Merge branch 'update/version_4_2_5' into 'release/v4.2'

Update version to 4.2.5

See merge request espressif/esp-idf!24489

.github/workflows/docker.yml

@@ -0,0 +1,87 @@
+name: docker
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release/*'
+    tags:
+      - 'v*.*'
+
+env:
+  # Platforms to build the image for
+  BUILD_PLATFORMS: linux/amd64
+  DOCKERHUB_REPO: ${{ github.repository_owner }}/idf
+
+jobs:
+  docker:
+    # Disable the job in forks
+    if: ${{ github.repository_owner == 'espressif' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
+      # as a build arg) and TAG_NAME (used when tagging the image).
+      #
+      # The following 3 steps cover the alternatives (tag, release branch, master branch):
+      - name: Set variables (tags)
+        if: ${{ github.ref_type == 'tag' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
+      - name: Set variables (release branches)
+        if: ${{ github.ref_type == 'branch' && startsWith(github.ref_name, 'release/') }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=release-${GITHUB_REF_NAME##release/}" >> $GITHUB_ENV
+      - name: Set variables (main branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=master" >> $GITHUB_ENV
+          echo "TAG_NAME=latest" >> $GITHUB_ENV
+
+      # Display the variables set above, just in case.
+      - name: Check variables
+        run: |
+          echo "CLONE_BRANCH_OR_TAG: $CLONE_BRANCH_OR_TAG"
+          echo "CHECKOUT_REF: $CHECKOUT_REF"
+          echo "TAG_NAME: $TAG_NAME"
+
+      # The following steps are the standard boilerplate from
+      # https://github.com/marketplace/actions/build-and-push-docker-images
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up QEMU for multiarch builds
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: tools/docker
+          push: true
+          tags: ${{ env.DOCKERHUB_REPO }}:${{ env.TAG_NAME }}
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: |
+            IDF_CLONE_URL=${{ github.server_url }}/${{ github.repository }}.git
+            IDF_CLONE_BRANCH_OR_TAG=${{ env.CLONE_BRANCH_OR_TAG }}
+
+      - name: Update Docker Hub repository description (master branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        uses: peter-evans/dockerhub-description@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          # Token based authentication is not supported here:
+          # https://github.com/peter-evans/dockerhub-description/issues/10
+          # https://github.com/docker/roadmap/issues/115#issuecomment-891694974
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: ${{ env.DOCKERHUB_REPO }}
+          readme-filepath: ./tools/docker/README.md

.github/workflows/release_zips.yml

@@ -0,0 +1,17 @@
+name: Create zip file with recursive source clone for release
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release_zips:
+    name: Create release zip file
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Create a recursive clone source zip
+        uses: espressif/github-actions/release_zips@master
+        env:
+            RELEASE_PROJECT_NAME: ESP-IDF
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -83,3 +83,6 @@ build
 
 # lock files for examples and components
 dependencies.lock
+
+# managed_components for examples
+managed_components

.gitlab-ci.yml

@@ -57,8 +57,6 @@ variables:
   CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/tools/ci/config/target-test.yml"
   # target test repo parameters
   TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
-  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"
 
   # Versioned esp-idf-doc env image to use for all document building jobs
   ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v7"
@@ -80,6 +78,8 @@ variables:
   python $SUBMODULE_FETCH_TOOL -s $SUBMODULES_TO_FETCH
 
 before_script:
+  - source tools/ci/utils.sh
+  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
   - source tools/ci/setup_python.sh
   # apply bot filter in before script
   - *apply_bot_filter
@@ -101,6 +101,8 @@ before_script:
     GIT_SUBMODULE_STRATEGY: none
   before_script:
     - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - source tools/ci/setup_python.sh
     - source tools/ci/configure_ci_environment.sh
 
@@ -110,6 +112,8 @@ before_script:
     GIT_SUBMODULE_STRATEGY: none
   before_script:
     - echo "Not setting up GitLab key, not fetching submodules"
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - source tools/ci/setup_python.sh
     # apply bot filter in before script
     - *apply_bot_filter
@@ -144,7 +148,12 @@ before_script:
     - macos_shell
   dependencies: []
   before_script:
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - *apply_bot_filter
+    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
+    # Clean up idf-env.json which might not be compatible with one produced by newer ESP-IDF versions
+    - rm -f ${IDF_TOOLS_PATH}/idf-env.json
     - $IDF_PATH/tools/idf_tools.py install-python-env
     # On macOS, these tools need to be installed
     - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@@ -157,6 +166,12 @@ before_script:
     - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
     - *fetch_submodules
 
+default:
+  retry:
+    max: 2
+    # In case of a runner failure we could hop to another one, or a network error could go away.
+    when: runner_system_failure
+
 include:
   - '/tools/ci/config/pre_check.yml'
   - '/tools/ci/config/build.yml'

.gitlab/CODEOWNERS

@@ -0,0 +1,6 @@
+# For the syntax of this file, see:
+#
+#    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
+#
+
+* @esp-idf-codeowners/all-maintainers

CMakeLists.txt

@@ -74,6 +74,10 @@ if(CONFIG_COMPILER_DISABLE_GCC8_WARNINGS)
                                 "-Wno-int-in-bool-context")
 endif()
 
+if(CONFIG_COMPILER_WARN_WRITE_STRINGS)
+    list(APPEND compile_options "-Wwrite-strings")
+endif()
+
 if(CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_DISABLE)
     list(APPEND compile_definitions "-DNDEBUG")
 endif()

Kconfig

@@ -114,7 +114,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
                     mon reset halt
                     # Run to a specific point in ROM code,
                     #  where most of initialization is complete.
-                    thb *0x40007901
+                    thb *0x40007d54
                     c
                     # Load the application into RAM
                     load

README.md

@@ -2,20 +2,15 @@
 
 * [中文版](./README_CN.md)
 
-ESP-IDF is the official development framework for the **ESP32** and **ESP32-S** Series SoCs provided for Windows, Linux and macOS.
+ESP-IDF is the development framework for Espressif SoCs (released after 2016<sup>[1](#fn1)</sup>) provided for Windows, Linux and macOS.
 
 # Developing With ESP-IDF
 
 ## Setting Up ESP-IDF
 
-See setup guides for detailed instructions to set up the ESP-IDF:
+See https://idf.espressif.com/ for links to detailed instructions on how to set up the ESP-IDF depending on chip you use.
 
-| Chip | Getting Started Guides for ESP-IDF |
-|:----:|:----|
-| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> |  <ul><li>[stable](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/) version</li><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/) version</li></ul> |
-| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/get-started/) version</li></ul> |
-
-**Note:** Each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) how to find documentation and how to checkout specific release of ESP-IDF.
+**Note:** Each SoC series and each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) on how to find documentation and how to checkout specific release of ESP-IDF.
 
 ### Non-GitHub forks
 
@@ -70,7 +65,7 @@ You don't need to run `idf.py build` before running `idf.py flash`, `idf.py flas
 
 ## Viewing Serial Output
 
-The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from ESP32 or ESP32-S Series SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from Espressif SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 Exit the monitor by typing Ctrl-].
 
@@ -106,3 +101,6 @@ This can be combined with other targets, ie `idf.py -p PORT erase_flash flash` w
 * If you're interested in contributing to ESP-IDF, please check the [Contributions Guide](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html).
 
 
+________
+
+<a name="fn1">1</a>: ESP8266 and ESP8285 are not supported in ESP-IDF. See [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK) instead.

README_CN.md

@@ -2,26 +2,22 @@
 
 * [English Version](./README.md)
 
-ESP-IDF 是由乐鑫官方推出的针对 **ESP32** 和 **ESP32-S2** 系列芯片的开发框架。
+ESP-IDF 是由乐鑫官方针对乐鑫各系列芯片产品（发布于 2016 年后<sup>[1](#fn1)</sup>）推出的开发框架，支持 Windows、Linux 和 macOS 操作系统。
 
 # 使用 ESP-IDF 进行开发
 
 ## 搭建 ESP-IDF 开发环境
 
-请参阅如下指南搭建 ESP-IDF 的开发环境：
-
-| 芯片 | ESP-IDF 入门指南 |
-|:----:|:----|
-| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> | <ul><li>[稳定](https://docs.espressif.com/projects/esp-idf/zh_CN/stable/get-started/) 版</li><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/get-started/) 版本</li></ul> |
-| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32s2/get-started/) 版本</li></ul> |
-
-**注意：** 每个 ESP-IDF 版本都有其对应的文档。 请参阅 [版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html) 部分，如何查找文档以及如何检出ESP-IDF的特定发行版。
+关于不同芯片如何搭建 ESP-IDF 的开发环境，请参考 https://idf.espressif.com/。
 
+**注意：** 不同系列芯片和不同 ESP-IDF 版本都有其对应的文档。请参阅[版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html)部分，获得关于如何查找文档以及如何检出 ESP-IDF 的特定发行版的详细信息。
 
 ### 非 GitHub 分叉的 ESP-IDF 项目
 
 ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodules)），所以它们会指向 GitHub。
-如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该[脚本](tools/set-submodules-to-github.sh)。它会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
+如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该脚本 [tools/set-submodules-to-github.sh](tools/set-submodules-to-github.sh)。
+
+这个脚本会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
 如果 ESP-IDF 是从 GitHub 上克隆得到，则不需要此步骤。
 
 ## 寻找项目
@@ -38,24 +34,16 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 
 ## 设置构建环境
 
-（请参考入门指南中列出的详细步骤。）
-* 在主机中安装入门指南中提到的构建所依赖的工具。
-* 将 ESP-IDF 中的 `tools/` 目录加入 PATH 环境变量中。
-* 运行 `python -m pip install -r requirements.txt` 安装 Python 依赖库。
+请参考入门指南中列出的详细步骤。
 
+* 在主机中安装入门指南中提到的构建所依赖的工具。
+* 运行安装脚本来设置构建环境。可为 Windows shell 选择 `install.bat` 或 `install.ps1`，为 Unix shell 选择 `install.sh` 和 `install.fish`。
+* 在使用 ESP-IDF 之前，需要在 shell 中运行导出脚本。Windows 下可运行 `export.bat`，Unix 下可运行 `source export.sh`。
+  
 ## 配置项目
 
-`idf.py menuconfig`
-
-* 打开项目的文本配置菜单。
-* 使用上下键浏览菜单。
-* 使用回车键进入子菜单，退出键返回上一级菜单或者退出配置。
-* 输入 `?` 查看帮助界面，按下回车键可以退出帮助界面。
-* 使用空格键或者 `Y` 和 `N` 按键来启用和禁用带复选框“`[*]`”的配置项。
-* 高亮某个配置项的同时按下 `?` 键可以显示该选项的帮助文档。
-* 输入 `/` 可以搜索指定的配置项。
-
-一旦配置完成，请按下退出键多次以退出配置界面，当提示是否保存新的的配置时，选择 “Yes”。
+* `idf.py set-target <chip_name>` 可将项目的目标芯片设置为 `<chip_name>`。运行 `idf.py set-target`，不用带任何参数，可查看所有支持的目标芯片列表。
+* `idf.py menuconfig` 可打开一个基于文本的配置菜单，可以用来对项目进行配置。
 
 ## 编译项目
 
@@ -65,23 +53,23 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 
 ## 烧写项目
 
-当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但是你还可以运行下面这条命令来自动烧写：
+当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但你也可以运行下面这条命令来自动烧写：
 
 `idf.py -p PORT flash`
 
-将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 MacOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。
+将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 macOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。
 
 这会烧写整个项目（包括应用程序，引导程序和分区表）到芯片中，此外还可以使用 `idf.py menuconfig` 来调整串口烧写相关的配置。
 
-你也不必先运行 `idf.py build`，再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。
+不必先运行 `idf.py build` 再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。
 
 ## 观察串口输入
 
-`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示 ESP32 和 ESP32-S2 的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示乐鑫芯片的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 输入 `Ctrl-]` 可退出监视器。
 
-想要一次性执行构建，烧写和监视，可以运行如下命令：
+想要一次性执行构建、烧写和监视，可以运行如下命令：
 
 `idf.py flash monitor`
 
@@ -92,24 +80,27 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 * `idf.py app` - 仅构建应用程序。
 * `idf.py app-flash` - 仅烧写应用程序。
 
-`idf.py app-flash` 会自动判断是否有源文件发生了改变而后重新构建应用程序。
+`idf.py app-flash` 会自动判断是否有源文件发生了改变然后重新构建应用程序。
 
 （在正常的开发中，即使引导程序和分区表没有发生变化，每次都重新烧写它们并不会带来什么危害。）
 
 ## 擦除 Flash
 
-`idf.py flash` 并不会擦除 Flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级。要擦除整块 Flash 请运行 `idf.py erase_flash`。
+`idf.py flash` 并不会擦除 flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级时。要擦除整块 flash 请运行 `idf.py erase_flash`。
 
-这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序，引导程序和分区表。
+这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序、引导程序和分区表。
 
 # 其它参考资源
 
-* 最新版的文档：https://docs.espressif.com/projects/esp-idf/ ，该文档是由本仓库 [docs 目录](docs) 构建得到。
+* 最新版的文档：https://docs.espressif.com/projects/esp-idf/，该文档是由本仓库 [docs 目录](docs) 构建得到。
 
 * 可以前往 [esp32.com 论坛](https://esp32.com/) 提问，挖掘社区资源。
 
-* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题不会被重复提交。
+* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题没有重复提交。
 
 * 如果你有兴趣为 ESP-IDF 作贡献，请先阅读[贡献指南](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html)。
 
 
+__________
+
+<a name="fn1">1</a>: ESP-IDF 不支持 ESP8266 和 ESP8285。如有需要，请参考 [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK)。

components/app_trace/CMakeLists.txt

@@ -30,13 +30,17 @@ endif()
 
 idf_component_register(SRCS "${srcs}"
                        INCLUDE_DIRS "${include_dirs}"
-                       PRIV_REQUIRES soc
+                       PRIV_REQUIRES soc esp_ipc
                        LDFRAGMENTS linker.lf)
 
-# disable --coverage for this component, as it is used as transport
-# for gcov
-target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
 
-# Force app_trace to also appear later than gcov in link line
-idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+if(CONFIG_APPTRACE_GCOV_ENABLE)
+    # disable --coverage for this component, as it is used as transport
+    # for gcov
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
+
+    # Force app_trace to also appear later than gcov in link line
+    idf_component_get_property(app_trace app_trace COMPONENT_LIB)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE
+        "-Wl,--undefined=gcov_rtio_atexit" $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+endif()

components/app_trace/component.mk

@@ -8,11 +8,7 @@ COMPONENT_ADD_INCLUDEDIRS = include
 
 COMPONENT_ADD_LDFLAGS = -lapp_trace
 
-# do not produce gcov info for this module, it is used as transport for gcov
-CFLAGS := $(subst --coverage,,$(CFLAGS))
-
 ifdef CONFIG_SYSVIEW_ENABLE
-
 COMPONENT_ADD_INCLUDEDIRS += \
 	sys_view/Config \
 	sys_view/SEGGER \
@@ -26,7 +22,12 @@ COMPONENT_SRCDIRS += \
 	sys_view/esp32 \
 	sys_view/ext
 else
+ifdef CONFIG_APPTRACE_GCOV_ENABLE
+# do not produce gcov info for this module, it is used as transport for gcov
+CFLAGS := $(subst --coverage,,$(CFLAGS))
+COMPONENT_ADD_LDFLAGS += -Wl,--undefined=gcov_rtio_atexit
 COMPONENT_SRCDIRS += gcov
 endif
+endif
 
 COMPONENT_ADD_LDFRAGMENTS += linker.lf

components/app_trace/gcov/gcov_rtio.c

@@ -22,7 +22,9 @@
 #include "soc/cpu.h"
 #include "soc/timer_periph.h"
 #include "esp_app_trace.h"
+#include "esp_freertos_hooks.h"
 #include "esp_private/dbg_stubs.h"
+#include "esp_ipc.h"
 #include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
@@ -37,128 +39,113 @@
 #define LOG_LOCAL_LEVEL CONFIG_LOG_DEFAULT_LEVEL
 #include "esp_log.h"
 const static char *TAG = "esp_gcov_rtio";
+static volatile bool s_create_gcov_task = false;
+static volatile bool s_gcov_task_running = false;
 
 extern void __gcov_dump(void);
 extern void __gcov_reset(void);
 
-static struct syscall_stub_table s_gcov_stub_table;
-
-
-static int gcov_stub_lock_try_acquire_recursive(_lock_t *lock)
+void gcov_dump_task(void *pvParameter)
 {
-    if (*lock && uxSemaphoreGetCount((xSemaphoreHandle)(*lock)) == 0) {
-        // we can do nothing here, gcov dump is initiated with some resource locked
-        // which is also used by gcov functions
-        ESP_EARLY_LOGE(TAG, "Lock 0x%x is busy during GCOV dump! System state can be inconsistent after dump!", lock);
-    }
-    return pdTRUE;
-}
+    int dump_result = 0;
+    bool *running = (bool *)pvParameter;
 
-static void gcov_stub_lock_acquire_recursive(_lock_t *lock)
-{
-    gcov_stub_lock_try_acquire_recursive(lock);
-}
+    ESP_EARLY_LOGV(TAG, "%s stack use in %d", __FUNCTION__, uxTaskGetStackHighWaterMark(NULL));
 
-static void gcov_stub_lock_release_recursive(_lock_t *lock)
-{
-}
-
-static int esp_dbg_stub_gcov_dump_do(void)
-{
-    int ret = ESP_OK;
-    FILE* old_stderr = stderr;
-    FILE* old_stdout = stdout;
-    static struct syscall_stub_table *old_tables[portNUM_PROCESSORS];
-
-    old_tables[0] = syscall_table_ptr_pro;
-#if portNUM_PROCESSORS > 1
-    old_tables[1] = syscall_table_ptr_app;
-#endif
     ESP_EARLY_LOGV(TAG, "Alloc apptrace down buf %d bytes", ESP_GCOV_DOWN_BUF_SIZE);
     void *down_buf = malloc(ESP_GCOV_DOWN_BUF_SIZE);
     if (down_buf == NULL) {
         ESP_EARLY_LOGE(TAG, "Could not allocate memory for the buffer");
-        return ESP_ERR_NO_MEM;
+        dump_result = ESP_ERR_NO_MEM;
+        goto gcov_exit;
     }
     ESP_EARLY_LOGV(TAG, "Config apptrace down buf");
     esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
+    /* we are directing the std outputs to the fake ones in order to reduce stack usage */
+    FILE *old_stderr = stderr;
+    FILE *old_stdout = stdout;
+    stderr = (FILE *) &__sf_fake_stderr;
+    stdout = (FILE *) &__sf_fake_stdout;
     ESP_EARLY_LOGV(TAG, "Dump data...");
-    // incase of dual-core chip APP and PRO CPUs share the same table, so it is safe to save only PRO's table
-    memcpy(&s_gcov_stub_table, syscall_table_ptr_pro, sizeof(s_gcov_stub_table));
-    s_gcov_stub_table._lock_acquire_recursive = &gcov_stub_lock_acquire_recursive;
-    s_gcov_stub_table._lock_release_recursive = &gcov_stub_lock_release_recursive;
-    s_gcov_stub_table._lock_try_acquire_recursive = &gcov_stub_lock_try_acquire_recursive,
-    syscall_table_ptr_pro = &s_gcov_stub_table;
-#if portNUM_PROCESSORS > 1
-    syscall_table_ptr_app = &s_gcov_stub_table;
-#endif
-    stderr = (FILE*) &__sf_fake_stderr;
-    stdout = (FILE*) &__sf_fake_stdout;
     __gcov_dump();
     // reset dump status to allow incremental data accumulation
     __gcov_reset();
-    stdout = old_stdout;
-    stderr = old_stderr;
-    syscall_table_ptr_pro = old_tables[0];
-#if portNUM_PROCESSORS > 1
-    syscall_table_ptr_app = old_tables[1];
-#endif
-    ESP_EARLY_LOGV(TAG, "Free apptrace down buf");
     free(down_buf);
+    stderr = old_stderr;
+    stdout = old_stdout;
     ESP_EARLY_LOGV(TAG, "Finish file transfer session");
-    ret = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
-    if (ret != ESP_OK) {
-        ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", ret);
+    dump_result = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
+    if (dump_result != ESP_OK) {
+        ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", dump_result);
+    }
+
+gcov_exit:
+    ESP_EARLY_LOGV(TAG, "dump_result %d", dump_result);
+    if (running) {
+        *running = false;
+    }
+
+    ESP_EARLY_LOGV(TAG, "%s stack use out %d", __FUNCTION__, uxTaskGetStackHighWaterMark(NULL));
+
+    vTaskDelete(NULL);
+}
+
+void gcov_create_task(void *arg)
+{
+    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
+    xTaskCreatePinnedToCore(&gcov_dump_task, "gcov_dump_task", 2048, (void *)&s_gcov_task_running, configMAX_PRIORITIES - 1, NULL, 0);
+}
+
+void gcov_create_task_tick_hook(void)
+{
+    extern esp_err_t esp_ipc_start_gcov_from_isr(uint32_t cpu_id, esp_ipc_func_t func, void* arg);
+    if (s_create_gcov_task) {
+        if (esp_ipc_start_gcov_from_isr(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
+            s_create_gcov_task = false;
+        }
     }
-    ESP_EARLY_LOGV(TAG, "exit %d", ret);
-    return ret;
 }
 
 /**
- * @brief Triggers gcov info dump.
+ * @brief Triggers gcov info dump task
  *        This function is to be called by OpenOCD, not by normal user code.
- * TODO: what about interrupted flash access (when cache disabled)???
+ * TODO: what about interrupted flash access (when cache disabled)
  *
  * @return ESP_OK on success, otherwise see esp_err_t
  */
 static int esp_dbg_stub_gcov_entry(void)
 {
-    return esp_dbg_stub_gcov_dump_do();
+    /* we are in isr context here */
+    s_create_gcov_task = true;
+    return ESP_OK;
 }
 
 int gcov_rtio_atexit(void (*function)(void) __attribute__ ((unused)))
 {
+    uint32_t capabilities = 0;
     ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
     esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_GCOV, (uint32_t)&esp_dbg_stub_gcov_entry);
-    return 0;
+    if (esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &capabilities) == ESP_OK) {
+        esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, capabilities | ESP_DBG_STUB_CAP_GCOV_TASK);
+    }
+    esp_register_freertos_tick_hook(gcov_create_task_tick_hook);
+    return ESP_OK;
 }
 
 void esp_gcov_dump(void)
 {
-    // disable IRQs on this CPU, other CPU is halted by OpenOCD
-    unsigned irq_state = portENTER_CRITICAL_NESTED();
-#if !CONFIG_FREERTOS_UNICORE
-    int other_core = xPortGetCoreID() ? 0 : 1;
-    esp_cpu_stall(other_core);
-#endif
+    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
+
     while (!esp_apptrace_host_is_connected(ESP_APPTRACE_DEST_TRAX)) {
-        wdt_hal_context_t twdt = {.inst = WDT_MWDT0, .mwdt_dev = &TIMERG0};
-        wdt_hal_context_t iwdt = {.inst = WDT_MWDT1, .mwdt_dev = &TIMERG1};
-        //Feed the Task Watchdog (TG0) to prevent it from timing out
-        wdt_hal_write_protect_disable(&twdt);
-        wdt_hal_feed(&twdt);
-        wdt_hal_write_protect_enable(&twdt);
-        //Likewise, feed the Interrupt Watchdog (TG1) to prevent a reboot
-        wdt_hal_write_protect_disable(&iwdt);
-        wdt_hal_feed(&iwdt);
-        wdt_hal_write_protect_enable(&iwdt);
+        vTaskDelay(pdMS_TO_TICKS(10));
     }
 
-    esp_dbg_stub_gcov_dump_do();
-#if !CONFIG_FREERTOS_UNICORE
-    esp_cpu_unstall(other_core);
-#endif
-    portEXIT_CRITICAL_NESTED(irq_state);
+    /* We are not in isr context here. Waiting for the completion is safe */
+    s_gcov_task_running = true;
+    s_create_gcov_task = true;
+    while (s_gcov_task_running) {
+        vTaskDelay(pdMS_TO_TICKS(10));
+    }
 }
 
 void *gcov_rtio_fopen(const char *path, const char *mode)
@@ -177,7 +164,7 @@ int gcov_rtio_fclose(void *stream)
 
 size_t gcov_rtio_fread(void *ptr, size_t size, size_t nmemb, void *stream)
 {
-    ESP_EARLY_LOGV(TAG, "%s read %u", __FUNCTION__, size*nmemb);
+    ESP_EARLY_LOGV(TAG, "%s read %u", __FUNCTION__, size * nmemb);
     size_t sz = esp_apptrace_fread(ESP_APPTRACE_DEST_TRAX, ptr, size, nmemb, stream);
     ESP_EARLY_LOGV(TAG, "%s actually read %u", __FUNCTION__, sz);
     return sz;

components/app_trace/linker.lf

@@ -3,12 +3,13 @@ archive: libapp_trace.a
 entries: 
     app_trace (noflash)
     app_trace_util (noflash)
-    SEGGER_SYSVIEW (noflash)
-    SEGGER_RTT_esp32 (noflash)
-    SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
-    SEGGER_SYSVIEW_FreeRTOS (noflash)
+    if SYSVIEW_ENABLE = y:
+      SEGGER_SYSVIEW (noflash)
+      SEGGER_RTT_esp32 (noflash)
+      SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
+      SEGGER_SYSVIEW_FreeRTOS (noflash)
 
-[mapping:driver]
+[mapping:app_trace_driver]
 archive: libdriver.a
 entries:
     if SYSVIEW_TS_SOURCE_TIMER_00 = y || SYSVIEW_TS_SOURCE_TIMER_01 = y

components/app_update/esp_app_desc.c

@@ -89,7 +89,10 @@ int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
     static bool first_call = true;
     if (first_call) {
         first_call = false;
-        const uint8_t* src = esp_app_desc.app_elf_sha256;
+        // At -O2 optimization level, GCC optimizes out the copying of the first byte of the app_elf_sha256,
+        // because it is zero at compile time, and only modified afterwards by esptool.
+        // Casting to volatile disables the optimization.
+        const volatile uint8_t* src = (const volatile uint8_t*)esp_app_desc.app_elf_sha256;
         for (size_t i = 0; i < sizeof(s_app_elf_sha256); ++i) {
             s_app_elf_sha256[i] = src[i];
         }

components/app_update/include/esp_ota_ops.h

@@ -49,7 +49,7 @@ typedef uint32_t esp_ota_handle_t;
 
 /**
  * @brief   Return esp_app_desc structure. This structure includes app version.
- * 
+ *
  * Return description for running app.
  * @return Pointer to esp_app_desc structure.
  */
@@ -224,7 +224,7 @@ const esp_partition_t* esp_ota_get_next_update_partition(const esp_partition_t *
 
 /**
  * @brief Returns esp_app_desc structure for app partition. This structure includes app version.
- * 
+ *
  * Returns a description for the requested app partition.
  * @param[in] partition     Pointer to app partition. (only app partition)
  * @param[out] app_desc     Structure of info about app.
@@ -313,9 +313,9 @@ typedef enum {
 /**
  * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
  *
- * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key #N-1, Key #N, Key #N+1).
- * When key #N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key #N-1 & Key #N.
- * After successfully booting the OTA app should call this function to revoke Key #N-1.
+ * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key N-1, Key N, Key N+1).
+ * When key N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key N-1 & Key N.
+ * After successfully booting the OTA app should call this function to revoke Key N-1.
  *
  * @param index - The index of the signature block to be revoked
  *

components/app_update/otatool.py

@@ -87,9 +87,8 @@ class OtatoolTarget():
             seq = bytearray(self.otadata[start:start + 4])
             crc = bytearray(self.otadata[start + 28:start + 32])
 
-            seq = struct.unpack('>I', seq)
-            crc = struct.unpack('>I', crc)
-
+            seq = struct.unpack('I', seq)
+            crc = struct.unpack('I', crc)
             info.append(otadata_info(seq[0], crc[0]))
 
         return info
@@ -103,12 +102,11 @@ class OtatoolTarget():
     def switch_ota_partition(self, ota_id):
         self._check_otadata_partition()
 
-        sys.path.append(PARTTOOL_DIR)
         import gen_esp32part as gen
 
         def is_otadata_info_valid(status):
             seq = status.seq % (1 << 32)
-            crc = hex(binascii.crc32(struct.pack("I", seq), 0xFFFFFFFF) % (1 << 32))
+            crc = binascii.crc32(struct.pack('I', seq), 0xFFFFFFFF) % (1 << 32)
             return seq < (int('0xFFFFFFFF', 16) % (1 << 32)) and status.crc == crc
 
         partition_table = self.target.partition_table
@@ -219,8 +217,8 @@ def _read_otadata(target):
 
     otadata_info = target._get_otadata_info()
 
-    print("             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}".format("OTA_SEQ", "CRC", "OTA_SEQ", "CRC"))
-    print("Firmware:  0x{:8x} \t0x{:8x} | \t0x{:8x} \t 0x{:8x}".format(otadata_info[0].seq, otadata_info[0].crc,
+    print('             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}'.format('OTA_SEQ', 'CRC', 'OTA_SEQ', 'CRC'))
+    print('Firmware:  0x{:08x} \t0x{:08x} | \t0x{:08x} \t 0x{:08x}'.format(otadata_info[0].seq, otadata_info[0].crc,
           otadata_info[1].seq, otadata_info[1].crc))
 
 

components/app_update/test/test_switch_ota.c

@@ -23,7 +23,7 @@
 #include "unity.h"
 
 #include "bootloader_common.h"
-#include "../include_bootloader/bootloader_flash.h"
+#include "../include_bootloader/bootloader_flash_priv.h"
 
 #include "esp_log.h"
 #include "esp_ota_ops.h"

components/bootloader/Kconfig.projbuild

@@ -114,7 +114,8 @@ menu "Bootloader config"
     config BOOTLOADER_NUM_PIN_FACTORY_RESET
         int "Number of the GPIO input for factory reset"
         depends on BOOTLOADER_FACTORY_RESET
-        range 0 39
+        range 0 39 if IDF_TARGET_ESP32
+        range 0 44 if IDF_TARGET_ESP32S2
         default 4
         help
             The selected GPIO will be configured as an input with internal pull-up enabled.
@@ -308,6 +309,15 @@ menu "Bootloader config"
             in this area of memory, you can increase it. It must be a multiple of 4 bytes.
             This area (rtc_retain_mem_t) is reserved and has access from the bootloader and an application.
 
+    config BOOTLOADER_FLASH_XMC_SUPPORT
+        bool "Enable the support for flash chips of XMC (READ HELP FIRST)"
+        default y
+        help
+            Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
+            XMC chips will be forbidden to be used, when this option is disabled.
+
+            DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
+
 endmenu  # Bootloader
 
 
@@ -615,6 +625,7 @@ menu "Security features"
         config SECURE_FLASH_ENCRYPTION_MODE_RELEASE
             bool "Release"
             select SECURE_ENABLE_SECURE_ROM_DL_MODE if SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_DISABLE_ROM_DL_MODE # NOERROR
+            select PARTITION_TABLE_MD5 if !ESP32_COMPATIBLE_PRE_V3_1_BOOTLOADERS
 
     endchoice
 
@@ -676,9 +687,17 @@ menu "Security features"
                 efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
 
                 If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse holding the public
-                key digest, causing an immediate denial of service and possibly allowing an additional fault
-                injection attack to bypass the signature protection.
+                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
+                immediate denial of service and possibly allowing an additional fault injection attack to
+                bypass the signature protection.
+
+                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+                However, efuse can be read/written from the application
 
         config SECURE_INSECURE_ALLOW_DL_MODE
             bool "Don't automatically restrict UART download mode"

components/bootloader/subproject/Makefile

@@ -32,4 +32,6 @@ CFLAGS += -D BOOTLOADER_BUILD=1
 # include the top-level "project" include directory, for sdkconfig.h
 CFLAGS += -I$(BUILD_DIR_BASE)/../include
 
+COMPONENT_ADD_LDFLAGS += -l$(COMPONENT_NAME) -Wl,--wrap=longjmp \
+
 include $(IDF_PATH)/make/project.mk

components/bootloader/subproject/main/ld/esp32/bootloader.ld

@@ -164,8 +164,35 @@ SECTIONS
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader/subproject/main/ld/esp32s2/bootloader.ld

@@ -150,8 +150,35 @@ SECTIONS
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader_support/include/bootloader_flash.h

@@ -0,0 +1,61 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#pragma once
+
+#include <stdint.h>
+#include <esp_err.h>
+#include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Read flash ID by sending 0x9F command
+ * @return flash raw ID
+ *     mfg_id = (ID >> 16) & 0xFF;
+       flash_id = ID & 0xffff;
+ */
+uint32_t bootloader_read_flash_id(void);
+
+#if SOC_CACHE_SUPPORT_WRAP
+/**
+ * @brief Set the burst mode setting command for specified wrap mode.
+ *
+ * @param mode The specified warp mode.
+ * @return always ESP_OK
+ */
+esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode);
+#endif
+
+/**
+ * @brief Startup flow recommended by XMC. Call at startup before any erase/write operation.
+ *
+ * @return ESP_OK When startup successfully, otherwise ESP_FAIL (indiciating you should reboot before erase/write).
+ */
+esp_err_t bootloader_flash_xmc_startup(void);
+
+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t bootloader_flash_unlock(void);
+
+#ifdef __cplusplus
+}
+#endif

components/bootloader_support/include/esp_flash_partitions.h

@@ -42,6 +42,9 @@ extern "C" {
 
 #define PART_FLAG_ENCRYPTED (1<<0)
 
+/* The md5sum value is found this many bytes after the ESP_PARTITION_MAGIC_MD5 offset */
+#define ESP_PARTITION_MD5_OFFSET 16
+
 /* Pre-partition table fixed flash offsets */
 #define ESP_BOOTLOADER_DIGEST_OFFSET 0x0
 #define ESP_BOOTLOADER_OFFSET 0x1000 /* Offset of bootloader image. Has matching value in bootloader KConfig.projbuild file. */

components/bootloader_support/include_bootloader/bootloader_flash_priv.h

@@ -19,11 +19,28 @@
 #include <stdint.h>
 #include <esp_err.h>
 #include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "bootloader_flash.h"
 
 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 0x10000
 #define MMAP_ALIGNED_MASK 0x0000FFFF
 
+/* SPI commands (actual on-wire commands not SPI controller bitmasks)
+   Suitable for use with the bootloader_execute_flash_command static function.
+*/
+#define CMD_RDID       0x9F
+#define CMD_WRSR       0x01
+#define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
+#define CMD_WREN       0x06
+#define CMD_WRDI       0x04
+#define CMD_RDSR       0x05
+#define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
+#define CMD_RDSFDP     0x5A /* Read the SFDP of the flash */
+#define CMD_WRAP       0x77 /* Set burst with wrap command */
+
+
 /* Provide a Flash API for bootloader_support code,
    that can be used from bootloader or app code.
 
@@ -136,4 +153,29 @@ static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vad
     return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
 }
 
+/**
+ * @brief Execute a user command on the flash
+ *
+ * @param command The command value to execute.
+ * @param mosi_data MOSI data to send
+ * @param mosi_len Length of MOSI data, in bits
+ * @param miso_len Length of MISO data to receive, in bits
+ * @return Received MISO data
+ */
+uint32_t bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len);
+
+/**
+ * @brief Read the SFDP of the flash
+ *
+ * @param sfdp_addr Address of the parameter to read
+ * @param miso_byte_num Bytes to read
+ * @return The read SFDP, little endian, 4 bytes at most
+ */
+uint32_t bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num);
+
+/**
+ * @brief Enable the flash write protect (WEL bit).
+ */
+void bootloader_enable_wp(void);
+
 #endif

components/bootloader_support/include_bootloader/bootloader_utility.h

@@ -99,9 +99,10 @@ __attribute__((noreturn)) void bootloader_reset(void);
 esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);
 
 /**
- * @brief Debug log contents of a buffer as hexadecimal
+ * @brief Debug log contents of a buffer as hexadecimal.
  *
- * @note Only works if component log level is DEBUG or higher.
+ * @note - Only works if component log level is DEBUG or higher.
+ *       - It will print at most 128 bytes from @c buffer.
  *
  * @param buffer Buffer to log
  * @param length Length of buffer in bytes. Maximum length 128 bytes.

components/bootloader_support/include_bootloader/flash_qio_mode.h

@@ -13,6 +13,8 @@
 // limitations under the License.
 #pragma once
 
+#include <stdint.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif

components/bootloader_support/src/bootloader_common.c

@@ -28,12 +28,13 @@
 #include "esp32s2/rom/gpio.h"
 #endif
 #include "esp_flash_partitions.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_common.h"
 #include "bootloader_utility.h"
 #include "soc/gpio_periph.h"
 #include "soc/rtc.h"
 #include "soc/efuse_reg.h"
+#include "soc/soc_memory_layout.h"
 #include "esp_image_format.h"
 #include "bootloader_sha.h"
 #include "sys/param.h"
@@ -295,7 +296,18 @@ RESET_REASON bootloader_common_get_reset_reason(int cpu_no)
 
 #if defined( CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP ) || defined( CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC )
 
-rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)(SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t));
+#define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+
+rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
+
+#if !IS_BOOTLOADER_BUILD
+/* The app needs to be told this memory is reserved, important if configured to use RTC memory as heap.
+
+   Note that keeping this macro here only works when other symbols in this file are referenced by the app, as
+   this feature is otherwise 100% part of the bootloader. However this seems to happen in all apps.
+ */
+SOC_RESERVE_MEMORY_REGION(RTC_RETAIN_MEM_ADDR, RTC_RETAIN_MEM_ADDR + sizeof(rtc_retain_mem_t), rtc_retain_mem);
+#endif
 
 static bool check_rtc_retain_mem(void)
 {

components/bootloader_support/src/bootloader_efuse_esp32s2.c

@@ -15,10 +15,10 @@
 #include "sdkconfig.h"
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
+#include "soc/efuse_reg.h"
 
 uint8_t bootloader_common_get_chip_revision(void)
 {
     // should return the same value as esp_efuse_get_chip_ver()
-    /* No other revisions for ESP32-S2 */
-    return 0;
+    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
 }

components/bootloader_support/src/bootloader_flash.c

@@ -13,13 +13,44 @@
 // limitations under the License.
 #include <stddef.h>
 
-#include <bootloader_flash.h>
+#include <bootloader_flash_priv.h>
 #include <esp_log.h>
 #include <esp_flash_encrypt.h>
-#if CONFIG_IDF_TARGET_ESP32S2
-#include "esp32s2/rom/spi_flash.h"
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
+
+#if CONFIG_IDF_TARGET_ESP32
+#   include "soc/spi_struct.h"
+#   include "soc/spi_reg.h"
+    /* SPI flash controller */
+#   define SPIFLASH SPI1
+#else
+#   include "soc/spi_mem_struct.h"
+#   include "soc/spi_mem_reg.h"
+    /* SPI flash controller */
+#   define SPIFLASH SPIMEM1
 #endif
 
+#if CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/spi_flash.h"
+#include "esp32/rom/ets_sys.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"  //For SPI_Encrypt_Write
+#include "esp32s2/rom/ets_sys.h"
+#endif
+
+#define BYTESHIFT(VAR, IDX)    (((VAR) >> ((IDX) * 8)) & 0xFF)
+#define ISSI_ID                0x9D
+#define MXIC_ID                0xC2
+#define GD_Q_ID_HIGH           0xC8
+#define GD_Q_ID_MID            0x40
+#define GD_Q_ID_LOW            0x16
+
+#define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI    (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
+#define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2        BIT1   // QE position when you write 8 bits(for SR2) at one time.
+#define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE     BIT9   // QE position when you write 16 bits at one time.
+
+
 #ifndef BOOTLOADER_BUILD
 /* Normal app version maps to esp_spi_flash.h operations...
  */
@@ -89,7 +120,7 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
     return spi_flash_erase_range(start_addr, size);
 }
 
-#else
+#else //BOOTLOADER_BUILD
 /* Bootloader version, uses ROM functions only */
 #include "soc/dport_reg.h"
 #if CONFIG_IDF_TARGET_ESP32
@@ -318,7 +349,7 @@ esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool
         return ESP_FAIL;
     }
 
-    err = spi_to_esp_err(esp_rom_spiflash_unlock());
+    err = bootloader_flash_unlock();
     if (err != ESP_OK) {
         return err;
     }
@@ -364,4 +395,332 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
     }
     return spi_to_esp_err(rc);
 }
+
+#endif // BOOTLOADER_BUILD
+
+FORCE_INLINE_ATTR bool is_issi_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == ISSI_ID;
+}
+
+// For GD25Q32, GD25Q64, GD25Q127C, GD25Q128, which use single command to read/write different SR.
+FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
+}
+
+FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
+}
+
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
+{
+    // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
+    // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
+    uint16_t status = 0;    // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
+    uint16_t new_status = 0;
+    uint8_t status_sr2 = 0;    // status_sr2 for SR2.
+    uint8_t new_status_sr2 = 0;
+    uint8_t sr1_bit_num = 0;
+    esp_err_t err = ESP_OK;
+
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
+        // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
+        // If any code here needs to be modified, check both chips.
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+
+        /* Clear all bits in the mask.
+        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
+        */
+        sr1_bit_num = 8;
+        new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
+    } else if (is_gd_q_chip(&g_rom_flashchip)) {
+        /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
+           Use 01H to write SR1 and 31H to write SR2.
+        */
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+        sr1_bit_num = 8;
+        new_status = 0;
+
+        status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
+        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
+    } else {
+        /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
+
+        /* Clear all bits except QE, if it is set.
+        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
+        */
+        sr1_bit_num = 16;
+        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
+    }
+
+    // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
+    bool status_written = false;
+    // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
+    if (status != new_status) {
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
+        status_written = true;
+    }
+
+    if (status_sr2 != new_status_sr2) {
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
+        status_written = true;
+    }
+
+    if (status_written) {
+        //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
+    }
+
+    return err;
+}
+
+
+/* dummy_len_plus values defined in ROM for SPI flash configuration */
+extern uint8_t g_rom_spiflash_dummy_len_plus[];
+IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
+    uint8_t command,
+    uint32_t addr_len, uint32_t address,
+    uint8_t dummy_len,
+    uint8_t mosi_len, uint32_t mosi_data,
+    uint8_t miso_len)
+{
+    assert(mosi_len <= 32);
+    assert(miso_len <= 32);
+    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
+    uint32_t old_user_reg = SPIFLASH.user.val;
+    uint32_t old_user1_reg = SPIFLASH.user1.val;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
+#else
+    SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
 #endif
+    //command phase
+    SPIFLASH.user.usr_command = 1;
+    SPIFLASH.user2.usr_command_bitlen = 7;
+    SPIFLASH.user2.usr_command_value = command;
+    //addr phase
+    SPIFLASH.user.usr_addr = addr_len > 0;
+    SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
+#else
+    SPIFLASH.addr = address;
+#endif
+    //dummy phase
+    if (miso_len > 0) {
+        uint32_t total_dummy = dummy_len + g_rom_spiflash_dummy_len_plus[1];
+        SPIFLASH.user.usr_dummy = total_dummy > 0;
+        SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
+    } else {
+        SPIFLASH.user.usr_dummy = 0;
+        SPIFLASH.user1.usr_dummy_cyclelen = 0;
+    }
+    //output data
+    SPIFLASH.user.usr_mosi = mosi_len > 0;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
+#else
+    SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
+#endif
+    SPIFLASH.data_buf[0] = mosi_data;
+    //input data
+    SPIFLASH.user.usr_miso = miso_len > 0;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
+#else
+    SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
+#endif
+
+    SPIFLASH.cmd.usr = 1;
+    while (SPIFLASH.cmd.usr != 0) {
+    }
+    SPIFLASH.ctrl.val = old_ctrl_reg;
+    SPIFLASH.user.val = old_user_reg;
+    SPIFLASH.user1.val = old_user1_reg;
+
+    uint32_t ret = SPIFLASH.data_buf[0];
+    if (miso_len < 32) {
+        //set unused bits to 0
+        ret &= ~(UINT32_MAX << miso_len);
+    }
+    return ret;
+}
+
+uint32_t IRAM_ATTR bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
+{
+    const uint8_t addr_len = 0;
+    const uint8_t address = 0;
+    const uint8_t dummy_len = 0;
+
+    return bootloader_flash_execute_command_common(command, addr_len, address,
+            dummy_len, mosi_len, mosi_data, miso_len);
+}
+
+// cmd(0x5A) + 24bit address + 8 cycles dummy
+uint32_t IRAM_ATTR bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num)
+{
+    assert(miso_byte_num <= 4);
+    const uint8_t command = CMD_RDSFDP;
+    const uint8_t addr_len = 24;
+    const uint8_t dummy_len = 8;
+    const uint8_t mosi_len = 0;
+    const uint32_t mosi_data = 0;
+    const uint8_t miso_len = miso_byte_num * 8;
+
+    return bootloader_flash_execute_command_common(command, addr_len, sfdp_addr,
+            dummy_len, mosi_len, mosi_data, miso_len);
+}
+
+void bootloader_enable_wp(void)
+{
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+}
+
+uint32_t IRAM_ATTR bootloader_read_flash_id(void)
+{
+    uint32_t id = bootloader_execute_flash_command(CMD_RDID, 0, 0, 24);
+    id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
+    return id;
+}
+
+#if SOC_CACHE_SUPPORT_WRAP
+esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode)
+{
+    uint32_t reg_bkp_ctrl = SPIFLASH.ctrl.val;
+    uint32_t reg_bkp_usr  = SPIFLASH.user.val;
+    SPIFLASH.user.fwrite_dio = 0;
+    SPIFLASH.user.fwrite_dual = 0;
+    SPIFLASH.user.fwrite_qio = 1;
+    SPIFLASH.user.fwrite_quad = 0;
+    SPIFLASH.ctrl.fcmd_dual = 0;
+    SPIFLASH.ctrl.fcmd_quad = 0;
+    SPIFLASH.user.usr_dummy = 0;
+    SPIFLASH.user.usr_addr = 1;
+    SPIFLASH.user.usr_command = 1;
+    SPIFLASH.user2.usr_command_bitlen = 7;
+    SPIFLASH.user2.usr_command_value = CMD_WRAP;
+    SPIFLASH.user1.usr_addr_bitlen = 23;
+    SPIFLASH.addr = 0;
+    SPIFLASH.user.usr_miso = 0;
+    SPIFLASH.user.usr_mosi = 1;
+    SPIFLASH.mosi_dlen.usr_mosi_bit_len = 7;
+    SPIFLASH.data_buf[0] = (uint32_t) mode << 4;;
+    SPIFLASH.cmd.usr = 1;
+    while(SPIFLASH.cmd.usr != 0)
+    { }
+
+    SPIFLASH.ctrl.val = reg_bkp_ctrl;
+    SPIFLASH.user.val = reg_bkp_usr;
+    return ESP_OK;
+}
+#endif //SOC_CACHE_SUPPORT_WRAP
+
+/*******************************************************************************
+ * XMC startup flow
+ ******************************************************************************/
+
+#define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
+#define XMC_VENDOR_ID 0x20
+
+#if BOOTLOADER_BUILD
+#define BOOTLOADER_FLASH_LOG(level, ...)    ESP_LOG##level(TAG, ##__VA_ARGS__)
+#else
+static DRAM_ATTR char bootloader_flash_tag[] = "bootloader_flash";
+#define BOOTLOADER_FLASH_LOG(level, ...)    ESP_DRAM_LOG##level(bootloader_flash_tag, ##__VA_ARGS__)
+#endif
+
+#if XMC_SUPPORT
+//strictly check the model
+static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
+{
+    uint32_t vendor_id = BYTESHIFT(rdid, 2);
+    uint32_t mfid = BYTESHIFT(rdid, 1);
+    uint32_t cpid = BYTESHIFT(rdid, 0);
+
+    if (vendor_id != XMC_VENDOR_ID) {
+        return false;
+    }
+
+    bool matched = false;
+    if (mfid == 0x40) {
+        if (cpid >= 0x13 && cpid <= 0x20) {
+            matched = true;
+        }
+    } else if (mfid == 0x41) {
+        if (cpid >= 0x17 && cpid <= 0x20) {
+            matched = true;
+        }
+    } else if (mfid == 0x50) {
+        if (cpid >= 0x15 && cpid <= 0x16) {
+            matched =  true;
+        }
+    }
+    return matched;
+}
+
+esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
+{
+    // If the RDID value is a valid XMC one, may skip the flow
+    const bool fast_check = true;
+    if (fast_check && is_xmc_chip_strict(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(D, "XMC chip detected by RDID (%08X), skip.", g_rom_flashchip.device_id);
+        return ESP_OK;
+    }
+
+    // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
+    const int sfdp_mfid_addr = 0x10;
+    uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
+    if (mf_id != XMC_VENDOR_ID) {
+        BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
+        return ESP_OK;
+    }
+
+    BOOTLOADER_FLASH_LOG(I, "XM25QHxxC startup flow");
+    // Enter DPD
+    bootloader_execute_flash_command(0xB9, 0, 0, 0);
+    // Enter UDPD
+    bootloader_execute_flash_command(0x79, 0, 0, 0);
+    // Exit UDPD
+    bootloader_execute_flash_command(0xFF, 0, 0, 0);
+    // Delay tXUDPD
+    ets_delay_us(2000);
+    // Release Power-down
+    bootloader_execute_flash_command(0xAB, 0, 0, 0);
+    ets_delay_us(20);
+    // Read flash ID and check again
+    g_rom_flashchip.device_id = bootloader_read_flash_id();
+    if (!is_xmc_chip_strict(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(E, "XMC flash startup fail");
+        return ESP_FAIL;
+    }
+
+    return ESP_OK;
+}
+
+#else
+//only compare the vendor id
+static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
+{
+    uint32_t vendor_id = (rdid >> 16) & 0xFF;
+    return (vendor_id == XMC_VENDOR_ID);
+}
+
+esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
+{
+    if (is_xmc_chip(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(E, "XMC chip detected (%08X) while support disabled.", g_rom_flashchip.device_id);
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+#endif //XMC_SUPPORT

components/bootloader_support/src/bootloader_flash_config_esp32.c

@@ -178,9 +178,9 @@ int bootloader_flash_get_wp_pin(void)
     uint8_t chip_ver;
     uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     switch(pkg_ver) {
+    case EFUSE_RD_CHIP_VER_PKG_ESP32U4WDH:
     case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
         return ESP32_D2WD_WP_GPIO;
-    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2:
     case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
         /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
         chip_ver = bootloader_common_get_chip_revision();

components/bootloader_support/src/bootloader_init.c

@@ -17,7 +17,7 @@
 #include "esp_attr.h"
 #include "esp_log.h"
 #include "bootloader_init.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_random.h"
 #include "bootloader_clock.h"

components/bootloader_support/src/bootloader_utility.c

@@ -59,13 +59,14 @@
 #include "esp_secure_boot.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "bootloader_config.h"
 #include "bootloader_common.h"
 #include "bootloader_utility.h"
 #include "bootloader_sha.h"
 #include "esp_efuse.h"
+#include "esp_fault.h"
 
 static const char *TAG = "boot";
 
@@ -257,9 +258,16 @@ static esp_err_t write_otadata(esp_ota_select_entry_t *otadata, uint32_t offset,
 static bool check_anti_rollback(const esp_partition_pos_t *partition)
 {
 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
-    esp_app_desc_t app_desc;
+    esp_app_desc_t app_desc = {};
     esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
-    return err == ESP_OK && esp_efuse_check_secure_version(app_desc.secure_version) == true;
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
+        return false;
+    }
+    bool sec_ver = esp_efuse_check_secure_version(app_desc.secure_version);
+    /* Anti FI check */
+    ESP_FAULT_ASSERT(sec_ver == esp_efuse_check_secure_version(app_desc.secure_version));
+    return sec_ver;
 #else
     return true;
 #endif
@@ -272,6 +280,8 @@ static void update_anti_rollback(const esp_partition_pos_t *partition)
     esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
     if (err == ESP_OK) {
         esp_efuse_update_secure_version(app_desc.secure_version);
+    } else {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
     }
 }
 
@@ -800,22 +810,19 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he
 
 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
 {
-#if BOOT_LOG_LEVEL >= LOG_LEVEL_DEBUG
-    assert(length <= 128); // Avoid unbounded VLA size
+#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
     const uint8_t *bytes = (const uint8_t *)buffer;
-    char hexbuf[length * 2 + 1];
-    hexbuf[length * 2] = 0;
-    for (int i = 0; i < length; i++) {
-        for (int shift = 0; shift < 2; shift++) {
-            uint8_t nibble = (bytes[i] >> (shift ? 0 : 4)) & 0x0F;
-            if (nibble < 10) {
-                hexbuf[i * 2 + shift] = '0' + nibble;
-            } else {
-                hexbuf[i * 2 + shift] = 'a' + nibble - 10;
-            }
-        }
-    }
+    const size_t output_len = MIN(length, 128);
+    char hexbuf[128 * 2 + 1];
+
+    bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
+
+    hexbuf[output_len * 2] = '\0';
     ESP_LOGD(TAG, "%s: %s", label, hexbuf);
+#else
+    (void) buffer;
+    (void) length;
+    (void) label;
 #endif
 }
 

components/bootloader_support/src/esp32/bootloader_esp32.c

@@ -23,6 +23,7 @@
 #include "bootloader_common.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_mem.h"
+#include "bootloader_flash_priv.h"
 
 #include "soc/cpu.h"
 #include "soc/dport_reg.h"
@@ -259,7 +260,7 @@ static esp_err_t bootloader_init_spi_flash(void)
     }
 #endif
 
-    esp_rom_spiflash_unlock();
+    bootloader_flash_unlock();
 
 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
     bootloader_enable_qio_mode();
@@ -267,6 +268,8 @@ static esp_err_t bootloader_init_spi_flash(void)
 
     print_flash_info(&bootloader_image_hdr);
     update_flash_config(&bootloader_image_hdr);
+    //ensure the flash is write-protected
+    bootloader_enable_wp();
     return ESP_OK;
 }
 
@@ -305,11 +308,13 @@ static void bootloader_init_uart_console(void)
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
 
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
         PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
         gpio_pad_pullup(uart_rx_gpio);
 
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
 
         DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
         DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
@@ -450,6 +455,11 @@ esp_err_t bootloader_init(void)
     bootloader_print_banner();
     // update flash ID
     bootloader_flash_update_id();
+    // Check and run XMC startup flow
+    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
+        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        goto err;
+    }
     // read bootloader header
     if ((ret = bootloader_read_bootloader_header()) != ESP_OK) {
         goto err;

components/bootloader_support/src/esp32/flash_encrypt.c

@@ -14,7 +14,7 @@
 
 #include <strings.h>
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "esp_image_format.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"

components/bootloader_support/src/esp32/secure_boot.c

@@ -29,7 +29,7 @@
 
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"

components/bootloader_support/src/esp32/secure_boot_signatures.c

@@ -13,7 +13,7 @@
 // limitations under the License.
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 #include "esp_log.h"

components/bootloader_support/src/esp32s2/bootloader_esp32s2.c

@@ -26,6 +26,7 @@
 #include "bootloader_clock.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_mem.h"
+#include "bootloader_flash_priv.h"
 
 #include "esp32s2/rom/cache.h"
 #include "esp32s2/rom/ets_sys.h"
@@ -205,7 +206,7 @@ static esp_err_t bootloader_init_spi_flash(void)
     }
 #endif
 
-    esp_rom_spiflash_unlock();
+    bootloader_flash_unlock();
 
 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
     bootloader_enable_qio_mode();
@@ -213,6 +214,8 @@ static esp_err_t bootloader_init_spi_flash(void)
 
     print_flash_info(&bootloader_image_hdr);
     update_flash_config(&bootloader_image_hdr);
+    //ensure the flash is write-protected
+    bootloader_enable_wp();
     return ESP_OK;
 }
 
@@ -251,11 +254,13 @@ static void bootloader_init_uart_console(void)
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
 
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
         PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
         gpio_pad_pullup(uart_rx_gpio);
 
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
 
         DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
         DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
@@ -372,6 +377,11 @@ esp_err_t bootloader_init(void)
     bootloader_print_banner();
     // update flash ID
     bootloader_flash_update_id();
+    // Check and run XMC startup flow
+    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
+        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        goto err;
+    }
     // read bootloader header
     if ((ret = bootloader_read_bootloader_header()) != ESP_OK) {
         goto err;

components/bootloader_support/src/esp32s2/flash_encrypt.c

@@ -14,7 +14,7 @@
 
 #include <strings.h>
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "bootloader_utility.h"
 #include "esp_image_format.h"
@@ -211,6 +211,12 @@ static esp_err_t initialise_flash_encryption(void)
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
 
+#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
+    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
+    // otherwise the Flash Encryption key cannot be read protected
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+#endif
+
     esp_err_t err = esp_efuse_batch_write_commit();
 
     return err;
@@ -297,8 +303,8 @@ static esp_err_t encrypt_bootloader(void)
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt bootloader in place: 0x%x", err);
             return err;
-        } 
-        
+        }
+
         ESP_LOGI(TAG, "bootloader encrypted successfully");
         return err;
     }

components/bootloader_support/src/esp32s2/secure_boot.c

@@ -17,7 +17,7 @@
 #include "esp_secure_boot.h"
 #include "soc/efuse_reg.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 
@@ -287,11 +287,23 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
 
+    esp_err_t err = ESP_FAIL;
 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
     ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif
 
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
@@ -308,6 +320,21 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
 
     esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
 
+#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+    bool rd_dis_now = true;
+#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
+    /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
+       when Flash Encryption is being enabled */
+    rd_dis_now = esp_flash_encryption_enabled();
+#endif
+    if (rd_dis_now) {
+        ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+    }
+#else
+    ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
+#endif
+
     err = esp_efuse_batch_write_commit();
     if (err != ESP_OK) {
         ESP_LOGI(TAG, "Error programming security eFuses.");

components/bootloader_support/src/esp32s2/secure_boot_signatures.c

@@ -15,7 +15,7 @@
 
 #include <string.h>
 #include "esp_fault.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 #include "esp_log.h"

components/bootloader_support/src/esp_image_format.c

@@ -20,7 +20,7 @@
 #include <esp_log.h>
 #include <esp_attr.h>
 #include <esp_spi_flash.h>
-#include <bootloader_flash.h>
+#include <bootloader_flash_priv.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
 #include "bootloader_util.h"

components/bootloader_support/src/flash_partitions.c

@@ -52,7 +52,7 @@ esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table
             MD5Update(&context, (unsigned char *) partition_table, num_parts * sizeof(esp_partition_info_t));
             MD5Final(digest, &context);
 
-            unsigned char *md5sum = ((unsigned char *) part) + 16; // skip the 2B magic number and the 14B fillup bytes
+            unsigned char *md5sum = ((unsigned char *) part) + ESP_PARTITION_MD5_OFFSET;
 
             if (memcmp(md5sum, digest, sizeof(digest)) != 0) {
                 if (log_errors) {

components/bootloader_support/src/flash_qio_mode.c

@@ -15,6 +15,7 @@
 #include <stdint.h>
 #include "bootloader_flash_config.h"
 #include "flash_qio_mode.h"
+#include "bootloader_flash_priv.h"
 #include "esp_log.h"
 #include "esp_err.h"
 #if CONFIG_IDF_TARGET_ESP32
@@ -25,30 +26,10 @@
 #include "esp32s2/rom/efuse.h"
 #include "soc/spi_mem_struct.h"
 #endif
-#include "soc/spi_struct.h"
-#include "soc/spi_reg.h"
 #include "soc/efuse_periph.h"
 #include "soc/io_mux_reg.h"
 #include "sdkconfig.h"
 
-/* SPI flash controller */
-#if CONFIG_IDF_TARGET_ESP32
-#define SPIFLASH SPI1
-#elif CONFIG_IDF_TARGET_ESP32S2
-#define SPIFLASH SPIMEM1
-#endif
-
-/* SPI commands (actual on-wire commands not SPI controller bitmasks)
-   Suitable for use with the execute_flash_command static function.
-*/
-#define CMD_RDID       0x9F
-#define CMD_WRSR       0x01
-#define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
-#define CMD_WREN       0x06
-#define CMD_WRDI       0x04
-#define CMD_RDSR       0x05
-#define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
-#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 
 static const char *TAG = "qio_mode";
 
@@ -104,6 +85,7 @@ const static qio_info_t chip_data[] = {
     { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
     { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
     { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
+    { "TH",          0xcd,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
 
     /* Final entry is default entry, if no other IDs have matched.
 
@@ -125,56 +107,6 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
 
    The command passed here is always the on-the-wire command given to the SPI flash unit.
 */
-static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len);
-
-/* dummy_len_plus values defined in ROM for SPI flash configuration */
-extern uint8_t g_rom_spiflash_dummy_len_plus[];
-uint32_t bootloader_read_flash_id(void)
-{
-    uint32_t id = execute_flash_command(CMD_RDID, 0, 0, 24);
-    id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
-    return id;
-}
-
-#if CONFIG_IDF_TARGET_ESP32S2
-#define FLASH_WRAP_CMD   0x77
-typedef enum {
-    FLASH_WRAP_MODE_8B  = 0,
-    FLASH_WRAP_MODE_16B = 2,
-    FLASH_WRAP_MODE_32B = 4,
-    FLASH_WRAP_MODE_64B = 6,
-    FLASH_WRAP_MODE_DISABLE = 1
-} spi_flash_wrap_mode_t;
-static esp_err_t spi_flash_wrap_set(spi_flash_wrap_mode_t mode)
-{
-    uint32_t reg_bkp_ctrl = SPIFLASH.ctrl.val;
-    uint32_t reg_bkp_usr  = SPIFLASH.user.val;
-    SPIFLASH.user.fwrite_dio = 0;
-    SPIFLASH.user.fwrite_dual = 0;
-    SPIFLASH.user.fwrite_qio = 1;
-    SPIFLASH.user.fwrite_quad = 0;
-    SPIFLASH.ctrl.fcmd_dual = 0;
-    SPIFLASH.ctrl.fcmd_quad = 0;
-    SPIFLASH.user.usr_dummy = 0;
-    SPIFLASH.user.usr_addr = 1;
-    SPIFLASH.user.usr_command = 1;
-    SPIFLASH.user2.usr_command_bitlen = 7;
-    SPIFLASH.user2.usr_command_value = FLASH_WRAP_CMD;
-    SPIFLASH.user1.usr_addr_bitlen = 23;
-    SPIFLASH.addr = 0;
-    SPIFLASH.user.usr_miso = 0;
-    SPIFLASH.user.usr_mosi = 1;
-    SPIFLASH.mosi_dlen.usr_mosi_bit_len = 7;
-    SPIFLASH.data_buf[0] = (uint32_t) mode << 4;;
-    SPIFLASH.cmd.usr = 1;
-    while (SPIFLASH.cmd.usr != 0) {
-    }
-
-    SPIFLASH.ctrl.val = reg_bkp_ctrl;
-    SPIFLASH.user.val = reg_bkp_usr;
-    return ESP_OK;
-}
-#endif
 
 void bootloader_enable_qio_mode(void)
 {
@@ -207,8 +139,8 @@ void bootloader_enable_qio_mode(void)
     enable_qio_mode(chip_data[i].read_status_fn,
                     chip_data[i].write_status_fn,
                     chip_data[i].status_qio_bit);
-#if CONFIG_IDF_TARGET_ESP32S2
-    spi_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
+#if SOC_CACHE_SUPPORT_WRAP
+    bootloader_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
 #endif
 }
 
@@ -225,7 +157,7 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     ESP_LOGD(TAG, "Initial flash chip status 0x%x", status);
 
     if ((status & (1 << status_qio_bit)) == 0) {
-        execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
         write_status_fn(status | (1 << status_qio_bit));
 
         esp_rom_spiflash_wait_idle(&g_rom_flashchip);
@@ -263,95 +195,48 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
 
 static unsigned read_status_8b_rdsr(void)
 {
-    return execute_flash_command(CMD_RDSR, 0, 0, 8);
+    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
 }
 
 static unsigned read_status_8b_rdsr2(void)
 {
-    return execute_flash_command(CMD_RDSR2, 0, 0, 8);
+    return bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
 }
 
 static unsigned read_status_16b_rdsr_rdsr2(void)
 {
-    return execute_flash_command(CMD_RDSR, 0, 0, 8) | (execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
+    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
 }
 
 static void write_status_8b_wrsr(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
 }
 
 static void write_status_8b_wrsr2(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR2, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR2, new_status, 8, 0);
 }
 
 static void write_status_16b_wrsr(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR, new_status, 16, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }
 
 static unsigned read_status_8b_xmc25qu64a(void)
 {
-    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    uint32_t read_status = execute_flash_command(CMD_RDSR, 0, 0, 8);
-    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+    uint32_t read_status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
     return read_status;
 }
 
 static void write_status_8b_xmc25qu64a(unsigned new_status)
 {
-    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
-}
-
-static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
-{
-    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
-#endif
-    SPIFLASH.user.usr_dummy = 0;
-    SPIFLASH.user.usr_addr = 0;
-    SPIFLASH.user.usr_command = 1;
-    SPIFLASH.user2.usr_command_bitlen = 7;
-
-    SPIFLASH.user2.usr_command_value = command;
-    SPIFLASH.user.usr_miso = miso_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
-#endif
-    SPIFLASH.user.usr_mosi = mosi_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
-#endif
-    SPIFLASH.data_buf[0] = mosi_data;
-
-    if (g_rom_spiflash_dummy_len_plus[1]) {
-        /* When flash pins are mapped via GPIO matrix, need a dummy cycle before reading via MISO */
-        if (miso_len > 0) {
-            SPIFLASH.user.usr_dummy = 1;
-            SPIFLASH.user1.usr_dummy_cyclelen = g_rom_spiflash_dummy_len_plus[1] - 1;
-        } else {
-            SPIFLASH.user.usr_dummy = 0;
-            SPIFLASH.user1.usr_dummy_cyclelen = 0;
-        }
-    }
-
-    SPIFLASH.cmd.usr = 1;
-    while (SPIFLASH.cmd.usr != 0) {
-    }
-
-    SPIFLASH.ctrl.val = old_ctrl_reg;
-    return SPIFLASH.data_buf[0];
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
 }

components/bootloader_support/src/idf/bootloader_sha.c

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 #include "bootloader_sha.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include <stdbool.h>
 #include <string.h>
 #include <assert.h>

components/bootloader_support/src/idf/secure_boot_signatures.c

@@ -13,7 +13,7 @@
 // limitations under the License.
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 #include "esp_log.h"
@@ -325,7 +325,7 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
                 break;
             }
     }
-    
+
     free(sig_be);
     free(buf);
 #if CONFIG_IDF_TARGET_ESP32

components/bt/CMakeLists.txt

@@ -573,6 +573,6 @@ idf_component_register(SRCS "${srcs}"
 if(CONFIG_BT_ENABLED)
     target_compile_options(${COMPONENT_LIB} PRIVATE -Wno-implicit-fallthrough -Wno-unused-const-variable)
 
-    target_link_libraries(${COMPONENT_LIB} INTERFACE "-L${CMAKE_CURRENT_LIST_DIR}/controller/lib")
+    target_link_libraries(${COMPONENT_LIB} INTERFACE "-L${CMAKE_CURRENT_LIST_DIR}/controller/lib/esp32")
     target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
 endif()

components/bt/Kconfig

@@ -365,11 +365,27 @@ menu "Bluetooth"
             int "Maximum number of devices in scan duplicate filter"
             depends on BTDM_BLE_SCAN_DUPL
             range 10 1000
-            default 200
+            default 100
             help
                 Maximum number of devices which can be recorded in scan duplicate filter.
                 When the maximum amount of device in the filter is reached, the cache will be refreshed.
 
+        config BTDM_SCAN_DUPL_CACHE_REFRESH_PERIOD
+            int "Duplicate scan list refresh period (seconds)"
+            depends on BTDM_BLE_SCAN_DUPL
+            range 0 1000
+            default 0
+            help
+                If the period value is non-zero, the controller will periodically clear the device information
+                stored in the scan duuplicate filter. If it is 0, the scan duuplicate filter will not be cleared
+                until the scanning is disabled. Duplicate advertisements for this period should not be sent to the
+                Host in advertising report events.
+                There are two scenarios where the ADV packet will be repeatedly reported:
+                1. The duplicate scan cache is full, the controller will delete the oldest device information and
+                add new device information.
+                2. When the refresh period is up, the controller will clear all device information and start filtering
+                again.
+
         config BTDM_BLE_MESH_SCAN_DUPL_EN
             bool "Special duplicate scan mechanism for BLE Mesh scan"
             depends on BTDM_BLE_SCAN_DUPL
@@ -381,7 +397,7 @@ menu "Bluetooth"
             int "Maximum number of Mesh adv packets in scan duplicate filter"
             depends on BTDM_BLE_MESH_SCAN_DUPL_EN
             range 10 1000
-            default 200
+            default 100
             help
                 Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
                 When the maximum amount of device in the filter is reached, the cache will be refreshed.
@@ -428,21 +444,6 @@ menu "Bluetooth"
                 If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
                 may cause adv packets lost more.
 
-        menuconfig BTDM_COEX_BT_OPTIONS
-            bool "Coexistence Bluetooth Side Options"
-            depends on ESP32_WIFI_SW_COEXIST_ENABLE
-            default n
-            help
-                Options of Bluetooth Side of WiFi and bluetooth coexistence.
-
-        config BTDM_COEX_BLE_ADV_HIGH_PRIORITY
-            bool "Improve BLE ADV priority for WiFi & BLE coexistence"
-            depends on BTDM_COEX_BT_OPTIONS
-            default n
-            help
-                Improve BLE ADV coexistence priority to make it better performance.
-                For example, BLE mesh need to enable this option to improve BLE adv performance.
-
     endmenu
 
     choice BT_HOST

components/bt/common/btc/core/btc_task.c

@@ -187,24 +187,12 @@ static void btc_thread_handler(void *arg)
         break;
     }
 
-    if (msg->arg) {
-        osi_free(msg->arg);
-    }
     osi_free(msg);
 }
 
 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
         return BT_STATUS_BUSY;
     }
 
@@ -217,52 +205,61 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
  * @param  arg       paramter
  * @param  arg_len   length of paramter
  * @param  copy_func deep copy function
+ * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func)
 {
-    btc_msg_t lmsg;
-
-    if (msg == NULL) {
+    btc_msg_t* lmsg;
+    bt_status_t ret;
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
+        BTC_TRACE_WARNING("%s Invalid parameters\n", __func__);
         return BT_STATUS_PARM_INVALID;
     }
 
     BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);
 
-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t) + arg_len);
+    if (lmsg == NULL) {
+        BTC_TRACE_WARNING("%s No memory\n", __func__);
+        return BT_STATUS_NOMEM;
     }
 
-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    }
 
+    ret = btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);
+    if (ret != BT_STATUS_SUCCESS) {
+        if (copy_func && free_func) {
+            free_func(lmsg);
+        }
+        osi_free(lmsg);
+    }
+
+    return ret;
 }
 
 /**
  * transfer an message to another module in tha same task.
  * @param  msg       message
- * @param  arg       paramter
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg)
+bt_status_t btc_inter_profile_call(btc_msg_t *msg)
 {
     if (msg == NULL) {
         return BT_STATUS_PARM_INVALID;
     }
 
-    msg->arg = arg;
     switch (msg->sig) {
     case BTC_SIG_API_CALL:
         profile_tab[msg->pid].btc_call(msg);

components/bt/common/btc/include/btc/btc_task.h

@@ -28,7 +28,7 @@ typedef struct btc_msg {
     uint8_t aid;    //application id
     uint8_t pid;    //profile id
     uint8_t act;    //profile action, defined in seprerate header files
-    void   *arg;    //param for btc function or function param
+    uint8_t arg[0]; //param for btc function or function param
 } btc_msg_t;
 
 typedef struct btc_adv_packet {
@@ -98,6 +98,7 @@ typedef struct {
 } btc_func_t;
 
 typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
+typedef void (* btc_arg_deep_free_t)(btc_msg_t *msg);
 
 /**
  * transfer an message to another module in the different task.
@@ -105,19 +106,20 @@ typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
  * @param  arg       paramter
  * @param  arg_len   length of paramter
  * @param  copy_func deep copy function
+ * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func);
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func);
 
 /**
  * transfer an message to another module in tha same task.
  * @param  msg       message
- * @param  arg       paramter
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg);
+bt_status_t btc_inter_profile_call(btc_msg_t *msg);
 
 bt_status_t btc_init(void);
 void btc_deinit(void);

components/bt/common/include/bt_common.h

@@ -42,6 +42,12 @@
 #define BTC_DYNAMIC_MEMORY         FALSE
 #endif
 
+#if UC_BT_BLUEDROID_MEM_DEBUG
+#define HEAP_MEMORY_DEBUG   TRUE
+#else
+#define HEAP_MEMORY_DEBUG   FALSE
+#endif
+
 #ifndef BT_BLE_DYNAMIC_ENV_MEMORY
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif

components/bt/common/include/bt_user_config.h

@@ -80,4 +80,11 @@
 #define UC_BT_LOG_OSI_TRACE_LEVEL           UC_TRACE_LEVEL_WARNING
 #endif
 
+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */

components/bt/common/osi/alarm.c

@@ -143,13 +143,13 @@ static void alarm_cb_handler(struct alarm_t *alarm)
         OSI_TRACE_WARNING("%s, invalid state %d\n", __func__, alarm_state);
         return;
     }
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_alarm_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_ALARM;
     arg.cb = alarm->cb;
     arg.cb_data = alarm->cb_data;
-    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL);
+    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL, NULL);
 }
 
 osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)
@@ -173,7 +173,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
         goto end;
     }
 
-    esp_timer_create_args_t tca;
+    esp_timer_create_args_t tca = {0};
     tca.callback = (esp_timer_cb_t)alarm_cb_handler;
     tca.arg = timer_id;
     tca.dispatch_method = ESP_TIMER_TASK;
@@ -318,3 +318,16 @@ uint32_t osi_time_get_os_boottime_ms(void)
 {
     return (uint32_t)(esp_timer_get_time() / 1000);
 }
+
+bool osi_alarm_is_active(osi_alarm_t *alarm)
+{
+    assert(alarm != NULL);
+    assert(alarm_mutex != NULL);
+    bool is_active = false;
+
+    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
+    is_active = alarm->deadline_us > 0;
+    osi_mutex_unlock(&alarm_mutex);
+
+    return is_active;
+}

components/bt/common/osi/config.c

@@ -550,10 +550,12 @@ static void config_parse(nvs_handle_t fp, config_t *config)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int buf_size = get_config_size_from_flash(fp);
-    char *buf = osi_calloc(buf_size);
+    char *buf = NULL;
+
     if(buf_size == 0) { //First use nvs
         goto error;
     }
+    buf = osi_calloc(buf_size);
     if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;

components/bt/common/osi/include/osi/alarm.h

@@ -20,6 +20,7 @@
 #define _ALARM_H_
 
 #include <stdint.h>
+#include <stdbool.h>
 #include "esp_timer.h"
 
 typedef struct alarm_t osi_alarm_t;
@@ -77,4 +78,8 @@ period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm);
 
 uint32_t osi_time_get_os_boottime_ms(void);
 
+// This function returns whether the alarm which encapsulated 
+// a one-shot timer is active or not
+bool osi_alarm_is_active(osi_alarm_t *alarm);
+
 #endif /*_ALARM_H_*/

components/bt/common/osi/thread.c

@@ -110,7 +110,6 @@ static void osi_thread_stop(osi_thread_t *thread)
 osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
 {
     int ret;
-    osi_thread_t *thread;
     struct osi_thread_start_arg start_arg = {0};
 
     if (stack_size <= 0 ||
@@ -119,17 +118,17 @@ osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priorit
         return NULL;
     }
 
-    thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
+    osi_thread_t *thread = (osi_thread_t *)osi_calloc(sizeof(osi_thread_t));
     if (thread == NULL) {
         goto _err;
     }
 
     thread->stop = false;
-    thread->work_queue_num = work_queue_num;
-    thread->work_queues = (fixed_queue_t **)osi_malloc(sizeof(fixed_queue_t *) * work_queue_num);
+    thread->work_queues = (fixed_queue_t **)osi_calloc(sizeof(fixed_queue_t *) * work_queue_num);
     if (thread->work_queues == NULL) {
         goto _err;
     }
+    thread->work_queue_num = work_queue_num;
 
     for (int i = 0; i < thread->work_queue_num; i++) {
         thread->work_queues[i] = fixed_queue_new(DEFAULT_WORK_QUEUE_CAPACITY);

components/bt/component.mk

@@ -9,11 +9,11 @@ COMPONENT_ADD_INCLUDEDIRS := include
 
 LIBS := btdm_app
 
-COMPONENT_ADD_LDFLAGS     := -lbt -L $(COMPONENT_PATH)/controller/lib \
+COMPONENT_ADD_LDFLAGS     := -lbt -L $(COMPONENT_PATH)/controller/lib/esp32 \
                            $(addprefix -l,$(LIBS))
 
 # re-link program if BT binary libs change
-COMPONENT_ADD_LINKER_DEPS := $(patsubst %,$(COMPONENT_PATH)/controller/lib/lib%.a,$(LIBS))
+COMPONENT_ADD_LINKER_DEPS := $(patsubst %,$(COMPONENT_PATH)/controller/lib/esp32/lib%.a,$(LIBS))
 
 COMPONENT_SUBMODULES += controller/lib
 

components/bt/controller/bt.c

@@ -37,10 +37,12 @@
 #include "esp_err.h"
 #include "esp_log.h"
 #include "esp_pm.h"
+#include "esp_timer.h"
 #include "driver/periph_ctrl.h"
 #include "soc/rtc.h"
 #include "soc/soc_memory_layout.h"
 #include "esp32/clk.h"
+#include "esp_coexist.h"
 #include "esp_coexist_internal.h"
 #if !CONFIG_FREERTOS_UNICORE
 #include "esp_ipc.h"
@@ -90,14 +92,9 @@ do{\
 } while(0)
 
 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010002
+#define OSI_VERSION              0x00010004
 #define OSI_MAGIC_VALUE          0xFADEBEAD
 
-/* SPIRAM Configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
-#define BTDM_MAX_QUEUE_NUM       (5)
-#endif
-
 /* Types definition
  ************************************************************************
  */
@@ -115,14 +112,10 @@ typedef struct {
     intptr_t end;
 } btdm_dram_available_region_t;
 
-/* PSRAM configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
 typedef struct {
-    QueueHandle_t handle;
+    void *handle;
     void *storage;
-    void *buffer;
 } btdm_queue_item_t;
-#endif
 
 /* OSI function */
 struct osi_funcs_t {
@@ -182,6 +175,11 @@ struct osi_funcs_t {
     void *(* _coex_schm_curr_phase_get)(void);
     int (* _coex_wifi_channel_get)(uint8_t *primary, uint8_t *secondary);
     int (* _coex_register_wifi_channel_change_callback)(void *cb);
+    xt_handler (*_set_isr_l3)(int n, xt_handler f, void *arg);
+    void (*_interrupt_l3_disable)(void);
+    void (*_interrupt_l3_restore)(void);
+    void *(* _customer_queue_create)(uint32_t queue_len, uint32_t item_size);
+    int (* _coex_version_get)(unsigned int *major, unsigned int *minor, unsigned int *patch);
     uint32_t _magic;
 };
 
@@ -238,7 +236,8 @@ extern uint8_t coex_schm_curr_period_get(void);
 extern void * coex_schm_curr_phase_get(void);
 extern int coex_wifi_channel_get(uint8_t *primary, uint8_t *secondary);
 extern int coex_register_wifi_channel_change_callback(void *cb);
-extern void coex_ble_adv_priority_high_set(bool high);
+/* Shutdown */
+extern void esp_bt_controller_shutdown(void);
 
 extern char _bss_start_btdm;
 extern char _bss_end_btdm;
@@ -263,12 +262,9 @@ extern uint32_t _btdm_data_end;
 /* Local Function Declare
  *********************************************************************
  */
-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue);
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue);
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
 static void IRAM_ATTR interrupt_disable(void);
 static void IRAM_ATTR interrupt_restore(void);
+static void IRAM_ATTR task_yield(void);
 static void IRAM_ATTR task_yield_from_isr(void);
 static void *semphr_create_wrapper(uint32_t max, uint32_t init);
 static void semphr_delete_wrapper(void *semphr);
@@ -316,6 +312,8 @@ static uint8_t coex_schm_curr_period_get_wrapper(void);
 static void * coex_schm_curr_phase_get_wrapper(void);
 static int coex_wifi_channel_get_wrapper(uint8_t *primary, uint8_t *secondary);
 static int coex_register_wifi_channel_change_callback_wrapper(void *cb);
+static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch);
+static void bt_controller_deinit_internal(void);
 
 /* Local variable definition
  ***************************************************************************
@@ -327,7 +325,7 @@ static const struct osi_funcs_t osi_funcs_ro = {
     ._ints_on = xt_ints_on,
     ._interrupt_disable = interrupt_disable,
     ._interrupt_restore = interrupt_restore,
-    ._task_yield = vPortYield,
+    ._task_yield = task_yield,
     ._task_yield_from_isr = task_yield_from_isr,
     ._semphr_create = semphr_create_wrapper,
     ._semphr_delete = semphr_delete_wrapper,
@@ -378,6 +376,11 @@ static const struct osi_funcs_t osi_funcs_ro = {
     ._coex_schm_curr_phase_get = coex_schm_curr_phase_get_wrapper,
     ._coex_wifi_channel_get = coex_wifi_channel_get_wrapper,
     ._coex_register_wifi_channel_change_callback = coex_register_wifi_channel_change_callback_wrapper,
+    ._set_isr_l3 = xt_set_interrupt_handler,
+    ._interrupt_l3_disable = interrupt_disable,
+    ._interrupt_l3_restore = interrupt_restore,
+    ._customer_queue_create = NULL,
+    ._coex_version_get = coex_version_get_wrapper,
     ._magic = OSI_MAGIC_VALUE,
 };
 
@@ -404,11 +407,6 @@ SOC_RESERVE_MEMORY_REGION(SOC_MEM_BT_DATA_START, SOC_MEM_BT_DATA_END,
 
 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;
 
-#if CONFIG_SPIRAM_USE_MALLOC
-static DRAM_ATTR btdm_queue_item_t btdm_queue_table[BTDM_MAX_QUEUE_NUM];
-static DRAM_ATTR SemaphoreHandle_t btdm_queue_table_mux = NULL;
-#endif /* #if CONFIG_SPIRAM_USE_MALLOC */
-
 /* Static variable declare */
 // timestamp when PHY/RF was switched on
 static DRAM_ATTR int64_t s_time_phy_rf_just_enabled = 0;
@@ -448,52 +446,6 @@ static inline void btdm_check_and_init_bb(void)
     }
 }
 
-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return NULL;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == NULL) {
-            memcpy(item, queue, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return false;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == queue->handle) {
-            memcpy(queue, item, sizeof(btdm_queue_item_t));
-            memset(item, 0, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
-
 static void IRAM_ATTR interrupt_disable(void)
 {
     if (xPortInIsrContext()) {
@@ -512,6 +464,11 @@ static void IRAM_ATTR interrupt_restore(void)
     }
 }
 
+static void IRAM_ATTR task_yield(void)
+{
+    vPortYield();
+}
+
 static void IRAM_ATTR task_yield_from_isr(void)
 {
     portYIELD_FROM_ISR();
@@ -519,148 +476,74 @@ static void IRAM_ATTR task_yield_from_isr(void)
 
 static void *semphr_create_wrapper(uint32_t max, uint32_t init)
 {
+    btdm_queue_item_t *semphr = heap_caps_calloc(1, sizeof(btdm_queue_item_t), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
+    assert(semphr);
+
 #if !CONFIG_SPIRAM_USE_MALLOC
-    return (void *)xSemaphoreCreateCounting(max, init);
+    semphr->handle = (void *)xSemaphoreCreateCounting(max, init);
 #else
-    StaticQueue_t *queue_buffer = NULL;
-    QueueHandle_t handle = NULL;
 
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    semphr->storage = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(semphr->storage);
 
-    handle = xSemaphoreCreateCountingStatic(max, init, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-    return handle;
-
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
+    semphr->handle = (void *)xSemaphoreCreateCountingStatic(max, init, semphr->storage);
 #endif
+    assert(semphr->handle);
+    return semphr;
 }
 
 static void semphr_delete_wrapper(void *semphr)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(semphr);
-#else
-    btdm_queue_item_t item = {
-        .handle = semphr,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
+    if (semphr == NULL) {
+        return;
     }
 
-    return;
+    btdm_queue_item_t *semphr_item = (btdm_queue_item_t *)semphr;
+
+    if (semphr_item->handle) {
+        vSemaphoreDelete(semphr_item->handle);
+    }
+#ifdef CONFIG_SPIRAM_USE_MALLOC
+    if (semphr_item->storage) {
+        free(semphr_item->storage);
+    }
 #endif
+
+    free(semphr);
 }
 
 static int32_t IRAM_ATTR semphr_take_from_isr_wrapper(void *semphr, void *hptw)
 {
-    return (int32_t)xSemaphoreTakeFromISR(semphr, hptw);
+    return (int32_t)xSemaphoreTakeFromISR(((btdm_queue_item_t *)semphr)->handle, hptw);
 }
 
 static int32_t IRAM_ATTR semphr_give_from_isr_wrapper(void *semphr, void *hptw)
 {
-    return (int32_t)xSemaphoreGiveFromISR(semphr, hptw);
+    return (int32_t)xSemaphoreGiveFromISR(((btdm_queue_item_t *)semphr)->handle, hptw);
 }
 
 static int32_t semphr_take_wrapper(void *semphr, uint32_t block_time_ms)
 {
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xSemaphoreTake(semphr, portMAX_DELAY);
+        return (int32_t)xSemaphoreTake(((btdm_queue_item_t *)semphr)->handle, portMAX_DELAY);
     } else {
-        return (int32_t)xSemaphoreTake(semphr, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xSemaphoreTake(((btdm_queue_item_t *)semphr)->handle, block_time_ms / portTICK_PERIOD_MS);
     }
 }
 
 static int32_t semphr_give_wrapper(void *semphr)
 {
-    return (int32_t)xSemaphoreGive(semphr);
+    return (int32_t)xSemaphoreGive(((btdm_queue_item_t *)semphr)->handle);
 }
 
 static void *mutex_create_wrapper(void)
 {
-#if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    QueueHandle_t handle = NULL;
-
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
-
-    handle = xSemaphoreCreateMutexStatic(queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-    return handle;
-
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
-#else
     return (void *)xSemaphoreCreateMutex();
-#endif
 }
 
 static void mutex_delete_wrapper(void *mutex)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
     vSemaphoreDelete(mutex);
-#else
-    btdm_queue_item_t item = {
-        .handle = mutex,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
-    }
-
-    return;
-#endif
 }
 
 static int32_t mutex_lock_wrapper(void *mutex)
@@ -675,102 +558,71 @@ static int32_t mutex_unlock_wrapper(void *mutex)
 
 static void *queue_create_wrapper(uint32_t queue_len, uint32_t item_size)
 {
+    btdm_queue_item_t *queue = NULL;
+
+    queue = (btdm_queue_item_t*)heap_caps_malloc(sizeof(btdm_queue_item_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue);
+
 #if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    uint8_t *queue_storage = NULL;
-    QueueHandle_t handle = NULL;
 
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    queue->storage = heap_caps_calloc(1, sizeof(StaticQueue_t) + (queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue->storage);
 
-    queue_storage = heap_caps_malloc((queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_storage ) {
-        goto error;
-    }
+    queue->handle = xQueueCreateStatic( queue_len, item_size, ((uint8_t*)(queue->storage)) + sizeof(StaticQueue_t), (StaticQueue_t*)(queue->storage));
+    assert(queue->handle);
 
-    handle = xQueueCreateStatic(queue_len, item_size, queue_storage, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = queue_storage,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-
-    return handle;
-
- error:
-    if (handle) {
-        vQueueDelete(handle);
-    }
-    if (queue_storage) {
-        free(queue_storage);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
 #else
-    return (void *)xQueueCreate(queue_len, item_size);
+    queue->handle = xQueueCreate( queue_len, item_size);
+    assert(queue->handle);
 #endif
+
+    return queue;
 }
 
 static void queue_delete_wrapper(void *queue)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
-    vQueueDelete(queue);
-#else
-    btdm_queue_item_t item = {
-        .handle = queue,
-        .storage = NULL,
-        .buffer = NULL,
-    };
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+    if (queue_item) {
+        if(queue_item->handle){
+            vQueueDelete(queue_item->handle);
+        }
 
-    if (btdm_queue_generic_deregister(&item)) {
-        vQueueDelete(item.handle);
-        free(item.storage);
-        free(item.buffer);
-    }
-
-    return;
+#if CONFIG_SPIRAM_USE_MALLOC
+        if (queue_item->storage) {
+            free(queue_item->storage);
+        }
 #endif
+
+        free(queue_item);
+    }
 }
 
 static int32_t queue_send_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueSend(queue, item, portMAX_DELAY);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
     } else {
-        return (int32_t)xQueueSend(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
     }
 }
 
 static int32_t IRAM_ATTR queue_send_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueSendFromISR(queue, item, hptw);
+    return (int32_t)xQueueSendFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }
 
 static int32_t queue_recv_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueReceive(queue, item, portMAX_DELAY);
+        return (int32_t)xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
     } else {
-        return (int32_t)xQueueReceive(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
     }
 }
 
 static int32_t IRAM_ATTR queue_recv_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueReceiveFromISR(queue, item, hptw);
+    return (int32_t)xQueueReceiveFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }
 
 static int32_t task_create_wrapper(void *task_func, const char *name, uint32_t stack_depth, void *param, uint32_t prio, void *task_handle, uint32_t core_id)
@@ -887,8 +739,7 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
 static void btdm_sleep_enter_phase2_wrapper(void)
 {
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_enter(MODEM_BLE_MODULE);
-        esp_modem_sleep_enter(MODEM_CLASSIC_BT_MODULE);
+        esp_phy_disable();
 #ifdef CONFIG_PM_ENABLE
         if (s_pm_lock_acquired) {
             esp_pm_lock_release(s_pm_lock);
@@ -896,7 +747,7 @@ static void btdm_sleep_enter_phase2_wrapper(void)
         }
 #endif
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-        esp_modem_sleep_enter(MODEM_BLE_MODULE);
+        esp_phy_disable();
         // pause bluetooth baseband
         periph_module_disable(PERIPH_BT_BASEBAND_MODULE);
     }
@@ -912,8 +763,7 @@ static void btdm_sleep_exit_phase3_wrapper(void)
 #endif
 
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_exit(MODEM_BLE_MODULE);
-        esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
+        esp_phy_enable();
         btdm_check_and_init_bb();
 #ifdef CONFIG_PM_ENABLE
         esp_timer_stop(s_btdm_slp_tmr);
@@ -921,7 +771,7 @@ static void btdm_sleep_exit_phase3_wrapper(void)
     } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
         // resume bluetooth baseband
         periph_module_enable(PERIPH_BT_BASEBAND_MODULE);
-        esp_modem_sleep_exit(MODEM_BLE_MODULE);
+        esp_phy_enable();
     }
 }
 
@@ -1144,6 +994,30 @@ static int coex_register_wifi_channel_change_callback_wrapper(void *cb)
 #endif
 }
 
+static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    const char *ver_str = esp_coex_version_get();
+    if (ver_str != NULL) {
+        unsigned int _major = 0, _minor = 0, _patch = 0;
+        if (sscanf(ver_str, "%u.%u.%u", &_major, &_minor, &_patch) != 3) {
+            return -1;
+        }
+        if (major != NULL) {
+            *major = _major;
+        }
+        if (minor != NULL) {
+            *minor = _minor;
+        }
+        if (patch != NULL) {
+            *patch = _patch;
+        }
+        return 0;
+    }
+#endif
+    return -1;
+}
+
 bool esp_vhci_host_check_send_available(void)
 {
     return API_vhci_host_check_send_available();
@@ -1364,14 +1238,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     ESP_LOGI(BTDM_LOG_TAG, "BT controller compile version [%s]", btdm_controller_get_compile_version());
 
-#if CONFIG_SPIRAM_USE_MALLOC
-    btdm_queue_table_mux = xSemaphoreCreateMutex();
-    if (btdm_queue_table_mux == NULL) {
-        return ESP_ERR_NO_MEM;
-    }
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
-
     s_wakeup_req_sem = semphr_create_wrapper(1, 0);
     if (s_wakeup_req_sem == NULL) {
         err = ESP_ERR_NO_MEM;
@@ -1461,37 +1327,14 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
-    #ifdef CONFIG_BTDM_COEX_BLE_ADV_HIGH_PRIORITY
-        coex_ble_adv_priority_high_set(true);
-    #else
-        coex_ble_adv_priority_high_set(false);
-    #endif
-
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
 
 error:
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if (s_light_sleep_pm_lock != NULL) {
-            esp_pm_lock_delete(s_light_sleep_pm_lock);
-            s_light_sleep_pm_lock = NULL;
-        }
-    }
-    if (s_pm_lock != NULL) {
-        esp_pm_lock_delete(s_pm_lock);
-        s_pm_lock = NULL;
-    }
-    if (s_btdm_slp_tmr != NULL) {
-        esp_timer_delete(s_btdm_slp_tmr);
-        s_btdm_slp_tmr = NULL;
-    }
-#endif
-    if (s_wakeup_req_sem) {
-        semphr_delete_wrapper(s_wakeup_req_sem);
-        s_wakeup_req_sem = NULL;
-    }
+
+    bt_controller_deinit_internal();
+
     return err;
 }
 
@@ -1503,6 +1346,13 @@ esp_err_t esp_bt_controller_deinit(void)
 
     btdm_controller_deinit();
 
+    bt_controller_deinit_internal();
+
+    return ESP_OK;
+}
+
+static void bt_controller_deinit_internal(void)
+{
     periph_module_disable(PERIPH_BT_MODULE);
 
 #ifdef CONFIG_PM_ENABLE
@@ -1510,40 +1360,47 @@ esp_err_t esp_bt_controller_deinit(void)
         esp_pm_lock_delete(s_light_sleep_pm_lock);
         s_light_sleep_pm_lock = NULL;
     }
-    esp_timer_stop(s_btdm_slp_tmr);
-    esp_timer_delete(s_btdm_slp_tmr);
-    s_btdm_slp_tmr = NULL;
+
+    if (s_pm_lock != NULL) {
+        esp_pm_lock_delete(s_pm_lock);
+        s_pm_lock = NULL;
+    }
+
+    if (s_btdm_slp_tmr != NULL) {
+        esp_timer_stop(s_btdm_slp_tmr);
+        esp_timer_delete(s_btdm_slp_tmr);
+        s_btdm_slp_tmr = NULL;
+    }
+
     s_pm_lock_acquired = false;
 #endif
-    semphr_delete_wrapper(s_wakeup_req_sem);
-    s_wakeup_req_sem = NULL;
 
-#if CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(btdm_queue_table_mux);
-    btdm_queue_table_mux = NULL;
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
+    if (s_wakeup_req_sem) {
+        semphr_delete_wrapper(s_wakeup_req_sem);
+        s_wakeup_req_sem = NULL;
+    }
 
-    free(osi_funcs_p);
-    osi_funcs_p = NULL;
+    if (osi_funcs_p) {
+        free(osi_funcs_p);
+        osi_funcs_p = NULL;
+    }
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
     btdm_lpcycle_us = 0;
     btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
 
-    return ESP_OK;
 }
 
 static void bt_shutdown(void)
 {
-    esp_err_t ret = ESP_OK;
-    ESP_LOGD(BTDM_LOG_TAG, "stop Bluetooth");
-
-    ret = esp_bt_controller_disable();
-    if (ESP_OK != ret) {
-        ESP_LOGW(BTDM_LOG_TAG, "controller disable ret=%d", ret);
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return;
     }
+
+    esp_bt_controller_shutdown();
+    esp_phy_disable();
+
     return;
 }
 
@@ -1568,21 +1425,11 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     esp_pm_lock_acquire(s_pm_lock);
 #endif
 
-    esp_phy_load_cal_and_init(PHY_BT_MODULE);
+    esp_phy_enable();
 
-    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE) {
-        //Just register to sleep module, make the modem sleep modules check BT sleep status when sleep enter.
-        //Thus, it will prevent WIFI from disabling RF when BT is not in sleep but is using RF.
-        esp_modem_sleep_register(MODEM_BLE_MODULE);
-        esp_modem_sleep_register(MODEM_CLASSIC_BT_MODULE);
-        esp_modem_sleep_exit(MODEM_BLE_MODULE);
-        esp_modem_sleep_exit(MODEM_CLASSIC_BT_MODULE);
-    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_register(MODEM_BLE_MODULE);
-        esp_modem_sleep_register(MODEM_CLASSIC_BT_MODULE);
-    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-        esp_modem_sleep_register(MODEM_BLE_MODULE);
-    }
+#if CONFIG_ESP32_WIFI_SW_COEXIST_ENABLE
+    coex_init();
+#endif
 
     if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
         btdm_controller_enable_sleep(true);
@@ -1592,15 +1439,11 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     btdm_check_and_init_bb();
 
     ret = btdm_controller_enable(mode);
-    if (ret) {
-        if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE
-                || btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-            esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-            esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
-        } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-            esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-        }
-        esp_phy_rf_deinit(PHY_BT_MODULE);
+    if (ret != 0) {
+#if CONFIG_ESP32_WIFI_SW_COEXIST_ENABLE
+        coex_deinit();
+#endif
+        esp_phy_disable();
 #ifdef CONFIG_PM_ENABLE
         if (!s_btdm_allow_light_sleep) {
             esp_pm_lock_release(s_light_sleep_pm_lock);
@@ -1636,14 +1479,11 @@ esp_err_t esp_bt_controller_disable(void)
 
     btdm_controller_disable();
 
-    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_NONE
-            || btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-        esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
-    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-    }
-    esp_phy_rf_deinit(PHY_BT_MODULE);
+#if CONFIG_ESP32_WIFI_SW_COEXIST_ENABLE
+    coex_deinit();
+#endif
+
+    esp_phy_disable();
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
     esp_unregister_shutdown_handler(bt_shutdown);
 
@@ -1710,13 +1550,8 @@ esp_err_t esp_bt_sleep_enable (void)
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
-    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_register(MODEM_BLE_MODULE);
-        esp_modem_sleep_register(MODEM_CLASSIC_BT_MODULE);
-        btdm_controller_enable_sleep (true);
-        status = ESP_OK;
-    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-        esp_modem_sleep_register(MODEM_BLE_MODULE);
+    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG ||
+            btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
         btdm_controller_enable_sleep (true);
         status = ESP_OK;
     } else {
@@ -1732,13 +1567,8 @@ esp_err_t esp_bt_sleep_disable (void)
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
-    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG) {
-        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
-        esp_modem_sleep_deregister(MODEM_CLASSIC_BT_MODULE);
-        btdm_controller_enable_sleep (false);
-        status = ESP_OK;
-    } else if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
-        esp_modem_sleep_deregister(MODEM_BLE_MODULE);
+    if (btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_ORIG ||
+            btdm_controller_get_sleep_mode() == BTDM_MODEM_SLEEP_MODE_EVED) {
         btdm_controller_enable_sleep (false);
         status = ESP_OK;
     } else {

components/bt/esp_ble_mesh/Kconfig.in

@@ -265,6 +265,19 @@ if BLE_MESH
             advertising bearer. This option should be enabled if PB-ADV is
             going to be used during provisioning procedure.
 
+    config BLE_MESH_UNPROVISIONED_BEACON_INTERVAL
+        int "Interval between two consecutive Unprovisioned Device Beacon"
+        depends on BLE_MESH_NODE && BLE_MESH_PB_ADV
+        default 5
+        default 3 if BLE_MESH_FAST_PROV
+        range 1 100
+        help
+            This option specifies the interval of sending two consecutive unprovisioned
+            device beacon, users can use this option to change the frequency of sending
+            unprovisioned device beacon. For example, if the value is 5, it means the
+            unprovisioned device beacon will send every 5 seconds. When the option of
+            BLE_MESH_FAST_PROV is selected, the value is better to be 3 seconds, or less.
+
     config BLE_MESH_PB_GATT
         bool "Provisioning support using GATT (PB-GATT)"
         select BLE_MESH_PROXY
@@ -565,6 +578,21 @@ if BLE_MESH
             stored to flash. E.g. the default value of 4 means that the
             state is saved every 24 hours (96 / 4).
 
+    config BLE_MESH_IVU_RECOVERY_IVI
+        bool "Recovery the IV index when the latest whole IV update procedure is missed"
+        default n
+        help
+            According to Section 3.10.5 of Mesh Specification v1.0.1.
+            If a node in Normal Operation receives a Secure Network beacon with an IV index
+            equal to the last known IV index+1 and the IV Update Flag set to 0, the node may
+            update its IV without going to the IV Update in Progress state, or it may initiate
+            an IV Index Recovery procedure (Section 3.10.6), or it may ignore the Secure
+            Network beacon. The node makes the choice depending on the time since last IV
+            update and the likelihood that the node has missed the Secure Network beacons
+            with the IV update Flag.
+            When the above situation is encountered, this option can be used to decide whether
+            to perform the IV index recovery procedure.
+
     config BLE_MESH_TX_SEG_MSG_COUNT
         int "Maximum number of simultaneous outgoing segmented messages"
         default 1
@@ -783,6 +811,13 @@ if BLE_MESH
             help
                 Maximum number of groups to which the LPN can subscribe.
 
+        config BLE_MESH_LPN_SUB_ALL_NODES_ADDR
+            bool "Automatically subscribe all nodes address"
+            default n
+            help
+                Automatically subscribe all nodes address when friendship
+                established.
+
     endif # BLE_MESH_LOW_POWER
 
     config BLE_MESH_FRIEND
@@ -1074,6 +1109,13 @@ if BLE_MESH
             lets the state to be changed at any time.
             If IV Update test mode is going to be used, this option should be enabled.
 
+    config BLE_MESH_DISCARD_OLD_SEQ_AUTH
+        bool
+        default y
+        help
+            This option is used to decide whether discarding the old SeqAuth when
+            receiving a segmented message.
+
     menu "BLE Mesh specific test option"
 
         config BLE_MESH_SELF_TEST

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c

@@ -51,7 +51,7 @@ esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t
         memcpy(&arg.start_ble_adv.data, data, sizeof(esp_ble_mesh_ble_adv_data_t));
     }
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -72,7 +72,7 @@ esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index)
 
     arg.stop_ble_adv.index = index;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */
@@ -89,7 +89,7 @@ esp_err_t esp_ble_mesh_start_ble_scanning(esp_ble_mesh_ble_scan_param_t *param)
     msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
     msg.act = BTC_BLE_MESH_ACT_START_BLE_SCAN;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -104,7 +104,7 @@ esp_err_t esp_ble_mesh_stop_ble_scanning(void)
     msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
     msg.act = BTC_BLE_MESH_ACT_STOP_BLE_SCAN;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c

@@ -55,7 +55,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_MESH_INIT;
 
-    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL) != BT_STATUS_SUCCESS) {
+    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL) != BT_STATUS_SUCCESS) {
         vSemaphoreDelete(semaphore);
         BT_ERR("Failed to start mesh init");
         return ESP_FAIL;
@@ -87,7 +87,7 @@ esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_DEINIT_MESH;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_DEINIT */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c

@@ -100,7 +100,7 @@ esp_err_t esp_ble_mesh_model_subscribe_group_addr(uint16_t element_addr, uint16_
     arg.model_sub_group_addr.model_id = model_id;
     arg.model_sub_group_addr.group_addr = group_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -126,7 +126,7 @@ esp_err_t esp_ble_mesh_model_unsubscribe_group_addr(uint16_t element_addr, uint1
     arg.model_unsub_group_addr.model_id = model_id;
     arg.model_unsub_group_addr.group_addr = group_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -160,7 +160,7 @@ esp_err_t esp_ble_mesh_node_add_local_net_key(const uint8_t net_key[16], uint16_
     arg.node_add_local_net_key.net_idx = net_idx;
     memcpy(arg.node_add_local_net_key.net_key, net_key, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -183,7 +183,7 @@ esp_err_t esp_ble_mesh_node_add_local_app_key(const uint8_t app_key[16], uint16_
     arg.node_add_local_app_key.app_idx = app_idx;
     memcpy(arg.node_add_local_app_key.app_key, app_key, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -208,7 +208,7 @@ esp_err_t esp_ble_mesh_node_bind_app_key_to_local_model(uint16_t element_addr, u
     arg.node_local_mod_app_bind.company_id = company_id;
     arg.node_local_mod_app_bind.app_idx = app_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c

@@ -29,7 +29,7 @@ esp_err_t esp_ble_mesh_lpn_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_lpn_disable(bool force)
@@ -45,7 +45,7 @@ esp_err_t esp_ble_mesh_lpn_disable(bool force)
 
     arg.lpn_disable.force = force;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -59,5 +59,5 @@ esp_err_t esp_ble_mesh_lpn_poll(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_POLL;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c

@@ -109,8 +109,8 @@ static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
         arg.model_send.msg_timeout = msg_timeout;
     }
 
-    status = (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy)
-              == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    status = (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy,
+                btc_ble_mesh_model_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 
     bt_mesh_free(msg_data);
 
@@ -244,8 +244,8 @@ esp_err_t esp_ble_mesh_server_model_update_state(esp_ble_mesh_model_t *model,
     msg.pid = BTC_PID_MODEL;
     msg.act = BTC_BLE_MESH_ACT_SERVER_MODEL_UPDATE_STATE;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy,
+                btc_ble_mesh_model_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SERVER_MODEL */
 
@@ -259,7 +259,7 @@ esp_err_t esp_ble_mesh_node_local_reset(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_NODE_RESET;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 #if (CONFIG_BLE_MESH_PROVISIONER)
@@ -283,7 +283,7 @@ esp_err_t esp_ble_mesh_provisioner_set_node_name(uint16_t index, const char *nam
     memset(arg.set_node_name.name, 0, sizeof(arg.set_node_name.name));
     strncpy(arg.set_node_name.name, name, ESP_BLE_MESH_NODE_NAME_MAX_LEN);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -320,8 +320,8 @@ esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr,
     arg.store_node_comp_data.unicast_addr = unicast_addr;
     arg.store_node_comp_data.length = length;
     arg.store_node_comp_data.data = data;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_uuid(const uint8_t uuid[16])
@@ -378,7 +378,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_node_with_uuid(const uint8_t uuid[16])
 
     memcpy(arg.delete_node_with_uuid.uuid, uuid, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -399,7 +399,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_node_with_addr(uint16_t unicast_addr)
 
     arg.delete_node_with_addr.unicast_addr = unicast_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -422,7 +422,7 @@ esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16],
     } else {
         bzero(arg.add_local_app_key.app_key, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -445,7 +445,7 @@ esp_err_t esp_ble_mesh_provisioner_update_local_app_key(const uint8_t app_key[16
     memcpy(arg.update_local_app_key.app_key, app_key, 16);
     arg.update_local_app_key.net_idx = net_idx;
     arg.update_local_app_key.app_idx = app_idx;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -474,7 +474,7 @@ esp_err_t esp_ble_mesh_provisioner_bind_app_key_to_local_model(uint16_t element_
     arg.local_mod_app_bind.app_idx = app_idx;
     arg.local_mod_app_bind.model_id = model_id;
     arg.local_mod_app_bind.cid = company_id;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -499,7 +499,7 @@ esp_err_t esp_ble_mesh_provisioner_add_local_net_key(const uint8_t net_key[16],
     } else {
         bzero(arg.add_local_net_key.net_key, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -520,7 +520,7 @@ esp_err_t esp_ble_mesh_provisioner_update_local_net_key(const uint8_t net_key[16
 
     memcpy(arg.update_local_net_key.net_key, net_key, 16);
     arg.update_local_net_key.net_idx = net_idx;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -543,7 +543,7 @@ esp_err_t esp_ble_mesh_provisioner_recv_heartbeat(bool enable)
 
     arg.enable_heartbeat_recv.enable = enable;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -564,7 +564,7 @@ esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_type(uint8_t type)
 
     arg.set_heartbeat_filter_type.type = type;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -593,7 +593,7 @@ esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_info(uint8_t op, esp_ble
     arg.set_heartbeat_filter_info.hb_src = info->hb_src;
     arg.set_heartbeat_filter_info.hb_dst = info->hb_dst;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_PROVISIONER_RECV_HB */
@@ -610,7 +610,7 @@ esp_err_t esp_ble_mesh_provisioner_direct_erase_settings(void)
 
     msg.act = BTC_BLE_MESH_ACT_PROVISIONER_DIRECT_ERASE_SETTINGS;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL)
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SETTINGS */
@@ -633,7 +633,7 @@ esp_err_t esp_ble_mesh_provisioner_open_settings_with_index(uint8_t index)
 
     arg.open_settings_with_index.index = index;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -654,7 +654,7 @@ esp_err_t esp_ble_mesh_provisioner_open_settings_with_uid(const char *uid)
 
     strncpy(arg.open_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -676,7 +676,7 @@ esp_err_t esp_ble_mesh_provisioner_close_settings_with_index(uint8_t index, bool
     arg.close_settings_with_index.index = index;
     arg.close_settings_with_index.erase = erase;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -698,7 +698,7 @@ esp_err_t esp_ble_mesh_provisioner_close_settings_with_uid(const char *uid, bool
     strncpy(arg.close_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
     arg.close_settings_with_uid.erase = erase;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -719,7 +719,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_settings_with_index(uint8_t index)
 
     arg.delete_settings_with_index.index = index;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -740,7 +740,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_settings_with_uid(const char *uid)
 
     strncpy(arg.delete_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c

@@ -65,7 +65,7 @@ esp_err_t esp_ble_mesh_node_prov_enable(esp_ble_mesh_prov_bearer_t bearers)
     msg.act = BTC_BLE_MESH_ACT_PROV_ENABLE;
     arg.node_prov_enable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -85,7 +85,7 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers)
     msg.act = BTC_BLE_MESH_ACT_PROV_DISABLE;
     arg.node_prov_disable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -109,7 +109,7 @@ esp_err_t esp_ble_mesh_node_set_oob_pub_key(uint8_t pub_key_x[32], uint8_t pub_k
     memcpy(arg.set_oob_pub_key.pub_key_y, pub_key_y, 32);
     memcpy(arg.set_oob_pub_key.private_key, private_key, 32);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -129,7 +129,7 @@ esp_err_t esp_ble_mesh_node_input_number(uint32_t number)
     msg.act = BTC_BLE_MESH_ACT_INPUT_NUMBER;
     arg.input_number.number = number;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -151,7 +151,7 @@ esp_err_t esp_ble_mesh_node_input_string(const char *string)
     strncpy(arg.input_string.string, string,
         MIN(strlen(string), sizeof(arg.input_string.string)));
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -173,7 +173,7 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name)
     memset(arg.set_device_name.name, 0, sizeof(arg.set_device_name.name));
     strncpy(arg.set_device_name.name, name, ESP_BLE_MESH_DEVICE_NAME_MAX_LEN);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -198,7 +198,7 @@ esp_err_t esp_ble_mesh_provisioner_read_oob_pub_key(uint8_t link_idx, uint8_t pu
     memcpy(arg.provisioner_read_oob_pub_key.pub_key_x, pub_key_x, 32);
     memcpy(arg.provisioner_read_oob_pub_key.pub_key_y, pub_key_y, 32);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -223,7 +223,7 @@ esp_err_t esp_ble_mesh_provisioner_input_string(const char *string, uint8_t link
         MIN(strlen(string), sizeof(arg.provisioner_input_str.string)));
     arg.provisioner_input_str.link_idx = link_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -245,7 +245,7 @@ esp_err_t esp_ble_mesh_provisioner_input_number(uint32_t number, uint8_t link_id
     arg.provisioner_input_num.number = number;
     arg.provisioner_input_num.link_idx = link_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -266,7 +266,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_enable(esp_ble_mesh_prov_bearer_t bearer
 
     arg.provisioner_enable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -287,7 +287,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_disable(esp_ble_mesh_prov_bearer_t beare
 
     arg.provisioner_disable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -313,7 +313,7 @@ esp_err_t esp_ble_mesh_provisioner_add_unprov_dev(esp_ble_mesh_unprov_dev_add_t
     memcpy(arg.provisioner_dev_add.add_dev.addr, add_dev->addr, sizeof(esp_ble_mesh_bd_addr_t));
     memcpy(arg.provisioner_dev_add.add_dev.uuid, add_dev->uuid, 16);
     arg.provisioner_dev_add.flags = flags;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -347,7 +347,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_device_with_addr(const uint8_t uuid[16],
     arg.provisioner_prov_dev_with_addr.bearer = bearer;
     arg.provisioner_prov_dev_with_addr.oob_info = oob_info;
     arg.provisioner_prov_dev_with_addr.unicast_addr = unicast_addr;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -374,7 +374,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_dev(esp_ble_mesh_device_delete_t *del_
     } else if (del_dev->flag & DEL_DEV_UUID_FLAG) {
         memcpy(arg.provisioner_dev_del.del_dev.uuid, del_dev->uuid, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -400,7 +400,7 @@ esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val,
     arg.set_dev_uuid_match.match_len = match_len;
     arg.set_dev_uuid_match.offset = offset;
     arg.set_dev_uuid_match.prov_after_match = prov_after_match;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -428,7 +428,7 @@ esp_err_t esp_ble_mesh_provisioner_set_prov_data_info(esp_ble_mesh_prov_data_inf
     } else if (prov_data_info->flag & PROV_DATA_IV_INDEX_FLAG) {
         arg.set_prov_data_info.prov_data.iv_index = prov_data_info->iv_index;
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -449,7 +449,7 @@ esp_err_t esp_ble_mesh_provisioner_set_static_oob_value(const uint8_t *value, ui
 
     arg.set_static_oob_val.length = length;
     memcpy(arg.set_static_oob_val.value, value, length);
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -469,7 +469,7 @@ esp_err_t esp_ble_mesh_provisioner_set_primary_elem_addr(uint16_t addr)
     msg.act = BTC_BLE_MESH_ACT_PROVISIONER_SET_PRIMARY_ELEM_ADDR;
 
     arg.set_primary_elem_addr.addr = addr;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -505,7 +505,7 @@ esp_err_t esp_ble_mesh_set_fast_prov_info(esp_ble_mesh_fast_prov_info_t *fast_pr
     if (fast_prov_info->match_len && fast_prov_info->match_val) {
         memcpy(arg.set_fast_prov_info.match_val, fast_prov_info->match_val, fast_prov_info->match_len);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -525,7 +525,7 @@ esp_err_t esp_ble_mesh_set_fast_prov_action(esp_ble_mesh_fast_prov_action_t acti
     msg.act = BTC_BLE_MESH_ACT_SET_FAST_PROV_ACTION;
 
     arg.set_fast_prov_action.action = action;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c

@@ -30,7 +30,7 @@ esp_err_t esp_ble_mesh_proxy_identity_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_IDENTITY_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_gatt_enable(void)
@@ -43,7 +43,7 @@ esp_err_t esp_ble_mesh_proxy_gatt_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_GATT_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
@@ -56,7 +56,7 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_GATT_DISABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
@@ -80,7 +80,7 @@ esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
     arg.proxy_client_connect.addr_type = addr_type;
     arg.proxy_client_connect.net_idx = net_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -97,7 +97,7 @@ esp_err_t esp_ble_mesh_proxy_client_disconnect(uint8_t conn_handle)
 
     arg.proxy_client_disconnect.conn_handle = conn_handle;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -121,7 +121,7 @@ esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle, uint16_
     arg.proxy_client_set_filter_type.net_idx = net_idx;
     arg.proxy_client_set_filter_type.filter_type = filter_type;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -146,8 +146,8 @@ esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle, uint16_
     arg.proxy_client_add_filter_addr.addr_num = addr_num;
     arg.proxy_client_add_filter_addr.addr = addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle, uint16_t net_idx,
@@ -171,6 +171,6 @@ esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle, uint
     arg.proxy_client_remove_filter_addr.addr_num = addr_num;
     arg.proxy_client_remove_filter_addr.addr = addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_provisioning_api.h

@@ -69,6 +69,12 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers);
 /**
  * @brief        Unprovisioned device set own oob public key & private key pair.
  *
+ * @note         In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+ *               The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+ *               use an out-of-band mechanism to exchange the public keys.
+ *               So as an unprovisioned device, it should use this function to input
+ *               the Public Key exchanged through the out-of-band mechanism.
+ *
  * @param[in]    pub_key_x:   Unprovisioned device's Public Key X
  * @param[in]    pub_key_y:   Unprovisioned device's Public Key Y
  * @param[in]    private_key: Unprovisioned device's Private Key
@@ -121,6 +127,10 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name);
 /**
  * @brief        Provisioner inputs unprovisioned device's oob public key.
  *
+ * @note         In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+ *               The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+ *               use an out-of-band mechanism to exchange the public keys.
+ *
  * @param[in]    link_idx:   The provisioning link index
  * @param[in]    pub_key_x:  Unprovisioned device's Public Key X
  * @param[in]    pub_key_y:  Unprovisioned device's Public Key Y
@@ -324,6 +334,19 @@ esp_err_t esp_ble_mesh_provisioner_set_prov_data_info(esp_ble_mesh_prov_data_inf
 /**
  * @brief         This function is called by Provisioner to set static oob value used for provisioning.
  *
+ * @note          The Bluetooth SIG recommends that mesh implementations enforce a randomly selected
+ *                AuthValue using all of the available bits, where permitted by the implementation.
+ *                A large entropy helps ensure that a brute-force of the AuthValue, even a static
+ *                AuthValue, cannot normally be completed in a reasonable time (CVE-2020-26557).
+ *
+ *                AuthValues selected using a cryptographically secure random or pseudorandom number
+ *                generator and having the maximum permitted entropy (128-bits) will be most difficult
+ *                to brute-force. AuthValues with reduced entropy or generated in a predictable manner
+ *                will not grant the same level of protection against this vulnerability. Selecting a
+ *                new AuthValue with each provisioning attempt can also make it more difficult to launch
+ *                a brute-force attack by requiring the attacker to restart the search with each
+ *                provisioning attempt (CVE-2020-26556).
+ *
  * @param[in]     value:  Pointer to the static oob value.
  * @param[in]     length: Length of the static oob value.
  *

components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h

@@ -582,6 +582,12 @@ typedef struct {
     /** Out of Band information field. */
     esp_ble_mesh_prov_oob_info_t oob_info;
 
+    /* NOTE: In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+     * The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+     * support an out-of-band mechanism to exchange the public keys.
+     * So as an unprovisioned device, it should enable this flag to support
+     * using an out-of-band mechanism to exchange Public Key.
+     */
     /** Flag indicates whether unprovisioned devices support OOB public key */
     bool oob_pub_key;
 
@@ -635,12 +641,29 @@ typedef struct {
     /** Provisioning Algorithm for the Provisioner */
     uint8_t        prov_algorithm;
 
+    /* NOTE: In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+     * The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+     * use an out-of-band mechanism to exchange the public keys.
+     */
     /** Provisioner public key oob */
     uint8_t        prov_pub_key_oob;
 
     /** Callback used to notify to set device OOB Public Key. Initialized by the stack. */
     esp_ble_mesh_cb_t provisioner_prov_read_oob_pub_key;
 
+    /* NOTE: The Bluetooth SIG recommends that mesh implementations enforce a randomly
+     * selected AuthValue using all of the available bits, where permitted by the
+     * implementation. A large entropy helps ensure that a brute-force of the AuthValue,
+     * even a static AuthValue, cannot normally be completed in a reasonable time (CVE-2020-26557).
+     *
+     * AuthValues selected using a cryptographically secure random or pseudorandom number
+     * generator and having the maximum permitted entropy (128-bits) will be most difficult
+     * to brute-force. AuthValues with reduced entropy or generated in a predictable manner
+     * will not grant the same level of protection against this vulnerability. Selecting a
+     * new AuthValue with each provisioning attempt can also make it more difficult to launch
+     * a brute-force attack by requiring the attacker to restart the search with each
+     * provisioning attempt (CVE-2020-26556).
+     */
     /** Provisioner static oob value */
     uint8_t        *prov_static_oob_val;
     /** Provisioner static oob value length */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_config_model_api.c

@@ -67,8 +67,8 @@ esp_err_t esp_ble_mesh_config_client_get_state(esp_ble_mesh_client_common_param_
     arg.cfg_client_get_state.params = params;
     arg.cfg_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy,
+                btc_ble_mesh_config_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_config_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -92,8 +92,8 @@ esp_err_t esp_ble_mesh_config_client_set_state(esp_ble_mesh_client_common_param_
     arg.cfg_client_set_state.params = params;
     arg.cfg_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy,
+                btc_ble_mesh_config_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_CFG_CLI */
 

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_generic_model_api.c

@@ -62,8 +62,8 @@ esp_err_t esp_ble_mesh_generic_client_get_state(esp_ble_mesh_client_common_param
     arg.generic_client_get_state.params = params;
     arg.generic_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy,
+                btc_ble_mesh_generic_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_generic_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -87,8 +87,8 @@ esp_err_t esp_ble_mesh_generic_client_set_state(esp_ble_mesh_client_common_param
     arg.generic_client_set_state.params = params;
     arg.generic_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy,
+                btc_ble_mesh_generic_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_GENERIC_CLIENT */
 

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_health_model_api.c

@@ -49,8 +49,8 @@ esp_err_t esp_ble_mesh_health_client_get_state(esp_ble_mesh_client_common_param_
     arg.health_client_get_state.params = params;
     arg.health_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy,
+                btc_ble_mesh_health_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_health_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -74,8 +74,8 @@ esp_err_t esp_ble_mesh_health_client_set_state(esp_ble_mesh_client_common_param_
     arg.health_client_set_state.params = params;
     arg.health_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy,
+                btc_ble_mesh_health_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_HEALTH_CLI */
 
@@ -103,7 +103,7 @@ esp_err_t esp_ble_mesh_health_server_fault_update(esp_ble_mesh_elem_t *element)
     msg.act = BTC_BLE_MESH_ACT_HEALTH_SERVER_FAULT_UPDATE;
     arg.health_fault_update.element = element;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_server_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_server_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_HEALTH_SRV */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_lighting_model_api.c

@@ -49,8 +49,8 @@ esp_err_t esp_ble_mesh_light_client_get_state(esp_ble_mesh_client_common_param_t
     arg.light_client_get_state.params = params;
     arg.light_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy,
+                btc_ble_mesh_lighting_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_light_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -74,8 +74,8 @@ esp_err_t esp_ble_mesh_light_client_set_state(esp_ble_mesh_client_common_param_t
     arg.light_client_set_state.params = params;
     arg.light_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy,
+                btc_ble_mesh_lighting_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_LIGHTING_CLIENT */
 

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_sensor_model_api.c

@@ -48,8 +48,8 @@ esp_err_t esp_ble_mesh_sensor_client_get_state(esp_ble_mesh_client_common_param_
     arg.sensor_client_get_state.params = params;
     arg.sensor_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy,
+                btc_ble_mesh_sensor_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_sensor_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -73,8 +73,8 @@ esp_err_t esp_ble_mesh_sensor_client_set_state(esp_ble_mesh_client_common_param_
     arg.sensor_client_set_state.params = params;
     arg.sensor_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy,
+                btc_ble_mesh_sensor_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SENSOR_CLI */
 

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_time_scene_model_api.c

@@ -49,8 +49,8 @@ esp_err_t esp_ble_mesh_time_scene_client_get_state(esp_ble_mesh_client_common_pa
     arg.time_scene_client_get_state.params = params;
     arg.time_scene_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy,
+                btc_ble_mesh_time_scene_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_time_scene_client_set_state(esp_ble_mesh_client_common_param_t *params,
@@ -74,8 +74,8 @@ esp_err_t esp_ble_mesh_time_scene_client_set_state(esp_ble_mesh_client_common_pa
     arg.time_scene_client_set_state.params = params;
     arg.time_scene_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy,
+                btc_ble_mesh_time_scene_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_TIME_SCENE_CLIENT */
 

components/bt/esp_ble_mesh/btc/btc_ble_mesh_ble.c

@@ -90,8 +90,8 @@ static void btc_ble_mesh_ble_callback(esp_ble_mesh_ble_cb_param_t *cb_params, ui
     msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_ble_cb_param_t),
-                         btc_ble_mesh_ble_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_ble_cb_param_t),
+                         btc_ble_mesh_ble_copy_req_data, btc_ble_mesh_ble_free_req_data);
 }
 
 #if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN

components/bt/esp_ble_mesh/btc/btc_ble_mesh_config_model.c

@@ -91,7 +91,7 @@ void btc_ble_mesh_config_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void
     }
 }
 
-static void btc_ble_mesh_config_client_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_config_client_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_config_client_args_t *arg = NULL;
 
@@ -306,8 +306,8 @@ static void btc_ble_mesh_config_client_callback(esp_ble_mesh_cfg_client_cb_param
     msg.pid = BTC_PID_CONFIG_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_cfg_client_cb_param_t),
-                         btc_ble_mesh_config_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_cfg_client_cb_param_t),
+                         btc_ble_mesh_config_client_copy_req_data, btc_ble_mesh_config_client_free_req_data);
 }
 
 void bt_mesh_config_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -710,7 +710,7 @@ static void btc_ble_mesh_config_server_callback(esp_ble_mesh_cfg_server_cb_param
     msg.pid = BTC_PID_CONFIG_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_cfg_server_cb_param_t), NULL);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_cfg_server_cb_param_t), NULL, NULL);
 }
 
 void bt_mesh_config_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,

components/bt/esp_ble_mesh/btc/btc_ble_mesh_generic_model.c

@@ -115,7 +115,7 @@ void btc_ble_mesh_generic_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, voi
     }
 }
 
-static void btc_ble_mesh_generic_client_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_generic_client_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_generic_client_args_t *arg = NULL;
 
@@ -376,8 +376,8 @@ static void btc_ble_mesh_generic_client_callback(esp_ble_mesh_generic_client_cb_
     msg.pid = BTC_PID_GENERIC_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_generic_client_cb_param_t),
-                         btc_ble_mesh_generic_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_generic_client_cb_param_t),
+                         btc_ble_mesh_generic_client_copy_req_data, btc_ble_mesh_generic_client_free_req_data);
 }
 
 void bt_mesh_generic_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -693,8 +693,8 @@ static void btc_ble_mesh_generic_server_callback(esp_ble_mesh_generic_server_cb_
     msg.pid = BTC_PID_GENERIC_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_generic_server_cb_param_t),
-                         btc_ble_mesh_generic_server_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_generic_server_cb_param_t),
+                         btc_ble_mesh_generic_server_copy_req_data, btc_ble_mesh_generic_server_free_req_data);
 }
 
 void bt_mesh_generic_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,

components/bt/esp_ble_mesh/btc/btc_ble_mesh_health_model.c

@@ -84,7 +84,7 @@ void btc_ble_mesh_health_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void
     }
 }
 
-static void btc_ble_mesh_health_client_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_health_client_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_health_client_args_t *arg = NULL;
 
@@ -239,8 +239,8 @@ static void btc_ble_mesh_health_client_callback(esp_ble_mesh_health_client_cb_pa
     msg.pid = BTC_PID_HEALTH_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_health_client_cb_param_t),
-                         btc_ble_mesh_health_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_health_client_cb_param_t),
+                         btc_ble_mesh_health_client_copy_req_data, btc_ble_mesh_health_client_free_req_data);
 }
 
 void bt_mesh_health_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -550,8 +550,8 @@ static void btc_ble_mesh_health_server_callback(esp_ble_mesh_health_server_cb_pa
     msg.pid = BTC_PID_HEALTH_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_health_server_cb_param_t),
-                         btc_ble_mesh_health_server_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_health_server_cb_param_t),
+                         btc_ble_mesh_health_server_copy_req_data, btc_ble_mesh_health_server_free_req_data);
 }
 
 void btc_ble_mesh_health_server_call_handler(btc_msg_t *msg)

components/bt/esp_ble_mesh/btc/btc_ble_mesh_lighting_model.c

@@ -83,7 +83,7 @@ void btc_ble_mesh_lighting_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, vo
     }
 }
 
-static void btc_ble_mesh_lighting_client_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_lighting_client_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_lighting_client_args_t *arg = NULL;
 
@@ -220,8 +220,8 @@ static void btc_ble_mesh_lighting_client_callback(esp_ble_mesh_light_client_cb_p
     msg.pid = BTC_PID_LIGHTING_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_light_client_cb_param_t),
-                         btc_ble_mesh_lighting_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_light_client_cb_param_t),
+                         btc_ble_mesh_lighting_client_copy_req_data, btc_ble_mesh_lighting_client_free_req_data);
 }
 
 void bt_mesh_lighting_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -505,8 +505,8 @@ static void btc_ble_mesh_lighting_server_callback(esp_ble_mesh_lighting_server_c
     msg.pid = BTC_PID_LIGHTING_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_lighting_server_cb_param_t),
-                         btc_ble_mesh_lighting_server_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_lighting_server_cb_param_t),
+                         btc_ble_mesh_lighting_server_copy_req_data, btc_ble_mesh_lighting_server_free_req_data);
 }
 
 void bt_mesh_lighting_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,

components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c

@@ -128,7 +128,7 @@ void btc_ble_mesh_prov_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     }
 }
 
-static void btc_ble_mesh_prov_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_prov_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_prov_args_t *arg = NULL;
 
@@ -204,7 +204,7 @@ void btc_ble_mesh_model_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     }
 }
 
-static void btc_ble_mesh_model_arg_deep_free(btc_msg_t *msg)
+void btc_ble_mesh_model_arg_deep_free(btc_msg_t *msg)
 {
     btc_ble_mesh_model_args_t *arg = NULL;
 
@@ -376,8 +376,8 @@ static bt_status_t btc_ble_mesh_model_callback(esp_ble_mesh_model_cb_param_t *pa
     msg.pid = BTC_PID_MODEL;
     msg.act = act;
 
-    ret = btc_transfer_context(&msg, param, sizeof(esp_ble_mesh_model_cb_param_t),
-                               btc_ble_mesh_model_copy_req_data);
+    ret = btc_transfer_context(&msg, param, param == NULL ? 0 : sizeof(esp_ble_mesh_model_cb_param_t),
+                               btc_ble_mesh_model_copy_req_data, btc_ble_mesh_model_free_req_data);
     if (ret != BT_STATUS_SUCCESS) {
         BT_ERR("btc_transfer_context failed");
     }
@@ -536,7 +536,7 @@ static bt_status_t btc_ble_mesh_prov_callback(esp_ble_mesh_prov_cb_param_t *para
     msg.pid = BTC_PID_PROV;
     msg.act = act;
 
-    ret = btc_transfer_context(&msg, param, sizeof(esp_ble_mesh_prov_cb_param_t), NULL);
+    ret = btc_transfer_context(&msg, param, param == NULL ? 0 : sizeof(esp_ble_mesh_prov_cb_param_t), NULL, NULL);
     if (ret != BT_STATUS_SUCCESS) {
         BT_ERR("btc_transfer_context failed");
     }

components/bt/esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c

@@ -458,8 +458,8 @@ static void btc_ble_mesh_sensor_client_callback(esp_ble_mesh_sensor_client_cb_pa
     msg.pid = BTC_PID_SENSOR_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_sensor_client_cb_param_t),
-                         btc_ble_mesh_sensor_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_sensor_client_cb_param_t),
+                         btc_ble_mesh_sensor_client_copy_req_data, btc_ble_mesh_sensor_client_free_req_data);
 }
 
 void bt_mesh_sensor_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -825,8 +825,8 @@ static void btc_ble_mesh_sensor_server_callback(esp_ble_mesh_sensor_server_cb_pa
     msg.pid = BTC_PID_SENSOR_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_sensor_server_cb_param_t),
-                         btc_ble_mesh_sensor_server_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_sensor_server_cb_param_t),
+                         btc_ble_mesh_sensor_server_copy_req_data, btc_ble_mesh_sensor_server_free_req_data);
 }
 
 void bt_mesh_sensor_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,

components/bt/esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c

@@ -222,8 +222,8 @@ static void btc_ble_mesh_time_scene_client_callback(esp_ble_mesh_time_scene_clie
     msg.pid = BTC_PID_TIME_SCENE_CLIENT;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_time_scene_client_cb_param_t),
-                         btc_ble_mesh_time_scene_client_copy_req_data);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_time_scene_client_cb_param_t),
+                         btc_ble_mesh_time_scene_client_copy_req_data, btc_ble_mesh_time_scene_client_free_req_data);
 }
 
 void bt_mesh_time_scene_client_cb_evt_to_btc(uint32_t opcode, uint8_t evt_type,
@@ -409,7 +409,7 @@ static void btc_ble_mesh_time_scene_server_callback(esp_ble_mesh_time_scene_serv
     msg.pid = BTC_PID_TIME_SCENE_SERVER;
     msg.act = act;
 
-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_time_scene_server_cb_param_t), NULL);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_time_scene_server_cb_param_t), NULL, NULL);
 }
 
 void bt_mesh_time_scene_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_config_model.h

@@ -53,6 +53,8 @@ void btc_ble_mesh_config_client_cb_handler(btc_msg_t *msg);
 
 void btc_ble_mesh_config_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_config_client_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_config_client_publish_callback(uint32_t opcode, struct bt_mesh_model *model,
                                                  struct bt_mesh_msg_ctx *ctx,
                                                  struct net_buf_simple *buf);

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_generic_model.h

@@ -53,6 +53,8 @@ void btc_ble_mesh_generic_client_cb_handler(btc_msg_t *msg);
 
 void btc_ble_mesh_generic_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_generic_client_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_generic_client_publish_callback(uint32_t opcode, struct bt_mesh_model *model,
                                                   struct bt_mesh_msg_ctx *ctx,
                                                   struct net_buf_simple *buf);

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_health_model.h

@@ -49,6 +49,8 @@ typedef enum {
 
 void btc_ble_mesh_health_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_health_client_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_health_client_call_handler(btc_msg_t *msg);
 
 void btc_ble_mesh_health_client_cb_handler(btc_msg_t *msg);

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_lighting_model.h

@@ -53,6 +53,8 @@ void btc_ble_mesh_lighting_client_cb_handler(btc_msg_t *msg);
 
 void btc_ble_mesh_lighting_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_lighting_client_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_lighting_client_publish_callback(uint32_t opcode, struct bt_mesh_model *model,
                                                    struct bt_mesh_msg_ctx *ctx,
                                                    struct net_buf_simple *buf);

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h

@@ -344,8 +344,12 @@ typedef union {
 
 void btc_ble_mesh_prov_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_prov_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_model_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_model_arg_deep_free(btc_msg_t *msg);
+
 const uint8_t *btc_ble_mesh_node_get_local_net_key(uint16_t net_idx);
 
 const uint8_t *btc_ble_mesh_node_get_local_app_key(uint16_t app_idx);

components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_sensor_model.h

@@ -53,6 +53,8 @@ void btc_ble_mesh_sensor_client_cb_handler(btc_msg_t *msg);
 
 void btc_ble_mesh_sensor_client_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 
+void btc_ble_mesh_sensor_client_arg_deep_free(btc_msg_t *msg);
+
 void btc_ble_mesh_sensor_client_publish_callback(uint32_t opcode, struct bt_mesh_model *model,
                                                  struct bt_mesh_msg_ctx *ctx,
                                                  struct net_buf_simple *buf);

components/bt/esp_ble_mesh/mesh_core/beacon.c

@@ -22,11 +22,11 @@
 #include "provisioner_prov.h"
 #include "provisioner_main.h"
 
-#if defined(CONFIG_BLE_MESH_FAST_PROV)
-#define UNPROVISIONED_INTERVAL     K_SECONDS(3)
+#if defined(CONFIG_BLE_MESH_UNPROVISIONED_BEACON_INTERVAL)
+#define UNPROVISIONED_INTERVAL     K_SECONDS(CONFIG_BLE_MESH_UNPROVISIONED_BEACON_INTERVAL)
 #else
 #define UNPROVISIONED_INTERVAL     K_SECONDS(5)
-#endif /* CONFIG_BLE_MESH_FAST_PROV */
+#endif
 #define PROVISIONED_INTERVAL       K_SECONDS(10)
 
 #define BEACON_TYPE_UNPROVISIONED  0x00
@@ -374,9 +374,19 @@ static void secure_beacon_recv(struct net_buf_simple *buf)
 
     cache_add(data, sub);
 
-    /* If we have NetKey0 accept initiation only from it */
+    /* Spec v1.0.1, Section 3.8.4:
+     * If a node on a primary subnet receives an update on
+     * the primary subnet, it shall propagate the IV update
+     * to all other subnets. If a node on a primary subnet
+     * receives an IV update on any other subnet, the update
+     * shall be ignored.
+     * If a node on a primary subnet receives an key update
+     * on any other subnet, the update shall not be ignored.
+     */
     if (bt_mesh_primary_subnet_exist() &&
-            sub->net_idx != BLE_MESH_KEY_PRIMARY) {
+        sub->net_idx != BLE_MESH_KEY_PRIMARY &&
+        BLE_MESH_IV_UPDATE(flags) &&
+        !BLE_MESH_KEY_REFRESH(flags)) {
         BT_WARN("Ignoring secure beacon on non-primary subnet");
         goto update_stats;
     }
@@ -390,7 +400,15 @@ static void secure_beacon_recv(struct net_buf_simple *buf)
         bt_mesh_beacon_ivu_initiator(false);
     }
 
-    iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    /* If a node on a primary subnet receives an IV update on any other subnet,
+     * the IV update shall be ignored. And if a node on a non-primary subnet
+     * receives an IV update on primary subnet, the IV update shall be ignored,
+     * because it doesn't have a primary network key.
+     */
+    if ((bt_mesh_primary_subnet_exist() && sub->net_idx == BLE_MESH_KEY_PRIMARY) ||
+        (!bt_mesh_primary_subnet_exist() && sub->net_idx != BLE_MESH_KEY_PRIMARY)) {
+        iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    }
 
     kr_change = bt_mesh_kr_update(sub, BLE_MESH_KEY_REFRESH(flags), new_key);
     if (kr_change) {

components/bt/esp_ble_mesh/mesh_core/bluedroid_host/mesh_bearer_adapt.c

@@ -502,7 +502,7 @@ int bt_le_update_white_list(struct bt_mesh_white_list *wl)
     }
 
     if (BTM_BleUpdateAdvWhitelist(wl->add_remove, wl->remote_bda,
-            wl->addr_type, (tBTM_ADD_WHITELIST_CBACK *)wl->update_wl_comp_cb) == false) {
+            wl->addr_type, (tBTM_UPDATE_WHITELIST_CBACK *)wl->update_wl_comp_cb) == false) {
         return -EIO;
     }
 
@@ -1959,17 +1959,20 @@ int bt_mesh_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
 }
 
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
-int bt_mesh_update_exceptional_list(uint8_t sub_code, uint8_t type, void *info)
+int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
 {
     BD_ADDR value = {0};
 
-    if ((sub_code > BLE_MESH_EXCEP_LIST_CLEAN) ||
-            (type > BLE_MESH_EXCEP_INFO_MESH_PROXY_ADV)) {
+    if ((sub_code > BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN) ||
+        (sub_code < BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
+         type > BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV) ||
+        (sub_code == BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
+         !(type & BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST))) {
         BT_ERR("%s, Invalid parameter", __func__);
         return -EINVAL;
     }
 
-    if (type == BLE_MESH_EXCEP_INFO_MESH_LINK_ID) {
+    if (type == BLE_MESH_EXCEP_LIST_TYPE_MESH_LINK_ID) {
         if (!info) {
             BT_ERR("Invalid Provisioning Link ID");
             return -EINVAL;
@@ -1977,7 +1980,7 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint8_t type, void *info)
         sys_memcpy_swap(value, info, sizeof(uint32_t));
     }
 
-    BT_DBG("%s exceptional list, type 0x%02x", sub_code ? "Remove" : "Add", type);
+    BT_DBG("%s exceptional list, type 0x%08x", sub_code ? "Remove" : "Add", type);
 
     /* The parameter "device_info" can't be NULL in the API */
     BLE_MESH_BTM_CHECK_STATUS(BTM_UpdateBleDuplicateExceptionalList(sub_code, type, value, NULL));

components/bt/esp_ble_mesh/mesh_core/cfg_srv.c

@@ -197,6 +197,21 @@ static bool app_key_is_valid(uint16_t app_idx)
     return false;
 }
 
+static bool mod_pub_app_key_bound(struct bt_mesh_model *model,
+                                  uint16_t app_idx)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(model->keys); i++) {
+        if (model->keys[i] == app_idx) {
+            return true;
+        }
+    }
+
+    BT_ERR("Appkey(0x%02x) not bound to this model.", app_idx);
+    return false;
+}
+
 static uint8_t _mod_pub_set(struct bt_mesh_model *model, uint16_t pub_addr,
                             uint16_t app_idx, uint8_t cred_flag, uint8_t ttl, uint8_t period,
                             uint8_t retransmit, bool store)
@@ -237,7 +252,11 @@ static uint8_t _mod_pub_set(struct bt_mesh_model *model, uint16_t pub_addr,
         return STATUS_SUCCESS;
     }
 
-    if (!bt_mesh_app_key_find(app_idx)) {
+    /* For case MESH/NODE/CFG/MP/BI-03-C, need to check if appkey
+     * is bound to model identified by the ModelIdentifier.
+     */
+    if (!bt_mesh_app_key_find(app_idx) ||
+        !mod_pub_app_key_bound(model, app_idx)) {
         return STATUS_INVALID_APPKEY;
     }
 
@@ -2352,7 +2371,7 @@ send_status:
 
     if (status == STATUS_SUCCESS) {
         bt_mesh_cfg_server_state_change_t change = {0};
-        change.cfg_netkey_delete.net_idx = sub->net_idx;
+        change.cfg_netkey_delete.net_idx = sub ? sub->net_idx : BLE_MESH_KEY_UNUSED;
         bt_mesh_config_server_cb_evt_to_btc(BTC_BLE_MESH_EVT_CONFIG_SERVER_STATE_CHANGE,
                                             model, ctx, (const uint8_t *)&change, sizeof(change));
     }
@@ -3049,7 +3068,7 @@ static void heartbeat_pub_set(struct bt_mesh_model *model,
         goto failed;
     }
 
-    if (param->period_log > 0x10) {
+    if (param->period_log > 0x11) {
         status = STATUS_CANNOT_SET;
         goto failed;
     }
@@ -3202,19 +3221,18 @@ static void heartbeat_sub_set(struct bt_mesh_model *model,
     }
 
     if (sub_src == BLE_MESH_ADDR_UNASSIGNED ||
-            sub_dst == BLE_MESH_ADDR_UNASSIGNED ||
-            sub_period == 0x00) {
+        sub_dst == BLE_MESH_ADDR_UNASSIGNED ||
+        sub_period == 0x00) {
         /* Only an explicit address change to unassigned should
          * trigger clearing of the values according to
          * MESH/NODE/CFG/HBS/BV-02-C.
          */
         if (sub_src == BLE_MESH_ADDR_UNASSIGNED ||
-                sub_dst == BLE_MESH_ADDR_UNASSIGNED) {
+            sub_dst == BLE_MESH_ADDR_UNASSIGNED) {
             cfg->hb_sub.src = BLE_MESH_ADDR_UNASSIGNED;
             cfg->hb_sub.dst = BLE_MESH_ADDR_UNASSIGNED;
             cfg->hb_sub.min_hops = BLE_MESH_TTL_MAX;
             cfg->hb_sub.max_hops = 0U;
-            cfg->hb_sub.count = 0U;
         }
 
         period_ms = 0;
@@ -3240,6 +3258,11 @@ static void heartbeat_sub_set(struct bt_mesh_model *model,
 
     hb_sub_send_status(model, ctx, STATUS_SUCCESS);
 
+    /* For case MESH/NODE/CFG/HBS/BV-02-C, set count_log to 0
+     * when Heartbeat Subscription Status message is sent.
+     */
+    cfg->hb_sub.count = 0U;
+
     /* MESH/NODE/CFG/HBS/BV-01-C expects the MinHops to be 0x7f after
      * disabling subscription, but 0x00 for subsequent Get requests.
      */

components/bt/esp_ble_mesh/mesh_core/friend.c

@@ -64,6 +64,7 @@ enum {
 };
 
 static void (*friend_cb)(bool establish, uint16_t lpn_addr, uint8_t reason);
+static void enqueue_update(struct bt_mesh_friend *frnd, uint8_t md);
 
 static bool friend_init = false;
 
@@ -233,7 +234,23 @@ void bt_mesh_friend_sec_update(uint16_t net_idx)
         }
 
         if (net_idx == BLE_MESH_KEY_ANY || frnd->net_idx == net_idx) {
-            frnd->sec_update = 1U;
+            /* For case MESH/NODE/FRND/FN/BV-20-C.
+             * A situation is:
+             * The friend node may receive more than one different secure updates
+             * consecutively. And using the previous approach will cause only the
+             * latest Friend Update message been enqueued.
+             * So we update the implementation here to enqueue the Friend Update
+             * message immediately once a different secure beacon is received.
+             *
+             * A disadvantage of the change is:
+             * A friend node may receive different secure beacons. Then the
+             * beacon_cache mechanism will not work. This will cause the friend
+             * message queue been full of these secure beacons. So before enqueuing
+             * the secure updates, we should check if the currently received one
+             * is already exists in the message queue. Or enhance the beacon cache
+             * filtering mechanism.
+             */
+            enqueue_update(frnd, 1);
         }
     }
 }
@@ -699,7 +716,6 @@ static void enqueue_update(struct bt_mesh_friend *frnd, uint8_t md)
         return;
     }
 
-    frnd->sec_update = 0U;
     enqueue_buf(frnd, buf);
 }
 
@@ -1116,10 +1132,6 @@ static void enqueue_friend_pdu(struct bt_mesh_friend *frnd,
     BT_DBG("type %u", type);
 
     if (type == BLE_MESH_FRIEND_PDU_SINGLE) {
-        if (frnd->sec_update) {
-            enqueue_update(frnd, 1);
-        }
-
         enqueue_buf(frnd, buf);
         return;
     }
@@ -1136,10 +1148,6 @@ static void enqueue_friend_pdu(struct bt_mesh_friend *frnd,
     net_buf_slist_put(&seg->queue, buf);
 
     if (type == BLE_MESH_FRIEND_PDU_COMPLETE) {
-        if (frnd->sec_update) {
-            enqueue_update(frnd, 1);
-        }
-
         sys_slist_merge_slist(&frnd->queue, &seg->queue);
 
         frnd->queue_size += seg->seg_count;

components/bt/esp_ble_mesh/mesh_core/include/mesh_bearer_adapt.h

@@ -776,29 +776,28 @@ int bt_mesh_encrypt_be(const uint8_t key[16], const uint8_t plaintext[16],
                        uint8_t enc_data[16]);
 
 enum {
-    BLE_MESH_EXCEP_LIST_ADD = 0,
-    BLE_MESH_EXCEP_LIST_REMOVE,
-    BLE_MESH_EXCEP_LIST_CLEAN,
+    BLE_MESH_EXCEP_LIST_SUB_CODE_ADD = 0,
+    BLE_MESH_EXCEP_LIST_SUB_CODE_REMOVE,
+    BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN,
 };
 
 enum {
-    BLE_MESH_EXCEP_INFO_ADV_ADDR = 0,
-    BLE_MESH_EXCEP_INFO_MESH_LINK_ID,
-    BLE_MESH_EXCEP_INFO_MESH_BEACON,
-    BLE_MESH_EXCEP_INFO_MESH_PROV_ADV,
-    BLE_MESH_EXCEP_INFO_MESH_PROXY_ADV,
+    BLE_MESH_EXCEP_LIST_TYPE_ADV_ADDR = 0,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_LINK_ID,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV,
 };
 
-enum {
-    BLE_MESH_EXCEP_CLEAN_ADDR_LIST           = BIT(0),
-    BLE_MESH_EXCEP_CLEAN_MESH_LINK_ID_LIST   = BIT(1),
-    BLE_MESH_EXCEP_CLEAN_MESH_BEACON_LIST    = BIT(2),
-    BLE_MESH_EXCEP_CLEAN_MESH_PROV_ADV_LIST  = BIT(3),
-    BLE_MESH_EXCEP_CLEAN_MESH_PROXY_ADV_LIST = BIT(4),
-    BLE_MESH_EXCEP_CLEAN_ALL_LIST            = 0xFFFF,
-};
+#define BLE_MESH_EXCEP_LIST_CLEAN_ADDR_LIST              BIT(0)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_LINK_ID_LIST      BIT(1)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_BEACON_LIST       BIT(2)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROV_ADV_LIST     BIT(3)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROXY_ADV_LIST    BIT(4)
+#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | \
+                                                          BIT(2) | BIT(3) | BIT(4))
 
-int bt_mesh_update_exceptional_list(uint8_t sub_code, uint8_t type, void *info);
+int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info);
 
 #ifdef __cplusplus
 }

components/bt/esp_ble_mesh/mesh_core/main.c

@@ -78,6 +78,11 @@ int bt_mesh_provision(const uint8_t net_key[16], uint16_t net_idx,
 
     memcpy(bt_mesh.dev_key, dev_key, 16);
 
+    if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER) &&
+        IS_ENABLED(CONFIG_BLE_MESH_LPN_SUB_ALL_NODES_ADDR)) {
+        bt_mesh_lpn_group_add(BLE_MESH_ADDR_ALL_NODES);
+    }
+
     if (IS_ENABLED(CONFIG_BLE_MESH_SETTINGS)) {
         BT_DBG("Storing network information persistently");
         bt_mesh_store_net();
@@ -110,6 +115,12 @@ void bt_mesh_node_reset(void)
     bt_mesh_tx_reset();
 
     if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER)) {
+        if (IS_ENABLED(CONFIG_BLE_MESH_LPN_SUB_ALL_NODES_ADDR)) {
+            uint16_t group = BLE_MESH_ADDR_ALL_NODES;
+
+            bt_mesh_lpn_group_del(&group, 1);
+        }
+
         bt_mesh_lpn_disable(true);
     }
 
@@ -602,14 +613,14 @@ int bt_mesh_provisioner_enable(bt_mesh_prov_bearer_t bearers)
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
     if (IS_ENABLED(CONFIG_BLE_MESH_PB_ADV) &&
             (bearers & BLE_MESH_PROV_ADV)) {
-        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_ADD,
-                                        BLE_MESH_EXCEP_INFO_MESH_BEACON, NULL);
+        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_ADD,
+                                        BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON, NULL);
     }
 
     if (IS_ENABLED(CONFIG_BLE_MESH_PB_GATT) &&
             (bearers & BLE_MESH_PROV_GATT)) {
-        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_ADD,
-                                        BLE_MESH_EXCEP_INFO_MESH_PROV_ADV, NULL);
+        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_ADD,
+                                        BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV, NULL);
     }
 #endif
 
@@ -657,8 +668,8 @@ int bt_mesh_provisioner_disable(bt_mesh_prov_bearer_t bearers)
             (bearers & BLE_MESH_PROV_GATT)) {
         bt_mesh_proxy_client_prov_disable();
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
-        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_REMOVE,
-                                        BLE_MESH_EXCEP_INFO_MESH_PROV_ADV, NULL);
+        bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_REMOVE,
+                                        BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV, NULL);
 #endif
     }
 
@@ -669,8 +680,8 @@ int bt_mesh_provisioner_disable(bt_mesh_prov_bearer_t bearers)
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
         if (IS_ENABLED(CONFIG_BLE_MESH_PB_ADV) &&
                 (enable & BLE_MESH_PROV_ADV)) {
-            bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_REMOVE,
-                                            BLE_MESH_EXCEP_INFO_MESH_BEACON, NULL);
+            bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_REMOVE,
+                                            BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON, NULL);
         }
 #endif
 

components/bt/esp_ble_mesh/mesh_core/mesh.h

@@ -20,7 +20,7 @@ extern "C" {
 #define BLE_MESH_KEY_ANY                0xffff
 
 #define BLE_MESH_ADDR_IS_UNICAST(addr)  ((addr) && (addr) < 0x8000)
-#define BLE_MESH_ADDR_IS_GROUP(addr)    ((addr) >= 0xc000 && (addr) <= 0xff00)
+#define BLE_MESH_ADDR_IS_GROUP(addr)    ((addr) >= 0xc000 && (addr) < 0xff00)
 #define BLE_MESH_ADDR_IS_VIRTUAL(addr)  ((addr) >= 0x8000 && (addr) < 0xc000)
 #define BLE_MESH_ADDR_IS_RFU(addr)      ((addr) >= 0xff00 && (addr) <= 0xfffb)
 

components/bt/esp_ble_mesh/mesh_core/net.c

@@ -673,7 +673,11 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
             return false;
         }
 
-        if (iv_index > bt_mesh.iv_index + 1) {
+        if ((iv_index > bt_mesh.iv_index + 1)
+#if CONFIG_BLE_MESH_IVU_RECOVERY_IVI
+            || (iv_index == bt_mesh.iv_index + 1 && !iv_update)
+#endif
+            ) {
             BT_WARN("Performing IV Index Recovery");
             (void)memset(bt_mesh.rpl, 0, sizeof(bt_mesh.rpl));
             bt_mesh.iv_index = iv_index;
@@ -681,10 +685,12 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
             goto do_update;
         }
 
+#if !CONFIG_BLE_MESH_IVU_RECOVERY_IVI
         if (iv_index == bt_mesh.iv_index + 1 && !iv_update) {
             BT_WARN("Ignoring new index in normal mode");
             return false;
         }
+#endif
 
         if (!iv_update) {
             /* Nothing to do */
@@ -1220,6 +1226,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
     }
 
     if (rx->net_if == BLE_MESH_NET_IF_ADV &&
+            !rx->friend_cred &&
             bt_mesh_relay_get() != BLE_MESH_RELAY_ENABLED &&
             bt_mesh_gatt_proxy_get() != BLE_MESH_GATT_PROXY_ENABLED) {
         return;
@@ -1232,7 +1239,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
      * Anything else (like GATT to adv, or locally originated packets)
      * use the Network Transmit state.
      */
-    if (rx->net_if == BLE_MESH_NET_IF_ADV) {
+    if (rx->net_if == BLE_MESH_NET_IF_ADV && !rx->friend_cred) {
         transmit = bt_mesh_relay_retransmit_get();
     } else {
         transmit = bt_mesh_net_transmit_get();
@@ -1302,6 +1309,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
      */
     if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) &&
             (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
+             rx->friend_cred ||
              rx->net_if == BLE_MESH_NET_IF_LOCAL)) {
         if (bt_mesh_proxy_server_relay(&buf->b, rx->ctx.recv_dst) &&
                 BLE_MESH_ADDR_IS_UNICAST(rx->ctx.recv_dst)) {
@@ -1309,7 +1317,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
         }
     }
 
-    if (relay_to_adv(rx->net_if)) {
+    if (relay_to_adv(rx->net_if) || rx->friend_cred) {
 #if !defined(CONFIG_BLE_MESH_RELAY_ADV_BUF)
         bt_mesh_adv_send(buf, NULL, NULL);
 #else
@@ -1378,8 +1386,9 @@ int bt_mesh_net_decode(struct net_buf_simple *data, enum bt_mesh_net_if net_if,
         return -EBADMSG;
     }
 
+    /* For case MESH/NODE/RLY/BV-01-C, even the DST is RFU, it needs to be forwarded. */
     if (BLE_MESH_ADDR_IS_RFU(rx->ctx.recv_dst)) {
-        BT_ERR("Destination address is RFU; dropping packet");
+        BT_ERR("Destination address is RFU; dropping packet 0x%02x", rx->ctx.recv_dst);
         return -EBADMSG;
     }
 
@@ -1541,8 +1550,8 @@ void bt_mesh_net_start(void)
 
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
     /* Add Mesh beacon type (Secure Network Beacon) to the exceptional list */
-    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_ADD,
-                                    BLE_MESH_EXCEP_INFO_MESH_BEACON, NULL);
+    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_ADD,
+                                    BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON, NULL);
 #endif
 
     if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER)) {

components/bt/esp_ble_mesh/mesh_core/net.h

@@ -95,7 +95,6 @@ struct bt_mesh_friend {
     uint8_t  fsn:1,
              send_last:1,
              pending_req:1,
-             sec_update:1,
              pending_buf:1,
              valid:1,
              established:1;

components/bt/esp_ble_mesh/mesh_core/nimble_host/mesh_bearer_adapt.c

@@ -88,7 +88,7 @@ int bt_mesh_host_init(void)
     int rc;
 
     if (init == true) {
-        return 0;
+        return -EALREADY;
     }
 
     rc = btc_init();

components/bt/esp_ble_mesh/mesh_core/prov.c

@@ -74,6 +74,7 @@
 
 #define START_PAYLOAD_MAX      20
 #define CONT_PAYLOAD_MAX       23
+#define START_LAST_SEG_MAX     2
 
 #define START_LAST_SEG(gpc)    (gpc >> 2)
 #define CONT_SEG_INDEX(gpc)    (gpc >> 2)
@@ -310,8 +311,8 @@ static void reset_adv_link(void)
 
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
     /* Remove the link id from exceptional list */
-    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_REMOVE,
-                                    BLE_MESH_EXCEP_INFO_MESH_LINK_ID, &link.id);
+    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_REMOVE,
+                                    BLE_MESH_EXCEP_LIST_TYPE_MESH_LINK_ID, &link.id);
 #endif
 
     reset_state();
@@ -751,7 +752,18 @@ static int prov_auth(uint8_t method, uint8_t action, uint8_t size)
             uint32_t num = 0U;
 
             bt_mesh_rand(&num, sizeof(num));
-            num %= div[size - 1];
+
+            if (output == BLE_MESH_BLINK ||
+                output == BLE_MESH_BEEP ||
+                output == BLE_MESH_VIBRATE) {
+                /** NOTE: According to the Bluetooth Mesh Profile Specification
+                 *  Section 5.4.2.4, blink, beep and vibrate should be a random
+                 *  integer between 0 and 10^size.
+                 */
+                num = (num % (div[size - 1] - 1)) + 1;
+            } else {
+                num %= div[size - 1];
+            }
 
             sys_put_be32(num, &link.auth[12]);
             (void)memset(link.auth, 0, 12);
@@ -829,6 +841,7 @@ static void prov_start(const uint8_t *data)
 
 static void send_confirm(void)
 {
+    uint8_t *local_conf = NULL;
     PROV_BUF(cfm, 17);
 
     BT_DBG("ConfInputs[0]   %s", bt_hex(link.conf_inputs, 64));
@@ -861,13 +874,21 @@ static void send_confirm(void)
 
     prov_buf_init(&cfm, PROV_CONFIRM);
 
+    local_conf = net_buf_simple_add(&cfm, 16);
+
     if (bt_mesh_prov_conf(link.conf_key, link.rand, link.auth,
-                          net_buf_simple_add(&cfm, 16))) {
+                          local_conf)) {
         BT_ERR("Unable to generate confirmation value");
         prov_send_fail_msg(PROV_ERR_UNEXP_ERR);
         return;
     }
 
+    if (!memcmp(link.conf, local_conf, 16)) {
+        BT_ERR("Confirmation value is identical to ours, rejecting.");
+        prov_send_fail_msg(PROV_ERR_NVAL_FMT);
+        return;
+    }
+
     if (prov_send(&cfm)) {
         BT_ERR("Unable to send Provisioning Confirm");
         return;
@@ -1359,8 +1380,8 @@ static void link_open(struct prov_rx *rx, struct net_buf_simple *buf)
 
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
     /* Add the link id into exceptional list */
-    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_ADD,
-                                    BLE_MESH_EXCEP_INFO_MESH_LINK_ID, &link.id);
+    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_ADD,
+                                    BLE_MESH_EXCEP_LIST_TYPE_MESH_LINK_ID, &link.id);
 #endif
 
     bearer_ctl_send(LINK_ACK, NULL, 0);
@@ -1429,18 +1450,22 @@ static void prov_msg_recv(void)
         return;
     }
 
-    if (type != PROV_FAILED && type != link.expect) {
-        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
-        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
-        return;
-    }
-
+    /* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
+     * with the Type field set to the lowest unsupported or RFU value, it sends a
+     * Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
+     */
     if (type >= ARRAY_SIZE(prov_handlers)) {
         BT_ERR("Unknown provisioning PDU type 0x%02x", type);
         prov_send_fail_msg(PROV_ERR_NVAL_PDU);
         return;
     }
 
+    if (type != PROV_FAILED && type != link.expect) {
+        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
+        return;
+    }
+
     if (1 + prov_handlers[type].len != link.rx.buf->len) {
         BT_ERR("Invalid length %u for type 0x%02x",
                 link.rx.buf->len, type);
@@ -1543,6 +1568,12 @@ static void gen_prov_start(struct prov_rx *rx, struct net_buf_simple *buf)
         return;
     }
 
+    if (START_LAST_SEG(rx->gpc) > START_LAST_SEG_MAX) {
+        BT_ERR("Invalid SegN 0x%02x", START_LAST_SEG(rx->gpc));
+        prov_send_fail_msg(PROV_ERR_UNEXP_ERR);
+        return;
+    }
+
     if (link.rx.buf->len > link.rx.buf->size) {
         BT_ERR("Too large provisioning PDU (%u bytes)",
                 link.rx.buf->len);
@@ -1639,15 +1670,30 @@ int bt_mesh_pb_gatt_recv(struct bt_mesh_conn *conn, struct net_buf_simple *buf)
         return -EINVAL;
     }
 
-    type = net_buf_simple_pull_u8(buf);
-    if (type != PROV_FAILED && type != link.expect) {
-        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+    /* For case MESH/NODE/PROV/BI-03-C, if the link is closed, when the node receive
+     * a Provisioning PDU , it will send a Provisioning Failed PDU with the Error Code
+     * field set to Unexpected PDU(0x03).
+     */
+    if (bt_mesh_atomic_test_bit(link.flags, LINK_INVALID)) {
+        BT_WARN("Unexpected msg 0x%02x on invalid link", type);
         prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
         return -EINVAL;
     }
 
+    /* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
+     * with the Type field set to the lowest unsupported or RFU value, it sends a
+     * Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
+     */
+    type = net_buf_simple_pull_u8(buf);
     if (type >= ARRAY_SIZE(prov_handlers)) {
         BT_ERR("Unknown provisioning PDU type 0x%02x", type);
+        prov_send_fail_msg(PROV_ERR_NVAL_PDU);
+        return -EINVAL;
+    }
+
+    if (type != PROV_FAILED && type != link.expect) {
+        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
         return -EINVAL;
     }
 
@@ -1791,8 +1837,8 @@ int bt_mesh_prov_deinit(void)
     k_delayed_work_free(&link.tx.retransmit);
 #if defined(CONFIG_BLE_MESH_USE_DUPLICATE_SCAN)
     /* Remove the link id from exceptional list */
-    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_REMOVE,
-                                    BLE_MESH_EXCEP_INFO_MESH_LINK_ID, &link.id);
+    bt_mesh_update_exceptional_list(BLE_MESH_EXCEP_LIST_SUB_CODE_REMOVE,
+                                    BLE_MESH_EXCEP_LIST_TYPE_MESH_LINK_ID, &link.id);
 #endif /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
 #endif /* CONFIG_BLE_MESH_PB_ADV */
 

components/bt/esp_ble_mesh/mesh_core/provisioner_main.c

@@ -1691,55 +1691,65 @@ int bt_mesh_provisioner_set_heartbeat_filter_info(uint8_t op, uint16_t src, uint
     }
 }
 
-static bool filter_with_rejectlist(struct heartbeat_filter *filter,
-                                   uint16_t hb_src, uint16_t hb_dst)
+static bool filter_with_rejectlist(uint16_t hb_src, uint16_t hb_dst)
 {
-    switch (filter->type) {
-    case HEARTBEAT_FILTER_WITH_SRC:
-        if (hb_src == filter->src) {
-            return true;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hb_rx.filter); i++) {
+        struct heartbeat_filter *filter = &hb_rx.filter[i];
+
+        switch (filter->type) {
+        case HEARTBEAT_FILTER_WITH_SRC:
+            if (hb_src == filter->src) {
+                return true;
+            }
+            break;
+        case HEARTBEAT_FILTER_WITH_DST:
+            if (hb_dst == filter->dst) {
+                return true;
+            }
+            break;
+        case HEARTBEAT_FILTER_WITH_BOTH:
+            if (hb_src == filter->src && hb_dst == filter->dst) {
+                return true;
+            }
+            break;
+        default:
+            BT_DBG("Unknown filter addr type 0x%02x", filter->type);
+            break;
         }
-        break;
-    case HEARTBEAT_FILTER_WITH_DST:
-        if (hb_dst == filter->dst) {
-            return true;
-        }
-        break;
-    case HEARTBEAT_FILTER_WITH_BOTH:
-        if (hb_src == filter->src && hb_dst == filter->dst) {
-            return true;
-        }
-        break;
-    default:
-        BT_WARN("Unknown filter addr type 0x%02x", filter->type);
-        break;
     }
 
     return false;
 }
 
-static bool filter_with_acceptlist(struct heartbeat_filter *filter,
-                                   uint16_t hb_src, uint16_t hb_dst)
+static bool filter_with_acceptlist(uint16_t hb_src, uint16_t hb_dst)
 {
-    switch (filter->type) {
-    case HEARTBEAT_FILTER_WITH_SRC:
-        if (hb_src == filter->src) {
-            return false;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hb_rx.filter); i++) {
+        struct heartbeat_filter *filter = &hb_rx.filter[i];
+
+        switch (filter->type) {
+        case HEARTBEAT_FILTER_WITH_SRC:
+            if (hb_src == filter->src) {
+                return false;
+            }
+            break;
+        case HEARTBEAT_FILTER_WITH_DST:
+            if (hb_dst == filter->dst) {
+                return false;
+            }
+            break;
+        case HEARTBEAT_FILTER_WITH_BOTH:
+            if (hb_src == filter->src && hb_dst == filter->dst) {
+                return false;
+            }
+            break;
+        default:
+            BT_DBG("Unknown filter addr type 0x%02x", filter->type);
+            break;
         }
-        break;
-    case HEARTBEAT_FILTER_WITH_DST:
-        if (hb_dst == filter->dst) {
-            return false;
-        }
-        break;
-    case HEARTBEAT_FILTER_WITH_BOTH:
-        if (hb_src == filter->src && hb_dst == filter->dst) {
-            return false;
-        }
-        break;
-    default:
-        BT_WARN("Unknown filter addr type 0x%02x", filter->type);
-        return false;
     }
 
     return true;
@@ -1749,26 +1759,20 @@ void bt_mesh_provisioner_heartbeat(uint16_t hb_src, uint16_t hb_dst,
                                    uint8_t init_ttl, uint8_t rx_ttl,
                                    uint8_t hops, uint16_t feat, int8_t rssi)
 {
-    int i;
-
     if (hb_rx.cb == NULL) {
         BT_DBG("Receiving heartbeat is not enabled");
         return;
     }
 
-    for (i = 0; i < ARRAY_SIZE(hb_rx.filter); i++) {
-        struct heartbeat_filter *filter = &hb_rx.filter[i];
-
-        if (hb_rx.type == HEARTBEAT_FILTER_REJECTLIST) {
-            if (filter_with_rejectlist(filter, hb_src, hb_dst)) {
-                BT_DBG("Filtered by rejectlist, src 0x%04x, dst 0x%04x", hb_src, hb_dst);
-                return;
-            }
-        } else {
-            if (filter_with_acceptlist(filter, hb_src, hb_dst)) {
-                BT_DBG("Filtered by acceptlist, src 0x%04x, dst 0x%04x", hb_src, hb_dst);
-                return;
-            }
+    if (hb_rx.type == HEARTBEAT_FILTER_REJECTLIST) {
+        if (filter_with_rejectlist(hb_src, hb_dst)) {
+            BT_INFO("Filtered by rejectlist, src 0x%04x, dst 0x%04x", hb_src, hb_dst);
+            return;
+        }
+    } else {
+        if (filter_with_acceptlist(hb_src, hb_dst)) {
+            BT_INFO("Filtered by acceptlist, src 0x%04x, dst 0x%04x", hb_src, hb_dst);
+            return;
         }
     }