change(version): Update version to 4.4.7

fix(esp_eth): W5500 receive function to return copy_len (v4.4)

See merge request espressif/esp-idf!29022

.editorconfig

@@ -19,14 +19,6 @@ trim_trailing_whitespace = false
 indent_style = tab
 indent_size = 2
 
-[*/freertos/**]
-indent_style = tab
-indent_size = 4
-
-[{*/freertos/**.S,**/FreeRTOSConfig.h}]
-indent_style = space
-indent_size = 4
-
 [*.pem]
 insert_final_newline = false
 

.flake8

@@ -153,6 +153,7 @@ exclude =
         components/tinyusb,
         components/unity/unity,
         components/spiffs/spiffs,
+        components/freemodbus,
         examples/build_system/cmake/import_lib/main/lib/tinyxml2,
         examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
     # autogenerated scripts
@@ -168,4 +169,5 @@ exclude =
 
 per-file-ignores =
     # Sphinx conf.py files use star imports to setup config variables
-        docs/conf_common.py: F405
+        docs/conf_common.py: F405,
+        components/freemodbus/docs/conf_common.py: F405

.gitlab-ci.yml

@@ -12,7 +12,7 @@ stages:
 workflow:
   rules:
     # Disable those non-protected push triggered pipelines
-    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
+    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && $CI_PIPELINE_SOURCE == "push"'
       when: never
     # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
     # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
@@ -62,13 +62,16 @@ variables:
   CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis:v4.4-1-2"
   SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:3"
 
-  # target test config file, used by assign test job
+  # target test config file, used by scan test and assign test job
   CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/.gitlab/ci/target-test.yml"
 
   # target test repo parameters
   TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
-  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v4.1"
+
+  # Set this variable to specify the file name for the known failure cases.
+  KNOWN_FAILURE_CASES_FILE_NAME: "4.4.txt"
+
+  IDF_CI_BUILD: 1
 
 .setup_tools_unless_target_test: &setup_tools_unless_target_test |
   if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
@@ -115,6 +118,8 @@ before_script:
     - source tools/ci/utils.sh
     - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
+    # Clean up idf-env.json which might not be compatible with one produced by newer ESP-IDF versions
+    - rm -f ${IDF_TOOLS_PATH}/idf-env.json
     - $IDF_PATH/tools/idf_tools.py install-python-env
     # On macOS, these tools need to be installed
     - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@@ -140,6 +145,7 @@ include:
   - '.gitlab/ci/pre_check.yml'
   - '.gitlab/ci/build.yml'
   - '.gitlab/ci/assign-test.yml'
+  - '.gitlab/ci/integration_test.yml'
   - '.gitlab/ci/host-test.yml'
   - '.gitlab/ci/target-test.yml'
   - '.gitlab/ci/deploy.yml'

.gitlab/ci/README.md

@@ -136,10 +136,11 @@ check if there's a suitable `.if-<if-anchor-you-need>` anchor
 1. if there is, create a rule following [`rules` Template Naming Rules](#rules-template-naming-rules).For detail information, please refer to [GitLab Documentation `rules-if`](https://docs.gitlab.com/ee/ci/yaml/README.html#rulesif). Here's an example.
 
     ```yaml
-    .rules:dev:
+    .rules:patterns:python-files:
       rules:
-        - <<: *if-trigger
+        - <<: *if-protected
         - <<: *if-dev-push
+          changes: *patterns-python-files
     ```
 
 2. if there isn't

.gitlab/ci/assign-test.yml

@@ -103,66 +103,3 @@ assign_unit_test:
     BUILD_DIR: ${CI_PROJECT_DIR}/tools/unit-test-app/builds
   script:
     - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
-
-assign_integration_test:
-  extends:
-    - .assign_test_template
-    - .rules:test:integration_test
-  needs:
-    - build_ssc_esp32
-    - build_ssc_esp32c3
-  artifacts:
-    paths:
-      - $TEST_DIR/test_configs
-  variables:
-    TEST_DIR: ${CI_PROJECT_DIR}/tools/ci/integration_test
-    BUILD_DIR: ${CI_PROJECT_DIR}/SSC/ssc_bin
-    INTEGRATION_TEST_CASE_PATH: "${CI_PROJECT_DIR}/auto_test_script/TestCaseFiles"
-    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
-    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    PYTHON_VER: 3.7.7
-  script:
-    # clone test script to assign tests
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    # assign integration test cases
-    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b ${BUILD_DIR} -o $TEST_DIR/test_configs
-
-update_test_cases:
-  extends: .rules:ref:master-schedule
-  stage: assign_test
-  image: $CI_DOCKER_REGISTRY/ubuntu-test-env
-  tags:
-    - deploy_test
-  needs:
-    - build_esp_idf_tests_cmake_esp32
-    - build_esp_idf_tests_cmake_esp32s2
-    - build_esp_idf_tests_cmake_esp32s3
-    - build_esp_idf_tests_cmake_esp32c3
-  artifacts:
-    when: always
-    paths:
-      - ${CI_PROJECT_DIR}/test-management/*.log
-    expire_in: 1 week
-  variables:
-    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
-    UNIT_TEST_DIR: "${CI_PROJECT_DIR}/components/idf_test/unit_test"
-    BOT_ACCOUNT_CONFIG_FILE: "${CI_PROJECT_DIR}/test-management/Config/Account.local.yml"
-    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    PYTHON_VER: 3.7.7
-  script:
-    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
-    - retry_failed git clone $TEST_MANAGEMENT_REPO
-    - python $CHECKOUT_REF_SCRIPT test-management test-management
-    - cd test-management
-    - echo $BOT_JIRA_ACCOUNT > ${BOT_ACCOUNT_CONFIG_FILE}
-    # update unit test cases
-    - export UNIT_TEST_CASE_FILES=$(find $UNIT_TEST_DIR -maxdepth 1 -name "*.yml" | xargs)
-    - python ImportTestCase.py $JIRA_TEST_MANAGEMENT_PROJECT unity -d $UNIT_TEST_CASE_FILES -r $GIT_SHA
-    # update example test cases
-    - python ImportTestCase.py $JIRA_TEST_MANAGEMENT_PROJECT tiny_test_fw -d ${CI_PROJECT_DIR}/examples -r $GIT_SHA
-    - python ImportTestCase.py $JIRA_TEST_MANAGEMENT_PROJECT tiny_test_fw -d ${CI_PROJECT_DIR}/tools/test_apps -r $GIT_SHA
-    # organize test cases
-    - python OrganizeTestCases.py $JIRA_TEST_MANAGEMENT_PROJECT

.gitlab/ci/build.yml

@@ -51,44 +51,6 @@ fast_template_app:
     BUILD_COMMAND_ARGS: "-p"
 #------------------------------------------------------------------------------
 
-.build_ssc_template:
-  extends:
-    - .build_template
-    - .rules:build:integration_test
-  artifacts:
-    paths:
-      - SSC/ssc_bin
-    expire_in: 1 week
-  script:
-    - retry_failed git clone $SSC_REPOSITORY
-    - python $CHECKOUT_REF_SCRIPT SSC SSC
-    - cd SSC
-    - MAKEFLAGS= ./ci_build_ssc.sh $TARGET_NAME
-
-build_ssc_esp32:
-  extends: .build_ssc_template
-  parallel: 3
-  variables:
-    TARGET_NAME: "ESP32"
-
-build_ssc_esp32s2:
-  extends: .build_ssc_template
-  parallel: 2
-  variables:
-    TARGET_NAME: "ESP32S2"
-
-build_ssc_esp32c3:
-  extends: .build_ssc_template
-  parallel: 3
-  variables:
-    TARGET_NAME: "ESP32C3"
-
-build_ssc_esp32s3:
-  extends: .build_ssc_template
-  parallel: 3
-  variables:
-    TARGET_NAME: "ESP32S3"
-
 .build_esp_idf_tests_cmake_template:
   extends: .build_template
   dependencies:  # set dependencies to null to avoid missing artifacts issue

.gitlab/ci/dependencies/dependencies.yml

@@ -65,15 +65,6 @@
     - "build:{0}"
     - build:target_test
 
-build:integration_test:
-  labels:
-    - build
-  patterns:
-    - build_components
-    - build_system
-  included_in:
-    - build:target_test
-
 ####################
 # Target Test Jobs #
 ####################
@@ -113,16 +104,6 @@ build:integration_test:
     - "build:component_ut-{0}"
     - build:target_test
 
-"test:integration_test":
-  labels:
-    - integration_test
-    - target_test
-  patterns:
-    - integration_test
-  included_in:
-    - build:integration_test
-    - build:target_test
-
 "test:host_test":
   labels:
     - host_test

.gitlab/ci/deploy.yml

@@ -9,49 +9,15 @@ push_to_github:
   extends:
     - .deploy_job_template
     - .before_script_minimal
-    - .rules:protected-no_label
-  dependencies: []
+    - .rules:push_to_github
+  needs:
+    - check_submodule_sync
   script:
     - add_github_ssh_keys
     - git remote remove github &>/dev/null || true
     - git remote add github git@github.com:espressif/esp-idf.git
     - tools/ci/push_to_github.sh
 
-deploy_test_result:
-  extends:
-    - .deploy_job_template
-    - .before_script_minimal
-    - .rules:ref:master-always
-  image: $CI_DOCKER_REGISTRY/bot-env
-  tags:
-    - deploy_test
-  artifacts:
-    when: always
-    paths:
-      - ${CI_PROJECT_DIR}/test-management/*.log
-      # save all test logs as artifacts, make it easier to track errors
-      - ${CI_PROJECT_DIR}/TEST_LOGS
-    expire_in: 1 mos
-  variables:
-    UNIT_TEST_CASE_FILE: "${CI_PROJECT_DIR}/components/idf_test/unit_test/TestCaseAll.yml"
-    BOT_ACCOUNT_CONFIG_FILE: "${CI_PROJECT_DIR}/test-management/Config/Account.local.yml"
-    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
-    AUTO_TEST_SCRIPT_PATH: "${CI_PROJECT_DIR}/auto_test_script"
-  script:
-    - add_gitlab_ssh_keys
-    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
-    - export REV_COUNT=$(git rev-list --count ${PIPELINE_COMMIT_SHA} --)
-    - export SUMMARY="IDF CI test result for $GIT_SHA (r${REV_COUNT})"
-    # artifacts of job update_test_cases creates test-management folder
-    # we need to remove it so we can clone test-management folder again
-    - rm -rf test-management
-    - retry_failed git clone $TEST_MANAGEMENT_REPO
-    - python3 $CHECKOUT_REF_SCRIPT test-management test-management
-    - cd test-management
-    - echo $BOT_JIRA_ACCOUNT > ${BOT_ACCOUNT_CONFIG_FILE}
-    # update test results
-    - python3 ImportTestResult.py -r "$GIT_SHA (r${REV_COUNT})" -j $JIRA_TEST_MANAGEMENT_PROJECT -s "$SUMMARY" -l CI -p ${CI_PROJECT_DIR}/TEST_LOGS --pipeline_url ${CI_PIPELINE_URL}
-
 check_submodule_sync:
   extends:
     - .deploy_job_template

.gitlab/ci/docs.yml

@@ -17,6 +17,9 @@
 .if-protected-no_label: &if-protected-no_label
   if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) && $BOT_TRIGGER_WITH_LABEL == null'
 
+.if-qa-test-tag: &if-qa-test-tag
+  if: '$CI_COMMIT_TAG =~ /^qa-test/'
+
 .if-label-build_docs: &if-label-build_docs
   if: '$BOT_LABEL_BUILD_DOCS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build_docs(?:,[^,\n\r]+)*$/i'
 
@@ -27,10 +30,12 @@
   if: '$BOT_LABEL_DOCS_FULL || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*docs_full(?:,[^,\n\r]+)*$/i'
 
 .if-dev-push: &if-dev-push
-  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
+  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
 
 .doc-rules:build:docs:
   rules:
+    - <<: *if-qa-test-tag
+      when: never
     - <<: *if-protected
     - <<: *if-label-build_docs
     - <<: *if-label-docs

.gitlab/ci/host-test.yml

@@ -192,9 +192,17 @@ test_idf_tools:
     - export PATH=$(p=$(echo $PATH | tr ":" "\n" | grep -v "/root/.espressif/tools\|/opt/espressif" | tr "\n" ":"); echo ${p%:})
     - cd ${IDF_PATH}/tools/test_idf_tools
     - ./test_idf_tools.py
+
+test_install_python_env:
+  extends: .host_test_template
+  script:
     # Test for create virtualenv. It must be invoked from Python, not from virtualenv.
+    # Remove tools gdbgui, pygdbmi, python-socketio, jinja2, itsdangerous, pygdbmi for virtualenv test to reduce virtualenv setup time
+    # since they are not necessary for this test and are tested elsewhere
+    - sed -E -i '/(^gdbgui|^pygdbmi|^python-socketio|^jinja2|^itsdangerous|^pygdbmi)/d' $IDF_PATH/requirements.txt
     - cd ${IDF_PATH}/tools
     - python3 ./idf_tools.py install-python-env
+  timeout: 4 hours # this requires longer timeout
 
 .test_efuse_table_on_host_template:
   extends: .host_test_template
@@ -235,24 +243,6 @@ test_efuse_table_on_host_esp32h2:
   variables:
     IDF_TARGET: esp32h2
 
-test_espcoredump:
-  extends: .host_test_template
-  artifacts:
-    when: always
-    paths:
-      - components/espcoredump/test/**/.coverage
-      - components/espcoredump/test/**/output
-    expire_in: 1 week
-  variables:
-    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
-    IDF_COREDUMP_ELF_TAG: idf-20210915
-    # install CMake version specified in tools.json
-    SETUP_TOOLS_LIST: "all"
-  script:
-    - retry_failed git clone ${IDF_COREDUMP_ELF_REPO} -b $IDF_COREDUMP_ELF_TAG
-    - cd ${IDF_PATH}/components/espcoredump/test/
-    - ./test_espcoredump.sh ${CI_PROJECT_DIR}/idf-coredump-elf
-
 test_logtrace_proc:
   extends: .host_test_template
   artifacts:

.gitlab/ci/integration_test.yml

@@ -0,0 +1,69 @@
+# generate dynamic integration pipeline by `idf-integration-ci` project
+
+.patterns-integration_test: &patterns-integration_test
+  # add all possible patterns to make sure `gen_integration_pipeline` can be triggered.
+  # fine-grained control will be done while generating the pipeline
+  # find `patterns` in `idf-integration-ci` project
+  - "components/**/*"
+  - "tools/**/*"
+  - ".gitlab-ci.yml"
+  - ".gitlab/ci/common.yml"
+  - ".gitlab/ci/integration_test.yml"
+  - ".gitmodules"
+  - "CMakeLists.txt"
+  - "install.sh"
+  - "export.sh"
+  - "Kconfig"
+  - "sdkconfig.rename"
+
+# Simplify the rules
+.integration_test_rules:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *patterns-integration_test
+    # support trigger by ci labels
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build(?:,[^,\n\r]+)*$/i'
+
+gen_integration_pipeline:
+  extends:
+    - .before_script_minimal
+    - .integration_test_rules
+  image: ${CI_INTEGRATION_ASSIGN_ENV}
+  stage: assign_test
+  cache: []
+  tags:
+    - assign_test
+  variables:
+    SUBMODULES_TO_FETCH: "none"
+    GIT_LFS_SKIP_SMUDGE: 1
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
+  artifacts:
+    paths:
+      - idf-integration-ci/child_pipeline/
+    expire_in: 2 weeks
+  script:
+    - add_gitlab_ssh_keys
+    - retry_failed git clone ${CI_GEN_INTEGRATION_PIPELINE_REPO} idf-integration-ci
+    - python $CHECKOUT_REF_SCRIPT idf-integration-ci idf-integration-ci
+    - cd idf-integration-ci
+    - python tools/generate_child_pipeline.py -o child_pipeline/
+
+child_integration_test_pipeline:
+  extends:
+    - .integration_test_rules
+  stage: assign_test
+  needs:
+    - gen_integration_pipeline
+  trigger:
+    include:
+      - artifact: idf-integration-ci/child_pipeline/pipeline.yml
+        job: gen_integration_pipeline
+    forward:
+      yaml_variables: false
+    strategy: depend

.gitlab/ci/pre_check.yml

@@ -24,13 +24,15 @@ check_pre_commit_master_release:
     - .rules:protected
   script:
     - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files
+    - pre-commit run --hook-stage post-commit validate-sbom-manifest
 
 check_pre_commit_MR:
   extends:
     - .check_pre_commit_template
-    - .rules:dev
+    - .rules:mr
   script:
     - python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs pre-commit run --files
+    - pre-commit run --hook-stage post-commit validate-sbom-manifest
 
 check_version:
   # Don't run this for feature/bugfix branches, so that it is possible to modify

.gitlab/ci/rules.yml

@@ -49,8 +49,6 @@
   - "tools/ci/test_build_system*.sh"
 
 .patterns-custom_test: &patterns-custom_test
-  - "components/espcoredump/**/*"
-
   - "tools/ci/python_packages/gitlab_api.py"
   - "tools/ci/python_packages/tiny_test_fw/**/*"
   - "tools/ci/python_packages/ttfw_idf/**/*"
@@ -87,10 +85,6 @@
 
   - "components/**/test_apps/**/*"
 
-.patterns-integration_test: &patterns-integration_test
-  - "tools/ci/python_packages/tiny_test_fw/**/*"
-  - "tools/ci/integration_test/**/*"
-
 .patterns-host_test: &patterns-host_test
   - ".gitlab/ci/host-test.yml"
 
@@ -180,13 +174,19 @@
   if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/'
 
 .if-protected: &if-protected
-  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/)'
+  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) || $CI_COMMIT_TAG =~ /^qa-test/'
 
 .if-protected-no_label: &if-protected-no_label
   if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) && $BOT_TRIGGER_WITH_LABEL == null'
 
+.if-qa-test-tag: &if-qa-test-tag
+  if: '$CI_COMMIT_TAG =~ /^qa-test/'
+
 .if-dev-push: &if-dev-push
-  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
+  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
+
+.if-merge_request: &if-merge_request
+  if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 
 .if-schedule: &if-schedule
   if: '$CI_PIPELINE_SOURCE == "schedule"'
@@ -204,10 +204,16 @@
   rules:
     - <<: *if-protected
 
-.rules:protected-no_label:
+.rules:push_to_github:
   rules:
+    - <<: *if-qa-test-tag
+      when: never
     - <<: *if-protected-no_label
 
+.rules:mr:
+  rules:
+    - <<: *if-merge_request
+
 .rules:dev:
   rules:
     - <<: *if-trigger
@@ -317,9 +323,6 @@
 .if-label-host_test: &if-label-host_test
   if: '$BOT_LABEL_HOST_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*host_test(?:,[^,\n\r]+)*$/i'
 
-.if-label-integration_test: &if-label-integration_test
-  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
-
 .if-label-iperf_stress_test: &if-label-iperf_stress_test
   if: '$BOT_LABEL_IPERF_STRESS_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*iperf_stress_test(?:,[^,\n\r]+)*$/i'
 
@@ -622,19 +625,6 @@
     - <<: *if-dev-push
       changes: *patterns-example_test
 
-.rules:build:integration_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build
-    - <<: *if-label-integration_test
-    - <<: *if-label-target_test
-    - <<: *if-dev-push
-      changes: *patterns-build_components
-    - <<: *if-dev-push
-      changes: *patterns-build_system
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-
 .rules:build:macos:
   rules:
     - <<: *if-protected
@@ -663,7 +653,6 @@
     - <<: *if-label-example_test_esp32c3
     - <<: *if-label-example_test_esp32s2
     - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
     - <<: *if-label-iperf_stress_test
     - <<: *if-label-target_test
     - <<: *if-label-unit_test
@@ -684,8 +673,6 @@
       changes: *patterns-custom_test
     - <<: *if-dev-push
       changes: *patterns-example_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
     - <<: *if-dev-push
       changes: *patterns-unit_test
 
@@ -946,16 +933,6 @@
     - <<: *if-dev-push
       changes: *patterns-host_test
 
-.rules:test:integration_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-integration_test
-    - <<: *if-label-target_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-
 .rules:test:submodule:
   rules:
     - <<: *if-protected

.gitlab/ci/target-test.yml

@@ -31,10 +31,11 @@
     - retry_failed git clone $TEST_ENV_CONFIG_REPO
     - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # git clone the known failure cases repo, run test
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - pip install minio
+    - python tools/ci/get_known_failure_cases_file.py
     # run test
     - cd tools/ci/python_packages/tiny_test_fw/bin
-    - run_cmd python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/known_failure_cases/known_failure_cases.txt
+    - run_cmd python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/${KNOWN_FAILURE_CASES_FILE_NAME}
 
 .example_test_template:
   extends: .target_test_job_template
@@ -96,6 +97,12 @@ example_test_001B:
     - ESP32
     - Example_EthKitV1
 
+example_test_httpbin:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - httpbin
+
 example_test_001B_V3:
   extends: .example_test_esp32_template
   tags:
@@ -357,7 +364,6 @@ test_app_test_003:
 
 test_app_test_004:
   extends: .test_app_esp32s2_template
-  parallel: 2
   tags:
     - ESP32S2
     - Example_GENERIC
@@ -368,6 +374,12 @@ test_app_test_005:
     - ESP32C3
     - Example_GENERIC
 
+test_app_test_006:
+  extends: .test_app_esp32s3_template
+  tags:
+    - ESP32S3
+    - Example_GENERIC
+
 test_app_test_esp32_generic:
   extends: .test_app_esp32_template
   parallel: 5
@@ -395,6 +407,12 @@ test_app_test_flash_psram_f8r8:
     - ESP32S3
     - MSPI_F8R8
 
+test_app_test_flash_psram_esp32:
+  extends: .test_app_esp32_template
+  tags:
+    - ESP32
+    - psram
+
 .component_ut_template:
   extends: .target_test_job_template
   needs: # the assign already needs all the build jobs
@@ -410,10 +428,11 @@ test_app_test_flash_psram_f8r8:
     - retry_failed git clone $TEST_ENV_CONFIG_REPO
     - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
     # git clone the known failure cases repo, run test
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - pip install minio
+    - python tools/ci/get_known_failure_cases_file.py
     # run test
     - cd tools/ci/python_packages/tiny_test_fw/bin
-    - run_cmd python Runner.py $COMPONENT_UT_DIRS -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/known_failure_cases/known_failure_cases.txt
+    - run_cmd python Runner.py $COMPONENT_UT_DIRS -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/${KNOWN_FAILURE_CASES_FILE_NAME}
 
 .component_ut_esp32_template:
   extends:
@@ -498,7 +517,7 @@ UT_001:
 
 UT_002:
   extends: .unit_test_esp32_template
-  parallel: 15
+  parallel: 16
   tags:
     - ESP32_IDF
     - UT_T1_1
@@ -533,7 +552,7 @@ UT_006:
 
 UT_007:
   extends: .unit_test_esp32_template
-  parallel: 7
+  parallel: 8
   tags:
     - ESP32_IDF
     - UT_T1_1
@@ -684,7 +703,7 @@ UT_046:
 
 UT_047:
   extends: .unit_test_esp32s2_template
-  parallel: 7
+  parallel: 8
   tags:
     - ESP32S2_IDF
     - UT_T1_1
@@ -703,7 +722,7 @@ UT_S2_SDSPI:
 
 UT_C3:
   extends: .unit_test_esp32c3_template
-  parallel: 35
+  parallel: 36
   tags:
     - ESP32C3_IDF
     - UT_T1_1
@@ -747,7 +766,7 @@ UT_C3_SDSPI:
 
 UT_S3:
   extends: .unit_test_esp32s3_template
-  parallel: 32
+  parallel: 33
   tags:
     - ESP32S3_IDF
     - UT_T1_1
@@ -767,203 +786,14 @@ UT_S3_FLASH:
 
 component_ut_test_ip101:
   extends: .component_ut_esp32_template
+  image: $CI_DOCKER_REGISTRY/ubuntu-test-env
   tags:
     - ESP32
-    - COMPONENT_UT_IP101
+    - eth_ip101
 
 component_ut_test_lan8720:
   extends: .component_ut_esp32_template
+  image: $CI_DOCKER_REGISTRY/ubuntu-test-env
   tags:
     - ESP32
-    - COMPONENT_UT_LAN8720
-
-.integration_test_template:
-  extends:
-    - .target_test_job_template
-    - .rules:test:integration_test
-  needs: # the assign already needs all the build jobs
-    - assign_integration_test
-  variables:
-    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
-    LOG_PATH: "${CI_PROJECT_DIR}/TEST_LOGS"
-    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
-    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/ci/integration_test/test_configs"
-    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/tools/ci/integration_test/KnownIssues"
-    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
-    PREPARE_TEST_BIN_SCRIPT: "${CI_PROJECT_DIR}/tools/ci/integration_test/prepare_test_bins.py"
-    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${PYTHONPATH}"
-    INITIAL_CONDITION_RETRY_COUNT: "1"
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
-  script:
-    - *define_config_file_name
-    # first test if config file exists, if not exist, exit 0
-    - test -e $CONFIG_FILE || exit 0
-    # clone local test env configs
-    - retry_failed git clone $TEST_ENV_CONFIG_REPO
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
-    # run test
-    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
-    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
-
-.integration_test_esp32c3_template:
-  extends:
-    - .integration_test_template
-  variables:
-    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32C3_IDF"
-
-nvs_compatible_test:
-  extends: .integration_test_template
-  artifacts:
-    when: always
-    paths:
-      - $LOG_PATH
-      - nvs_wifi.bin
-    expire_in: 1 mos
-  tags:
-    - ESP32_IDF
-    - NVS_Compatible
-  script:
-    - *define_config_file_name
-    # first test if config file exists, if not exist, exit 0
-    - test -e $CONFIG_FILE || exit 0
-    # clone local test env configs
-    - retry_failed git clone $TEST_ENV_CONFIG_REPO
-    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
-    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    # prepare nvs bins
-    - cd auto_test_script
-    - ./tools/prepare_nvs_bin.sh
-    # run test
-    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
-    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
-
-IT_001:
-  extends: .integration_test_template
-  parallel: 2
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_002:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_2
-
-IT_003:
-  extends: .integration_test_template
-  parallel: 9
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_005:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_5
-
-IT_006:
-  extends: .integration_test_template
-  parallel: 5
-  tags:
-    - ESP32_IDF
-    - SSC_T1_6
-
-IT_007:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_7
-
-IT_008:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_8
-
-IT_011:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_MESH1
-
-IT_012:
-  extends: .integration_test_template
-  parallel: 2
-  tags:
-    - ESP32_IDF
-    - SSC_T2_MESH1
-
-IT_013:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T3_MESH1
-
-IT_014:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T6_MESH1
-
-IT_015:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T12_MESH1
-
-IT_016:
-  extends: .integration_test_template
-  allow_failure: true
-  tags:
-    - ESP32_IDF
-    - SSC_T50_MESH1
-
-IT_017:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_MESH2
-
-IT_018:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_9
-
-IT_019:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_2
-
-IT_020:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_3
-
-IT_022:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T3_2
-
-IT_C3_001:
-  extends: .integration_test_esp32c3_template
-  parallel: 6
-  tags:
-    - ESP32C3_IDF
-    - SSC_T2_5
+    - eth_lan8720

.gitmodules

@@ -2,6 +2,26 @@
 # All the relative URL paths are intended to be GitHub ones
 # For Espressif's public projects please use '../../espressif/proj', not a '../proj'
 #
+# Submodules SBOM information
+# ---------------------------
+# Submodules, which are used directly and not forked into espressif namespace should
+# contain SBOM information here. Other submodules should have the SBOM manifest file
+# included in the root of their project's repository.
+#
+# The sbom-hash entry records the submodule's checkout SHA as presented in git-tree
+# commit object. For example spiffs submodule
+#
+# $ git ls-tree HEAD components/spiffs/spiffs
+# 160000 commit 0dbb3f71c5f6fae3747a9d935372773762baf852	components/spiffs/spiffs
+#
+# The hash can be also obtained with git submodule command
+#
+# $ git submodule status components/spiffs/spiffs
+# 0dbb3f71c5f6fae3747a9d935372773762baf852 components/spiffs/spiffs (0.2-255-g0dbb3f71c5f6)
+#
+# The submodule SHA recorded here has to match with SHA, which is presented in git-tree.
+# This is checked by CI. Also please don't forget to update the submodule version
+# if you are changing the sbom-hash. This is important for SBOM generation.
 
 [submodule "components/esptool_py/esptool"]
 	path = components/esptool_py/esptool
@@ -14,6 +34,12 @@
 [submodule "components/bootloader/subproject/components/micro-ecc/micro-ecc"]
 	path = components/bootloader/subproject/components/micro-ecc/micro-ecc
 	url = ../../kmackay/micro-ecc.git
+	sbom-version = 1.1
+	sbom-cpe = cpe:2.3:a:micro-ecc_project:micro-ecc:{}:*:*:*:*:*:*:*
+	sbom-supplier = Person: Ken MacKay
+	sbom-url = https://github.com/kmackay/micro-ecc
+	sbom-description = A small and fast ECDH and ECDSA implementation for 8-bit, 32-bit, and 64-bit processors
+	sbom-hash = 24c60e243580c7868f4334a1ba3123481fe1aa48
 
 [submodule "components/coap/libcoap"]
 	path = components/coap/libcoap
@@ -30,10 +56,21 @@
 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = ../../pellepl/spiffs.git
+	sbom-version = 0.2-255-g0dbb3f71c5f6
+	sbom-supplier = Person: Peter Andersson
+	sbom-url = https://github.com/pellepl/spiffs
+	sbom-description = Wear-leveled SPI flash file system for embedded devices
+	sbom-hash = 0dbb3f71c5f6fae3747a9d935372773762baf852
 
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
+	sbom-version = 1.7.17
+	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
+	sbom-supplier = Person: Dave Gamble
+	sbom-url = https://github.com/DaveGamble/cJSON
+	sbom-description = Ultralightweight JSON parser in ANSI C
+	sbom-hash = 87d8f0961a01bf09bef98ff89bae9fdec42181ee
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
@@ -58,10 +95,21 @@
 [submodule "components/protobuf-c/protobuf-c"]
 	path = components/protobuf-c/protobuf-c
 	url = ../../protobuf-c/protobuf-c.git
+	sbom-version = 1.4.1
+	sbom-cpe = cpe:2.3:a:protobuf-c_project:protobuf-c:{}:*:*:*:*:*:*:*
+	sbom-supplier = Organization: protobuf-c community <https://groups.google.com/g/protobuf-c>
+	sbom-url = https://github.com/protobuf-c/protobuf-c
+	sbom-description = Protocol Buffers implementation in C
+	sbom-hash = abc67a11c6db271bedbb9f58be85d6f4e2ea8389
 
 [submodule "components/unity/unity"]
 	path = components/unity/unity
 	url = ../../ThrowTheSwitch/Unity.git
+	sbom-version = v2.4.3-51-g7d2bf62b7e6a
+	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
+	sbom-url = https://github.com/ThrowTheSwitch/Unity
+	sbom-description = Simple Unit Testing for C
+	sbom-hash = 7d2bf62b7e6afaf38153041a9d53c21aeeca9a25
 
 [submodule "examples/build_system/cmake/import_lib/main/lib/tinyxml2"]
 	path = examples/build_system/cmake/import_lib/main/lib/tinyxml2
@@ -90,6 +138,11 @@
 [submodule "components/cmock/CMock"]
 	path = components/cmock/CMock
 	url = ../../ThrowTheSwitch/CMock.git
+	sbom-version = v2.5.2-2-geeecc49ce8af
+	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
+	sbom-url = https://github.com/ThrowTheSwitch/CMock
+	sbom-description = CMock - Mock/stub generator for C
+	sbom-hash = eeecc49ce8af123cf8ad40efdb9673e37b56230f
 
 [submodule "components/openthread/openthread"]
 	path = components/openthread/openthread

.pre-commit-config.yaml

@@ -1,6 +1,8 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 
+default_stages: [commit]
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.0.1
@@ -29,16 +31,17 @@ repos:
       - id: mixed-line-ending
         args: ['-f=lf']
       - id: double-quote-string-fixer
-  - repo: https://gitlab.com/pycqa/flake8
+  - repo: https://github.com/PyCQA/flake8
     rev: 3.9.2
     hooks:
       - id: flake8
         args: ['--config=.flake8', '--tee', '--benchmark']
-  - repo: https://github.com/pycqa/isort
-    rev: 5.9.3
+  - repo: https://github.com/asottile/reorder-python-imports
+    rev: v3.12.0
     hooks:
-      - id: isort
-        name: isort (python)
+      - id: reorder-python-imports
+        name: Reorder Python imports
+        args: [--py36-plus]
         exclude: >
           (?x)^(
               .*_pb2.py
@@ -102,8 +105,8 @@ repos:
         name: Check type annotations in python files
         entry: tools/ci/check_type_comments.py
         additional_dependencies:
-          - 'mypy==0.800'
-          - 'mypy-extensions==0.4.3'
+          - 'mypy==1.0.1'
+          - 'mypy-extensions==1.0.0'
         exclude: >
           (?x)^(
               .*_pb2.py
@@ -123,3 +126,8 @@ repos:
     hooks:
       - id: file-contents-sorter
         files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt)'
+  - repo: https://github.com/espressif/esp-idf-sbom.git
+    rev: v0.13.0
+    hooks:
+      - id: validate-sbom-manifest
+        stages: [post-commit]

Kconfig

@@ -13,6 +13,10 @@ mainmenu "Espressif IoT Development Framework Configuration"
         bool
         option env="IDF_ENV_FPGA"
 
+    config IDF_CI_BUILD
+        bool
+        default y if "$(IDF_CI_BUILD)" = "y" || "$(IDF_CI_BUILD)" = 1
+
     config IDF_TARGET_ARCH_RISCV
         bool
         default "n"

components/app_trace/CMakeLists.txt

@@ -50,10 +50,12 @@ idf_component_register(SRCS "${srcs}"
                        PRIV_REQUIRES soc esp_ipc
                        LDFRAGMENTS linker.lf)
 
-# disable --coverage for this component, as it is used as transport
-# for gcov
-target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
-
-# Force app_trace to also appear later than gcov in link line
-idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+if(CONFIG_APPTRACE_GCOV_ENABLE)
+    # disable --coverage for this component, as it is used as transport
+    # for gcov
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
+    # Force app_trace to appear later than gcov in link line
+    idf_component_get_property(app_trace app_trace COMPONENT_LIB)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE
+        "-Wl,--undefined=gcov_rtio_atexit" $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+endif()

components/app_update/esp_ota_ops.c

@@ -181,13 +181,18 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
         return ESP_ERR_INVALID_ARG;
     }
 
+    if (size == 0) {
+        ESP_LOGD(TAG, "write data size is 0");
+        return ESP_OK;
+    }
+
     // find ota handle in linked list
     for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
         if (it->handle == handle) {
             if (it->need_erase) {
                 // must erase the partition before writing to it
-                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE;
-                uint32_t last_sector = (it->wrote_size + size) / SPI_FLASH_SEC_SIZE;
+                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE; // first affected sector
+                uint32_t last_sector = (it->wrote_size + size - 1) / SPI_FLASH_SEC_SIZE; // last affected sector
 
                 ret = ESP_OK;
                 if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
@@ -919,8 +924,8 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
 
         if (trusted_keys.key_digests[i] != NULL) {
             bool all_zeroes = true;
-            for (unsigned j = 0; j < ESP_SECURE_BOOT_DIGEST_LEN; j++) {
-                all_zeroes = all_zeroes && (*(uint8_t *)(trusted_keys.key_digests[i] + j) == 0);
+            for (unsigned j = 0; j < ESP_SECURE_BOOT_DIGEST_LEN; j+=4) {
+                all_zeroes = all_zeroes && (*(uint32_t *)(trusted_keys.key_digests[i] + j) == 0);
             }
             if (!all_zeroes) {
                 memcpy(trusted_digests.key_digests[trusted_digests.num_digests++], (uint8_t *)trusted_keys.key_digests[i], ESP_SECURE_BOOT_DIGEST_LEN);

components/app_update/include/esp_ota_ops.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -103,7 +103,7 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
  * @param size    Size of data buffer in bytes.
  *
  * @return
- *    - ESP_OK: Data was written to flash successfully.
+ *    - ESP_OK: Data was written to flash successfully, or size = 0
  *    - ESP_ERR_INVALID_ARG: handle is invalid.
  *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
  *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.

components/bootloader/Kconfig.projbuild

@@ -62,34 +62,66 @@ menu "Bootloader config"
         default 4 if BOOTLOADER_LOG_LEVEL_DEBUG
         default 5 if BOOTLOADER_LOG_LEVEL_VERBOSE
 
-    config BOOTLOADER_SPI_CUSTOM_WP_PIN
-        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
-        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
-        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
-        default n
-        help
-            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
-            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+    menu "Serial Flash Configurations"
+        config BOOTLOADER_SPI_CUSTOM_WP_PIN
+            bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+            depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+            default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+            default n
+            help
+                This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+                SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
 
-            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
-            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
-            for external SPIRAM if it is enabled.
+                When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+                ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+                for external SPIRAM if it is enabled.
 
-            If this config item is set to N (default), the correct WP pin will be automatically used for any
-            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
-            Y and specify the GPIO number connected to the WP.
+                If this config item is set to N (default), the correct WP pin will be automatically used for any
+                Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+                Y and specify the GPIO number connected to the WP.
 
-    config BOOTLOADER_SPI_WP_PIN
-        int "Custom SPI Flash WP Pin"
-        range 0 33
-        default 7
-        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
-        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
-        help
-            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
+        config BOOTLOADER_SPI_WP_PIN
+            int "Custom SPI Flash WP Pin"
+            range 0 33
+            default 7
+            depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+            #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
+            help
+                The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
 
-            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
-            value to the GPIO number of the SPI flash WP pin.
+                If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+                value to the GPIO number of the SPI flash WP pin.
+
+        config BOOTLOADER_FLASH_DC_AWARE
+            bool "Allow app adjust Dummy Cycle bits in SPI Flash for higher frequency (READ HELP FIRST)"
+            help
+                This will force 2nd bootloader to be loaded by DOUT mode, and will restore Dummy Cycle setting by
+                resetting the Flash
+
+        config BOOTLOADER_FLASH_XMC_SUPPORT
+            bool "Enable the support for flash chips of XMC (READ DOCS FIRST)"
+            default y
+            help
+                Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
+                XMC chips will be forbidden to be used, when this option is disabled.
+
+                DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
+
+                comment "Features below require specific hardware (READ DOCS FIRST!)"
+
+        config BOOTLOADER_FLASH_32BIT_ADDR
+            bool
+            default y if ESPTOOLPY_FLASHSIZE_32MB || ESPTOOLPY_FLASHSIZE_64MB || ESPTOOLPY_FLASHSIZE_128MB
+            default n
+            help
+                This is a helper config for 32bits address flash. Invisible for users.
+
+        config BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
+            bool
+            default y if ESPTOOLPY_OCT_FLASH && BOOTLOADER_FLASH_32BIT_ADDR
+            default n
+
+    endmenu
 
     choice BOOTLOADER_VDDSDIO_BOOST
         bool "VDDSDIO LDO voltage"
@@ -385,7 +417,6 @@ menu "Bootloader config"
 
     config BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE
         hex "Size in bytes for custom purposes"
-        range 0 0x10
         default 0
         depends on BOOTLOADER_CUSTOM_RESERVE_RTC
         help
@@ -394,14 +425,6 @@ menu "Bootloader config"
             in this area of memory, you can increase it. It must be a multiple of 4 bytes.
             This area (rtc_retain_mem_t) is reserved and has access from the bootloader and an application.
 
-    config BOOTLOADER_FLASH_XMC_SUPPORT
-        bool "Enable the support for flash chips of XMC (READ HELP FIRST)"
-        default y
-        help
-            Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
-            XMC chips will be forbidden to be used, when this option is disabled.
-
-            DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
 
 endmenu  # Bootloader
 
@@ -429,17 +452,22 @@ menu "Security features"
         select MBEDTLS_ECDSA_C
         depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE
 
+    config SECURE_ESP32_SUPPORTS_RSA
+        bool
+        default y if ESP32_REV_MIN_FULL >= 300
+        depends on IDF_TARGET_ESP32
+
     config SECURE_BOOT_SUPPORTS_RSA
         bool
         default y
-        depends on ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3
+        # RSA secure boot is supported in ESP32 revision >= v3.0
+        depends on SECURE_ESP32_SUPPORTS_RSA || IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3 # NOERROR
 
     config SECURE_TARGET_HAS_SECURE_ROM_DL_MODE
         bool
         default y
         depends on IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3
 
-
     config SECURE_SIGNED_APPS_NO_SECURE_BOOT
         bool "Require signed app images"
         depends on !SECURE_BOOT
@@ -509,7 +537,8 @@ menu "Security features"
     config SECURE_BOOT
         bool "Enable hardware Secure Boot in bootloader (READ DOCS FIRST)"
         default n
-        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || ESP32C3_REV_MIN >= 3 || IDF_TARGET_ESP32S3
+        # Secure boot is not supported for ESP32-C3 revision < v0.3
+        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || (IDF_TARGET_ESP32C3 && ESP32C3_REV_MIN_FULL >= 3) || IDF_TARGET_ESP32S3 # NOERROR
         select ESPTOOLPY_NO_STUB if !IDF_TARGET_ESP32 && !IDF_TARGET_ESP32S2
         help
             Build a bootloader which enables Secure Boot on first boot.
@@ -522,7 +551,7 @@ menu "Security features"
 
     choice SECURE_BOOT_VERSION
         bool "Select secure boot version"
-        default SECURE_BOOT_V2_ENABLED if ESP32_REV_MIN_3
+        default SECURE_BOOT_V2_ENABLED if ESP32_REV_MIN_FULL >= 300
         depends on SECURE_BOOT
         help
             Select the Secure Boot Version. Depends on the Chip Revision.
@@ -875,7 +904,7 @@ menu "Security features"
         default SECURE_ENABLE_SECURE_ROM_DL_MODE if SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT # NOERROR
         default SECURE_INSECURE_ALLOW_DL_MODE
         depends on SECURE_BOOT_V2_ENABLED || SECURE_FLASH_ENC_ENABLED
-        depends on !IDF_TARGET_ESP32 || ESP32_REV_MIN_3
+        depends on !(IDF_TARGET_ESP32 && ESP32_REV_MIN_FULL < 300)
 
         config SECURE_DISABLE_ROM_DL_MODE
             bool "UART ROM download mode (Permanently disabled (recommended))"
@@ -901,9 +930,9 @@ menu "Security features"
                 Download Mode into a separate Secure Download mode. This option can only work if
                 Download Mode is not already disabled by eFuse.
 
-                Secure Download mode limits the use of Download Mode functions to simple flash read,
-                write and erase operations, plus a command to return a summary of currently enabled
-                security features.
+                Secure Download mode limits the use of Download Mode functions to update SPI config,
+                changing baud rate, basic flash write and a command to return a summary of currently
+                enabled security features (`get_security_info`).
 
                 Secure Download mode is not compatible with the esptool.py flasher stub feature,
                 espefuse.py, read/writing memory or registers, encrypted download, or any other

components/bootloader/sdkconfig.rename

@@ -23,3 +23,5 @@ CONFIG_FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_CACHE         CONFIG_SECURE_FLASH_
 
 # Secure Boot Scheme
 CONFIG_SECURE_BOOT_ENABLED                                  CONFIG_SECURE_BOOT_V1_ENABLED
+
+CONFIG_SPI_FLASH_OCTAL_32BIT_ADDR_ENABLE                    CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH

components/bootloader/subproject/main/component.mk

@@ -17,7 +17,7 @@ ifdef CONFIG_IDF_TARGET_ESP32
     ifndef CONFIG_SPI_FLASH_ROM_DRIVER_PATCH
         LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.spiflash.ld
     endif
-    ifdef CONFIG_ESP32_REV_MIN_3
+    ifeq ($(shell expr $(CONFIG_ESP32_REV_MIN_FULL) \>= 300), 1)
         LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.eco3.ld
     endif
 endif

components/bootloader/subproject/main/ld/esp32/bootloader.ld

@@ -44,7 +44,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@@ -60,6 +60,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
     *libefuse.a:*.*(.literal .text .literal.* .text.*)
@@ -182,4 +183,23 @@ SECTIONS
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader/subproject/main/ld/esp32c3/bootloader.ld

@@ -1,16 +1,50 @@
 /** Simplified memory map for the bootloader.
  *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-C3 ROM static data usage is as follows:
+ *  - 0x3fccae00 - 0x3fcdc710: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdc710 - 0x3fcde710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcde710 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fcdc710).
  */
 
+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fcdc710 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdc710;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }
 
+/* The app may use RAM for static allocations up to the start of iram_loader_seg.
+ * If you have changed something above and this assert fails:
+ * 1. Check what the new value of bootloader_iram_loader_seg start is.
+ * 2. Update the value in this assert.
+ * 3. Update (SRAM_DRAM_END + I_D_SRAM_OFFSET) in components/esp_system/ld/esp32c3/memory.ld.in to the same value.
+ */
+ASSERT(bootloader_iram_loader_seg_start == 0x403ce710, "bootloader_iram_loader_seg_start inconsistent with SRAM_DRAM_END");
+
 /* Default entry point: */
 ENTRY(call_start_cpu0);
 
@@ -31,7 +65,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    *libbootloader_support.a:bootloader_efuse_esp32c3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@@ -47,6 +81,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@@ -176,17 +211,34 @@ SECTIONS
 /**
  *  Appendix: Memory Usage of ROM bootloader
  *
- *  +--------+--------------+------+ 0x3FCC_AE00
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_C710
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_E710
+ * 0x3fccae00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdc710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcde710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdf060 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdf664 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdf830 ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
  */

components/bootloader/subproject/main/ld/esp32h2/bootloader.ld

@@ -1,14 +1,40 @@
 /** Simplified memory map for the bootloader.
  *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-H2 ROM static data usage is as follows:
+ *  - 0x3fccb900 - 0x3fcdd210: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdd210 - 0x3fcdf210: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdf210 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
  */
 
+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdd120;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }
 
 /* Default entry point: */
@@ -31,7 +57,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    *libbootloader_support.a:bootloader_efuse_esp32h2.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@@ -45,6 +71,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@@ -173,17 +200,34 @@ SECTIONS
 /**
  *  Appendix: Memory Usage of ROM bootloader
  *
- *  +--------+--------------+------+ 0x3FCC_B900
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_D210
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_F210
+ * 0x3fccb81c ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdd120 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdf120 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdfa6c ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfe40 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfe4c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
  */

components/bootloader/subproject/main/ld/esp32s2/bootloader.ld

@@ -31,7 +31,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@@ -47,6 +47,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@@ -170,4 +171,23 @@ SECTIONS
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader/subproject/main/ld/esp32s3/bootloader.ld

@@ -66,7 +66,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32s3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@@ -82,6 +82,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
     *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@@ -205,4 +206,62 @@ SECTIONS
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }
+
+/**
+ *  Appendix: Memory Usage of ROM bootloader
+ *
+ * 0x3fcd7e00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fce9710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fceb710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x3fced710 ------------------> __stack_app (app cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fceee34 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcef770 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcef81c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fcf0000 ------------------> _data_end_interface
+ */

components/bootloader_support/CMakeLists.txt

@@ -13,7 +13,7 @@ set(srcs
     "src/flash_partitions.c"
     "src/flash_qio_mode.c"
     "src/bootloader_flash_config_${IDF_TARGET}.c"
-    "src/bootloader_efuse_${IDF_TARGET}.c"
+    "src/bootloader_efuse.c"
     )
 
 if(BOOTLOADER_BUILD)

components/bootloader_support/include/bootloader_common.h

@@ -26,7 +26,7 @@
 extern "C" {
 #endif
 
-/// Type of hold a GPIO in low state
+// Type of hold a GPIO in low state
 typedef enum {
     GPIO_LONG_HOLD  = 1,    /*!< The long hold GPIO */
     GPIO_SHORT_HOLD = -1,   /*!< The short hold GPIO */
@@ -187,13 +187,6 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,
  */
 esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc);
 
-/**
- * @brief Get chip revision
- *
- * @return Chip revision number
- */
-uint8_t bootloader_common_get_chip_revision(void);
-
 /**
  * @brief Get chip package
  *

components/bootloader_support/include/bootloader_flash.h

@@ -9,6 +9,17 @@
 #include <esp_spi_flash.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#if CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/spi_flash.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/rom/spi_flash.h"
+#elif CONFIG_IDF_TARGET_ESP32C3
+#include "esp32c3/rom/spi_flash.h"
+#elif CONFIG_IDF_TARGET_ESP32H2
+#include "esp32h2/rom/spi_flash.h"
+#endif
 #include "bootloader_flash_override.h"
 
 #ifdef __cplusplus
@@ -48,6 +59,12 @@ esp_err_t bootloader_flash_xmc_startup(void);
   */
 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
 
+/**
+ * @brief Get the spi flash working mode.
+ *
+ * @return The mode of flash working mode, see `esp_rom_spiflash_read_mode_t`
+ */
+esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void);
 
 #ifdef __cplusplus
 }

components/bootloader_support/include/bootloader_flash_override.h

@@ -96,6 +96,18 @@ extern const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_sup
   */
 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
 
+#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
+/**
+ * @brief Enable 32bits address flash(larger than 16MB) can map to cache.
+ *
+ * @param flash_mode SPI flash working mode.
+ *
+ * @note This can be overridden because it's attribute weak.
+ */
+void __attribute__((weak)) bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode);
+#endif
+
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/esp_app_format.h

@@ -6,6 +6,7 @@
 #pragma once
 
 #include <inttypes.h>
+#include "esp_assert.h"
 
 /**
  * @brief ESP chip ID
@@ -21,7 +22,7 @@ typedef enum {
 } __attribute__((packed)) esp_chip_id_t;
 
 /** @cond */
-_Static_assert(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
+ESP_STATIC_ASSERT(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
 /** @endcond */
 
 /**
@@ -78,8 +79,15 @@ typedef struct {
                                 * pin and sets this field to 0xEE=disabled) */
     uint8_t spi_pin_drv[3];     /*!< Drive settings for the SPI flash pins (read by ROM bootloader) */
     esp_chip_id_t chip_id;      /*!< Chip identification number */
-    uint8_t min_chip_rev;       /*!< Minimum chip revision supported by image */
-    uint8_t reserved[8];       /*!< Reserved bytes in additional header space, currently unused */
+    uint8_t min_chip_rev;       /*!< Minimal chip revision supported by image
+                                 * After the Major and Minor revision eFuses were introduced into the chips, this field is no longer used.
+                                 * But for compatibility reasons, we keep this field and the data in it.
+                                 * Use min_chip_rev_full instead.
+                                 * The software interprets this as a Major version for most of the chips and as a Minor version for the ESP32-C3.
+                                 */
+    uint16_t min_chip_rev_full; /*!< Minimal chip revision supported by image, in format: major * 100 + minor */
+    uint16_t max_chip_rev_full; /*!< Maximal chip revision supported by image, in format: major * 100 + minor */
+    uint8_t reserved[4];        /*!< Reserved bytes in additional header space, currently unused */
     uint8_t hash_appended;      /*!< If 1, a SHA256 digest "simple hash" (of the entire image) is appended after the checksum.
                                  * Included in image length. This digest
                                  * is separate to secure boot and only used for detecting corruption.
@@ -88,7 +96,7 @@ typedef struct {
 } __attribute__((packed))  esp_image_header_t;
 
 /** @cond */
-_Static_assert(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");
+ESP_STATIC_ASSERT(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");
 /** @endcond */
 
 
@@ -122,4 +130,5 @@ typedef struct {
 
 /** @cond */
 _Static_assert(sizeof(esp_app_desc_t) == 256, "esp_app_desc_t should be 256 bytes");
+_Static_assert(offsetof(esp_app_desc_t, secure_version) == 4, "secure_version field must be at 4 offset");
 /** @endcond */

components/bootloader_support/include/esp_flash_encrypt.h

@@ -12,6 +12,7 @@
 #include "esp_spi_flash.h"
 #endif
 #include "soc/efuse_periph.h"
+#include "hal/efuse_hal.h"
 #include "sdkconfig.h"
 
 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
@@ -46,19 +47,15 @@ typedef enum {
  */
 static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_enabled(void)
 {
+#ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+    return efuse_hal_flash_encryption_enabled();
+#else
+
     uint32_t flash_crypt_cnt = 0;
 #if CONFIG_IDF_TARGET_ESP32
-    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-        flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
-    #else
-        esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
-    #endif
+    esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
 #else
-    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-        flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
-    #else
-        esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
-    #endif
+    esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
 #endif
     /* __builtin_parity is in flash, so we calculate parity inline */
     bool enabled = false;
@@ -69,6 +66,7 @@ static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_e
         flash_crypt_cnt >>= 1;
     }
     return enabled;
+#endif // CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
 }
 
 /* @brief Update on-device flash encryption

components/bootloader_support/include/esp_image_format.h

@@ -9,6 +9,7 @@
 #include <esp_err.h>
 #include "esp_flash_partitions.h"
 #include "esp_app_format.h"
+#include "esp_assert.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -32,6 +33,7 @@ typedef struct {
   uint32_t segment_data[ESP_IMAGE_MAX_SEGMENTS]; /* Data offsets for each segment */
   uint32_t image_len; /* Length of image on flash, in bytes */
   uint8_t image_digest[32]; /* appended SHA-256 digest */
+  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
 } esp_image_metadata_t;
 
 typedef enum {
@@ -53,12 +55,18 @@ typedef struct {
     uint32_t crc;                   /*!< Check sum crc32 */
 } rtc_retain_mem_t;
 
+
+ESP_STATIC_ASSERT(offsetof(rtc_retain_mem_t, crc) == sizeof(rtc_retain_mem_t) - sizeof(uint32_t), "CRC field must be the last field of rtc_retain_mem_t structure");
+
 #ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
-_Static_assert(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+ESP_STATIC_ASSERT(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+/* The custom field must be the penultimate field */
+ESP_STATIC_ASSERT(offsetof(rtc_retain_mem_t, custom) == sizeof(rtc_retain_mem_t) - sizeof(uint32_t) - CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE,
+               "custom field in rtc_retain_mem_t structure must be the field before the CRC one");
 #endif
 
 #if defined(CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP) || defined(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC)
-_Static_assert(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+ESP_STATIC_ASSERT(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
 #endif
 
 #ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
@@ -68,7 +76,7 @@ _Static_assert(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_R
 #endif
 
 #if defined(CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP) || defined(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC)
-_Static_assert(sizeof(rtc_retain_mem_t) <= ESP_BOOTLOADER_RESERVE_RTC, "Reserved RTC area must exceed size of rtc_retain_mem_t");
+ESP_STATIC_ASSERT(sizeof(rtc_retain_mem_t) <= ESP_BOOTLOADER_RESERVE_RTC, "Reserved RTC area must exceed size of rtc_retain_mem_t");
 #endif
 
 /**

components/bootloader_support/include/esp_secure_boot.h

@@ -200,7 +200,7 @@ typedef struct {
  */
 esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
 
-#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3
+#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_FULL >= 300
 /**
  * @brief Structure to hold public key digests calculated from the signature blocks of a single image.
  *
@@ -223,7 +223,7 @@ typedef struct {
  *
  */
 esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
-#endif // !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3
+#endif // !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_FULL >= 300
 
 /** @brief Legacy ECDSA verification function
  *

components/bootloader_support/include_bootloader/bootloader_flash_priv.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -24,14 +24,19 @@
 #define CMD_RDID       0x9F
 #define CMD_WRSR       0x01
 #define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
+#define CMD_WRSR3      0x11 /* Not all SPI flash uses this command */
 #define CMD_WREN       0x06
+#define CMD_WRENVSR    0x50 /* Flash write enable for volatile SR bits */
 #define CMD_WRDI       0x04
 #define CMD_RDSR       0x05
 #define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_RDSR3      0x15 /* Not all SPI flash uses this command */
 #define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 #define CMD_RDSFDP     0x5A /* Read the SFDP of the flash */
 #define CMD_WRAP       0x77 /* Set burst with wrap command */
 #define CMD_RESUME     0x7A /* Resume command to clear flash suspend bit */
+#define CMD_FASTRD_4B       0x0C
+#define CMD_SLOWRD_4B       0x13
 
 
 /* Provide a Flash API for bootloader_support code,
@@ -171,4 +176,12 @@ uint32_t bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_n
  */
 void bootloader_enable_wp(void);
 
+/**
+ * @brief Once this function is called,
+ * any on-going internal operations will be terminated and the device will return to its default power-on
+ * state and lose all the current volatile settings, such as Volatile Status Register bits, Write Enable Latch
+ * (WEL) status, Program/Erase Suspend status, etc.
+ */
+void bootloader_spi_flash_reset(void);
+
 #endif

components/bootloader_support/src/bootloader_clock_init.c

@@ -7,10 +7,12 @@
 #include "soc/soc.h"
 #include "soc/rtc.h"
 #include "soc/efuse_periph.h"
+#include "soc/chip_revision.h"
 #include "soc/rtc_cntl_reg.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "soc/dport_reg.h"
 #endif
+#include "hal/efuse_hal.h"
 #include "esp_rom_sys.h"
 #include "esp_rom_uart.h"
 
@@ -32,8 +34,7 @@ __attribute__((weak)) void bootloader_clock_configure(void)
      * document). For rev. 0, switch to 240 instead if it has been enabled
      * previously.
      */
-    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
-    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
+    if (!ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 100) &&
             DPORT_REG_GET_FIELD(DPORT_CPU_PER_CONF_REG, DPORT_CPUPERIOD_SEL) == DPORT_CPUPERIOD_SEL_240) {
         cpu_freq_mhz = 240;
     }

components/bootloader_support/src/bootloader_common_loader.c

@@ -22,6 +22,9 @@
 #include "soc/gpio_periph.h"
 #include "soc/rtc.h"
 #include "soc/efuse_reg.h"
+#include "soc/chip_revision.h"
+#include "hal/efuse_ll.h"
+#include "hal/efuse_hal.h"
 #include "soc/soc_memory_types.h"
 #include "hal/gpio_ll.h"
 #include "esp_image_format.h"
@@ -30,6 +33,7 @@
 #include "bootloader_flash_priv.h"
 
 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
+#define IS_MAX_REV_SET(max_chip_rev_full) (((max_chip_rev_full) != 65535) && ((max_chip_rev_full) != 0))
 
 static const char* TAG = "boot_comm";
 
@@ -59,28 +63,38 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata)
     return bootloader_common_select_otadata(two_otadata, valid_two_otadata, true);
 }
 
-esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
+esp_err_t __attribute__((optimize("-Os"))) bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
 {
     esp_err_t err = ESP_OK;
     esp_chip_id_t chip_id = CONFIG_IDF_FIRMWARE_CHIP_ID;
     if (chip_id != img_hdr->chip_id) {
         ESP_LOGE(TAG, "mismatch chip ID, expected %d, found %d", chip_id, img_hdr->chip_id);
         err = ESP_FAIL;
-    }
-
+    } else {
 #ifndef CONFIG_IDF_ENV_FPGA
-    uint8_t revision = bootloader_common_get_chip_revision();
-    if (revision < img_hdr->min_chip_rev) {
-        /* To fix this error, please update mininum supported chip revision from configuration,
-         * located in TARGET (e.g. ESP32) specific options under "Component config" menu */
-        ESP_LOGE(TAG, "This chip is revision %d but the application is configured for minimum revision %d. Can't run.", revision, img_hdr->min_chip_rev);
-        err = ESP_FAIL;
-    } else if (revision != img_hdr->min_chip_rev) {
-#ifdef BOOTLOADER_BUILD
-        ESP_LOGI(TAG, "chip revision: %d, min. %s chip revision: %d", revision, type == ESP_IMAGE_BOOTLOADER ? "bootloader" : "application", img_hdr->min_chip_rev);
-#endif
-    }
+        unsigned revision = efuse_hal_chip_revision();
+        unsigned int major_rev = revision / 100;
+        unsigned int minor_rev = revision % 100;
+        unsigned min_rev = img_hdr->min_chip_rev_full;
+        if (type == ESP_IMAGE_BOOTLOADER || type == ESP_IMAGE_APPLICATION) {
+            if (!ESP_CHIP_REV_ABOVE(revision, min_rev)) {
+                ESP_LOGE(TAG, "Image requires chip rev >= v%d.%d, but chip is v%d.%d",
+                         min_rev / 100, min_rev % 100,
+                         major_rev, minor_rev);
+                err = ESP_FAIL;
+            }
+        }
+        if (type == ESP_IMAGE_APPLICATION) {
+            unsigned max_rev = img_hdr->max_chip_rev_full;
+            if ((IS_MAX_REV_SET(max_rev) && (revision > max_rev) && !efuse_ll_get_disable_wafer_version_major())) {
+                ESP_LOGE(TAG, "Image requires chip rev <= v%d.%d, but chip is v%d.%d",
+                         max_rev / 100, max_rev % 100,
+                         major_rev, minor_rev);
+                err = ESP_FAIL;
+            }
+        }
 #endif // CONFIG_IDF_ENV_FPGA
+    }
 
     return err;
 }
@@ -139,6 +153,8 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
 
 #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
 
+_Static_assert(RTC_RETAIN_MEM_ADDR >= SOC_RTC_DRAM_LOW, "rtc_retain_mem_t structure size is bigger than the RTC memory size. Consider reducing RTC reserved memory size.");
+
 rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
 
 #ifndef BOOTLOADER_BUILD
@@ -151,14 +167,25 @@ rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR
 SOC_RESERVE_MEMORY_REGION(RTC_RETAIN_MEM_ADDR, RTC_RETAIN_MEM_ADDR + sizeof(rtc_retain_mem_t), rtc_retain_mem);
 #endif
 
+static uint32_t rtc_retain_mem_size(void) {
+#ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
+    /* A custom memory has been reserved by the user, do not consider this memory into CRC calculation as it may change without
+     * the have the user updating the CRC. Return the offset of the custom field, which is equivalent to size of the structure
+     * minus the size of everything after (including) `custom` */
+    return offsetof(rtc_retain_mem_t, custom);
+#else
+    return sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc);
+#endif
+}
+
 static bool check_rtc_retain_mem(void)
 {
-    return esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc)) == rtc_retain_mem->crc && rtc_retain_mem->crc != UINT32_MAX;
+    return esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size()) == rtc_retain_mem->crc && rtc_retain_mem->crc != UINT32_MAX;
 }
 
 static void update_rtc_retain_mem_crc(void)
 {
-    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc));
+    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size());
 }
 
 void bootloader_common_reset_rtc_retain_mem(void)

components/bootloader_support/src/bootloader_console.c

@@ -26,6 +26,9 @@
 #include "esp32h2/rom/ets_sys.h"
 #include "esp32h2/rom/uart.h"
 #endif
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+#include "hal/usb_phy_ll.h"
+#endif
 #include "esp_rom_gpio.h"
 #include "esp_rom_uart.h"
 #include "esp_rom_sys.h"
@@ -44,12 +47,7 @@ void bootloader_console_init(void)
 {
     const int uart_num = CONFIG_ESP_CONSOLE_UART_NUM;
 
-#if !ESP_ROM_SUPPORT_MULTIPLE_UART
-    /* esp_rom_install_channel_put is not available unless multiple UARTs are supported */
     esp_rom_install_uart_printf();
-#else
-    esp_rom_install_channel_putc(1, esp_rom_uart_putc);
-#endif
 
     // Wait for UART FIFO to be empty.
     esp_rom_uart_tx_wait_idle(0);
@@ -58,10 +56,10 @@ void bootloader_console_init(void)
     // Some constants to make the following code less upper-case
     const int uart_tx_gpio = CONFIG_ESP_CONSOLE_UART_TX_GPIO;
     const int uart_rx_gpio = CONFIG_ESP_CONSOLE_UART_RX_GPIO;
+
     // Switch to the new UART (this just changes UART number used for esp_rom_printf in ROM code).
-#if ESP_ROM_SUPPORT_MULTIPLE_UART
     esp_rom_uart_set_as_console(uart_num);
-#endif
+
     // If console is attached to UART1 or if non-default pins are used,
     // need to reconfigure pins using GPIO matrix
     if (uart_num != 0 ||
@@ -109,6 +107,10 @@ void bootloader_console_init(void)
     esp_rom_uart_usb_acm_init(s_usb_cdc_buf, sizeof(s_usb_cdc_buf));
     esp_rom_uart_set_as_console(ESP_ROM_UART_USB);
     esp_rom_install_channel_putc(1, bootloader_console_write_char_usb);
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+    usb_phy_ll_usb_wrap_pad_enable(&USB_WRAP, true);
+    usb_phy_ll_int_otg_enable(&USB_WRAP);
+#endif
 }
 #endif //CONFIG_ESP_CONSOLE_USB_CDC
 

components/bootloader_support/src/bootloader_efuse.c

@@ -0,0 +1,37 @@
+/*
+ * SPDX-FileCopyrightText: 2019-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <stdint.h>
+#include "sdkconfig.h"
+#include "bootloader_common.h"
+#include "hal/efuse_ll.h"
+#include "hal/efuse_hal.h"
+#include "esp_attr.h"
+
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
+{
+    return efuse_ll_get_chip_ver_pkg();
+}
+
+int bootloader_clock_get_rated_freq_mhz(void)
+{
+#ifdef CONFIG_IDF_TARGET_ESP32
+    return efuse_hal_get_rated_freq_mhz();
+
+#elif CONFIG_IDF_TARGET_ESP32C3
+    return 160;
+
+#elif CONFIG_IDF_TARGET_ESP32H2
+    return 96;
+
+#elif CONFIG_IDF_TARGET_ESP32S2
+    return 240;
+
+#elif CONFIG_IDF_TARGET_ESP32S3
+    return 240;
+
+#endif
+}

components/bootloader_support/src/bootloader_efuse_esp32.c

@@ -1,61 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2019-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "bootloader_common.h"
-#include "bootloader_clock.h"
-#include "soc/efuse_reg.h"
-#include "soc/syscon_reg.h"
-#include "esp_attr.h"
-
-IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
-{
-    uint8_t eco_bit0, eco_bit1, eco_bit2;
-    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
-    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
-    eco_bit2 = (REG_READ(SYSCON_DATE_REG) & 0x80000000) >> 31;
-    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
-    uint8_t chip_ver = 0;
-    switch (combine_value) {
-    case 0:
-        chip_ver = 0;
-        break;
-    case 1:
-        chip_ver = 1;
-        break;
-    case 3:
-        chip_ver = 2;
-        break;
-#if CONFIG_IDF_ENV_FPGA
-    case 4: /* Empty efuses, but SYSCON_DATE_REG bit is set */
-        chip_ver = 3;
-        break;
-#endif
-    case 7:
-        chip_ver = 3;
-        break;
-    default:
-        chip_ver = 0;
-        break;
-    }
-    return chip_ver;
-}
-
-IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    uint32_t pkg_version = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-    uint32_t pkg_version_4bit = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG_4BIT);
-    return (pkg_version_4bit << 3) | pkg_version;
-}
-
-int bootloader_clock_get_rated_freq_mhz()
-{
-    //Check if ESP32 is rated for a CPU frequency of 160MHz only
-    if (REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_RATED) &&
-        REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_LOW)) {
-        return 160;
-    }
-    return 240;
-}

components/bootloader_support/src/bootloader_efuse_esp32c3.c

@@ -1,21 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-#include "soc/efuse_reg.h"
-#include "esp_attr.h"
-
-IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
-}
-
-IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
-}

components/bootloader_support/src/bootloader_efuse_esp32h2.c

@@ -1,21 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-#include "soc/efuse_reg.h"
-#include "esp_attr.h"
-
-IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
-}
-
-IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
-}

components/bootloader_support/src/bootloader_efuse_esp32s2.c

@@ -1,23 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2019-2022 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "sdkconfig.h"
-#include "bootloader_clock.h"
-#include "bootloader_common.h"
-#include "soc/efuse_reg.h"
-#include "esp_attr.h"
-
-IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
-}
-
-IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_4_REG, EFUSE_PKG_VERSION);
-}

components/bootloader_support/src/bootloader_efuse_esp32s3.c

@@ -1,21 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-#include "esp_attr.h"
-
-IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    /* No other revisions for ESP32-S3 */
-    return 0;
-}
-
-IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return 0;
-}

components/bootloader_support/src/bootloader_flash.c

@@ -10,6 +10,7 @@
 #include <esp_flash_encrypt.h>
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#include "hal/efuse_hal.h"
 
 #if CONFIG_IDF_TARGET_ESP32
 #   include "soc/spi_struct.h"
@@ -36,7 +37,7 @@
 #endif
 
 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-#define ENCRYPTION_IS_VIRTUAL 1
+#define ENCRYPTION_IS_VIRTUAL (!efuse_hal_flash_encryption_enabled())
 #else
 #define ENCRYPTION_IS_VIRTUAL 0
 #endif
@@ -144,6 +145,11 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
 #include "esp32h2/rom/cache.h"
 #include "soc/cache_memory.h"
 #endif
+
+#if CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/rom/opi_flash.h"
+#endif
+
 static const char *TAG = "bootloader_flash";
 
 #if CONFIG_IDF_TARGET_ESP32
@@ -481,6 +487,34 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
     return spi_to_esp_err(rc);
 }
 
+#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
+void bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)
+{
+    esp_rom_opiflash_spi0rd_t cache_rd = {};
+    switch (flash_mode) {
+    case ESP_ROM_SPIFLASH_FASTRD_MODE:
+        cache_rd.addr_bit_len = 32;
+        cache_rd.dummy_bit_len = 8;
+        cache_rd.cmd = CMD_FASTRD_4B;
+        cache_rd.cmd_bit_len = 8;
+        break;
+     case ESP_ROM_SPIFLASH_SLOWRD_MODE:
+        cache_rd.addr_bit_len = 32;
+        cache_rd.dummy_bit_len = 0;
+        cache_rd.cmd = CMD_SLOWRD_4B;
+        cache_rd.cmd_bit_len = 8;
+        break;
+    default:
+        assert(false);
+        break;
+    }
+    uint32_t autoload = Cache_Suspend_DCache();
+    esp_rom_opiflash_cache_mode_config(flash_mode, &cache_rd);
+    Cache_Resume_DCache(autoload);
+}
+#endif
+
+
 #endif // BOOTLOADER_BUILD
 
 
@@ -573,7 +607,7 @@ esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
 #ifndef g_rom_spiflash_dummy_len_plus // ESP32-C3 uses a macro to access ROM data here
 extern uint8_t g_rom_spiflash_dummy_len_plus[];
 #endif
-IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
+IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
     uint8_t command,
     uint32_t addr_len, uint32_t address,
     uint8_t dummy_len,
@@ -603,14 +637,12 @@ IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
     SPIFLASH.addr = address;
 #endif
     //dummy phase
+    uint32_t total_dummy = dummy_len;
     if (miso_len > 0) {
-        uint32_t total_dummy = dummy_len + g_rom_spiflash_dummy_len_plus[1];
-        SPIFLASH.user.usr_dummy = total_dummy > 0;
-        SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
-    } else {
-        SPIFLASH.user.usr_dummy = 0;
-        SPIFLASH.user1.usr_dummy_cyclelen = 0;
+        total_dummy += g_rom_spiflash_dummy_len_plus[1];
     }
+    SPIFLASH.user.usr_dummy = total_dummy > 0;
+    SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
     //output data
     SPIFLASH.user.usr_mosi = mosi_len > 0;
 #if CONFIG_IDF_TARGET_ESP32
@@ -679,6 +711,12 @@ uint32_t IRAM_ATTR bootloader_read_flash_id(void)
     return id;
 }
 
+void bootloader_spi_flash_reset(void)
+{
+    bootloader_execute_flash_command(0x66, 0, 0, 0);
+    bootloader_execute_flash_command(0x99, 0, 0, 0);
+}
+
 #if SOC_CACHE_SUPPORT_WRAP
 esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode)
 {
@@ -811,3 +849,40 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
 }
 
 #endif //XMC_SUPPORT
+
+esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void)
+{
+    esp_rom_spiflash_read_mode_t spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
+#if CONFIG_IDF_TARGET_ESP32
+    uint32_t spi_ctrl = REG_READ(SPI_CTRL_REG(0));
+    if (spi_ctrl & SPI_FREAD_QIO) {
+        spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
+    } else if (spi_ctrl & SPI_FREAD_QUAD) {
+        spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
+    } else if (spi_ctrl & SPI_FREAD_DIO) {
+        spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
+    } else if (spi_ctrl & SPI_FREAD_DUAL) {
+        spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
+    } else if (spi_ctrl & SPI_FASTRD_MODE) {
+        spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
+    } else {
+        spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
+    }
+#else
+    uint32_t spi_ctrl = REG_READ(SPI_MEM_CTRL_REG(0));
+    if (spi_ctrl & SPI_MEM_FREAD_QIO) {
+        spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
+    } else if (spi_ctrl & SPI_MEM_FREAD_QUAD) {
+        spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
+    } else if (spi_ctrl & SPI_MEM_FREAD_DIO) {
+        spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
+    } else if (spi_ctrl & SPI_MEM_FREAD_DUAL) {
+        spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
+    } else if (spi_ctrl & SPI_MEM_FASTRD_MODE) {
+        spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
+    } else {
+        spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
+    }
+#endif
+    return spi_mode;
+}

components/bootloader_support/src/bootloader_flash_config_esp32.c

@@ -17,6 +17,8 @@
 #include "soc/spi_reg.h"
 #include "soc/soc_caps.h"
 #include "soc/soc_pins.h"
+#include "soc/chip_revision.h"
+#include "hal/efuse_hal.h"
 #include "hal/gpio_hal.h"
 #include "flash_qio_mode.h"
 #include "bootloader_common.h"
@@ -168,16 +170,13 @@ int bootloader_flash_get_wp_pin(void)
     return CONFIG_SPIRAM_SPIWP_SD3_PIN; // can be set for app when DIO or DOUT config used for PSRAM only
 #else
     // no custom value, find it based on the package eFuse value
-    uint8_t chip_ver;
-    uint32_t pkg_ver = bootloader_common_get_chip_ver_pkg();
-    switch(pkg_ver) {
+    switch(bootloader_common_get_chip_ver_pkg()) {
     case EFUSE_RD_CHIP_VER_PKG_ESP32U4WDH:
     case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
         return ESP32_D2WD_WP_GPIO;
     case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
         /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
-        chip_ver = bootloader_common_get_chip_revision();
-        return (chip_ver < 3) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
+        return !ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 300) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
     case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
         return ESP32_PICO_V3_GPIO;
     default:

components/bootloader_support/src/bootloader_init.c

@@ -18,6 +18,7 @@
 #include "soc/cpu.h"
 #include "soc/rtc.h"
 #include "hal/wdt_hal.h"
+#include "hal/efuse_hal.h"
 
 static const char *TAG = "boot";
 
@@ -40,9 +41,10 @@ esp_err_t bootloader_read_bootloader_header(void)
 
 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    /* read chip revision from efuse */
-    uint8_t revision = bootloader_common_get_chip_revision();
-    ESP_LOGI(TAG, "chip revision: %d", revision);
+    unsigned revision = efuse_hal_chip_revision();
+    unsigned major = revision / 100;
+    unsigned minor = revision % 100;
+    ESP_LOGI(TAG, "chip revision: v%d.%d", major, minor);
     /* compare with the one set in bootloader image header */
     if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
         return ESP_FAIL;
@@ -92,4 +94,12 @@ void bootloader_print_banner(void)
 {
     ESP_LOGI(TAG, "ESP-IDF %s 2nd stage bootloader", IDF_VER);
     ESP_LOGI(TAG, "compile time " __TIME__);
+
+#if CONFIG_FREERTOS_UNICORE
+#if (SOC_CPU_CORES_NUM > 1)
+    ESP_EARLY_LOGW(TAG, "Unicore bootloader");
+#endif
+#else
+    ESP_EARLY_LOGI(TAG, "Multicore bootloader");
+#endif
 }

components/bootloader_support/src/bootloader_panic.c

@@ -12,7 +12,11 @@
 
 void __assert_func(const char *file, int line, const char *func, const char *expr)
 {
+
+#if !CONFIG_OPTIMIZATION_ASSERTIONS_SILENT
     esp_rom_printf("Assert failed in %s, %s:%d (%s)\r\n", func, file, line, expr);
+#endif
+
     while (1) {
     }
 }

components/bootloader_support/src/bootloader_random_esp32s3.c

@@ -83,8 +83,6 @@ void bootloader_random_disable(void)
     REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
     REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
 
-    //Stop SAR ADC clock
-    CLEAR_PERI_REG_MASK(SENS_SAR_PERI_CLK_GATE_CONF_REG, SENS_SARADC_CLK_EN);
     //Power off SAR ADC
     REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0);
     //return to ADC RTC controller

components/bootloader_support/src/esp32/bootloader_soc.c

@@ -3,18 +3,10 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  */
+
 #include <stdbool.h>
 
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    (void)enable;
-}
-
-void bootloader_ana_bod_reset_config(bool enable)
-{
-    (void)enable;
-}
-
+//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
     (void)enable;

components/bootloader_support/src/esp32c3/bootloader_esp32c3.c

@@ -23,6 +23,7 @@
 #include "soc/extmem_reg.h"
 #include "soc/io_mux_reg.h"
 #include "soc/system_reg.h"
+#include "soc/chip_revision.h"
 #include "esp32c3/rom/efuse.h"
 #include "esp32c3/rom/spi_flash.h"
 #include "esp32c3/rom/cache.h"
@@ -38,6 +39,7 @@
 #include "bootloader_flash_priv.h"
 #include "bootloader_soc.h"
 #include "esp_efuse.h"
+#include "hal/efuse_hal.h"
 
 static const char *TAG = "boot.esp32c3";
 
@@ -258,7 +260,7 @@ static inline void bootloader_hardware_init(void)
 {
     // This check is always included in the bootloader so it can
     // print the minimum revision error message later in the boot
-    if (bootloader_common_get_chip_revision() < 3) {
+    if (!ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 3)) {
         REGI2C_WRITE_MASK(I2C_ULP, I2C_ULP_IR_FORCE_XPD_IPH, 1);
         REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_1P1_PVT, 12);
     }
@@ -266,30 +268,29 @@ static inline void bootloader_hardware_init(void)
 
 static inline void bootloader_ana_reset_config(void)
 {
+    //Enable super WDT reset.
+    bootloader_ana_super_wdt_reset_config(true);
+
     /*
-      For origin chip & ECO1: only support swt reset;
-      For ECO2: fix brownout reset bug, support swt & brownout reset;
-      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
+      For origin chip & ECO1: brownout & clock glitch reset not available
+      For ECO2: fix brownout reset bug
+      For ECO3: fix clock glitch reset bug
     */
-    uint8_t chip_version = bootloader_common_get_chip_revision();
-    switch (chip_version) {
+    switch (efuse_hal_chip_revision()) {
         case 0:
         case 1:
-            //Enable WDT reset. Disable BOR and GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Disable BOD and GLITCH reset
             bootloader_ana_bod_reset_config(false);
             bootloader_ana_clock_glitch_reset_config(false);
             break;
         case 2:
-            //Enable WDT and BOR reset. Disable GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Enable BOD reset. Disable GLITCH reset
             bootloader_ana_bod_reset_config(true);
             bootloader_ana_clock_glitch_reset_config(false);
             break;
         case 3:
         default:
-            //Enable WDT, BOR, and GLITCH reset
-            bootloader_ana_super_wdt_reset_config(true);
+            //Enable BOD, and GLITCH reset
             bootloader_ana_bod_reset_config(true);
             bootloader_ana_clock_glitch_reset_config(true);
             break;

components/bootloader_support/src/esp32c3/bootloader_soc.c

@@ -12,15 +12,15 @@ void bootloader_ana_super_wdt_reset_config(bool enable)
     REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
 
     if (enable) {
-        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
         REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
     }
 }
 
 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
 
     if (enable) {
         REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);

components/bootloader_support/src/esp32s2/bootloader_soc.c

@@ -3,18 +3,10 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  */
+
 #include <stdbool.h>
 
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    (void)enable;
-}
-
-void bootloader_ana_bod_reset_config(bool enable)
-{
-    (void)enable;
-}
-
+//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
     (void)enable;

components/bootloader_support/src/esp32s3/bootloader_esp32s3.c

@@ -218,12 +218,19 @@ static esp_err_t bootloader_init_spi_flash(void)
     }
 #endif
 
+#if CONFIG_BOOTLOADER_FLASH_DC_AWARE
+    // Reset flash, clear volatile bits DC[0:1]. Make it work under default mode to boot.
+    bootloader_spi_flash_reset();
+#endif
+
     bootloader_flash_unlock();
 
 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
     bootloader_enable_qio_mode();
 #endif
-
+#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
+    bootloader_flash_32bits_address_map_enable(bootloader_flash_get_spi_mode());
+#endif
     print_flash_info(&bootloader_image_hdr);
     update_flash_config(&bootloader_image_hdr);
     //ensure the flash is write-protected
@@ -317,7 +324,7 @@ static void bootloader_super_wdt_auto_feed(void)
 
 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable WDT, BOR, and GLITCH reset
+    //Enable WDT, BOD, and GLITCH reset
     bootloader_ana_super_wdt_reset_config(true);
     bootloader_ana_bod_reset_config(true);
     bootloader_ana_clock_glitch_reset_config(true);

components/bootloader_support/src/esp32s3/bootloader_soc.c

@@ -12,15 +12,15 @@ void bootloader_ana_super_wdt_reset_config(bool enable)
     REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
 
     if (enable) {
-        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
         REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
     }
 }
 
 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
 
     if (enable) {
         REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);

components/bootloader_support/src/esp_image_format.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,6 +17,7 @@
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
 #include "bootloader_common.h"
+#include "esp_efuse.h"
 #include "esp_rom_sys.h"
 #include "soc/soc_memory_types.h"
 #if CONFIG_IDF_TARGET_ESP32
@@ -31,6 +32,8 @@
 #include "esp32h2/rom/secure_boot.h"
 #endif
 
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
 /* Checking signatures as part of verifying images is necessary:
    - Always if secure boot is enabled
    - Differently in bootloader and/or app, depending on kconfig
@@ -74,10 +77,10 @@ static bool should_map(uint32_t load_addr);
 
 static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
 /* Load or verify a segment */
-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);
 
 /* split segment and verify if data_len is too long */
-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);
 
 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
@@ -102,7 +105,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
     while(0)
 
 static esp_err_t process_image_header(esp_image_metadata_t *data, uint32_t part_offset, bootloader_sha256_handle_t *sha_handle, bool do_verify, bool silent);
-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent);
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent);
 static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data, bool silent, bool skip_check_checksum);
 
 static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
@@ -152,7 +155,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     CHECK_ERR(process_segments(data, silent, do_load, sha_handle, checksum));
     bool skip_check_checksum = !do_verify || esp_cpu_in_ocd_debug_mode();
     CHECK_ERR(process_checksum(sha_handle, checksum_word, data, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(data, part->size, do_verify, silent));
+    CHECK_ERR(process_appended_hash_and_sig(data, part->offset, part->size, do_verify, silent));
     if (verify_sha) {
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
         // secure boot images have a signature appended
@@ -220,6 +223,21 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
             }
         }
     }
+
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    /* For anti-rollback case, reconfirm security version of the application to prevent FI attacks */
+    bool sec_ver = false;
+    if (do_load) {
+        sec_ver = esp_efuse_check_secure_version(data->secure_version);
+        if (!sec_ver) {
+            err = ESP_FAIL;
+            goto err;
+        }
+    }
+    /* Ensure that the security version check passes for image loading scenario */
+    ESP_FAULT_ASSERT(!do_load || sec_ver == true);
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
 #endif // BOOTLOADER_BUILD
 
     // Success!
@@ -292,7 +310,7 @@ esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_meta
     CHECK_ERR(process_segments(metadata, silent, do_load, NULL, NULL));
     bool skip_check_checksum = true;
     CHECK_ERR(process_checksum(NULL, 0, metadata, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(metadata, part->size, true, silent));
+    CHECK_ERR(process_appended_hash_and_sig(metadata, part->offset, part->size, true, silent));
     return ESP_OK;
 err:
     return err;
@@ -486,8 +504,8 @@ static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool
     uint32_t next_addr = start_segments;
     for (int i = 0; i < data->image.segment_count; i++) {
         esp_image_segment_header_t *header = &data->segments[i];
-        ESP_LOGV(TAG, "loading segment header %d at offset 0x%x", i, next_addr);
-        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum));
+        ESP_LOGV(TAG, "loading segment header %d at offset 0x%"PRIx32, i, next_addr);
+        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum, data));
         next_addr += sizeof(esp_image_segment_header_t);
         data->segment_data[i] = next_addr;
         next_addr += header->data_len;
@@ -508,7 +526,7 @@ err:
     return err;
 }
 
-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
     esp_err_t err;
 
@@ -566,7 +584,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
         uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
         /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
         data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
-        CHECK_ERR(process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum));
+        CHECK_ERR(process_segment_data(index, load_addr, data_addr, data_len, do_load, sha_handle, checksum, metadata));
         data_addr += data_len;
         data_len_remain -= data_len;
     }
@@ -581,7 +599,42 @@ err:
     return err;
 }
 
-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+/* The __attribute__((optimize("O0"))) is used to disable optimizations for this function,
+ * preventing the compiler from potentially optimizing data_buffer and reading data directly from src.
+ * This is crucial as we want to read from Flash only once, ensuring the integrity of the data.
+ */
+__attribute__((optimize("O0")))
+static size_t process_esp_app_desc_data(const uint32_t *src, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
+{
+    /* Using data_buffer here helps to securely read secure_version
+     * (for anti-rollback) from esp_app_desc_t, preventing FI attack.
+     * We read data from Flash into this buffer, which is covered by sha256.
+     * Therefore, if the flash is under attackers control and contents are modified
+     * the sha256 comparison will fail.
+     *
+     * The esp_app_desc_t structure is located in DROM and is always in segment #0.
+     *
+     * esp_app_desc_t is always at #0 segment (index==0).
+     * secure_version field of esp_app_desc_t is located at #2 word (w_i==1).
+     */
+    uint32_t data_buffer[2];
+    memcpy(data_buffer, src, sizeof(data_buffer));
+    assert(data_buffer[0] == ESP_APP_DESC_MAGIC_WORD);
+    metadata->secure_version = data_buffer[1];
+    if (checksum != NULL) {
+        *checksum ^= data_buffer[0] ^ data_buffer[1];
+    }
+    if (sha_handle != NULL) {
+        bootloader_sha256_data(sha_handle, data_buffer, sizeof(data_buffer));
+    }
+    ESP_FAULT_ASSERT(memcmp(data_buffer, src, sizeof(data_buffer)) == 0);
+    ESP_FAULT_ASSERT(memcmp(&metadata->secure_version, &src[1], sizeof(uint32_t)) == 0);
+    return sizeof(data_buffer);
+}
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
     // If we are not loading, and the checksum is empty, skip processing this
     // segment for data
@@ -614,10 +667,24 @@ static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, ui
 #endif
     }
     uint32_t *dest = (uint32_t *)load_addr;
-#endif
+#endif // BOOTLOADER_BUILD
 
     const uint32_t *src = data;
 
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    // Case I: Bootloader verifying application
+    // Case II: Bootloader verifying bootloader
+    // Anti-rollback check should handle only Case I from above.
+    if (segment == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+        ESP_LOGD(TAG, "additional anti-rollback check 0x%"PRIx32, data_addr);
+        // The esp_app_desc_t structure is located in DROM and is always in segment #0.
+        size_t len = process_esp_app_desc_data(src, sha_handle, checksum, metadata);
+        data_len -= len;
+        src += len / 4;
+        // In BOOTLOADER_BUILD, for DROM (segment #0) we do not load it into dest (only map it), do_load = false.
+    }
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
     for (size_t i = 0; i < data_len; i += 4) {
         int w_i = i / 4; // Word index
         uint32_t w = src[w_i];
@@ -741,7 +808,7 @@ esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
                             data);
 }
 
-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent)
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent)
 {
     esp_err_t err = ESP_OK;
     if (data->image.hash_appended) {
@@ -752,8 +819,34 @@ static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part
         data->image_len += HASH_LEN;
     }
 
-    if (data->image_len > part_len) {
-        FAIL_LOAD("Image length %d doesn't fit in partition length %d", data->image_len, part_len);
+    uint32_t sig_block_len = 0;
+    const uint32_t end = data->image_len;
+#if CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    // Case I: Bootloader part
+    if (part_offset == ESP_BOOTLOADER_OFFSET) {
+        // For bootloader with secure boot v1, signature stays in an independant flash
+        // sector (offset 0x0)  and does not get appended to the image.
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    } else {
+    // Case II: Application part
+#if CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+        sig_block_len = sizeof(esp_secure_boot_sig_block_t);
+#else
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    }
+#endif // CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    const uint32_t full_image_len = end + sig_block_len;
+    if (full_image_len > part_len) {
+        FAIL_LOAD("Image length %d doesn't fit in partition length %d", full_image_len, part_len);
     }
     return err;
 err:
@@ -814,7 +907,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 #if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
     // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
     // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
-    uint32_t padded_end = (end + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE-1);
+    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
     if (padded_end > end) {
         const void *padding = bootloader_mmap(end, padded_end - end);
         bootloader_sha256_data(sha_handle, padding, padded_end - end);

components/bootloader_support/src/flash_encrypt.c

@@ -174,7 +174,12 @@ void esp_flash_encryption_set_release_mode(void)
     ESP_LOGE(TAG, "Flash Encryption support not added, abort..");
     abort();
 #endif
+
+#if CONFIG_SOC_SUPPORTS_SECURE_DL_MODE
+    esp_efuse_enable_rom_secure_download_mode();
+#else
     esp_efuse_disable_rom_download_mode();
+#endif
     esp_efuse_batch_write_commit();
 
     if (esp_get_flash_encryption_mode() != ESP_FLASH_ENC_MODE_RELEASE) {

components/bootloader_support/src/flash_qio_mode.c

@@ -168,6 +168,11 @@ unsigned bootloader_read_status_8b_rdsr2(void)
     return bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
 }
 
+unsigned bootloader_read_status_8b_rdsr3(void)
+{
+    return bootloader_execute_flash_command(CMD_RDSR3, 0, 0, 8);
+}
+
 unsigned bootloader_read_status_16b_rdsr_rdsr2(void)
 {
     return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
@@ -183,6 +188,11 @@ void bootloader_write_status_8b_wrsr2(unsigned new_status)
     bootloader_execute_flash_command(CMD_WRSR2, new_status, 8, 0);
 }
 
+void bootloader_write_status_8b_wrsr3(unsigned new_status)
+{
+    bootloader_execute_flash_command(CMD_WRSR3, new_status, 8, 0);
+}
+
 void bootloader_write_status_16b_wrsr(unsigned new_status)
 {
     bootloader_execute_flash_command(CMD_WRSR, new_status, 16, 0);

components/bootloader_support/src/secure_boot_v2/secure_boot.c

@@ -247,7 +247,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
 
     ESP_LOGI(TAG, "%d signature block(s) found appended to the app.", app_key_digests.num_digests);
     if (app_key_digests.num_digests > boot_key_digests.num_digests) {
-        ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?");
+        ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?", app_key_digests.num_digests, boot_key_digests.num_digests);
     }
 
     /* Confirm if at least one public key from the application matches a public key in the bootloader

components/bootloader_support/test_apps/rtc_custom_section/CMakeLists.txt

@@ -0,0 +1,6 @@
+# The following lines of boilerplate have to be in your project's
+# CMakeLists in this exact order for cmake to work correctly
+cmake_minimum_required(VERSION 3.5)
+
+include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+project(test_rtc_custom_section)

components/bootloader_support/test_apps/rtc_custom_section/README.md

@@ -0,0 +1,2 @@
+| Supported Targets | ESP32 | ESP32-C3 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- |

components/bootloader_support/test_apps/rtc_custom_section/main/CMakeLists.txt

@@ -0,0 +1,2 @@
+idf_component_register(SRCS "test_main.c"
+                       INCLUDE_DIRS ".")

components/bootloader_support/test_apps/rtc_custom_section/main/test_main.c

@@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "bootloader_common.h"
+#include <stdio.h>
+#include "sdkconfig.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+
+#define TEST_MAGIC_VALUE 0x42987561
+
+extern rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void);
+
+void app_main(void) {
+    rtc_retain_mem_t* mem = bootloader_common_get_rtc_retain_mem();
+    uint32_t* _rtc_vars = (uint32_t*) mem->custom;
+
+    if (_rtc_vars[0] != TEST_MAGIC_VALUE) {
+        /* On the first boot, set the data inside the array */
+        _rtc_vars[0] = TEST_MAGIC_VALUE;
+    } else {
+        /* Second boot, the data was saved saved, success */
+        printf("SUCCESS: data were saved across reboot\n");
+        vTaskDelay(10000 / portTICK_PERIOD_MS);
+    }
+
+    esp_restart();
+}

components/bootloader_support/test_apps/rtc_custom_section/sdkconfig.defaults

@@ -0,0 +1,3 @@
+CONFIG_BOOTLOADER_RESERVE_RTC_SIZE=0x10
+CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC=y
+CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE=0x200

components/bt/CMakeLists.txt

@@ -6,7 +6,7 @@ if(CONFIG_BT_ENABLED)
     elseif(CONFIG_IDF_TARGET_ESP32C3)
         set(srcs "controller/esp32c3/bt.c")
     elseif(CONFIG_IDF_TARGET_ESP32S3)
-        set(srcs "controller/esp32s3/bt.c")
+        set(srcs "controller/esp32c3/bt.c")
     endif()
 
     set(include_dirs common/osi/include)
@@ -16,7 +16,7 @@ if(CONFIG_BT_ENABLED)
     elseif(CONFIG_IDF_TARGET_ESP32C3)
         list(APPEND include_dirs include/esp32c3/include)
     elseif(CONFIG_IDF_TARGET_ESP32S3)
-        list(APPEND include_dirs include/esp32s3/include)
+        list(APPEND include_dirs include/esp32c3/include)
     endif()
 
     list(APPEND priv_include_dirs
@@ -38,6 +38,8 @@ if(CONFIG_BT_ENABLED)
          "common/osi/buffer.c"
          "common/osi/config.c"
          "common/osi/fixed_queue.c"
+         "common/osi/pkt_queue.c"
+         "common/osi/fixed_pkt_queue.c"
          "common/osi/future.c"
          "common/osi/hash_functions.c"
          "common/osi/hash_map.c"
@@ -297,6 +299,7 @@ if(CONFIG_BT_ENABLED)
                    "host/bluedroid/stack/gatt/gatt_db.c"
                    "host/bluedroid/stack/gatt/gatt_main.c"
                    "host/bluedroid/stack/gatt/gatt_sr.c"
+                   "host/bluedroid/stack/gatt/gatt_sr_hash.c"
                    "host/bluedroid/stack/gatt/gatt_utils.c"
                    "host/bluedroid/stack/hcic/hciblecmds.c"
                    "host/bluedroid/stack/hcic/hcicmds.c"

components/bt/common/api/esp_blufi_api.c

@@ -46,7 +46,8 @@ esp_err_t esp_blufi_send_wifi_conn_report(wifi_mode_t opmode, esp_blufi_sta_conn
     arg.wifi_conn_report.softap_conn_num = softap_conn_num;
     arg.wifi_conn_report.extra_info = extra_info;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list)
@@ -62,7 +63,8 @@ esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list
     arg.wifi_list.apCount = apCount;
     arg.wifi_list.list = list;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_blufi_profile_init(void)
@@ -75,7 +77,7 @@ esp_err_t esp_blufi_profile_init(void)
     msg.pid = BTC_PID_BLUFI;
     msg.act = BTC_BLUFI_ACT_INIT;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_blufi_profile_deinit(void)
@@ -88,7 +90,7 @@ esp_err_t esp_blufi_profile_deinit(void)
     msg.pid = BTC_PID_BLUFI;
     msg.act = BTC_BLUFI_ACT_DEINIT;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 uint16_t esp_blufi_get_version(void)
@@ -108,7 +110,7 @@ esp_err_t esp_blufi_send_error_info(esp_blufi_error_state_t state)
     msg.act = BTC_BLUFI_ACT_SEND_ERR_INFO;
     arg.blufi_err_infor.state = state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)
@@ -126,6 +128,7 @@ esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)
     arg.custom_data.data = data;
     arg.custom_data.data_len = data_len;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif  ///BLUFI_INCLUDED == TRUE

components/bt/common/api/include/api/esp_blufi_api.h

@@ -57,6 +57,8 @@ typedef enum {
 typedef enum {
     ESP_BLUFI_STA_CONN_SUCCESS = 0x00,
     ESP_BLUFI_STA_CONN_FAIL    = 0x01,
+    ESP_BLUFI_STA_CONNECTING   = 0x02,
+    ESP_BLUFI_STA_NO_IP        = 0x03,
 } esp_blufi_sta_conn_state_t;
 
 /// BLUFI init status
@@ -82,6 +84,9 @@ typedef enum {
     ESP_BLUFI_READ_PARAM_ERROR,
     ESP_BLUFI_MAKE_PUBLIC_ERROR,
     ESP_BLUFI_DATA_FORMAT_ERROR,
+    ESP_BLUFI_CALC_MD5_ERROR,
+    ESP_BLUFI_WIFI_SCAN_FAIL,
+    ESP_BLUFI_MSG_STATE_ERROR,
 } esp_blufi_error_state_t;
 
 /**
@@ -105,6 +110,12 @@ typedef struct {
     bool softap_max_conn_num_set;   /*!< is max connection number of softap interface set */
     uint8_t softap_channel;         /*!< channel of softap interface */
     bool softap_channel_set;        /*!< is channel of softap interface set */
+    uint8_t sta_max_conn_retry;     /*!< max retry of sta establish connection */
+    bool sta_max_conn_retry_set;    /*!< is max retry of sta establish connection set */
+    uint8_t sta_conn_end_reason;    /*!< reason of sta connection end */
+    bool sta_conn_end_reason_set;   /*!< is reason of sta connection end set */
+    int8_t sta_conn_rssi;           /*!< rssi of sta connection */
+    bool sta_conn_rssi_set;         /*!< is rssi of sta connection set */
 } esp_blufi_extra_info_t;
 
 /** @brief Description of an WiFi AP */
@@ -114,9 +125,9 @@ typedef struct {
 } esp_blufi_ap_record_t;
 
 /// Bluetooth address length
-#define ESP_BD_ADDR_LEN     6
+#define ESP_BLUFI_BD_ADDR_LEN     6
 /// Bluetooth device address
-typedef uint8_t esp_bd_addr_t[ESP_BD_ADDR_LEN];
+typedef uint8_t esp_blufi_bd_addr_t[ESP_BLUFI_BD_ADDR_LEN];
 
 /**
  * @brief BLUFI callback parameters union
@@ -147,7 +158,7 @@ typedef union {
      * @brief ESP_BLUFI_EVENT_CONNECT
 	 */
     struct blufi_connect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
         uint8_t    server_if;                       /*!< server interface */
         uint16_t   conn_id;                         /*!< Connection id */
     } connect;									    /*!< Blufi callback param of ESP_BLUFI_EVENT_CONNECT */
@@ -156,7 +167,7 @@ typedef union {
      * @brief ESP_BLUFI_EVENT_DISCONNECT
 	 */
     struct blufi_disconnect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
     } disconnect;									/*!< Blufi callback param of ESP_BLUFI_EVENT_DISCONNECT */
 
     /* ESP_BLUFI_EVENT_REQ_WIFI_CONNECT */          /* No callback param */

components/bt/common/btc/core/btc_task.c

@@ -62,6 +62,10 @@
 #endif /* #if CLASSIC_BT_INCLUDED */
 #endif
 
+#if (BLE_INCLUDED == TRUE)
+#include "btc_gap_ble.h"
+#endif
+
 #if CONFIG_BLE_MESH
 #include "btc_ble_mesh_ble.h"
 #include "btc_ble_mesh_prov.h"
@@ -77,6 +81,9 @@
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
 #define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
+#define BTC_TASK_WORKQUEUE_NUM          (2)
+#define BTC_TASK_WORKQUEUE0_LEN         (0)
+#define BTC_TASK_WORKQUEUE1_LEN         (5)
 
 osi_thread_t *btc_thread;
 
@@ -199,24 +206,12 @@ static void btc_thread_handler(void *arg)
         break;
     }
 
-    if (msg->arg) {
-        osi_free(msg->arg);
-    }
     osi_free(msg);
 }
 
 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
         return BT_STATUS_BUSY;
     }
 
@@ -229,52 +224,61 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
  * @param  arg       paramter
  * @param  arg_len   length of paramter
  * @param  copy_func deep copy function
+ * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func)
 {
-    btc_msg_t lmsg;
-
-    if (msg == NULL) {
+    btc_msg_t* lmsg;
+    bt_status_t ret;
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
+        BTC_TRACE_WARNING("%s Invalid parameters\n", __func__);
         return BT_STATUS_PARM_INVALID;
     }
 
     BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);
 
-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t) + arg_len);
+    if (lmsg == NULL) {
+        BTC_TRACE_WARNING("%s No memory\n", __func__);
+        return BT_STATUS_NOMEM;
     }
 
-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    }
 
+    ret = btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);
+    if (ret != BT_STATUS_SUCCESS) {
+        if (copy_func && free_func) {
+            free_func(lmsg);
+        }
+        osi_free(lmsg);
+    }
+
+    return ret;
 }
 
 /**
  * transfer an message to another module in tha same task.
  * @param  msg       message
- * @param  arg       paramter
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg)
+bt_status_t btc_inter_profile_call(btc_msg_t *msg)
 {
     if (msg == NULL) {
         return BT_STATUS_PARM_INVALID;
     }
 
-    msg->arg = arg;
     switch (msg->sig) {
     case BTC_SIG_API_CALL:
         profile_tab[msg->pid].btc_call(msg);
@@ -410,7 +414,9 @@ error_exit:;
 
 bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    const size_t workqueue_len[] = {BTC_TASK_WORKQUEUE0_LEN, BTC_TASK_WORKQUEUE1_LEN};
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE,
+                                   BTC_TASK_WORKQUEUE_NUM, workqueue_len);
     if (btc_thread == NULL) {
         return BT_STATUS_NOMEM;
     }
@@ -423,6 +429,7 @@ bt_status_t btc_init(void)
 
 #if (BLE_INCLUDED == TRUE)
     btc_gap_callback_init();
+    btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE
 
 #if SCAN_QUEUE_CONGEST_CHECK
@@ -440,7 +447,9 @@ void btc_deinit(void)
 
     osi_thread_free(btc_thread);
     btc_thread = NULL;
-
+#if (BLE_INCLUDED == TRUE)
+    btc_gap_ble_deinit();
+#endif  ///BLE_INCLUDED == TRUE
 #if SCAN_QUEUE_CONGEST_CHECK
     btc_adv_list_deinit();
 #endif
@@ -459,3 +468,8 @@ int get_btc_work_queue_size(void)
 {
     return osi_thread_queue_wait_size(btc_thread, 0);
 }
+
+osi_thread_t *btc_get_current_thread(void)
+{
+    return btc_thread;
+}

components/bt/common/btc/include/btc/btc_task.h

@@ -28,7 +28,7 @@ typedef struct btc_msg {
     uint8_t aid;    //application id
     uint8_t pid;    //profile id
     uint8_t act;    //profile action, defined in seprerate header files
-    void   *arg;    //param for btc function or function param
+    UINT8   arg[0]; //param for btc function or function param
 } btc_msg_t;
 
 typedef struct btc_adv_packet {
@@ -100,6 +100,7 @@ typedef struct {
 } btc_func_t;
 
 typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
+typedef void (* btc_arg_deep_free_t)(btc_msg_t *msg);
 
 #ifdef __cplusplus
 extern "C" {
@@ -111,25 +112,33 @@ extern "C" {
  * @param  arg       paramter
  * @param  arg_len   length of paramter
  * @param  copy_func deep copy function
+ * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func);
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func);
 
 /**
  * transfer an message to another module in tha same task.
  * @param  msg       message
- * @param  arg       paramter
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
  */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg);
+bt_status_t btc_inter_profile_call(btc_msg_t *msg);
 
 bt_status_t btc_init(void);
 void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);
 
+/**
+ * get the BTC thread handle
+ * @return           NULL: fail
+ *                   others: pointer of osi_thread structure of BTC
+ */
+osi_thread_t *btc_get_current_thread(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c

@@ -144,7 +144,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
         param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;
 
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 
         break;
     }
@@ -283,7 +283,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         msg.act = ESP_BLUFI_EVENT_INIT_FINISH;
         param.init_finish.state = ESP_BLUFI_INIT_OK;
 
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
         break;
     }
     case BTA_GATTS_CONNECT_EVT: {
@@ -295,7 +295,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                         BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                         p_data->conn.reason, p_data->conn.conn_id);
 
-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
         blufi_env.conn_id = p_data->conn.conn_id;
         blufi_env.is_connected = true;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
@@ -303,11 +303,11 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
         msg.act = ESP_BLUFI_EVENT_BLE_CONNECT;
-        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
         param.connect.conn_id = BTC_GATT_GET_CONN_ID(p_data->conn.conn_id);
         conn_id = param.connect.conn_id;
         server_if = p_data->conn.server_if;
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
         break;
     }
     case BTA_GATTS_DISCONNECT_EVT: {
@@ -320,7 +320,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                         BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                         p_data->conn.reason, p_data->conn.conn_id);
 
-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
         blufi_env.conn_id = p_data->conn.conn_id;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
         blufi_env.sec_mode = 0x0;
@@ -334,8 +334,8 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
         msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
         break;
     }
     case BTA_GATTS_OPEN_EVT:
@@ -385,8 +385,6 @@ void esp_blufi_send_encap(void *arg)
 retry:
     if (blufi_env.is_connected == false) {
         BTC_TRACE_WARNING("%s ble connection is broken\n", __func__);
-        osi_free(hdr);
-        hdr =  NULL;
         return;
     }
     if (esp_ble_get_cur_sendable_packets_num(BTC_GATT_GET_CONN_ID(blufi_env.conn_id)) > 0) {
@@ -410,7 +408,7 @@ esp_err_t esp_blufi_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
     msg.pid = BTC_PID_GATTS;
     msg.act = BTC_GATTS_ACT_CLOSE;
     arg.close.conn_id = BTC_GATT_CREATE_CONN_ID(gatts_if, conn_id);
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -98,7 +98,7 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
     msg.act = ESP_BLUFI_EVENT_REPORT_ERROR;
     esp_blufi_cb_param_t param;
     param.report_error.state = state;
-    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 }
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
@@ -144,6 +144,16 @@ void btc_blufi_recv_handler(uint8_t *data, int len)
 
     if (BLUFI_FC_IS_FRAG(hdr->fc)) {
         if (blufi_env.offset == 0) {
+            /*
+            blufi_env.aggr_buf should be NULL if blufi_env.offset is 0.
+            It is possible that the process of sending fragment packet
+            has not been completed
+            */
+            if (blufi_env.aggr_buf) {
+                BTC_TRACE_ERROR("%s msg error, blufi_env.aggr_buf is not freed\n", __func__);
+                btc_blufi_report_error(ESP_BLUFI_MSG_STATE_ERROR);
+                return;
+            }
             blufi_env.total_len = hdr->data[0] | (((uint16_t) hdr->data[1]) << 8);
             blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
             if (blufi_env.aggr_buf == NULL) {
@@ -163,6 +173,18 @@ void btc_blufi_recv_handler(uint8_t *data, int len)
 
     } else {
         if (blufi_env.offset > 0) {   /* if previous pkt is frag */
+            /* blufi_env.aggr_buf should not be NULL */
+            if (blufi_env.aggr_buf == NULL) {
+                BTC_TRACE_ERROR("%s buffer is NULL\n", __func__);
+                btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
+                return;
+            }
+            /* payload length should be equal to total_len */
+            if ((blufi_env.offset + hdr->data_len) != blufi_env.total_len) {
+                BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
+                btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+                return;
+            }
             memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);
 
             btc_blufi_protocol_handler(hdr->type, blufi_env.aggr_buf, blufi_env.total_len);
@@ -321,6 +343,21 @@ static void btc_blufi_wifi_conn_report(uint8_t opmode, uint8_t sta_conn_state, u
             *p++ = 1;
             *p++ = info->softap_channel;
         }
+        if (info->sta_max_conn_retry_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_MAX_CONN_RETRY;
+            *p++ = 1;
+            *p++ = info->sta_max_conn_retry;
+        }
+        if (info->sta_conn_end_reason_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_END_REASON;
+            *p++ = 1;
+            *p++ = info->sta_conn_end_reason;
+        }
+        if (info->sta_conn_rssi_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_RSSI;
+            *p++ = 1;
+            *p++ = info->sta_conn_rssi;
+        }
     }
     if (p - data > data_len) {
         BTC_TRACE_ERROR("%s len error %d %d\n", __func__, (int)(p - data), data_len);
@@ -714,6 +751,21 @@ void btc_blufi_call_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
             dst->wifi_conn_report.extra_info->softap_channel = src_info->softap_channel;
             dst->wifi_conn_report.extra_info_len += (1 + 2);
         }
+        if (src_info->sta_max_conn_retry_set) {
+            dst->wifi_conn_report.extra_info->sta_max_conn_retry_set = src_info->sta_max_conn_retry_set;
+            dst->wifi_conn_report.extra_info->sta_max_conn_retry = src_info->sta_max_conn_retry;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
+        if (src_info->sta_conn_end_reason_set) {
+            dst->wifi_conn_report.extra_info->sta_conn_end_reason_set = src_info->sta_conn_end_reason_set;
+            dst->wifi_conn_report.extra_info->sta_conn_end_reason = src_info->sta_conn_end_reason;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
+        if (src_info->sta_conn_rssi_set) {
+            dst->wifi_conn_report.extra_info->sta_conn_rssi_set = src_info->sta_conn_rssi_set;
+            dst->wifi_conn_report.extra_info->sta_conn_rssi = src_info->sta_conn_rssi;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
         break;
     }
     case BTC_BLUFI_ACT_SEND_WIFI_LIST:{

components/bt/common/btc/profile/esp/blufi/blufi_protocol.c

@@ -51,35 +51,35 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_SET_WIFI_OPMODE;
             param.wifi_mode.op_mode = data[0];
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_CONN_TO_AP:
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_REQ_CONNECT_TO_AP;
 
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_DISCONN_FROM_AP:
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_REQ_DISCONNECT_FROM_AP;
 
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_STATUS:
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_GET_WIFI_STATUS;
 
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_DEAUTHENTICATE_STA:
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_DEAUTHENTICATE_STA;
 
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL,NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_GET_VERSION: {
             uint8_t type = BLUFI_BUILD_TYPE(BLUFI_TYPE_DATA, BLUFI_TYPE_DATA_SUBTYPE_REPLY_VERSION);
@@ -94,13 +94,13 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_RECV_SLAVE_DISCONNECT_BLE;
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
             break;
         case BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_LIST:
             msg.sig = BTC_SIG_API_CB;
             msg.pid = BTC_PID_BLUFI;
             msg.act = ESP_BLUFI_EVENT_GET_WIFI_LIST;
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
             break;
         default:
             BTC_TRACE_ERROR("%s Unkown Ctrl pkt %02x\n", __func__, type);
@@ -125,7 +125,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_STA_BSSID;
             memcpy(param.sta_bssid.bssid, &data[0], 6);
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_STA_SSID:
             msg.sig = BTC_SIG_API_CB;
@@ -134,7 +134,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.sta_ssid.ssid = &data[0];
             param.sta_ssid.ssid_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_STA_PASSWD:
             msg.sig = BTC_SIG_API_CB;
@@ -143,7 +143,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.sta_passwd.passwd = &data[0];
             param.sta_passwd.passwd_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_SSID:
             msg.sig = BTC_SIG_API_CB;
@@ -152,7 +152,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.softap_ssid.ssid = &data[0];
             param.softap_ssid.ssid_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_PASSWD:
             msg.sig = BTC_SIG_API_CB;
@@ -161,7 +161,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.softap_passwd.passwd = &data[0];
             param.softap_passwd.passwd_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_MAX_CONN_NUM:
             msg.sig = BTC_SIG_API_CB;
@@ -169,7 +169,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_MAX_CONN_NUM;
             param.softap_max_conn_num.max_conn_num = data[0];
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_AUTH_MODE:
             msg.sig = BTC_SIG_API_CB;
@@ -177,7 +177,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_AUTH_MODE;
             param.softap_auth_mode.auth_mode = data[0];
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_CHANNEL:
             msg.sig = BTC_SIG_API_CB;
@@ -185,7 +185,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_CHANNEL;
             param.softap_channel.channel = data[0];
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_USERNAME:
             msg.sig = BTC_SIG_API_CB;
@@ -194,7 +194,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.username.name = &data[0];
             param.username.name_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_CA:
             msg.sig = BTC_SIG_API_CB;
@@ -203,7 +203,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.ca.cert = &data[0];
             param.ca.cert_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_CLIENT_CERT:
             msg.sig = BTC_SIG_API_CB;
@@ -212,7 +212,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.client_cert.cert = &data[0];
             param.client_cert.cert_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SERVER_CERT:
             msg.sig = BTC_SIG_API_CB;
@@ -221,7 +221,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.client_cert.cert = &data[0];
             param.client_cert.cert_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_CLIENT_PRIV_KEY:
             msg.sig = BTC_SIG_API_CB;
@@ -230,7 +230,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.client_pkey.pkey = &data[0];
             param.client_pkey.pkey_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_SERVER_PRIV_KEY:
             msg.sig = BTC_SIG_API_CB;
@@ -239,7 +239,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             param.client_pkey.pkey = &data[0];
             param.client_pkey.pkey_len = len;
 
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         case BLUFI_TYPE_DATA_SUBTYPE_CUSTOM_DATA:
             msg.sig = BTC_SIG_API_CB;
@@ -247,7 +247,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
             msg.act = ESP_BLUFI_EVENT_RECV_CUSTOM_DATA;
             param.custom_data.data = &data[0];
             param.custom_data.data_len = len;
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
             break;
         default:
             BTC_TRACE_ERROR("%s Unkown Ctrl pkt %02x\n", __func__, type);

components/bt/common/btc/profile/esp/blufi/include/blufi_int.h

@@ -20,7 +20,7 @@
 #if (BLUFI_INCLUDED == TRUE)
 
 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
-#define BTC_BLUFI_SUB_VER     0x02  //Version + Subversion
+#define BTC_BLUFI_SUB_VER     0x03  //Version + Subversion
 #define BTC_BLUFI_VERSION     ((BTC_BLUFI_GREAT_VER<<8)|BTC_BLUFI_SUB_VER)  //Version + Subversion
 
 typedef UINT8 tGATT_IF;
@@ -129,6 +129,9 @@ extern tBLUFI_ENV *blufi_env_ptr;
 #define BLUFI_TYPE_DATA_SUBTYPE_WIFI_LIST               0x11
 #define BLUFI_TYPE_DATA_SUBTYPE_ERROR_INFO              0x12
 #define BLUFI_TYPE_DATA_SUBTYPE_CUSTOM_DATA             0x13
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_MAX_CONN_RETRY      0x14
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_END_REASON     0x15
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_RSSI           0x16
 #define BLUFI_TYPE_IS_CTRL(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_CTRL)
 #define BLUFI_TYPE_IS_DATA(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_DATA)
 

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -256,12 +256,12 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 
             rc = ble_gap_conn_find(event->connect.conn_handle, &desc);
             assert(rc == 0);
-            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, sizeof(esp_bd_addr_t));
+            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
 
             param.connect.conn_id = event->connect.conn_handle;
             /* save connection handle */
             conn_handle = event->connect.conn_handle;
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
         }
         if (event->connect.status != 0) {
             /* Connection failed; resume advertising. */
@@ -270,7 +270,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         return 0;
     case BLE_GAP_EVENT_DISCONNECT:
         ESP_LOGI(TAG, "disconnect; reason=%d\n", event->disconnect.reason);
-        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
         blufi_env.is_connected = false;
         blufi_env.recv_seq = blufi_env.send_seq = 0;
         blufi_env.sec_mode = 0x0;
@@ -287,8 +287,8 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         msg.sig = BTC_SIG_API_CB;
         msg.pid = BTC_PID_BLUFI;
         msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 
         return 0;
     case BLE_GAP_EVENT_CONN_UPDATE:
@@ -419,7 +419,7 @@ void esp_blufi_deinit(void)
     msg.pid = BTC_PID_BLUFI;
     msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
     param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;
-    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 }
 
 void esp_blufi_send_notify(void *arg)
@@ -427,9 +427,15 @@ void esp_blufi_send_notify(void *arg)
     struct pkt_info *pkts = (struct pkt_info *) arg;
     struct os_mbuf *om;
     om = ble_hs_mbuf_from_flat(pkts->pkt, pkts->pkt_len);
+    if (om == NULL) {
+        ESP_LOGE(TAG, "Error in allocating memory");
+        return;
+    }
     int rc = 0;
     rc = ble_gattc_notify_custom(conn_handle, gatt_values[1].val_handle, om);
-    assert(rc == 0);
+    if (rc != 0) {
+        ESP_LOGE(TAG, "Error in sending notification");
+    }
 }
 
 void esp_blufi_disconnect(void)
@@ -444,8 +450,6 @@ void esp_blufi_send_encap(void *arg)
     struct blufi_hdr *hdr = (struct blufi_hdr *)arg;
     if (blufi_env.is_connected == false) {
         BTC_TRACE_WARNING("%s ble connection is broken\n", __func__);
-        osi_free(hdr);
-        hdr =  NULL;
         return;
     }
     btc_blufi_send_notify((uint8_t *)hdr,

components/bt/common/include/bt_user_config.h

@@ -93,4 +93,11 @@
 #define UC_BT_BLUFI_ENABLE                  FALSE
 #endif
 
+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */

components/bt/common/osi/alarm.c

@@ -149,7 +149,7 @@ static void alarm_cb_handler(struct alarm_t *alarm)
     msg.pid = BTC_PID_ALARM;
     arg.cb = alarm->cb;
     arg.cb_data = alarm->cb_data;
-    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL);
+    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL, NULL);
 }
 
 osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)

components/bt/common/osi/config.c

@@ -262,6 +262,32 @@ bool config_remove_section(config_t *config, const char *section)
     return list_remove(config->sections, sec);
 }
 
+bool config_update_newest_section(config_t *config, const char *section)
+{
+    assert(config != NULL);
+    assert(section != NULL);
+
+    list_node_t *first_node = list_begin(config->sections);
+    if (first_node == NULL) {
+        return false;
+    }
+    section_t *first_sec = list_node(first_node);
+    if (strcmp(first_sec->name, section) == 0) {
+        return true;
+    }
+
+    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
+        section_t *sec = list_node(node);
+        if (strcmp(sec->name, section) == 0) {
+            list_delete(config->sections, sec);
+            list_prepend(config->sections, sec);
+            return true;
+        }
+    }
+
+    return false;
+}
+
 bool config_remove_key(config_t *config, const char *section, const char *key)
 {
     assert(config != NULL);

components/bt/common/osi/fixed_pkt_queue.c

@@ -0,0 +1,161 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/allocator.h"
+#include "osi/pkt_queue.h"
+#include "osi/fixed_pkt_queue.h"
+#include "osi/osi.h"
+#include "osi/semaphore.h"
+
+typedef struct fixed_pkt_queue_t {
+    struct pkt_queue *pkt_list;
+    osi_sem_t enqueue_sem;
+    osi_sem_t dequeue_sem;
+    size_t capacity;
+    fixed_pkt_queue_cb dequeue_ready;
+} fixed_pkt_queue_t;
+
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity)
+{
+    fixed_pkt_queue_t *ret = osi_calloc(sizeof(fixed_pkt_queue_t));
+    if (!ret) {
+        goto error;
+    }
+
+    ret->capacity = capacity;
+    ret->pkt_list = pkt_queue_create();
+    if (!ret->pkt_list) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->enqueue_sem, capacity, capacity);
+    if (!ret->enqueue_sem) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->dequeue_sem, capacity, 0);
+    if (!ret->dequeue_sem) {
+        goto error;
+    }
+
+    return ret;
+
+error:
+    fixed_pkt_queue_free(ret, NULL);
+    return NULL;
+}
+
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    fixed_pkt_queue_unregister_dequeue(queue);
+
+    pkt_queue_destroy(queue->pkt_list, (pkt_queue_free_cb)free_cb);
+    queue->pkt_list = NULL;
+
+    if (queue->enqueue_sem) {
+        osi_sem_free(&queue->enqueue_sem);
+    }
+    if (queue->dequeue_sem) {
+        osi_sem_free(&queue->dequeue_sem);
+    }
+    osi_free(queue);
+}
+
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return true;
+    }
+
+    return pkt_queue_is_empty(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return pkt_queue_length(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    return queue->capacity;
+}
+
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout)
+{
+    bool ret = false;
+
+    assert(queue != NULL);
+    assert(linked_pkt != NULL);
+
+    if (osi_sem_take(&queue->enqueue_sem, timeout) != 0) {
+        return false;
+    }
+
+    ret = pkt_queue_enqueue(queue->pkt_list, linked_pkt);
+
+    assert(ret == true);
+    osi_sem_give(&queue->dequeue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout)
+{
+    pkt_linked_item_t *ret = NULL;
+
+    assert(queue != NULL);
+
+    if (osi_sem_take(&queue->dequeue_sem, timeout) != 0) {
+        return NULL;
+    }
+    ret = pkt_queue_dequeue(queue->pkt_list);
+
+    osi_sem_give(&queue->enqueue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    return pkt_queue_try_peek_first(queue->pkt_list);
+}
+
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb)
+{
+    assert(queue != NULL);
+    assert(ready_cb != NULL);
+
+    queue->dequeue_ready = ready_cb;
+}
+
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    queue->dequeue_ready = NULL;
+}
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    if (queue->dequeue_ready) {
+        queue->dequeue_ready(queue);
+    }
+}

components/bt/common/osi/include/osi/config.h

@@ -107,6 +107,11 @@ void config_set_string(config_t *config, const char *section, const char *key, c
 // Neither |config| nor |section| may be NULL.
 bool config_remove_section(config_t *config, const char *section);
 
+// Updates |section| to be the first section in |config|. Return true if |section| is in
+// |config| and updated successfully, false otherwise.
+// Neither |config| nor |section| may be NULL.
+bool config_update_newest_section(config_t *config, const char *section);
+
 // Removes one specific |key| residing in |section| of the |config|. Returns true
 // if the section and key were found and the key was removed, false otherwise.
 // None of |config|, |section|, or |key| may be NULL.

components/bt/common/osi/include/osi/fixed_pkt_queue.h

@@ -0,0 +1,79 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _FIXED_PKT_QUEUE_H_
+#define _FIXED_PKT_QUEUE_H_
+
+
+#include "osi/pkt_queue.h"
+#include "osi/semaphore.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef FIXED_PKT_QUEUE_SIZE_MAX
+#define FIXED_PKT_QUEUE_SIZE_MAX                    254
+#endif
+
+#define FIXED_PKT_QUEUE_MAX_TIMEOUT                 OSI_SEM_MAX_TIMEOUT
+
+struct fixed_pkt_queue_t;
+
+typedef struct fixed_pkt_queue_t fixed_pkt_queue_t;
+
+typedef void (*fixed_pkt_queue_free_cb)(pkt_linked_item_t *data);
+typedef void (*fixed_pkt_queue_cb)(fixed_pkt_queue_t *queue);
+
+// Creates a new fixed queue with the given |capacity|. If more elements than
+// |capacity| are added to the queue, the caller is blocked until space is
+// made available in the queue. Returns NULL on failure. The caller must free
+// the returned queue with |fixed_pkt_queue_free|.
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity);
+
+// Freeing a queue that is currently in use (i.e. has waiters
+// blocked on it) results in undefined behaviour.
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb);
+
+// Returns a value indicating whether the given |queue| is empty. If |queue|
+// is NULL, the return value is true.
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue);
+
+// Returns the length of the |queue|. If |queue| is NULL, the return value
+// is 0.
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue);
+
+// Returns the maximum number of elements this queue may hold. |queue| may
+// not be NULL.
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue);
+
+// Enqueues the given |data| into the |queue|. The caller will be blocked or immediately return or wait for timeout according to the parameter timeout.
+// If enqueue failed, it will return false, otherwise return true
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout);
+
+// Dequeues the next element from |queue|. If the queue is currently empty,
+// this function will block the caller until an item is enqueued or immediately return or wait for timeout according to the parameter timeout.
+// If dequeue failed, it will return NULL, otherwise return a point.
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout);
+
+// Returns the first element from |queue|, if present, without dequeuing it.
+// This function will never block the caller. Returns NULL if there are no
+// elements in the queue or |queue| is NULL.
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue);
+
+// Registers |queue| with |reactor| for dequeue operations. When there is an element
+// in the queue, ready_cb will be called. The |context| parameter is passed, untouched,
+// to the callback routine. Neither |queue|, nor |reactor|, nor |read_cb| may be NULL.
+// |context| may be NULL.
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb);
+
+// Unregisters the dequeue ready callback for |queue| from whichever reactor
+// it is registered with, if any. This function is idempotent.
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
+
+#endif

components/bt/common/osi/include/osi/pkt_queue.h

@@ -0,0 +1,88 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _PKT_LIST_H_
+#define _PKT_LIST_H_
+
+#include "sys/queue.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct pkt_queue;
+
+typedef struct pkt_linked_item {
+    STAILQ_ENTRY(pkt_linked_item) next;
+    uint8_t data[];
+} pkt_linked_item_t;
+
+#define BT_PKT_LINKED_HDR_SIZE (sizeof (pkt_linked_item_t))
+
+typedef void (*pkt_queue_free_cb)(pkt_linked_item_t *item);
+
+/*
+ * brief: create a pkt_queue instance. pkt_queue is a wrapper class of a FIFO implemented by single linked list.
+ *        The enqueue and dequeue operations of the FIFO are protected against race conditions of multiple tasks
+ * return: NULL if not enough memory, otherwise a valid pointer
+ */
+struct pkt_queue *pkt_queue_create(void);
+
+/*
+ * brief: enqueue one item to the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * param item: the item to be enqueued to the FIFO
+ * return: true if enqueued successfully, false when the arguments passed in are invalid
+ */
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item);
+
+/*
+ * brief: dequeue one item for the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of type pkt_linked_item_t dequeued, NULL if the queue is empty or upon exception
+ */
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue);
+
+/*
+ * brief: get the pointer of the first item from the FIFO but not get it dequeued
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of the first item in the FIFO, NULL if the FIFO is empty
+ */
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the number of items existing in the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: total number of items in the FIFO
+ */
+size_t pkt_queue_length(const struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the status whether the FIFO is empty
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: false if the FIFO is not empty, otherwise true
+ */
+bool pkt_queue_is_empty(const struct pkt_queue *queue);
+
+/*
+ * brief: delete the item in the FIFO one by one
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+/*
+ * brief: delete the items in the FIFO and then destroy the pkt_queue instance.
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

components/bt/common/osi/include/osi/thread.h

@@ -28,6 +28,7 @@
 #define OSI_THREAD_MAX_TIMEOUT OSI_SEM_MAX_TIMEOUT
 
 struct osi_thread;
+struct osi_event;
 
 typedef struct osi_thread osi_thread_t;
 
@@ -48,7 +49,7 @@ typedef enum {
  * param work_queue_num: speicify queue number, the queue[0] has highest priority, and the priority is decrease by index
  * return : if create successfully, return thread handler; otherwise return NULL.
  */
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num);
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[]);
 
 /*
  * brief: Destroy a thread or task
@@ -88,4 +89,42 @@ const char *osi_thread_name(osi_thread_t *thread);
  */
 int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx);
 
+/*
+ * brief: Create an osi_event struct and register the handler function and its argument
+ *        An osi_event is a kind of work that can be posted to the workqueue of osi_thread to process,
+ *        but the work can have at most one instance the thread workqueue before it is processed. This
+ *        allows the "single post, multiple data processing" jobs.
+ * param func: the handler to process the job
+ * param context: the argument to be passed to the handler function when the job is being processed
+ * return: NULL if no memory, otherwise a valid struct pointer
+ */
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context);
+
+/*
+ * brief: Bind an osi_event to a specific work queue for an osi_thread.
+ *        After binding is completed, a function call of API osi_thread_post_event will send a work
+ *        to the workqueue of the thread, with specified queue index.
+ * param func: event: the pointer to osi_event that is created using osi_event_create
+ * param thread: the pointer to osi_thread that is created using osi_thread_create
+ * param queue_idx: the index of the workqueue of the specified osi_thread, with range starting from 0 to work_queue_num - 1
+ * return: true if osi_event binds to the thread's workqueue successfully, otherwise false
+ */
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx);
+
+/*
+ * brief: Destroy the osi_event struct created by osi_event_create and free the allocated memory
+ * param event: the pointer to osi_event
+ */
+void osi_event_delete(struct osi_event* event);
+
+/*
+ * brief: try sending a work to the binded thread's workqueue, so that it can be handled by the worker thread
+ * param event: pointer to osi_event, created by osi_event_create
+ * param timeout: post timeout, OSI_THREAD_MAX_TIMEOUT means blocking forever, 0 means never blocking, others means block millisecond
+ * return: true if the message is enqueued to the thread workqueue, otherwise failed
+ * note: if the return value of function is false, it is the case that the workqueue of the thread is full, and users
+ *       are expected to post the event sometime later to get the work handled.
+ */
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout);
+
 #endif /* __THREAD_H__ */

components/bt/common/osi/pkt_queue.c

@@ -0,0 +1,144 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/pkt_queue.h"
+#include "osi/allocator.h"
+#include "osi/mutex.h"
+
+
+STAILQ_HEAD(pkt_queue_header, pkt_linked_item);
+
+struct pkt_queue {
+    osi_mutex_t lock;
+    size_t length;
+    struct pkt_queue_header header;
+} pkt_queue_t;
+
+struct pkt_queue *pkt_queue_create(void)
+{
+    struct pkt_queue *queue = calloc(1, sizeof(struct pkt_queue));
+    if (queue == NULL) {
+        return NULL;
+    }
+    if (osi_mutex_new(&queue->lock) != 0) {
+        osi_free(queue);
+    }
+    struct pkt_queue_header *p = &queue->header;
+    STAILQ_INIT(p);
+
+    return queue;
+}
+
+static void pkt_queue_cleanup(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item = STAILQ_FIRST(header);
+    pkt_linked_item_t *tmp;
+
+    pkt_queue_free_cb free_func = (free_cb != NULL) ? free_cb : (pkt_queue_free_cb)osi_free_func;
+
+    while (item != NULL) {
+        tmp = STAILQ_NEXT(item, next);
+        free_func(item);
+        item = tmp;
+        queue->length--;
+    }
+    STAILQ_INIT(header);
+    queue->length = 0;
+}
+
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+}
+
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+
+    osi_mutex_free(&queue->lock);
+    osi_free(queue);
+}
+
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue)
+{
+    if (queue == NULL || queue->length == 0) {
+        return NULL;
+    }
+
+    struct pkt_linked_item *item;
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    item = STAILQ_FIRST(header);
+    if (item != NULL) {
+        STAILQ_REMOVE_HEAD(header, next);
+        if (queue->length > 0) {
+            queue->length--;
+        }
+    }
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}
+
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item)
+{
+    if (queue == NULL || item == NULL) {
+        return false;
+    }
+
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    STAILQ_INSERT_TAIL(header, item, next);
+    queue->length++;
+    osi_mutex_unlock(&queue->lock);
+
+    return true;
+}
+
+size_t pkt_queue_length(const struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return queue->length;
+}
+
+bool pkt_queue_is_empty(const struct pkt_queue *queue)
+{
+    return pkt_queue_length(queue) == 0;
+}
+
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    item = STAILQ_FIRST(header);
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}

components/bt/common/osi/thread.c

@@ -19,16 +19,28 @@
 #include <string.h>
 
 #include "osi/allocator.h"
-#include "osi/fixed_queue.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/queue.h"
 #include "osi/semaphore.h"
 #include "osi/thread.h"
+#include "osi/mutex.h"
+
+struct work_item {
+    osi_thread_func_t func;
+    void *context;
+};
+
+struct work_queue {
+    QueueHandle_t queue;
+    size_t capacity;
+};
 
 struct osi_thread {
   void *thread_handle;                  /*!< Store the thread object */
   int  thread_id;                       /*!< May for some OS, such as Linux */
   bool stop;
   uint8_t work_queue_num;               /*!< Work queue number */
-  fixed_queue_t **work_queues;          /*!< Point to queue array, and the priority inverse array index */
+  struct work_queue **work_queues;      /*!< Point to queue array, and the priority inverse array index */
   osi_sem_t work_sem;
   osi_sem_t stop_sem;
 };
@@ -39,13 +51,98 @@ struct osi_thread_start_arg {
   int error;
 };
 
-typedef struct {
-  osi_thread_func_t func;
-  void *context;
-} work_item_t;
+struct osi_event {
+    struct work_item item;
+    osi_mutex_t lock;
+    uint16_t is_queued;
+    uint16_t queue_idx;
+    osi_thread_t *thread;
+};
 
 static const size_t DEFAULT_WORK_QUEUE_CAPACITY = 100;
 
+static struct work_queue *osi_work_queue_create(size_t capacity)
+{
+    if (capacity == 0) {
+        return NULL;
+    }
+
+    struct work_queue *wq = (struct work_queue *)osi_malloc(sizeof(struct work_queue));
+    if (wq != NULL) {
+        wq->queue = xQueueCreate(capacity, sizeof(struct work_item));
+        if (wq->queue != 0) {
+            wq->capacity = capacity;
+            return wq;
+        } else {
+            osi_free(wq);
+        }
+    }
+
+    return NULL;
+}
+
+static void osi_work_queue_delete(struct work_queue *wq)
+{
+    if (wq != NULL) {
+        if (wq->queue != 0) {
+            vQueueDelete(wq->queue);
+        }
+        wq->queue = 0;
+        wq->capacity = 0;
+        osi_free(wq);
+    }
+    return;
+}
+
+static bool osi_thead_work_queue_get(struct work_queue *wq, struct work_item *item)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    if (pdTRUE == xQueueReceive(wq->queue, item, 0)) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+static bool osi_thead_work_queue_put(struct work_queue *wq, const struct work_item *item, uint32_t timeout)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    bool ret = true;
+    if (timeout ==  OSI_SEM_MAX_TIMEOUT) {
+        if (xQueueSend(wq->queue, item, portMAX_DELAY) != pdTRUE) {
+            ret = false;
+        }
+    } else {
+        if (xQueueSend(wq->queue, item, timeout / portTICK_PERIOD_MS) != pdTRUE) {
+            ret = false;
+        }
+    }
+
+    return ret;
+}
+
+static size_t osi_thead_work_queue_len(struct work_queue *wq)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (wq->capacity != 0);
+
+    size_t available_spaces = (size_t)uxQueueSpacesAvailable(wq->queue);
+
+    if (available_spaces <= wq->capacity) {
+        return wq->capacity - available_spaces;
+    } else {
+        assert (0);
+    }
+    return 0;
+}
+
 static void osi_thread_run(void *arg)
 {
     struct osi_thread_start_arg *start = (struct osi_thread_start_arg *)arg;
@@ -62,11 +159,10 @@ static void osi_thread_run(void *arg)
             break;
         }
 
+        struct work_item item;
         while (!thread->stop && idx < thread->work_queue_num) {
-            work_item_t *item = fixed_queue_dequeue(thread->work_queues[idx], 0);
-            if (item) {
-                item->func(item->context);
-                osi_free(item);
+            if (osi_thead_work_queue_get(thread->work_queues[idx], &item) == true) {
+                item.func(item.context);
                 idx = 0;
                 continue;
             } else {
@@ -107,31 +203,32 @@ static void osi_thread_stop(osi_thread_t *thread)
 }
 
 //in linux, the stack_size, priority and core may not be set here, the code will be ignore the arguments
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[])
 {
     int ret;
     struct osi_thread_start_arg start_arg = {0};
 
     if (stack_size <= 0 ||
             core < OSI_THREAD_CORE_0 || core > OSI_THREAD_CORE_AFFINITY ||
-            work_queue_num <= 0) {
+            work_queue_num <= 0 || work_queue_len == NULL) {
         return NULL;
     }
 
-    osi_thread_t *thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
+    osi_thread_t *thread = (osi_thread_t *)osi_calloc(sizeof(osi_thread_t));
     if (thread == NULL) {
         goto _err;
     }
 
     thread->stop = false;
-    thread->work_queue_num = work_queue_num;
-    thread->work_queues = (fixed_queue_t **)osi_malloc(sizeof(fixed_queue_t *) * work_queue_num);
+    thread->work_queues = (struct work_queue **)osi_calloc(sizeof(struct work_queue *) * work_queue_num);
     if (thread->work_queues == NULL) {
         goto _err;
     }
+    thread->work_queue_num = work_queue_num;
 
     for (int i = 0; i < thread->work_queue_num; i++) {
-        thread->work_queues[i] = fixed_queue_new(DEFAULT_WORK_QUEUE_CAPACITY);
+        size_t queue_len = work_queue_len[i] ? work_queue_len[i] : DEFAULT_WORK_QUEUE_CAPACITY;
+        thread->work_queues[i] = osi_work_queue_create(queue_len);
         if (thread->work_queues[i] == NULL) {
             goto _err;
         }
@@ -175,12 +272,14 @@ _err:
 
         for (int i = 0; i < thread->work_queue_num; i++) {
             if (thread->work_queues[i]) {
-                fixed_queue_free(thread->work_queues[i], osi_free_func);
+                osi_work_queue_delete(thread->work_queues[i]);
             }
+            thread->work_queues[i] = NULL;
         }
 
         if (thread->work_queues) {
             osi_free(thread->work_queues);
+            thread->work_queues = NULL;
         }
 
         if (thread->work_sem) {
@@ -206,12 +305,14 @@ void osi_thread_free(osi_thread_t *thread)
 
     for (int i = 0; i < thread->work_queue_num; i++) {
         if (thread->work_queues[i]) {
-            fixed_queue_free(thread->work_queues[i], osi_free_func);
+            osi_work_queue_delete(thread->work_queues[i]);
+            thread->work_queues[i] = NULL;
         }
     }
 
     if (thread->work_queues) {
         osi_free(thread->work_queues);
+        thread->work_queues = NULL;
     }
 
     if (thread->work_sem) {
@@ -235,15 +336,12 @@ bool osi_thread_post(osi_thread_t *thread, osi_thread_func_t func, void *context
         return false;
     }
 
-    work_item_t *item = (work_item_t *)osi_malloc(sizeof(work_item_t));
-    if (item == NULL) {
-        return false;
-    }
-    item->func = func;
-    item->context = context;
+    struct work_item item;
 
-    if (fixed_queue_enqueue(thread->work_queues[queue_idx], item, timeout) == false) {
-        osi_free(item);
+    item.func = func;
+    item.context = context;
+
+    if (osi_thead_work_queue_put(thread->work_queues[queue_idx], &item, timeout) == false) {
         return false;
     }
 
@@ -273,5 +371,83 @@ int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx)
         return -1;
     }
 
-    return fixed_queue_length(thread->work_queues[wq_idx]);
+    return (int)(osi_thead_work_queue_len(thread->work_queues[wq_idx]));
+}
+
+
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context)
+{
+    struct osi_event *event = osi_calloc(sizeof(struct osi_event));
+    if (event != NULL) {
+        if (osi_mutex_new(&event->lock) == 0) {
+            event->item.func = func;
+            event->item.context = context;
+            return event;
+        }
+        osi_free(event);
+    }
+
+    return NULL;
+}
+
+void osi_event_delete(struct osi_event* event)
+{
+    if (event != NULL) {
+        osi_mutex_free(&event->lock);
+        memset(event, 0, sizeof(struct osi_event));
+        osi_free(event);
+    }
+}
+
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx)
+{
+    if (event == NULL || event->thread != NULL) {
+        return false;
+    }
+
+    if (thread == NULL || queue_idx >= thread->work_queue_num) {
+        return false;
+    }
+
+    event->thread = thread;
+    event->queue_idx = queue_idx;
+
+    return true;
+}
+
+static void osi_thread_generic_event_handler(void *context)
+{
+    struct osi_event *event = (struct osi_event *)context;
+    if (event != NULL && event->item.func != NULL) {
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued = 0;
+        osi_mutex_unlock(&event->lock);
+        event->item.func(event->item.context);
+    }
+}
+
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout)
+{
+    assert(event != NULL && event->thread != NULL);
+    assert(event->queue_idx >= 0 && event->queue_idx < event->thread->work_queue_num);
+    bool ret = false;
+    if (event->is_queued == 0) {
+        uint16_t acquire_cnt = 0;
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued += 1;
+        acquire_cnt = event->is_queued;
+        osi_mutex_unlock(&event->lock);
+
+        if (acquire_cnt == 1) {
+            ret = osi_thread_post(event->thread, osi_thread_generic_event_handler, event, event->queue_idx, timeout);
+            if (!ret) {
+                // clear "is_queued" when post failure, to allow for following event posts
+                osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+                event->is_queued = 0;
+                osi_mutex_unlock(&event->lock);
+            }
+        }
+    }
+
+    return ret;
 }

components/bt/controller/esp32/Kconfig.in

@@ -205,6 +205,11 @@ menu "HCI UART(H4) Options"
         help
             UART Baudrate for HCI. Please use standard baudrate.
 
+    config BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
+        bool "Enable UART flow control"
+        depends on BTDM_CTRL_HCI_MODE_UART_H4
+        default y
+
 endmenu
 
 menu "MODEM SLEEP Options"
@@ -351,7 +356,23 @@ config BTDM_SCAN_DUPL_CACHE_SIZE
     default 100
     help
         Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
+        When the maximum amount of device in the filter is reached, the oldest device will be refreshed.
+
+config BTDM_SCAN_DUPL_CACHE_REFRESH_PERIOD
+    int "Duplicate scan list refresh period (seconds)"
+    depends on BTDM_BLE_SCAN_DUPL
+    range 0 1000
+    default 0
+    help
+        If the period value is non-zero, the controller will periodically clear the device information
+        stored in the scan duuplicate filter. If it is 0, the scan duuplicate filter will not be cleared
+        until the scanning is disabled. Duplicate advertisements for this period should not be sent to the
+        Host in advertising report events.
+        There are two scenarios where the ADV packet will be repeatedly reported:
+        1. The duplicate scan cache is full, the controller will delete the oldest device information and
+        add new device information.
+        2. When the refresh period is up, the controller will clear all device information and start filtering
+        again.
 
 config BTDM_BLE_MESH_SCAN_DUPL_EN
     bool "Special duplicate scan mechanism for BLE Mesh scan"

components/bt/controller/esp32/bt.c

@@ -88,14 +88,9 @@ do{\
 } while(0)
 
 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010003
+#define OSI_VERSION              0x00010004
 #define OSI_MAGIC_VALUE          0xFADEBEAD
 
-/* SPIRAM Configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
-#define BTDM_MAX_QUEUE_NUM       (6)
-#endif
-
 /* Types definition
  ************************************************************************
  */
@@ -113,14 +108,10 @@ typedef struct {
     intptr_t end;
 } btdm_dram_available_region_t;
 
-/* PSRAM configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
 typedef struct {
-    QueueHandle_t handle;
+    void *handle;
     void *storage;
-    void *buffer;
 } btdm_queue_item_t;
-#endif
 
 /* OSI function */
 struct osi_funcs_t {
@@ -184,6 +175,7 @@ struct osi_funcs_t {
     void (*_interrupt_l3_disable)(void);
     void (*_interrupt_l3_restore)(void);
     void *(* _customer_queue_create)(uint32_t queue_len, uint32_t item_size);
+    int (* _coex_version_get)(unsigned int *major, unsigned int *minor, unsigned int *patch);
     uint32_t _magic;
 };
 
@@ -242,6 +234,8 @@ extern int coex_wifi_channel_get(uint8_t *primary, uint8_t *secondary);
 extern int coex_register_wifi_channel_change_callback(void *cb);
 /* Shutdown */
 extern void esp_bt_controller_shutdown(void);
+extern void sdk_config_set_bt_pll_track_enable(bool enable);
+extern void sdk_config_set_uart_flow_ctrl_enable(bool enable);
 
 extern char _bss_start_btdm;
 extern char _bss_end_btdm;
@@ -266,11 +260,6 @@ extern uint32_t _btdm_data_end;
 /* Local Function Declare
  *********************************************************************
  */
-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue);
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue);
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
-
 #if CONFIG_BTDM_CTRL_HLI
 static xt_handler set_isr_hlevel_wrapper(int n, xt_handler f, void *arg);
 static void IRAM_ATTR interrupt_hlevel_disable(void);
@@ -333,11 +322,13 @@ static uint8_t coex_schm_curr_period_get_wrapper(void);
 static void * coex_schm_curr_phase_get_wrapper(void);
 static int coex_wifi_channel_get_wrapper(uint8_t *primary, uint8_t *secondary);
 static int coex_register_wifi_channel_change_callback_wrapper(void *cb);
+static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch);
 #if CONFIG_BTDM_CTRL_HLI
 static void *customer_queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t item_size);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 static void IRAM_ATTR interrupt_l3_disable(void);
 static void IRAM_ATTR interrupt_l3_restore(void);
+static void bt_controller_deinit_internal(void);
 
 /* Local variable definition
  ***************************************************************************
@@ -424,6 +415,7 @@ static const struct osi_funcs_t osi_funcs_ro = {
 #else
     ._customer_queue_create = NULL,
 #endif /* CONFIG_BTDM_CTRL_HLI */
+    ._coex_version_get = coex_version_get_wrapper,
     ._magic = OSI_MAGIC_VALUE,
 };
 
@@ -450,11 +442,6 @@ SOC_RESERVE_MEMORY_REGION(SOC_MEM_BT_DATA_START, SOC_MEM_BT_DATA_END,
 
 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;
 
-#if CONFIG_SPIRAM_USE_MALLOC
-static DRAM_ATTR btdm_queue_item_t btdm_queue_table[BTDM_MAX_QUEUE_NUM];
-static DRAM_ATTR SemaphoreHandle_t btdm_queue_table_mux = NULL;
-#endif /* #if CONFIG_SPIRAM_USE_MALLOC */
-
 /* Static variable declare */
 // timestamp when PHY/RF was switched on
 static DRAM_ATTR int64_t s_time_phy_rf_just_enabled = 0;
@@ -506,52 +493,6 @@ static inline void btdm_check_and_init_bb(void)
     }
 }
 
-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return NULL;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == NULL) {
-            memcpy(item, queue, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return false;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == queue->handle) {
-            memcpy(queue, item, sizeof(btdm_queue_item_t));
-            memset(item, 0, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
-
 #if CONFIG_BTDM_CTRL_HLI
 struct interrupt_hlevel_cb{
     uint32_t status;
@@ -624,6 +565,9 @@ static void IRAM_ATTR task_yield_from_isr(void)
 
 static void *semphr_create_wrapper(uint32_t max, uint32_t init)
 {
+    btdm_queue_item_t *semphr = heap_caps_calloc(1, sizeof(btdm_queue_item_t), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
+    assert(semphr);
+
     void *handle = NULL;
 
 #if !CONFIG_SPIRAM_USE_MALLOC
@@ -632,112 +576,94 @@ static void *semphr_create_wrapper(uint32_t max, uint32_t init)
     StaticQueue_t *queue_buffer = NULL;
 
     queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    assert(queue_buffer);
+    semphr->storage = queue_buffer;
 
     handle = (void *)xSemaphoreCreateCountingStatic(max, init, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
 #endif
+    assert(handle);
 
 #if CONFIG_BTDM_CTRL_HLI
     SemaphoreHandle_t downstream_semaphore = handle;
     assert(downstream_semaphore);
     hli_queue_handle_t s_semaphore = hli_semaphore_create(max, downstream_semaphore);
-    assert(downstream_semaphore);
-    return s_semaphore;
+    assert(s_semaphore);
+    semphr->handle = (void *)s_semaphore;
 #else
-    return handle;
+    semphr->handle =  handle;
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
-#if CONFIG_SPIRAM_USE_MALLOC
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
-#endif
+    return semphr;
 }
 
 static void semphr_delete_wrapper(void *semphr)
 {
+    if (semphr == NULL) {
+        return;
+    }
+
+    btdm_queue_item_t *semphr_item = (btdm_queue_item_t *)semphr;
     void *handle = NULL;
 #if CONFIG_BTDM_CTRL_HLI
-    if (((hli_queue_handle_t)semphr)->downstream != NULL) {
-        handle = ((hli_queue_handle_t)semphr)->downstream;
-     }
-
-    hli_queue_delete(semphr);
+    if (semphr_item->handle) {
+        handle = ((hli_queue_handle_t)(semphr_item->handle))->downstream;
+        hli_queue_delete((hli_queue_handle_t)(semphr_item->handle));
+    }
 #else
-    handle = semphr;
+    handle = semphr_item->handle;
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
-#if !CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(handle);
-#else
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
+    if (handle) {
+        vSemaphoreDelete(handle);
+    }
+#ifdef CONFIG_SPIRAM_USE_MALLOC
+    if (semphr_item->storage) {
+        free(semphr_item->storage);
     }
 #endif
+
+    free(semphr);
 }
 
 static int32_t IRAM_ATTR semphr_take_from_isr_wrapper(void *semphr, void *hptw)
 {
 #if CONFIG_BTDM_CTRL_HLI
-    return (int32_t)xSemaphoreTakeFromISR(((hli_queue_handle_t)semphr)->downstream, hptw);
+    // Not support it
+    assert(0);
+    return 0;
 #else
-    return (int32_t)xSemaphoreTakeFromISR(semphr, hptw);
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
+    return (int32_t)xSemaphoreTakeFromISR(handle, hptw);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }
 
 static int32_t IRAM_ATTR semphr_give_from_isr_wrapper(void *semphr, void *hptw)
 {
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
     UNUSED(hptw);
     assert(xPortGetCoreID() == CONFIG_BTDM_CTRL_PINNED_TO_CORE);
-    return hli_semaphore_give(semphr);
+    return hli_semaphore_give(handle);
 #else
-    return (int32_t)xSemaphoreGiveFromISR(semphr, hptw);
+    return (int32_t)xSemaphoreGiveFromISR(handle, hptw);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }
 
 static int32_t semphr_take_wrapper(void *semphr, uint32_t block_time_ms)
 {
     bool ret;
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xSemaphoreTake(((hli_queue_handle_t)semphr)->downstream, portMAX_DELAY);
+        ret = xSemaphoreTake(((hli_queue_handle_t)handle)->downstream, portMAX_DELAY);
     } else {
-        ret = xSemaphoreTake(((hli_queue_handle_t)semphr)->downstream, block_time_ms / portTICK_PERIOD_MS);
+        ret = xSemaphoreTake(((hli_queue_handle_t)handle)->downstream, block_time_ms / portTICK_PERIOD_MS);
     }
 #else
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xSemaphoreTake(semphr, portMAX_DELAY);
+        ret = xSemaphoreTake(handle, portMAX_DELAY);
     } else {
-        ret = xSemaphoreTake(semphr, block_time_ms / portTICK_PERIOD_MS);
+        ret = xSemaphoreTake(handle, block_time_ms / portTICK_PERIOD_MS);
     }
 #endif /* CONFIG_BTDM_CTRL_HLI */
     return (int32_t)ret;
@@ -745,72 +671,22 @@ static int32_t semphr_take_wrapper(void *semphr, uint32_t block_time_ms)
 
 static int32_t semphr_give_wrapper(void *semphr)
 {
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
-    return (int32_t)xSemaphoreGive(((hli_queue_handle_t)semphr)->downstream);
+    return (int32_t)xSemaphoreGive(((hli_queue_handle_t)handle)->downstream);
 #else
-    return (int32_t)xSemaphoreGive(semphr);
+    return (int32_t)xSemaphoreGive(handle);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }
 
 static void *mutex_create_wrapper(void)
 {
-#if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    QueueHandle_t handle = NULL;
-
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
-
-    handle = xSemaphoreCreateMutexStatic(queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-    return handle;
-
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
-#else
     return (void *)xSemaphoreCreateMutex();
-#endif
 }
 
 static void mutex_delete_wrapper(void *mutex)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
     vSemaphoreDelete(mutex);
-#else
-    btdm_queue_item_t item = {
-        .handle = mutex,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
-    }
-
-    return;
-#endif
 }
 
 static int32_t mutex_lock_wrapper(void *mutex)
@@ -825,109 +701,93 @@ static int32_t mutex_unlock_wrapper(void *mutex)
 
 static void *queue_create_wrapper(uint32_t queue_len, uint32_t item_size)
 {
+    btdm_queue_item_t *queue = NULL;
+
+    queue = (btdm_queue_item_t*)heap_caps_malloc(sizeof(btdm_queue_item_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue);
+
 #if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    uint8_t *queue_storage = NULL;
-    QueueHandle_t handle = NULL;
 
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    queue->storage = heap_caps_calloc(1, sizeof(StaticQueue_t) + (queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue->storage);
 
-    queue_storage = heap_caps_malloc((queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_storage ) {
-        goto error;
-    }
+    queue->handle = xQueueCreateStatic( queue_len, item_size, ((uint8_t*)(queue->storage)) + sizeof(StaticQueue_t), (StaticQueue_t*)(queue->storage));
+    assert(queue->handle);
 
-    handle = xQueueCreateStatic(queue_len, item_size, queue_storage, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = queue_storage,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-
-    return handle;
-
- error:
-    if (handle) {
-        vQueueDelete(handle);
-    }
-    if (queue_storage) {
-        free(queue_storage);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
 #else
-    return (void *)xQueueCreate(queue_len, item_size);
+    queue->handle = xQueueCreate( queue_len, item_size);
+    assert(queue->handle);
 #endif
+
+    return queue;
 }
 
 static void queue_delete_wrapper(void *queue)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
-    vQueueDelete(queue);
-#else
-    btdm_queue_item_t item = {
-        .handle = queue,
-        .storage = NULL,
-        .buffer = NULL,
-    };
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+    if (queue_item) {
+        if(queue_item->handle){
+            vQueueDelete(queue_item->handle);
+        }
 
-    if (btdm_queue_generic_deregister(&item)) {
-        vQueueDelete(item.handle);
-        free(item.storage);
-        free(item.buffer);
-    }
-
-    return;
+#if CONFIG_SPIRAM_USE_MALLOC
+        if (queue_item->storage) {
+            free(queue_item->storage);
+        }
 #endif
+
+        free(queue_item);
+    }
 }
 
 #if CONFIG_BTDM_CTRL_HLI
 static void *queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t item_size)
 {
-    QueueHandle_t downstream_queue = queue_create_wrapper(queue_len, item_size);
-    assert(downstream_queue);
+    btdm_queue_item_t *queue_item = queue_create_wrapper(queue_len, item_size);
+    assert(queue_item);
+    QueueHandle_t downstream_queue = queue_item->handle;
+    assert(queue_item->handle);
     hli_queue_handle_t queue = hli_queue_create(queue_len, item_size, downstream_queue);
     assert(queue);
-    return queue;
+    queue_item->handle = queue;
+    return (void *)queue_item;
 }
 
 static void *customer_queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t item_size)
 {
-    QueueHandle_t downstream_queue = queue_create_wrapper(queue_len, item_size);
-    assert(downstream_queue);
+    btdm_queue_item_t *queue_item = queue_create_wrapper(queue_len, item_size);
+    assert(queue_item);
+    QueueHandle_t downstream_queue = queue_item->handle;
+    assert(queue_item->handle);
     hli_queue_handle_t queue = hli_customer_queue_create(queue_len, item_size, downstream_queue);
     assert(queue);
-    return queue;
+    queue_item->handle = queue;
+    return (void *)queue_item;
 }
 
 static void queue_delete_hlevel_wrapper(void *queue)
 {
-    if (((hli_queue_handle_t)queue)->downstream != NULL) {
-        queue_delete_wrapper(((hli_queue_handle_t)queue)->downstream);
+    if (queue == NULL) {
+        return;
+    }
+
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+
+    if (queue_item->handle) {
+        void *handle = ((hli_queue_handle_t)(queue_item->handle))->downstream;
+        hli_queue_delete(queue_item->handle);
+        queue_item->handle = handle;
+        queue_delete_wrapper(queue_item);
     }
-    hli_queue_delete(queue);
 }
 
 static int32_t queue_send_hlevel_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueSend(((hli_queue_handle_t)queue)->downstream, item, portMAX_DELAY);
+        return (int32_t)xQueueSend(((hli_queue_handle_t)handle)->downstream, item, portMAX_DELAY);
     } else {
-        return (int32_t)xQueueSend(((hli_queue_handle_t)queue)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueSend(((hli_queue_handle_t)handle)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
     }
 }
 
@@ -946,16 +806,18 @@ static int32_t IRAM_ATTR queue_send_from_isr_hlevel_wrapper(void *queue, void *i
 {
     UNUSED(hptw);
     assert(xPortGetCoreID() == CONFIG_BTDM_CTRL_PINNED_TO_CORE);
-    return hli_queue_put(queue, item);
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
+    return hli_queue_put(handle, item);
 }
 
 static int32_t queue_recv_hlevel_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
     bool ret;
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xQueueReceive(((hli_queue_handle_t)queue)->downstream, item, portMAX_DELAY);
+        ret = xQueueReceive(((hli_queue_handle_t)handle)->downstream, item, portMAX_DELAY);
     } else {
-        ret = xQueueReceive(((hli_queue_handle_t)queue)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
+        ret = xQueueReceive(((hli_queue_handle_t)handle)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
     }
 
     return (int32_t)ret;
@@ -963,7 +825,9 @@ static int32_t queue_recv_hlevel_wrapper(void *queue, void *item, uint32_t block
 
 static int32_t IRAM_ATTR queue_recv_from_isr_hlevel_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueReceiveFromISR(((hli_queue_handle_t)queue)->downstream, item, hptw);
+    // Not support it
+    assert(0);
+    return 0;
 }
 
 #else
@@ -971,24 +835,24 @@ static int32_t IRAM_ATTR queue_recv_from_isr_hlevel_wrapper(void *queue, void *i
 static int32_t queue_send_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueSend(queue, item, portMAX_DELAY);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
     } else {
-        return (int32_t)xQueueSend(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
     }
 }
 
 static int32_t IRAM_ATTR queue_send_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueSendFromISR(queue, item, hptw);
+    return (int32_t)xQueueSendFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }
 
 static int32_t queue_recv_wrapper(void *queue, void *item, uint32_t block_time_ms)
  {
     bool ret;
     if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xQueueReceive(queue, item, portMAX_DELAY);
+        ret = xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
     } else {
-        ret = xQueueReceive(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        ret = xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
     }
 
     return (int32_t)ret;
@@ -996,7 +860,7 @@ static int32_t queue_recv_wrapper(void *queue, void *item, uint32_t block_time_m
 
 static int32_t IRAM_ATTR queue_recv_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueReceiveFromISR(queue, item, hptw);
+    return (int32_t)xQueueReceiveFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
@@ -1046,7 +910,11 @@ static void *malloc_internal_wrapper(size_t size)
 
 static int32_t IRAM_ATTR read_mac_wrapper(uint8_t mac[6])
 {
-    return esp_read_mac(mac, ESP_MAC_BT);
+    int ret = esp_read_mac(mac, ESP_MAC_BT);
+    ESP_LOGI(BTDM_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
+               mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+
+    return ret;
 }
 
 static void IRAM_ATTR srand_wrapper(unsigned int seed)
@@ -1370,6 +1238,30 @@ static int coex_register_wifi_channel_change_callback_wrapper(void *cb)
 #endif
 }
 
+static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    const char *ver_str = esp_coex_version_get();
+    if (ver_str != NULL) {
+        unsigned int _major = 0, _minor = 0, _patch = 0;
+        if (sscanf(ver_str, "%u.%u.%u", &_major, &_minor, &_patch) != 3) {
+            return -1;
+        }
+        if (major != NULL) {
+            *major = _major;
+        }
+        if (minor != NULL) {
+            *minor = _minor;
+        }
+        if (patch != NULL) {
+            *patch = _patch;
+        }
+        return 0;
+    }
+#endif
+    return -1;
+}
+
 bool esp_vhci_host_check_send_available(void)
 {
     return API_vhci_host_check_send_available();
@@ -1614,21 +1506,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     ESP_LOGI(BTDM_LOG_TAG, "BT controller compile version [%s]", btdm_controller_get_compile_version());
 
-#if CONFIG_SPIRAM_USE_MALLOC
-    btdm_queue_table_mux = xSemaphoreCreateMutex();
-    if (btdm_queue_table_mux == NULL) {
-        return ESP_ERR_NO_MEM;
-    }
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
-
     s_wakeup_req_sem = semphr_create_wrapper(1, 0);
     if (s_wakeup_req_sem == NULL) {
         err = ESP_ERR_NO_MEM;
         goto error;
     }
 
-    esp_phy_pd_mem_init();
+    esp_phy_modem_init();
 
     esp_bt_power_domain_on();
 
@@ -1688,6 +1572,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
 #endif
 
+#if CONFIG_BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
+    sdk_config_set_uart_flow_ctrl_enable(true);
+#else
+    sdk_config_set_uart_flow_ctrl_enable(false);
+#endif
+
 #ifdef CONFIG_PM_ENABLE
     if (!s_btdm_allow_light_sleep) {
         if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
@@ -1725,26 +1615,9 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     return ESP_OK;
 
 error:
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if (s_light_sleep_pm_lock != NULL) {
-            esp_pm_lock_delete(s_light_sleep_pm_lock);
-            s_light_sleep_pm_lock = NULL;
-        }
-    }
-    if (s_pm_lock != NULL) {
-        esp_pm_lock_delete(s_pm_lock);
-        s_pm_lock = NULL;
-    }
-    if (s_btdm_slp_tmr != NULL) {
-        esp_timer_delete(s_btdm_slp_tmr);
-        s_btdm_slp_tmr = NULL;
-    }
-#endif
-    if (s_wakeup_req_sem) {
-        semphr_delete_wrapper(s_wakeup_req_sem);
-        s_wakeup_req_sem = NULL;
-    }
+
+    bt_controller_deinit_internal();
+
     return err;
 }
 
@@ -1756,6 +1629,13 @@ esp_err_t esp_bt_controller_deinit(void)
 
     btdm_controller_deinit();
 
+    bt_controller_deinit_internal();
+
+    return ESP_OK;
+}
+
+static void bt_controller_deinit_internal(void)
+{
     periph_module_disable(PERIPH_BT_MODULE);
 
 #ifdef CONFIG_PM_ENABLE
@@ -1777,17 +1657,16 @@ esp_err_t esp_bt_controller_deinit(void)
 
     s_pm_lock_acquired = false;
 #endif
-    semphr_delete_wrapper(s_wakeup_req_sem);
-    s_wakeup_req_sem = NULL;
 
-#if CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(btdm_queue_table_mux);
-    btdm_queue_table_mux = NULL;
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
+    if (s_wakeup_req_sem) {
+        semphr_delete_wrapper(s_wakeup_req_sem);
+        s_wakeup_req_sem = NULL;
+    }
 
-    free(osi_funcs_p);
-    osi_funcs_p = NULL;
+    if (osi_funcs_p) {
+        free(osi_funcs_p);
+        osi_funcs_p = NULL;
+    }
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
@@ -1796,9 +1675,7 @@ esp_err_t esp_bt_controller_deinit(void)
 
     esp_bt_power_domain_off();
 
-    esp_phy_pd_mem_deinit();
-
-    return ESP_OK;
+    esp_phy_modem_deinit();
 }
 
 static void bt_controller_shutdown(void* arg)
@@ -1852,6 +1729,8 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         btdm_controller_enable_sleep(true);
     }
 
+    sdk_config_set_bt_pll_track_enable(true);
+
     // inititalize bluetooth baseband
     btdm_check_and_init_bb();
 

components/bt/controller/esp32c3/Kconfig.in

@@ -4,11 +4,13 @@ config BT_CTRL_MODE_EFF
 
 config BT_CTRL_BLE_MAX_ACT
     int "BLE Max Instances"
-    default 10
+    default 6
     range 1 10
     help
         BLE maximum activities of bluetooth controller，both of connections,
-        scan , sync and adv(periodic adv, multi-adv).
+        scan , sync and adv(periodic adv, multi-adv). Each instance needs to
+        consume 828 bytes, you can save RAM by modifying the instance value
+        according to actual needs.
 
 config BT_CTRL_BLE_MAX_ACT_EFF
     int
@@ -24,8 +26,24 @@ config BT_CTRL_BLE_STATIC_ACL_TX_BUF_NB
         (alloate when controller initialise, never free until controller de-initialise)
         another is dynamically allocating (allocate before TX and free after TX).
 
+choice BT_CTRL_PINNED_TO_CORE_CHOICE
+    prompt "The cpu core which bluetooth controller run"
+    depends on !FREERTOS_UNICORE
+    help
+        Specify the cpu core to run bluetooth controller.
+        Can not specify no-affinity.
+
+    config BT_CTRL_PINNED_TO_CORE_0
+        bool "Core 0 (PRO CPU)"
+    config BT_CTRL_PINNED_TO_CORE_1
+        bool "Core 1 (APP CPU)"
+        depends on !FREERTOS_UNICORE
+endchoice
+
 config BT_CTRL_PINNED_TO_CORE
     int
+    default 0 if BT_CTRL_PINNED_TO_CORE_0
+    default 1 if BT_CTRL_PINNED_TO_CORE_1
     default 0
 
 choice BT_CTRL_HCI_MODE_CHOICE
@@ -36,7 +54,7 @@ choice BT_CTRL_HCI_MODE_CHOICE
     config BT_CTRL_HCI_MODE_VHCI
         bool "VHCI"
         help
-            Normal option. Mostly, choose this VHCI when bluetooth host run on ESP32C3, too.
+            Normal option. Mostly, choose this VHCI when bluetooth host run on ESP32S3 or ESP32C3.
 
     config BT_CTRL_HCI_MODE_UART_H4
         bool "UART(H4)"
@@ -60,15 +78,29 @@ config BT_CTRL_ADV_DUP_FILT_MAX
     help
         The maxinum number of suplicate scan filter
 
-config BT_CTRL_HW_CCA
-    bool "HW CCA check enable"
-    default n
+choice BT_BLE_CCA_MODE
+    prompt "BLE CCA mode"
+    default BT_BLE_CCA_MODE_NONE
     help
-        It enables HW CCA feature in controller
+        Define BT BLE CCA mode
+
+    config BT_BLE_CCA_MODE_NONE
+        bool "NONE"
+    config BT_BLE_CCA_MODE_HW
+        bool "Hardware"
+    config BT_BLE_CCA_MODE_SW
+        bool "Software"
+endchoice
+
+config BT_BLE_CCA_MODE
+    int
+    default 0 if BT_BLE_CCA_MODE_NONE
+    default 1 if BT_BLE_CCA_MODE_HW
+    default 2 if BT_BLE_CCA_MODE_SW
 
 config BT_CTRL_HW_CCA_VAL
     int "CCA threshold value"
-    range 20 60
+    range 20 100
     default 20
     help
         It is the threshold value of HW CCA, if the value is 30, it means CCA threshold is -30 dBm.
@@ -134,12 +166,10 @@ config BT_CTRL_RX_ANTENNA_INDEX_EFF
 
 choice BT_CTRL_DFT_TX_POWER_LEVEL
     prompt "BLE default Tx power level"
-    default BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default BT_CTRL_DFT_TX_POWER_LEVEL_P9
     help
         Specify default Tx power level
 
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_N24
         bool "-24dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_N21
@@ -170,26 +200,28 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
         bool "+15dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_P18
         bool "+18dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
+        bool "+21dBm"
 endchoice
 
 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
     int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
+    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
+    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
+    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
+    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
+    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
+    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
+    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
+    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
+    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
+    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
+    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
+    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
     default 0
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
@@ -247,20 +279,19 @@ choice BT_CTRL_SCAN_DUPL_TYPE
     config BT_CTRL_SCAN_DUPL_TYPE_DEVICE
         bool "Scan Duplicate By Device Address"
         help
-            This way is to use advertiser address filtering. The adv packet of the same address is only
-            allowed to be reported once
+            Advertising packets with the same address, address type, and advertising type are reported once.
 
     config BT_CTRL_SCAN_DUPL_TYPE_DATA
         bool "Scan Duplicate By Advertising Data"
         help
-            This way is to use advertising data filtering. All same advertising data only allow to be reported
-            once even though they are from different devices.
+            Advertising packets with identical advertising data, address type, and advertising type
+            are reported only once, even if they originate from different devices.
 
     config BT_CTRL_SCAN_DUPL_TYPE_DATA_DEVICE
         bool "Scan Duplicate By Device Address And Advertising Data"
         help
-            This way is to use advertising data and device address filtering. All different adv packets with
-            the same address are allowed to be reported.
+            Advertising packets with the same address, advertising data, address type,
+            and advertising type are reported only once.
 endchoice
 
 config BT_CTRL_SCAN_DUPL_TYPE
@@ -280,6 +311,22 @@ config BT_CTRL_SCAN_DUPL_CACHE_SIZE
         Maximum number of devices which can be recorded in scan duplicate filter.
         When the maximum amount of device in the filter is reached, the cache will be refreshed.
 
+config BT_CTRL_DUPL_SCAN_CACHE_REFRESH_PERIOD
+    int "Duplicate scan list refresh period (seconds)"
+    depends on BT_CTRL_BLE_SCAN_DUPL
+    range 0 1000
+    default 0
+    help
+        If the period value is non-zero, the controller will periodically clear the device information
+        stored in the scan duuplicate filter. If it is 0, the scan duuplicate filter will not be cleared
+        until the scanning is disabled. Duplicate advertisements for this period should not be sent to the
+        Host in advertising report events.
+        There are two scenarios where the ADV packet will be repeatedly reported:
+        1. The duplicate scan cache is full, the controller will delete the oldest device information and
+        add new device information.
+        2. When the refresh period is up, the controller will clear all device information and start filtering
+        again.
+
 config BT_CTRL_BLE_MESH_SCAN_DUPL_EN
     bool "Special duplicate scan mechanism for BLE Mesh scan"
     depends on BT_CTRL_BLE_SCAN_DUPL
@@ -351,12 +398,12 @@ menu "MODEM SLEEP Options"
             bool "Main crystal"
             help
                 Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
+                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, and
+                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
+                than other bluetooth low power clock sources.
         config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
             bool "External 32kHz crystal"
-            depends on ESP32C3_RTC_CLK_SRC_EXT_CRYS
+            depends on (ESP32C3_RTC_CLK_SRC_EXT_CRYS || ESP32S3_RTC_CLK_SRC_EXT_CRYS)
             help
                 External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
                 stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
@@ -364,13 +411,21 @@ menu "MODEM SLEEP Options"
 
         config BT_CTRL_LPCLK_SEL_RTC_SLOW
             bool "Internal 150kHz RC oscillator"
-            depends on ESP32C3_RTC_CLK_SRC_INT_RC
+            depends on (ESP32C3_RTC_CLK_SRC_INT_RC || ESP32S3_RTC_CLK_SRC_INT_RC)
             help
                 Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                 in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
     endchoice
+
+    config BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        bool "power up main XTAL during light sleep"
+        depends on (BT_CTRL_LPCLK_SEL_MAIN_XTAL || BT_CTRL_LPCLK_SEL_EXT_32K_XTAL) && FREERTOS_USE_TICKLESS_IDLE
+        default n
+        help
+            If this option is selected, the main crystal will power up during light sleep when the low power clock
+            selects an external 32kHz crystal but the external 32kHz crystal does not exist or the low power clock
+            selects the main crystal.
+
 endmenu
 
 config BT_CTRL_SLEEP_MODE_EFF
@@ -404,3 +459,19 @@ config BT_CTRL_CODED_AGC_RECORRECT_EN
     default n
     help
         Enable coded phy AGC recorrect
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    bool "Disable active scan backoff"
+    default n
+    help
+        Disable active scan backoff. The bluetooth spec requires that scanners should run a backoff procedure to
+        minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
+        scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
+
+config BT_BLE_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero"
+    default n
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32s3/Kconfig.in

@@ -1,423 +1 @@
-config BT_CTRL_MODE_EFF
-    int
-    default 1
-
-config BT_CTRL_BLE_MAX_ACT
-    int "BLE Max Instances"
-    default 10
-    range 1 10
-    help
-        BLE maximum instances of bluetooth controller.
-
-config BT_CTRL_BLE_MAX_ACT_EFF
-    int
-    default BT_CTRL_BLE_MAX_ACT
-    default 0
-
-config BT_CTRL_BLE_STATIC_ACL_TX_BUF_NB
-    int "BLE static ACL TX buffer numbers"
-    range 0 12
-    default 0
-    help
-        BLE ACL buffer have two methods to be allocated. One is persistent allocating
-        (alloate when controller initialise, never free until controller de-initialise)
-        another is dynamically allocating (allocate before TX and free after TX).
-
-choice BT_CTRL_PINNED_TO_CORE_CHOICE
-    prompt "The cpu core which bluetooth controller run"
-    depends on !FREERTOS_UNICORE
-    help
-        Specify the cpu core to run bluetooth controller.
-        Can not specify no-affinity.
-
-    config BT_CTRL_PINNED_TO_CORE_0
-        bool "Core 0 (PRO CPU)"
-    config BT_CTRL_PINNED_TO_CORE_1
-        bool "Core 1 (APP CPU)"
-        depends on !FREERTOS_UNICORE
-endchoice
-
-config BT_CTRL_PINNED_TO_CORE
-    int
-    default 0 if BT_CTRL_PINNED_TO_CORE_0
-    default 1 if BT_CTRL_PINNED_TO_CORE_1
-    default 0
-
-choice BT_CTRL_HCI_MODE_CHOICE
-    prompt "HCI mode"
-    help
-        Specify HCI mode as VHCI or UART(H4)
-
-    config BT_CTRL_HCI_MODE_VHCI
-        bool "VHCI"
-        help
-            Normal option. Mostly, choose this VHCI when bluetooth host run on ESP32S3, too.
-
-    config BT_CTRL_HCI_MODE_UART_H4
-        bool "UART(H4)"
-        help
-            If use external bluetooth host which run on other hardware and use UART as the HCI interface,
-            choose this option.
-endchoice
-
-config BT_CTRL_HCI_TL
-    int
-    default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
-    default 1
-    help
-        HCI mode as VHCI or UART(H4)
-
-config BT_CTRL_ADV_DUP_FILT_MAX
-    int "The maxinum number of 5.0 extend duplicate scan filter"
-    range 1 500
-    default 30
-    help
-        The maxinum number of suplicate scan filter
-
-config BT_CTRL_HW_CCA
-    bool "HW CCA check enable"
-    default n
-    help
-        It enables HW CCA feature in controller
-
-config BT_CTRL_HW_CCA_VAL
-    int "CCA threshold value"
-    range 20 60
-    default 20
-    help
-        It is the threshold value of HW CCA, if the value is 30, it means CCA threshold is -30 dBm.
-
-config BT_CTRL_HW_CCA_EFF
-    int
-    default 1 if BT_CTRL_HW_CCA
-    default 0
-    help
-        If other devices are sending packets in the air and the signal is strong,
-        the packet hw to be sent this time is cancelled.
-
-choice BT_CTRL_CE_LENGTH_TYPE
-    prompt "Connection event length determination method"
-    help
-        Specify connection event length determination
-
-    config BT_CTRL_CE_LENGTH_TYPE_ORIG
-        bool "ORIGINAL"
-    config BT_CTRL_CE_LENGTH_TYPE_CE
-        bool "Use CE parameter for HCI command"
-    config BT_CTRL_CE_LENGTH_TYPE_SD
-        bool "Use Espressif self-defined method"
-endchoice
-
-config BT_CTRL_CE_LENGTH_TYPE_EFF
-    int
-    default 0 if BT_CTRL_CE_LENGTH_TYPE_ORIG
-    default 1 if BT_CTRL_CE_LENGTH_TYPE_CE
-    default 2 if BT_CTRL_CE_LENGTH_TYPE_SD
-
-choice BT_CTRL_TX_ANTENNA_INDEX
-    prompt "default Tx anntena used"
-    help
-        Specify default Tx antenna used for bluetooth
-
-    config BT_CTRL_TX_ANTENNA_INDEX_0
-        bool "Antenna 0"
-    config BT_CTRL_TX_ANTENNA_INDEX_1
-        bool "Antenna 1"
-endchoice
-
-config BT_CTRL_TX_ANTENNA_INDEX_EFF
-    int
-    default 0 if BT_CTRL_TX_ANTENNA_INDEX_0
-    default 1 if BT_CTRL_TX_ANTENNA_INDEX_1
-
-choice BT_CTRL_RX_ANTENNA_INDEX
-    prompt "default Rx anntena used"
-    help
-        Specify default Rx antenna used for bluetooth
-
-    config BT_CTRL_RX_ANTENNA_INDEX_0
-        bool "Antenna 0"
-    config BT_CTRL_RX_ANTENNA_INDEX_1
-        bool "Antenna 1"
-endchoice
-
-config BT_CTRL_RX_ANTENNA_INDEX_EFF
-    int
-    default 0 if BT_CTRL_RX_ANTENNA_INDEX_0
-    default 1 if BT_CTRL_RX_ANTENNA_INDEX_1
-
-choice BT_CTRL_DFT_TX_POWER_LEVEL
-    prompt "BLE default Tx power level"
-    default BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    help
-        Specify default Tx power level
-
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N24
-        bool "-24dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N21
-        bool "-21dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N18
-        bool "-18dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N15
-        bool "-15dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N12
-        bool "-12dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N9
-        bool "-9dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N6
-        bool "-6dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N3
-        bool "-3dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_N0
-        bool "0dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P3
-        bool "+3dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P6
-        bool "+6dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P9
-        bool "+9dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P12
-        bool "+12dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P15
-        bool "+15dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
-        bool "+18dBm"
-
-endchoice
-
-config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
-    int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
-
-    default 0
-
-config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
-    bool "BLE adv report flow control supported"
-    default y
-    help
-        The function is mainly used to enable flow control for advertising reports. When it is enabled,
-        advertising reports will be discarded by the controller if the number of unprocessed advertising
-        reports exceeds the size of BLE adv report flow control.
-
-config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_NUM
-    int "BLE adv report flow control number"
-    depends on BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
-    range 50 1000
-    default 100
-    help
-        The number of unprocessed advertising report that bluetooth host can save.If you set
-        `BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_NUM` to a small value, this may cause adv packets lost.
-        If you set `BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_NUM` to a large value, bluetooth host may cache a
-        lot of adv packets and this may cause system memory run out. For example, if you set
-        it to 50, the maximum memory consumed by host is 35 * 50 bytes. Please set
-        `BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_NUM` according to your system free memory and handle adv
-        packets as fast as possible, otherwise it will cause adv packets lost.
-
-config BT_CTRL_BLE_ADV_REPORT_DISCARD_THRSHOLD
-    int "BLE adv lost event threshold value"
-    depends on BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
-    range 1 1000
-    default 20
-    help
-        When adv report flow control is enabled, The ADV lost event will be generated when the number
-        of ADV packets lost in the controller reaches this threshold. It is better to set a larger value.
-        If you set `BT_CTRL_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
-        may cause adv packets lost more.
-
-config BT_CTRL_BLE_SCAN_DUPL
-    bool "BLE Scan Duplicate Options"
-    default y
-    help
-        This select enables parameters setting of BLE scan duplicate.
-
-choice BT_CTRL_SCAN_DUPL_TYPE
-    prompt "Scan Duplicate Type"
-    default BT_CTRL_SCAN_DUPL_TYPE_DEVICE
-    depends on BT_CTRL_BLE_SCAN_DUPL
-    help
-        Scan duplicate have three ways. one is "Scan Duplicate By Device Address", This way is to use
-        advertiser address filtering. The adv packet of the same address is only allowed to be reported once.
-        Another way is "Scan Duplicate By Device Address And Advertising Data". This way is to use advertising
-        data and device address filtering. All different adv packets with the same address are allowed to be
-        reported. The last way is "Scan Duplicate By Advertising Data". This way is to use advertising data
-        filtering. All same advertising data only allow to be reported once even though they are from
-        different devices.
-
-    config BT_CTRL_SCAN_DUPL_TYPE_DEVICE
-        bool "Scan Duplicate By Device Address"
-        help
-            This way is to use advertiser address filtering. The adv packet of the same address is only
-            allowed to be reported once
-
-    config BT_CTRL_SCAN_DUPL_TYPE_DATA
-        bool "Scan Duplicate By Advertising Data"
-        help
-            This way is to use advertising data filtering. All same advertising data only allow to be reported
-            once even though they are from different devices.
-
-    config BT_CTRL_SCAN_DUPL_TYPE_DATA_DEVICE
-        bool "Scan Duplicate By Device Address And Advertising Data"
-        help
-            This way is to use advertising data and device address filtering. All different adv packets with
-            the same address are allowed to be reported.
-endchoice
-
-config BT_CTRL_SCAN_DUPL_TYPE
-    int
-    depends on BT_CTRL_BLE_SCAN_DUPL
-    default 0 if BT_CTRL_SCAN_DUPL_TYPE_DEVICE
-    default 1 if BT_CTRL_SCAN_DUPL_TYPE_DATA
-    default 2 if BT_CTRL_SCAN_DUPL_TYPE_DATA_DEVICE
-    default 0
-
-config BT_CTRL_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_CTRL_BLE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
-config BT_CTRL_BLE_MESH_SCAN_DUPL_EN
-    bool "Special duplicate scan mechanism for BLE Mesh scan"
-    depends on BT_CTRL_BLE_SCAN_DUPL
-    default n
-    help
-        This enables the BLE scan duplicate for special BLE Mesh scan.
-
-config BT_CTRL_MESH_DUPL_SCAN_CACHE_SIZE
-    int "Maximum number of Mesh adv packets in scan duplicate filter"
-    depends on BT_CTRL_BLE_MESH_SCAN_DUPL_EN
-    range 10 1000
-    default 100
-    help
-        Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
-choice BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM
-    prompt "Coexistence: limit on MAX Tx/Rx time for coded-PHY connection"
-    default BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_DIS
-    depends on ESP32_WIFI_SW_COEXIST_ENABLE
-    help
-        When using PHY-Coded in BLE connection, limitation on max tx/rx time can be applied to
-        better avoid dramatic performance deterioration of Wi-Fi.
-
-    config BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_EN
-        bool "Force Enable"
-        help
-            Always enable the limitation on max tx/rx time for Coded-PHY connection
-
-    config BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_DIS
-        bool "Force Disable"
-        help
-            Disable the limitation on max tx/rx time for Coded-PHY connection
-endchoice
-
-config BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_EFF
-    int
-    default 0 if (!ESP32_WIFI_SW_COEXIST_ENABLE)
-    default 1 if BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_EN
-    default 0 if BT_CTRL_COEX_PHY_CODED_TX_RX_TLIM_DIS
-
-menu "MODEM SLEEP Options"
-    visible if BT_ENABLED
-
-    config BT_CTRL_MODEM_SLEEP
-        bool "Bluetooth modem sleep"
-        depends on !BT_CTRL_HCI_MODE_UART_H4
-        default n
-        help
-            Enable/disable bluetooth controller low power mode.
-            Modem sleep is not supported to be used with UART HCI.
-
-    config BT_CTRL_MODEM_SLEEP_MODE_1
-        bool "Bluetooth Modem sleep Mode 1"
-        depends on BT_CTRL_MODEM_SLEEP
-        default y
-        help
-            Mode 1 is the currently supported sleep mode. In this mode,
-            bluetooth controller sleeps between and BLE events. A low
-            power clock is used to maintain bluetooth reference clock.
-
-    choice BT_CTRL_LOW_POWER_CLOCK
-        prompt "Bluetooth low power clock"
-        depends on BT_CTRL_MODEM_SLEEP_MODE_1
-        help
-            Select the low power clock source for bluetooth controller
-
-        config BT_CTRL_LPCLK_SEL_MAIN_XTAL
-            bool "Main crystal"
-            help
-                Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
-        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
-            bool "External 32kHz crystal"
-            depends on ESP32S3_RTC_CLK_SRC_EXT_CRYS
-            help
-                External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
-                stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
-                modem sleep to be used with both DFS and light sleep.
-
-        config BT_CTRL_LPCLK_SEL_RTC_SLOW
-            bool "Internal 150kHz RC oscillator"
-            depends on ESP32S3_RTC_CLK_SRC_INT_RC
-            help
-                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
-                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
-    endchoice
-endmenu
-
-config BT_CTRL_SLEEP_MODE_EFF
-    int
-    default 1 if BT_CTRL_MODEM_SLEEP_MODE_1
-    default 0
-
-config BT_CTRL_SLEEP_CLOCK_EFF
-    int
-    default 1 if BT_CTRL_LPCLK_SEL_MAIN_XTAL
-    default 2 if BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
-    default 3 if BT_CTRL_LPCLK_SEL_RTC_SLOW
-
-    default 0
-
-config BT_CTRL_HCI_TL_EFF
-    int
-    default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
-    default 1
-
-config BT_CTRL_AGC_RECORRECT_EN
-    bool "Enable HW AGC recorrect"
-    default n
-    help
-        Enable uncoded phy AGC recorrect
-
-config BT_CTRL_CODED_AGC_RECORRECT_EN
-    bool "Enable coded phy AGC recorrect"
-    depends on BT_CTRL_AGC_RECORRECT_EN
-    default n
-    help
-        Enable coded phy AGC recorrect
+source "$IDF_PATH/components/bt/controller/esp32c3/Kconfig.in"

components/bt/esp_ble_mesh/Kconfig.in

@@ -6,6 +6,15 @@ if BLE_MESH
         help
             It is a temporary solution and needs further modifications.
 
+    config BLE_MESH_RANDOM_ADV_INTERVAL
+        bool "Support using random adv interval for mesh packets"
+        select BT_BLE_HIGH_DUTY_ADV_INTERVAL if BT_BLUEDROID_ENABLED
+        default n
+        help
+            Enable this option to allow using random advertising interval
+            for mesh packets. And this could help avoid collision of
+            advertising packets.
+
     config BLE_MESH_USE_DUPLICATE_SCAN
         bool "Support Duplicate Scan in BLE Mesh"
         depends on BT_BLUEDROID_ENABLED
@@ -536,6 +545,20 @@ if BLE_MESH
             Provisioner can provision up to 20 nodes and each node contains two elements,
             then the replay protection list size of Provisioner should be at least 40.
 
+    config BLE_MESH_NOT_RELAY_REPLAY_MSG
+        bool "Not relay replayed messages in a mesh network"
+        depends on BLE_MESH_EXPERIMENTAL
+        default n
+        help
+            There may be many expired messages in a complex mesh network that would be
+            considered replayed messages.
+            Enable this option will refuse to relay such messages, which could help to
+            reduce invalid packets in the mesh network.
+            However, it should be noted that enabling this option may result in packet
+            loss in certain environments.
+            Therefore, users need to decide whether to enable this option according to
+            the actual usage situation.
+
     config BLE_MESH_MSG_CACHE_SIZE
         int "Network message cache size"
         default 10
@@ -585,6 +608,21 @@ if BLE_MESH
             stored to flash. E.g. the default value of 4 means that the
             state is saved every 24 hours (96 / 4).
 
+    config BLE_MESH_IVU_RECOVERY_IVI
+        bool "Recovery the IV index when the latest whole IV update procedure is missed"
+        default n
+        help
+            According to Section 3.10.5 of Mesh Specification v1.0.1.
+            If a node in Normal Operation receives a Secure Network beacon with an IV index
+            equal to the last known IV index+1 and the IV Update Flag set to 0, the node may
+            update its IV without going to the IV Update in Progress state, or it may initiate
+            an IV Index Recovery procedure (Section 3.10.6), or it may ignore the Secure
+            Network beacon. The node makes the choice depending on the time since last IV
+            update and the likelihood that the node has missed the Secure Network beacons
+            with the IV update Flag.
+            When the above situation is encountered, this option can be used to decide whether
+            to perform the IV index recovery procedure.
+
     config BLE_MESH_TX_SEG_MSG_COUNT
         int "Maximum number of simultaneous outgoing segmented messages"
         default 1
@@ -803,6 +841,13 @@ if BLE_MESH
             help
                 Maximum number of groups to which the LPN can subscribe.
 
+        config BLE_MESH_LPN_SUB_ALL_NODES_ADDR
+            bool "Automatically subscribe all nodes address"
+            default n
+            help
+                Automatically subscribe all nodes address when friendship
+                established.
+
     endif # BLE_MESH_LOW_POWER
 
     config BLE_MESH_FRIEND
@@ -1110,6 +1155,19 @@ if BLE_MESH
                 This option adds extra self-tests which are run every time BLE Mesh
                 networking is initialized.
 
+        config BLE_MESH_BQB_TEST
+            bool "Enable BLE Mesh specific internal test"
+            default n
+            help
+                This option is used to enable some internal functions for auto-pts test.
+
+        config BLE_MESH_BQB_TEST_LOG
+            bool
+            depends on BLE_MESH_BQB_TEST
+            default y
+            help
+                This option is used to enable the log of auto-pts test.
+
         if BLE_MESH_SELF_TEST
 
             config BLE_MESH_TEST_AUTO_ENTER_NETWORK
@@ -1204,4 +1262,12 @@ if BLE_MESH
 
     endmenu
 
+    config BLE_MESH_EXPERIMENTAL
+        bool "Make BLE Mesh experimental features visible"
+        default n
+        help
+            Make BLE Mesh Experimental features visible.
+            Experimental features list:
+            - CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+
 endif # BLE_MESH

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c

@@ -43,7 +43,7 @@ esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t
         memcpy(&arg.start_ble_adv.data, data, sizeof(esp_ble_mesh_ble_adv_data_t));
     }
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -64,7 +64,7 @@ esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index)
 
     arg.stop_ble_adv.index = index;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */
@@ -81,7 +81,7 @@ esp_err_t esp_ble_mesh_start_ble_scanning(esp_ble_mesh_ble_scan_param_t *param)
     msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
     msg.act = BTC_BLE_MESH_ACT_START_BLE_SCAN;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -96,7 +96,7 @@ esp_err_t esp_ble_mesh_stop_ble_scanning(void)
     msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
     msg.act = BTC_BLE_MESH_ACT_STOP_BLE_SCAN;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c

@@ -47,7 +47,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_MESH_INIT;
 
-    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL) != BT_STATUS_SUCCESS) {
+    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL) != BT_STATUS_SUCCESS) {
         vSemaphoreDelete(semaphore);
         BT_ERR("Failed to start mesh init");
         return ESP_FAIL;
@@ -65,7 +65,9 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
 esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
 {
     btc_ble_mesh_prov_args_t arg = {0};
+    SemaphoreHandle_t semaphore = NULL;
     btc_msg_t msg = {0};
+    esp_err_t ret = ESP_OK;
 
     if (param == NULL) {
         return ESP_ERR_INVALID_ARG;
@@ -73,13 +75,36 @@ esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
 
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
+    // Create a semaphore
+    if ((semaphore = xSemaphoreCreateCounting(1, 0)) == NULL) {
+        BT_ERR("Failed to create semaphore");
+        return ESP_ERR_NO_MEM;
+    }
+
     arg.mesh_deinit.param.erase_flash = param->erase_flash;
+    /* Transport semaphore pointer to BTC layer, and will give the semaphore in the BTC task */
+    arg.mesh_deinit.semaphore = semaphore;
 
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_DEINIT_MESH;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL) != BT_STATUS_SUCCESS) {
+        vSemaphoreDelete(semaphore);
+        BT_ERR("Failed to start mesh deinit");
+        return ESP_FAIL;
+    }
+
+    /* Take the Semaphore, wait BLE Mesh de-initialization to finish. */
+    xSemaphoreTake(semaphore, portMAX_DELAY);
+    /* Don't forget to delete the semaphore at the end. */
+    vSemaphoreDelete(semaphore);
+
+    ret = bt_mesh_host_deinit();
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    return ESP_OK;
 }
 #endif /* CONFIG_BLE_MESH_DEINIT */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c

@@ -92,7 +92,7 @@ esp_err_t esp_ble_mesh_model_subscribe_group_addr(uint16_t element_addr, uint16_
     arg.model_sub_group_addr.model_id = model_id;
     arg.model_sub_group_addr.group_addr = group_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -118,7 +118,7 @@ esp_err_t esp_ble_mesh_model_unsubscribe_group_addr(uint16_t element_addr, uint1
     arg.model_unsub_group_addr.model_id = model_id;
     arg.model_unsub_group_addr.group_addr = group_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -152,7 +152,7 @@ esp_err_t esp_ble_mesh_node_add_local_net_key(const uint8_t net_key[16], uint16_
     arg.node_add_local_net_key.net_idx = net_idx;
     memcpy(arg.node_add_local_net_key.net_key, net_key, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -175,7 +175,7 @@ esp_err_t esp_ble_mesh_node_add_local_app_key(const uint8_t app_key[16], uint16_
     arg.node_add_local_app_key.app_idx = app_idx;
     memcpy(arg.node_add_local_app_key.app_key, app_key, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -200,7 +200,7 @@ esp_err_t esp_ble_mesh_node_bind_app_key_to_local_model(uint16_t element_addr, u
     arg.node_local_mod_app_bind.company_id = company_id;
     arg.node_local_mod_app_bind.app_idx = app_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c

@@ -21,7 +21,7 @@ esp_err_t esp_ble_mesh_lpn_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_lpn_disable(bool force)
@@ -37,7 +37,7 @@ esp_err_t esp_ble_mesh_lpn_disable(bool force)
 
     arg.lpn_disable.force = force;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -51,5 +51,5 @@ esp_err_t esp_ble_mesh_lpn_poll(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_POLL;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }