupported+;QThreadEvents+;no-resumed+");
+    esp_gdbstub_send_str("qSupported:multiprocess+;swbreak-;hwbreak+;qRelocInsn+;fork-events+;vfork-events+;exec-events+;vContSupported+;no-resumed+");
     esp_gdbstub_send_end();
 }
 

components/esp_http_client/esp_http_client.c

@@ -34,6 +34,8 @@ static const char *TAG = "HTTP_CLIENT";
 
 ESP_STATIC_ASSERT((int)ESP_HTTP_CLIENT_TLS_VER_ANY == (int)ESP_TLS_VER_ANY, "Enum mismatch in esp_http_client and esp-tls");
 ESP_STATIC_ASSERT((int)ESP_HTTP_CLIENT_TLS_VER_MAX <= (int)ESP_TLS_VER_TLS_MAX, "HTTP client supported TLS is not supported in esp-tls");
+ESP_STATIC_ASSERT((int)HTTP_TLS_DYN_BUF_RX_STATIC == (int)ESP_TLS_DYN_BUF_RX_STATIC, "Enum mismatch in esp_http_client and esp-tls");
+ESP_STATIC_ASSERT((int)HTTP_TLS_DYN_BUF_STRATEGY_MAX <= (int)ESP_TLS_DYN_BUF_STRATEGY_MAX, "HTTP client supported TLS is not supported in esp-tls");
 
 /**
  * HTTP Buffer
@@ -767,6 +769,14 @@ esp_http_client_handle_t esp_http_client_init(const esp_http_client_config_t *co
     }
     esp_transport_ssl_set_tls_version(ssl, config->tls_version);
 
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+    /* When tls_dyn_buf_strategy is 0, mbedTLS dynamic buffer allocation uses default behavior.
+     * No need to call esp_transport_ssl_set_esp_tls_dyn_buf_strategy() in this case */
+    if (config->tls_dyn_buf_strategy != 0 && config->tls_dyn_buf_strategy < HTTP_TLS_DYN_BUF_STRATEGY_MAX) {
+        esp_transport_ssl_set_esp_tls_dyn_buf_strategy(ssl, config->tls_dyn_buf_strategy);
+    }
+#endif
+
 #if CONFIG_ESP_TLS_USE_SECURE_ELEMENT
     if (config->use_secure_element) {
         esp_transport_ssl_use_secure_element(ssl);
@@ -956,6 +966,7 @@ esp_err_t esp_http_client_cleanup(esp_http_client_handle_t client)
     _clear_auth_data(client);
     free(client->auth_data);
     free(client->current_header_key);
+    free(client->current_header_value);
     free(client->location);
     free(client->auth_header);
     free(client);

components/esp_http_client/include/esp_http_client.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -137,6 +137,11 @@ typedef enum {
     HTTP_ADDR_TYPE_INET6 = AF_INET6,        /**< IPv6 address family. */
 } esp_http_client_addr_type_t;
 
+typedef enum {
+    HTTP_TLS_DYN_BUF_RX_STATIC = 1,     /*!< Strategy to disable dynamic RX buffer allocations and convert to static allocation post-handshake, reducing memory fragmentation */
+    HTTP_TLS_DYN_BUF_STRATEGY_MAX,      /*!< to indicate max */
+} esp_http_client_tls_dyn_buf_strategy_t;
+
 /**
  * @brief HTTP configuration
  */
@@ -199,6 +204,10 @@ typedef struct {
     struct esp_transport_item_t *transport;
 #endif
     esp_http_client_addr_type_t addr_type;  /*!< Address type used in http client configurations */
+
+#if CONFIG_MBEDTLS_DYNAMIC_BUFFER
+    esp_http_client_tls_dyn_buf_strategy_t tls_dyn_buf_strategy; /*!< TLS dynamic buffer strategy */
+#endif
 } esp_http_client_config_t;
 
 /**

components/esp_http_client/lib/http_utils.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -11,6 +11,7 @@
 #include <assert.h>
 
 #include "http_utils.h"
+#include "esp_check.h"
 
 #ifndef mem_check
 #define mem_check(x) assert(x)
@@ -64,8 +65,16 @@ char *http_utils_append_string(char **str, const char *new_str, int len)
         }
         if (old_str) {
             old_len = strlen(old_str);
-            old_str = realloc(old_str, old_len + l + 1);
-            mem_check(old_str);
+            // old_str should not be reallocated directly, as in case of memory exhaustion,
+            // it will be lost and we will not be able to free it.
+            char *tmp = realloc(old_str, old_len + l + 1);
+            if (tmp == NULL) {
+                free(old_str);
+                old_str = NULL;
+                ESP_RETURN_ON_FALSE(old_str, NULL, "http_utils", "Memory exhausted");
+            }
+            old_str = tmp;
+            // Ensure the new string is null-terminated
             old_str[old_len + l] = 0;
         } else {
             old_str = calloc(1, l + 1);

components/esp_http_server/src/esp_httpd_priv.h

@@ -132,6 +132,15 @@ struct httpd_data {
     httpd_err_handler_func_t *err_handler_fns;
 };
 
+/**
+ * @brief Options for receiving HTTP request data
+ */
+typedef enum {
+    HTTPD_RECV_OPT_NONE               = 0,
+    HTTPD_RECV_OPT_HALT_AFTER_PENDING = 1,   /*!< Halt immediately after receiving from pending buffer */
+    HTTPD_RECV_OPT_BLOCKING           = 2,   /*!< Receive blocking (don't return partial length) */
+} httpd_recv_opt_t;
+
 /******************* Group : Session Management ********************/
 /** @name Session Management
  * Functions related to HTTP session management
@@ -422,22 +431,27 @@ int httpd_send(httpd_req_t *req, const char *buf, size_t buf_len);
  *
  * @note    The exposed API httpd_recv() is simply this function with last parameter
  *          set as false. This function is used internally during reception and
- *          processing of a new request. The option to halt after receiving pending
- *          data prevents the server from requesting more data than is needed for
- *          completing a packet in case when all the remaining part of the packet is
- *          in the pending buffer.
+ *          processing of a new request.
+ *
+ *          There are 2 options available that affect the behavior of the function:
+ *          - HTTPD_RECV_OPT_HALT_AFTER_PENDING
+ *            The option to halt after receiving pending data prevents the server from
+ *            requesting more data than is needed for completing a packet in case when
+ *            all the remaining part of the packet is in the pending buffer.
+ *
+ *          - HTTPD_RECV_OPT_BLOCKING
+ *            The option to not return until the `buf_len` bytes have been read.
  *
  * @param[in]  req    Pointer to new HTTP request which only has the socket descriptor
  * @param[out] buf    Pointer to the buffer which will be filled with the received data
  * @param[in] buf_len Length of the buffer
- * @param[in] halt_after_pending When set true, halts immediately after receiving from
- *                               pending buffer
+ * @param[in] opt     Receive option
  *
  * @return
  *  - Length of data : if successful
  *  - ESP_FAIL       : if failed
  */
-int httpd_recv_with_opt(httpd_req_t *r, char *buf, size_t buf_len, bool halt_after_pending);
+int httpd_recv_with_opt(httpd_req_t *r, char *buf, size_t buf_len, httpd_recv_opt_t opt);
 
 /**
  * @brief   For un-receiving HTTP request data
@@ -510,7 +524,7 @@ int httpd_default_recv(httpd_handle_t hd, int sockfd, char *buf, size_t buf_len,
  * @param[in] req                       Pointer to handshake request that will be handled
  * @param[in] supported_subprotocol     Pointer to the subprotocol supported by this URI
  * @return
- *  - ESP_OK                        : When handshake is sucessful
+ *  - ESP_OK                        : When handshake is successful
  *  - ESP_ERR_NOT_FOUND             : When some headers (Sec-WebSocket-*) are not found
  *  - ESP_ERR_INVALID_VERSION       : The WebSocket version is not "13"
  *  - ESP_ERR_INVALID_STATE         : Handshake was done beforehand
@@ -525,7 +539,7 @@ esp_err_t httpd_ws_respond_server_handshake(httpd_req_t *req, const char *suppor
  *
  * @param[in] req    Pointer to handshake request that will be handled
  * @return
- *  - ESP_OK                        : When handshake is sucessful
+ *  - ESP_OK                        : When handshake is successful
  *  - ESP_ERR_INVALID_ARG           : Argument is invalid (null or non-WebSocket)
  *  - ESP_ERR_INVALID_STATE         : Received only some parts of a control frame
  *  - ESP_FAIL                      : Socket failures

components/esp_http_server/src/httpd_txrx.c

@@ -95,7 +95,7 @@ static size_t httpd_recv_pending(httpd_req_t *r, char *buf, size_t buf_len)
     return buf_len;
 }
 
-int httpd_recv_with_opt(httpd_req_t *r, char *buf, size_t buf_len, bool halt_after_pending)
+int httpd_recv_with_opt(httpd_req_t *r, char *buf, size_t buf_len, httpd_recv_opt_t opt)
 {
     ESP_LOGD(TAG, LOG_FMT("requested length = %"NEWLIB_NANO_COMPAT_FORMAT), NEWLIB_NANO_COMPAT_CAST(buf_len));
 
@@ -112,34 +112,41 @@ int httpd_recv_with_opt(httpd_req_t *r, char *buf, size_t buf_len, bool halt_aft
         /* If buffer filled then no need to recv.
          * If asked to halt after receiving pending data then
          * return with received length */
-        if (!buf_len || halt_after_pending) {
+        if (!buf_len || opt == HTTPD_RECV_OPT_HALT_AFTER_PENDING) {
             return pending_len;
         }
     }
 
     /* Receive data of remaining length */
-    int ret = ra->sd->recv_fn(ra->sd->handle, ra->sd->fd, buf, buf_len, 0);
-    if (ret < 0) {
-        ESP_LOGD(TAG, LOG_FMT("error in recv_fn"));
-        if ((ret == HTTPD_SOCK_ERR_TIMEOUT) && (pending_len != 0)) {
-            /* If recv() timeout occurred, but pending data is
-             * present, return length of pending data.
-             * This behavior is similar to that of socket recv()
-             * function, which, in case has only partially read the
-             * requested length, due to timeout, returns with read
-             * length, rather than error */
-            return pending_len;
+    size_t recv_len = pending_len;
+    do {
+        int ret = ra->sd->recv_fn(ra->sd->handle, ra->sd->fd, buf, buf_len, 0);
+        if (ret < 0) {
+            ESP_LOGD(TAG, LOG_FMT("error in recv_fn"));
+            if ((ret == HTTPD_SOCK_ERR_TIMEOUT) && (pending_len != 0)) {
+                /* If recv() timeout occurred, but pending data is
+                * present, return length of pending data.
+                * This behavior is similar to that of socket recv()
+                * function, which, in case has only partially read the
+                * requested length, due to timeout, returns with read
+                * length, rather than error */
+                return pending_len;
+            }
+            return ret;
         }
-        return ret;
-    }
 
-    ESP_LOGD(TAG, LOG_FMT("received length = %"NEWLIB_NANO_COMPAT_FORMAT), NEWLIB_NANO_COMPAT_CAST((ret + pending_len)));
-    return ret + pending_len;
+        recv_len += ret;
+        buf      += ret;
+        buf_len  -= ret;
+    } while (buf_len > 0 && opt == HTTPD_RECV_OPT_BLOCKING);
+
+    ESP_LOGD(TAG, LOG_FMT("received length = %"NEWLIB_NANO_COMPAT_FORMAT), NEWLIB_NANO_COMPAT_CAST(recv_len));
+    return recv_len;
 }
 
 int httpd_recv(httpd_req_t *r, char *buf, size_t buf_len)
 {
-    return httpd_recv_with_opt(r, buf, buf_len, false);
+    return httpd_recv_with_opt(r, buf, buf_len, HTTPD_RECV_OPT_NONE);
 }
 
 size_t httpd_unrecv(struct httpd_req *r, const char *buf, size_t buf_len)

components/esp_http_server/src/httpd_ws.c

@@ -296,7 +296,7 @@ esp_err_t httpd_ws_recv_frame(httpd_req_t *req, httpd_ws_frame_t *frame, size_t
 
         /* Grab the second byte */
         uint8_t second_byte = 0;
-        if (httpd_recv_with_opt(req, (char *)&second_byte, sizeof(second_byte), false) <= 0) {
+        if (httpd_recv_with_opt(req, (char *)&second_byte, sizeof(second_byte), HTTPD_RECV_OPT_BLOCKING) < sizeof(second_byte)) {
             ESP_LOGW(TAG, LOG_FMT("Failed to receive the second byte"));
             return ESP_FAIL;
         }
@@ -313,7 +313,7 @@ esp_err_t httpd_ws_recv_frame(httpd_req_t *req, httpd_ws_frame_t *frame, size_t
         } else if (init_len == 126) {
             /* Case 2: If length byte is 126, then this frame's length bit is 16 bits */
             uint8_t length_bytes[2] = { 0 };
-            if (httpd_recv_with_opt(req, (char *)length_bytes, sizeof(length_bytes), false) <= 0) {
+            if (httpd_recv_with_opt(req, (char *)length_bytes, sizeof(length_bytes), HTTPD_RECV_OPT_BLOCKING) < sizeof(length_bytes)) {
                 ESP_LOGW(TAG, LOG_FMT("Failed to receive 2 bytes length"));
                 return ESP_FAIL;
             }
@@ -322,8 +322,8 @@ esp_err_t httpd_ws_recv_frame(httpd_req_t *req, httpd_ws_frame_t *frame, size_t
         } else if (init_len == 127) {
             /* Case 3: If length is byte 127, then this frame's length bit is 64 bits */
             uint8_t length_bytes[8] = { 0 };
-            if (httpd_recv_with_opt(req, (char *)length_bytes, sizeof(length_bytes), false) <= 0) {
-                ESP_LOGW(TAG, LOG_FMT("Failed to receive 2 bytes length"));
+            if (httpd_recv_with_opt(req, (char *)length_bytes, sizeof(length_bytes), HTTPD_RECV_OPT_BLOCKING) < sizeof(length_bytes)) {
+                ESP_LOGW(TAG, LOG_FMT("Failed to receive 8 bytes length"));
                 return ESP_FAIL;
             }
 
@@ -338,7 +338,7 @@ esp_err_t httpd_ws_recv_frame(httpd_req_t *req, httpd_ws_frame_t *frame, size_t
         }
         /* If this frame is masked, dump the mask as well */
         if (masked) {
-            if (httpd_recv_with_opt(req, (char *)aux->mask_key, sizeof(aux->mask_key), false) <= 0) {
+            if (httpd_recv_with_opt(req, (char *)aux->mask_key, sizeof(aux->mask_key), HTTPD_RECV_OPT_BLOCKING) < sizeof(aux->mask_key)) {
                 ESP_LOGW(TAG, LOG_FMT("Failed to receive mask key"));
                 return ESP_FAIL;
             }
@@ -375,7 +375,7 @@ esp_err_t httpd_ws_recv_frame(httpd_req_t *req, httpd_ws_frame_t *frame, size_t
     size_t offset = 0;
 
     while (left_len > 0) {
-        int read_len = httpd_recv_with_opt(req, (char *)frame->payload + offset, left_len, false);
+        int read_len = httpd_recv_with_opt(req, (char *)frame->payload + offset, left_len, HTTPD_RECV_OPT_NONE);
         if (read_len <= 0) {
             ESP_LOGW(TAG, LOG_FMT("Failed to receive payload"));
             return ESP_FAIL;
@@ -483,7 +483,7 @@ esp_err_t httpd_ws_get_frame_type(httpd_req_t *req)
     /* Read the first byte from the frame to get the FIN flag and Opcode */
     /* Please refer to RFC6455 Section 5.2 for more details */
     uint8_t first_byte = 0;
-    if (httpd_recv_with_opt(req, (char *)&first_byte, sizeof(first_byte), false) <= 0) {
+    if (httpd_recv_with_opt(req, (char *)&first_byte, sizeof(first_byte), HTTPD_RECV_OPT_BLOCKING) < sizeof(first_byte)) {
         /* If the recv() return code is <= 0, then this socket FD is invalid (i.e. a broken connection) */
         /* Here we mark it as a Close message and close it later. */
         ESP_LOGW(TAG, LOG_FMT("Failed to read header byte (socket FD invalid), closing socket now"));

components/esp_hw_support/Kconfig

@@ -372,4 +372,12 @@ menu "Hardware Settings"
     config ESP_SPI_BUS_LOCK_FUNCS_IN_IRAM
         bool
         default n
+
+    config ESP_ECDSA_ENABLE_P192_CURVE
+        bool "Enable ECDSA 192-curve operations"
+        depends on SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+        default N
+        help
+            By default, only the 256-bit curve operations are allowed. If this configuration is enabled,
+            it will set the eFuse to allow ECDSA operations using both the 192-bit and 256-bit curves
 endmenu

components/esp_hw_support/dma/gdma.c

@@ -135,8 +135,8 @@ static esp_err_t do_allocate_gdma_channel(const gdma_channel_search_info_t *sear
 
     for (int i = start_group_id; i < end_group_id && search_code; i++) { // loop to search group
         group = gdma_acquire_group_handle(i, search_info->hal_init);
-        group->bus_id = search_info->bus_id;
         ESP_GOTO_ON_FALSE(group, ESP_ERR_NO_MEM, err, TAG, "no mem for group(%d)", i);
+        group->bus_id = search_info->bus_id;
         for (int j = 0; j < pairs_per_group && search_code; j++) { // loop to search pair
             pair = gdma_acquire_pair_handle(group, j);
             ESP_GOTO_ON_FALSE(pair, ESP_ERR_NO_MEM, err, TAG, "no mem for pair(%d,%d)", i, j);

components/esp_hw_support/esp_clock_output.c

@@ -63,7 +63,9 @@ static clkout_channel_handle_t* clkout_channel_alloc(soc_clkout_sig_id_t clk_sig
                (s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].mapped_clock == clk_sig)) {
         allocated_channel = &s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)];
     }
-    allocated_channel->channel_id = (clock_out_channel_t)IONUM_TO_CLKOUT_CHANNEL(gpio_num);
+    if (allocated_channel != NULL) {
+        allocated_channel->channel_id = (clock_out_channel_t)IONUM_TO_CLKOUT_CHANNEL(gpio_num);
+    }
     portEXIT_CRITICAL(&s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].clkout_channel_lock);
 #elif SOC_GPIO_CLOCKOUT_BY_GPIO_MATRIX
     for (uint32_t channel = 0; channel < CLKOUT_CHANNEL_MAX; channel++) {
@@ -117,6 +119,9 @@ static esp_clock_output_mapping_t* clkout_mapping_alloc(clkout_channel_handle_t*
 
     if (allocated_mapping == NULL) {
         allocated_mapping = (esp_clock_output_mapping_t *)malloc(sizeof(esp_clock_output_mapping_t));
+        if (!allocated_mapping) {
+            return NULL;
+        }
         allocated_mapping->mapped_io = gpio_num;
         allocated_mapping->clkout_channel_hdl = channel_hdl;
         allocated_mapping->ref_cnt = 0;

components/esp_hw_support/esp_memory_utils.c

@@ -52,6 +52,9 @@ bool esp_ptr_byte_accessible(const void *p)
     intptr_t ip = (intptr_t) p;
     bool r;
     r = (ip >= SOC_BYTE_ACCESSIBLE_LOW && ip < SOC_BYTE_ACCESSIBLE_HIGH);
+#if SOC_MEM_TCM_SUPPORTED
+    r |= esp_ptr_in_tcm(p);
+#endif
 #if CONFIG_ESP_SYSTEM_ALLOW_RTC_FAST_MEM_AS_HEAP
     /* For ESP32 case, RTC fast memory is accessible to PRO cpu only and hence
      * for single core configuration (where it gets added to system heap) following

components/esp_hw_support/include/esp_memory_utils.h

@@ -278,6 +278,10 @@ inline static bool esp_ptr_internal(const void *p) {
     bool r;
     r = ((intptr_t)p >= SOC_MEM_INTERNAL_LOW && (intptr_t)p < SOC_MEM_INTERNAL_HIGH);
 
+#if SOC_MEM_TCM_SUPPORTED
+    r |= esp_ptr_in_tcm(p);
+#endif
+
 #if SOC_RTC_SLOW_MEM_SUPPORTED
     r |= ((intptr_t)p >= SOC_RTC_DATA_LOW && (intptr_t)p < SOC_RTC_DATA_HIGH);
 #endif

components/esp_hw_support/include/esp_private/esp_pmu.h

@@ -12,6 +12,7 @@
 #include <stdlib.h>
 
 #include "soc/soc_caps.h"
+#include "soc/clk_tree_defs.h"
 
 #if SOC_PMU_SUPPORTED
 #include "hal/pmu_hal.h"
@@ -225,18 +226,20 @@ uint32_t pmu_sleep_calculate_hp_hw_wait_time(uint32_t pd_flags, uint32_t slowclk
  * @brief Calculate the hardware time overhead during sleep to compensate for sleep time
  *
  * @param pd_flags flags indicates the power domain that will be powered down
+ * @param slowclk_src slow clock source of pmu
  * @param slowclk_period re-calibrated slow clock period
  * @param fastclk_period re-calibrated fast clock period
  *
  * @return hardware time overhead in us
  */
-uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_period, uint32_t fastclk_period);
+uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, soc_rtc_slow_clk_src_t slowclk_src, uint32_t slowclk_period, uint32_t fastclk_period);
 
 /**
  * @brief Get default sleep configuration
  * @param config pmu_sleep_config instance
  * @param pd_flags flags indicates the power domain that will be powered down
  * @param adjustment total software and hardware time overhead
+ * @param slowclk_src slow clock source of pmu
  * @param slowclk_period re-calibrated slow clock period in microseconds,
  *                       Q13.19 fixed point format
  * @param fastclk_period re-calibrated fast clock period in microseconds,
@@ -245,7 +248,7 @@ uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_pe
 
  * @return hardware time overhead in us
  */
-const pmu_sleep_config_t* pmu_sleep_config_default(pmu_sleep_config_t *config, uint32_t pd_flags, uint32_t adjustment, uint32_t slowclk_period, uint32_t fastclk_period, bool dslp);
+const pmu_sleep_config_t* pmu_sleep_config_default(pmu_sleep_config_t *config, uint32_t pd_flags, uint32_t adjustment, soc_rtc_slow_clk_src_t slowclk_src, uint32_t slowclk_period, uint32_t fastclk_period, bool dslp);
 
 /**
  * @brief Prepare the chip to enter sleep mode

components/esp_hw_support/intr_alloc.c

@@ -73,6 +73,15 @@ struct shared_vector_desc_t {
 #define VECDESC_FL_SHARED       (1<<2)
 #define VECDESC_FL_NONSHARED    (1<<3)
 
+#if SOC_CPU_HAS_FLEXIBLE_INTC
+/* On targets that have configurable interrupts levels, store the assigned level in the flags */
+#define VECDESC_FL_LEVEL_SHIFT  (8)
+/* Allocate 4 bits in the flag */
+#define VECDESC_FL_LEVEL_MASK   (0xf)
+/* Help to extract the level from flags */
+#define VECDESC_FL_LEVEL(flags) (((flags) >> VECDESC_FL_LEVEL_SHIFT) & VECDESC_FL_LEVEL_MASK)
+#endif
+
 //Pack using bitfields for better memory use
 struct vector_desc_t {
     int flags: 16;                          //OR of VECDESC_FL_* defines
@@ -258,7 +267,17 @@ static bool is_vect_desc_usable(vector_desc_t *vd, int flags, int cpu, int force
         return false;
     }
 
-#ifndef SOC_CPU_HAS_FLEXIBLE_INTC
+#if SOC_CPU_HAS_FLEXIBLE_INTC
+    /* On target that have configurable interrupts levels, check if the interrupt has already
+     * been allocated, and if yes, make sure the levels are compatible. */
+    const int vector_lvl = VECDESC_FL_LEVEL(vd->flags);
+    /* A non-zero value means the level has already been set prior to this allocation, make
+     * sure the current level matches what we need. */
+    if (vector_lvl != 0 && (flags & (1 << vector_lvl)) == 0) {
+        ALCHLOG("....Unusable: incompatible priority");
+        return false;
+    }
+#else
     //Check if the interrupt priority is acceptable
     if (!(flags & (1 << intr_desc.priority))) {
         ALCHLOG("....Unusable: incompatible priority");
@@ -640,6 +659,7 @@ esp_err_t esp_intr_alloc_intrstatus(int source, int flags, uint32_t intrstatusre
 #if SOC_CPU_HAS_FLEXIBLE_INTC
     //Extract the level from the interrupt passed flags
     int level = esp_intr_flags_to_level(flags);
+    vd->flags |= level << VECDESC_FL_LEVEL_SHIFT;
     esp_cpu_intr_set_priority(intr, level);
 
     if (flags & ESP_INTR_FLAG_EDGE) {
@@ -786,6 +806,10 @@ static esp_err_t intr_free_for_current_cpu(intr_handle_t handle)
         //we save.(We can also not use the same exit path for empty shared ints anymore if we delete
         //the desc.) For now, just mark it as free.
         handle->vector_desc->flags &= ~(VECDESC_FL_NONSHARED|VECDESC_FL_RESERVED|VECDESC_FL_SHARED);
+#if SOC_CPU_HAS_FLEXIBLE_INTC
+        //Clear the assigned level
+        handle->vector_desc->flags &= ~(VECDESC_FL_LEVEL_MASK << VECDESC_FL_LEVEL_SHIFT);
+#endif
         handle->vector_desc->source = ETS_INTERNAL_UNUSED_INTR_SOURCE;
 
         //Also kill non_iram mask bit.
@@ -798,11 +822,17 @@ static esp_err_t intr_free_for_current_cpu(intr_handle_t handle)
 
 int esp_intr_get_intno(intr_handle_t handle)
 {
+    if (handle == NULL || handle->vector_desc == NULL) {
+        return -1;
+    }
     return handle->vector_desc->intno;
 }
 
 int esp_intr_get_cpu(intr_handle_t handle)
 {
+    if (handle == NULL || handle->vector_desc == NULL) {
+        return -1;
+    }
     return handle->vector_desc->cpu;
 }
 

components/esp_hw_support/port/esp32/include/soc/rtc.h

@@ -478,6 +478,14 @@ bool rtc_dig_8m_enabled(void);
  */
 uint32_t rtc_clk_freq_cal(uint32_t cal_val);
 
+/**
+ * @brief Calculate the slow clock period value by slow clock frequency
+ *
+ * @param freq_hz Frequency of the slow clock in Hz
+ * @return Fixed point value of slow clock period in microseconds
+ */
+uint32_t rtc_clk_freq_to_period(uint32_t freq_hz);
+
 /**
  * @brief sleep configuration for rtc_sleep_init function
  */