Merge branch 'bugfix/wafer_version_minor_s3_v5.0' into 'release/v5.0'

esp32s3: fixed bug chip v0.0 detected as vX.8 (v5.0) See merge request espressif/esp-idf!21351
Merge branch 'fix/esp32s3_memprot_v5.0' into 'release/v5.0'
2022-12-01 20:37:52 +08:00 · 2022-12-01 20:36:42 +08:00 · 2022-12-01 09:19:08 +05:30 · 2022-12-01 09:19:08 +05:30 · 2022-12-01 09:19:07 +05:30 · 2022-12-01 01:56:53 +08:00
1682 changed files with 26017 additions and 27573 deletions
--- a/.flake8
+++ b/.flake8
@@ -146,10 +146,8 @@ exclude =
        components/json/cJSON,
        components/mbedtls/mbedtls,
        components/openthread/openthread,
-        components/tinyusb,
        components/unity/unity,
        components/spiffs/spiffs,
-        examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
    # autogenerated scripts
        components/protocomm/python/constants_pb2.py,
        components/protocomm/python/sec0_pb2.py,
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -57,28 +57,27 @@ variables:
  PYTHON_VER: 3.7.10

  CLANG_TIDY_RUNNER_PROJ: 2107  # idf/clang-tidy-runner
-  IDF_BUILD_APPS_PROJ: 2818  # fuhanxi/idf-build-apps
+  IDF_BUILD_APPS_PROJ: 2818  # espressif/idf-build-apps

  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"

-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.0:2-3"
-  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.0:2"
-  AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test-v5.0:2-1"
-  CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis-v5.0:2-1"
-  TARGET_TEST_ENV_IMAGE: "$CI_DOCKER_REGISTRY/target-test-env-v5.0:2"
-  QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.0:2-20210826"
+  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.0:4"
+  AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test-v5.0:4-2"
+  CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis-v5.0:4-2"
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.0:4-4"
+  QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.0:4-20220802"
+  TARGET_TEST_ENV_IMAGE: "$CI_DOCKER_REGISTRY/target-test-env-v5.0:3"

  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:3"
-  LINUX_SHELL_IMAGE: "${CI_DOCKER_REGISTRY}/linux-shells-v5.0:2"
+
+  PRE_COMMIT_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"

  # target test config file, used by assign test job
  CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/.gitlab/ci/target-test.yml"

  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
-  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v4.1"

  # cache python dependencies
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
@@ -112,145 +111,101 @@ cache:
      - .cache/submodule_archives
    policy: pull

-.setup_tools_unless_target_test: &setup_tools_unless_target_test |
+.common_before_scripts: &common-before_scripts |
+  source tools/ci/utils.sh
+  is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
+
  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
-  export IDF_MIRROR_PREFIX_MAP=
-  fi
-  if [[ "$SETUP_TOOLS" == "1" || "$CI_JOB_STAGE" != "target_test" ]]; then
-  tools/idf_tools.py --non-interactive install ${SETUP_TOOLS_LIST:-} && eval "$(tools/idf_tools.py --non-interactive export)" || exit 1
-    if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
-    fi
+    export IDF_MIRROR_PREFIX_MAP=
  fi

-.download_test_python_contraint_file: &download_test_python_contraint_file |
+  if echo "$CI_MERGE_REQUEST_LABELS" | egrep "^([^,\n\r]+,)*include_nightly_run(,[^,\n\r]+)*$"; then
+    export INCLUDE_NIGHTLY_RUN="1"
+  fi
+
+  # configure cmake related flags
+  source tools/ci/configure_ci_environment.sh
+
+  # add extra python packages
+  export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/esp_app_trace:$IDF_PATH/components/partition_table:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
+
+.setup_tools_and_idf_python_venv: &setup_tools_and_idf_python_venv |
+  # must use after setup_tools_except_target_test
+  # otherwise the export.sh won't work properly
+
+  # download constraint file for dev
  if [[ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]]; then
    wget -O /tmp/constraint.txt --header="Authorization:Bearer ${ESPCI_TOKEN}" ${GITLAB_HTTP_SERVER}/api/v4/projects/2581/repository/files/${CI_PYTHON_CONSTRAINT_FILE}/raw?ref=${CI_PYTHON_CONSTRAINT_BRANCH}
    mkdir -p ~/.espressif
    mv /tmp/constraint.txt ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
  fi

-.download_test_python_tool: &download_test_python_tool |
+  # Mirror
+  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
+    export IDF_MIRROR_PREFIX_MAP=
+  fi
+
+  # install latest python packages
+  # target test jobs
+  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
+    # ttfw jobs
+    if ! echo "${CI_JOB_NAME}" | egrep ".+_pytest_.+"; then
+      run_cmd bash install.sh --enable-ci --enable-ttfw
+    else
+      run_cmd bash install.sh --enable-ci --enable-pytest
+    fi
+  elif [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
+    run_cmd bash install.sh --enable-ci --enable-docs
+  elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
+    run_cmd bash install.sh --enable-ci --enable-pytest
+  else
+    run_cmd bash install.sh --enable-ci
+  fi
+
+  source ./export.sh
+
+  # Custom OpenOCD
+  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
+    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+    wget $OOCD_DISTRO_URL
+    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+    tar -x -f $ARCH_NAME
+    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+    export PATH=$PWD/openocd-esp32/bin:$PATH
+  fi
+
  if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then
    git clone --quiet --depth=1 -b ${CI_PYTHON_TOOL_BRANCH} https://gitlab-ci-token:${ESPCI_TOKEN}@${GITLAB_HTTPS_HOST}/espressif/${CI_PYTHON_TOOL_REPO}.git
    pip install ./${CI_PYTHON_TOOL_REPO}
    rm -rf ${CI_PYTHON_TOOL_REPO}
  fi

-.set_include_nightly_run: &set_include_nightly_run |
-  if echo "$CI_MERGE_REQUEST_LABELS" | egrep "^([^,\n\r]+,)*include_nightly_run(,[^,\n\r]+)*$"; then
-    export INCLUDE_NIGHTLY_RUN="1"
-  fi
-
 before_script:
-  - source tools/ci/utils.sh
-  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-  - *set_include_nightly_run
-  - source tools/ci/setup_python.sh
+  - *common-before_scripts
+  - *setup_tools_and_idf_python_venv
  - add_gitlab_ssh_keys
-  - source tools/ci/configure_ci_environment.sh
-  - *setup_tools_unless_target_test
  - fetch_submodules
-  - *download_test_python_contraint_file
-  - $IDF_PATH/tools/idf_tools.py install-python-env
-  # install esptool globally, TODO: remove this, IDFCI-1207
-  - pip install esptool -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
-  - *download_test_python_tool
-
-# used for check scripts which we want to run unconditionally
-.before_script_no_sync_submodule:
-  before_script:
-    - echo "Not setting up GitLab key, not fetching submodules"
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - *set_include_nightly_run
-    - source tools/ci/setup_python.sh
-    - source tools/ci/configure_ci_environment.sh
-    - *download_test_python_contraint_file
-    - $IDF_PATH/tools/idf_tools.py install-python-env

 .before_script_minimal:
  before_script:
-    - echo "Only load utils.sh"
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - *set_include_nightly_run
-
-.before_script_integration_test:
-  before_script:
-    # need to install esptool, needn't install idf python env
-  - source tools/ci/utils.sh
-  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-  - *set_include_nightly_run
-  - source tools/ci/setup_python.sh
-  - add_gitlab_ssh_keys
-  - fetch_submodules
-  # download the constraint file manually
-  - mkdir -p ~/.espressif
-  - wget -O ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE} --header="Authorization:Bearer ${ESPCI_TOKEN}" ${GITLAB_HTTP_SERVER}/api/v4/projects/2581/repository/files/${CI_PYTHON_CONSTRAINT_FILE}/raw
-  - *download_test_python_contraint_file
-  # TODO: remove this, IDFCI-1207
-  - pip install esptool -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
-  - *download_test_python_tool
+    - *common-before_scripts

 .before_script_macos:
  before_script:
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - *set_include_nightly_run
-    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
-    - *download_test_python_contraint_file
-    - $IDF_PATH/tools/idf_tools.py install-python-env
+    - *common-before_scripts
    # On macOS, these tools need to be installed
+    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
    # This adds tools (compilers) and the version-specific Python environment to PATH
-    - *setup_tools_unless_target_test
-    # Install packages required by CI scripts into IDF Python environment
-    - pip install -r $IDF_PATH/tools/ci/python_packages/ttfw_idf/requirements.txt
-    - source tools/ci/configure_ci_environment.sh
-    # Part of tools/ci/setup_python.sh; we don't use pyenv on macOS, so can't run the rest of the script.
-    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
+    - *setup_tools_and_idf_python_venv
    - fetch_submodules

-.before_script_pytest:
-  before_script:
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - *set_include_nightly_run
-    - source tools/ci/setup_python.sh
-    - add_gitlab_ssh_keys
-    - source tools/ci/configure_ci_environment.sh
-    - *setup_tools_unless_target_test
-    - fetch_submodules
-    - *download_test_python_contraint_file
-    - $IDF_PATH/tools/idf_tools.py install-python-env --features pytest
-    # TODO: remove this, IDFCI-1207
-    - pip install esptool -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
-    - eval "$($IDF_PATH/tools/idf_tools.py export)"  # use idf venv instead
-
 .before_script_build_jobs:
  before_script:
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - *set_include_nightly_run
-    - source tools/ci/setup_python.sh
+    - *common-before_scripts
+    - *setup_tools_and_idf_python_venv
    - add_gitlab_ssh_keys
-    - source tools/ci/configure_ci_environment.sh
-    - *setup_tools_unless_target_test
    - fetch_submodules
-    - *download_test_python_contraint_file
-    - $IDF_PATH/tools/idf_tools.py install-python-env --features pytest
-    # TODO: remove this, IDFCI-1207
-    - pip install esptool -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
-    - eval "$($IDF_PATH/tools/idf_tools.py export)"  # use idf venv instead
-    # not only need pytest related packages, but also needs ttfw requirements
-    - internal_pip_install $IDF_BUILD_APPS_PROJ idf_build_apps
-    - pip install -r tools/ci/python_packages/ttfw_idf/requirements.txt -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
    - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}

--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -2,208 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/tools
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/tools
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_serial_slave_link/    @esp-idf-codeowners/peripherals
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/tools
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/fatfs/**/*.py             @esp-idf-codeowners/tools
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/tools
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/tools
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/tinyusb/                  @esp-idf-codeowners/peripherals/usb
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-/docs/**/migration-guides/              @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/idf_size_yaml/         @esp-idf-codeowners/peripherals
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-/tools/test_apps/README.md    @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@@ -116,7 +116,7 @@ curl -X POST --header "PRIVATE-TOKEN: [YOUR PERSONAL ACCESS TOKEN]" [GITLAB_SERV
    ```yaml
    check_docs_lang_sync:
      extends:
-        - .pre_check_job_template
+        - .pre_check_template
        - .rules:build:docs
      script:
        - cd docs
--- a/.gitlab/ci/assign-test.yml
+++ b/.gitlab/ci/assign-test.yml
@@ -85,6 +85,8 @@ assign_integration_test:
  extends:
    - .assign_test_template
    - .rules:test:integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
  needs:
    - build_ssc_esp32
    - build_ssc_esp32c3
@@ -98,12 +100,13 @@ assign_integration_test:
    INTEGRATION_TEST_CASE_PATH: "${CI_PROJECT_DIR}/auto_test_script/TestCaseFiles"
    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    PYTHON_VER: 3.7.7
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
+    - add_gitlab_ssh_keys
    # clone test script to assign tests
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
    # assign integration test cases
    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b ${BUILD_DIR} -o $TEST_DIR/test_configs
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -300,11 +300,11 @@ build_ssc_esp32s3:
      -t $IDF_TARGET
      --config "configs/*="
      --copy-sdkconfig
+      --preserve-all
      --collect-size-info $SIZE_INFO_LOCATION
      --collect-app-info list_job_${CI_NODE_INDEX:-1}.json
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --preserve-all
    - run_cmd python tools/unit-test-app/tools/UnitTestParser.py tools/unit-test-app ${CI_NODE_INDEX:-1}

 build_esp_idf_tests_cmake_esp32:
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@@ -77,45 +77,6 @@ build:integration_test:
  included_in:
    - build:target_test

-# -------------
-# Special Cases
-# -------------
-"build:{0}-esp32s3":
-  matrix:
-    - *target_test
-  labels:
-    - build
-    - "{0}"
-    - target_test
-  patterns:
-    - build_components
-    - build_system
-    - build_target_test
-    - "{0}"
-    - "build-{0}"
-  included_in:
-    - "build:{0}"
-    - build:target_test
-
-"build:component_ut-esp32s3":
-  matrix:
-    - *target_test
-  labels:
-    - build
-    - component_ut
-    - unit_test
-    - target_test
-  patterns:
-    - build_components
-    - build_system
-    - build_target_test
-    - component_ut
-    - unit_test
-    - build-component_ut
-    - build-unit_test
-  included_in:
-    - "build:{0}"
-    - build:target_test

 ####################
 # Target Test Jobs #
@@ -167,6 +128,7 @@ build:integration_test:
      - wifi      # example_test_002, example_test*wifi*
      - ethernet  # example_test*ethernet*
      - sdio      # UT_044, UT_045
+      - adc       # component_ut_pytest_esp32x_adc
  patterns:
    - "{0}-{1}-{2}"
    - "{0}-{2}"
@@ -214,27 +176,6 @@ build:integration_test:
    - "build:component_ut-esp32c2"
    - build:target_test

-# due to the lack of runners, s3 tests will only be triggered by label
-"test:{0}-esp32s3":
-  matrix:
-    - *target_test
-  labels:
-    - "{0}_esp32s3"
-  included_in:
-    - "build:{0}"
-    - "build:{0}-esp32s3"
-    - build:target_test
-
-# overwrite the esp32s3 component ut again
-"test:component_ut-esp32s3": # component_ut will trigger by unit_test as well, since now we have 2 kinds of UT
-  labels:
-    - "component_ut_esp32s3"
-    - "unit_test_esp32s3"
-  included_in:
-    - build:component_ut
-    - "build:component_ut-esp32s3"
-    - build:target_test
-
 "test:integration_test":
  labels:
    - integration_test
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@@ -1,5 +1,4 @@
 .deploy_job_template:
-  extends: .before_script_no_sync_submodule
  stage: deploy
  image: $ESP_ENV_IMAGE
  tags:
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@@ -41,7 +41,7 @@
 # stage: pre_check
 check_readme_links:
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
  tags: ["build", "amd64", "internet"]
  allow_failure: true
  script:
@@ -49,7 +49,7 @@ check_readme_links:

 check_docs_lang_sync:
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
    - .doc-rules:build:docs
  script:
    - cd docs
@@ -62,7 +62,6 @@ check_docs_lang_sync:
  dependencies: []
  script:
    - cd docs
-    - pip install -U -r requirements.txt
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
  parallel:
    matrix:
@@ -72,11 +71,10 @@ check_docs_lang_sync:
 check_docs_gh_links:
  image: $ESP_IDF_DOC_ENV_IMAGE
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
    - .doc-rules:build:docs
  script:
    - cd docs
-    - pip install -U -r requirements.txt
    - build-docs gh-linkcheck

 # stage: build_doc
@@ -148,8 +146,6 @@ build_docs_pdf:
    DOC_BUILDERS: "latex"

 .deploy_docs_template:
-  extends:
-    - .before_script_no_sync_submodule
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
    DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
@@ -161,7 +157,6 @@ build_docs_pdf:
  script:
    - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
    - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
-    - pip install -U -r docs/requirements.txt
    - deploy-docs

 # stage: test_deploy
@@ -227,5 +222,4 @@ check_doc_links:
  allow_failure: true
  script:
    - cd docs
-    - pip install -U -r requirements.txt
    - build-docs -t $DOCTGT -l $DOCLANG linkcheck
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@@ -204,19 +204,26 @@ test_idf_py:
    - cd ${IDF_PATH}/tools/test_idf_py
    - ./test_idf_py.py

+# Test for create virtualenv. It must be invoked from Python, not from virtualenv.
+# Use docker image system python without any extra dependencies
 test_idf_tools:
-  extends: .host_test_template
+  extends:
+    - .host_test_template
+    - .before_script_minimal
  artifacts:
    when: on_failure
    paths:
      - tools/tools.new.json
    expire_in: 1 week
+  image:
+    name: $ESP_ENV_IMAGE
+    entrypoint: [""]  # use system python3. no extra pip package installed
  script:
-    # Remove Xtensa and ULP toolchains from the PATH, tests will expect a clean environment
-    - export PATH=$(p=$(echo $PATH | tr ":" "\n" | grep -v "/root/.espressif/tools\|/opt/espressif" | tr "\n" ":"); echo ${p%:})
+    # Tools must be downloaded for testing
+    - python3 ${IDF_PATH}/tools/idf_tools.py download
    - cd ${IDF_PATH}/tools/test_idf_tools
-    - ./test_idf_tools.py
-    # Test for create virtualenv. It must be invoked from Python, not from virtualenv.
+    - python3 -m pip install jsonschema
+    - python3 ./test_idf_tools.py
    - python3 ./test_idf_tools_python_env.py

 .test_efuse_table_on_host_template:
@@ -268,7 +275,7 @@ test_espcoredump:
    expire_in: 1 week
  variables:
    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
-    IDF_COREDUMP_ELF_TAG: idf-20210915
+    IDF_COREDUMP_ELF_TAG: idf-20220928
    # install CMake version specified in tools.json
    SETUP_TOOLS_LIST: "all"
  script:
@@ -316,8 +323,8 @@ test_mkuf2:
    - ./test_mkuf2.py

 test_autocomplete:
-  extends: .host_test_template
-  image: $LINUX_SHELL_IMAGE
+  extends:
+    - .host_test_template
  artifacts:
    when: on_failure
    paths:
@@ -327,8 +334,8 @@ test_autocomplete:
    - ${IDF_PATH}/tools/ci/test_autocomplete.py

 test_detect_python:
-  extends: .host_test_template
-  image: $LINUX_SHELL_IMAGE
+  extends:
+    - .host_test_template
  script:
    - cd ${IDF_PATH}
    - shellcheck -s sh tools/detect_python.sh
@@ -430,6 +437,14 @@ test_linux_example:
    - timeout 5 ./build/linux_host_app.elf >test.log || true
    - grep "Restarting" test.log

+test_partition_api_host:
+  extends: .host_test_template
+  script:
+    - cd ${IDF_PATH}/components/esp_partition/host_test/partition_api_test
+    - idf.py build
+    - timeout 5 ./build/partition_api_test.elf >test.log
+    - grep " 0 Failures" test.log
+
 test_gen_soc_caps_kconfig:
  extends: .host_test_template
  script:
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@@ -1,21 +1,15 @@
-.pre_check_base_template:
+.pre_check_template:
  stage: pre_check
  image: $ESP_ENV_IMAGE
  tags:
    - host_test
  dependencies: []

-.pre_check_job_template:
-  extends:
-    - .pre_check_base_template
-    - .before_script_no_sync_submodule
-
 .check_pre_commit_template:
-  extends: .pre_check_job_template
-  image: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"
-  before_script:
-    - source tools/ci/utils.sh
-    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
+  extends:
+    - .pre_check_template
+    - .before_script_minimal
+  image: $PRE_COMMIT_IMAGE

 check_pre_commit_master_release:
  extends:
@@ -35,32 +29,20 @@ check_version:
  # Don't run this for feature/bugfix branches, so that it is possible to modify
  # esp_idf_version.h in a branch before tagging the next version.
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
    - .rules:protected
  script:
    - export IDF_PATH=$PWD
    - tools/ci/check_idf_version.sh

 check_rom_api_header:
-  extends: .pre_check_job_template
+  extends: .pre_check_template
  script:
    - tools/ci/check_examples_rom_header.sh
    - tools/ci/check_api_violation.sh

-check_python_style:
-  extends:
-    - .pre_check_base_template
-    - .rules:patterns:python-files
-  artifacts:
-    when: on_failure
-    paths:
-      - flake8_output.txt
-    expire_in: 1 week
-  script:
-    - python -m flake8 --config=$IDF_PATH/.flake8 --output-file=flake8_output.txt --tee --benchmark $IDF_PATH
-
 test_check_kconfigs:
-  extends: .pre_check_job_template
+  extends: .pre_check_template
  artifacts:
    when: on_failure
    paths:
@@ -75,7 +57,7 @@ test_check_kconfigs:
    - python ${IDF_PATH}/tools/ci/test_check_kconfigs.py

 check_blobs:
-  extends: .pre_check_base_template
+  extends: .pre_check_template
  tags:
    - build
  variables:
@@ -90,7 +72,7 @@ check_blobs:
    - bash $IDF_PATH/tools/ci/check_blobs.sh

 check_fuzzer_compilation:
-   extends: .pre_check_base_template
+   extends: .pre_check_template
   image: $AFL_FUZZER_TEST_IMAGE
   script:
     - cd ${IDF_PATH}/components/lwip/test_afl_host
@@ -100,7 +82,7 @@ check_fuzzer_compilation:

 check_public_headers:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:build
  tags:
    - build
@@ -113,7 +95,7 @@ check_public_headers:

 check_chip_support_components:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:build
  tags:
    - build
@@ -130,7 +112,7 @@ check_chip_support_components:

 check_esp_err_to_name:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:build
  tags:
    - build
@@ -146,7 +128,7 @@ check_esp_err_to_name:

 check_esp_system:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:build
  tags:
    - build
@@ -157,19 +139,19 @@ check_esp_system:
 # the version returned by 'git describe'
 check_version_tag:
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
    - .rules:tag:release
  script:
    - (git cat-file -t $CI_COMMIT_REF_NAME | grep tag) || (echo "ESP-IDF versions must be annotated tags." && exit 1)

 check_artifacts_expire_time:
-  extends: .pre_check_job_template
+  extends: .pre_check_template
  script:
    # check if we have set expire time for all artifacts
    - python tools/ci/check_artifacts_expire_time.py

 check_commit_msg:
-  extends: .pre_check_job_template
+  extends: .pre_check_template
  script:
    - git status
    - git log -n10 --oneline ${PIPELINE_COMMIT_SHA}
@@ -178,7 +160,7 @@ check_commit_msg:

 check_test_scripts_build_test_rules:
  extends:
-    - .pre_check_job_template
+    - .pre_check_template
    - .before_script_build_jobs
  script:
    - python tools/ci/check_build_test_rules.py check-test-scripts examples/ tools/test_apps components
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@@ -170,9 +170,8 @@
  - "components/openthread/openthread"
  - "components/protobuf-c/protobuf-c"
  - "components/spiffs/spiffs"
-  - "components/tinyusb/tinyusb"
  - "components/unity/unity"
-  - "examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib"
+  - "components/heap/tlsf"
  - ".gitmodules"

 # for jobs: example_test*flash_encryption_wifi_high_traffic
@@ -220,6 +219,13 @@
  - "components/driver/**/*"
  - "components/sdmmc/**/*"

+# for jobs: component_ut_pytest_esp32x_adc:
+.patterns-component_ut-adc: &patterns-component_ut-adc
+  - "components/esp_adc/**/*"
+  - "components/driver/**/*"
+  - "components/hal/**/*"
+  - "components/esp_hw_support/**/*"
+  - "components/efuse/**/*"

 ##############
 # if anchors #
@@ -499,7 +505,7 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut
    - <<: *if-dev-push
-      changes: *patterns-unit_test
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32:
  rules:
@@ -519,6 +525,8 @@
      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-component_ut
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32c2:
  rules:
@@ -534,6 +542,8 @@
      changes: *patterns-build_components
    - <<: *if-dev-push
      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32c3:
  rules:
@@ -552,6 +562,8 @@
      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-component_ut
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32h2:
  rules:
@@ -570,6 +582,8 @@
      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-component_ut
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32s2:
  rules:
@@ -588,6 +602,8 @@
      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-component_ut
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:build:component_ut-esp32s3:
  rules:
@@ -607,7 +623,7 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut
    - <<: *if-dev-push
-      changes: *patterns-unit_test
+      changes: *patterns-component_ut-adc

 .rules:build:custom_test:
  rules:
@@ -984,6 +1000,8 @@
      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-component_ut
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
    - <<: *if-dev-push
      changes: *patterns-custom_test
    - <<: *if-dev-push
@@ -1191,6 +1209,19 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:test:component_ut-esp32-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
+
 .rules:test:component_ut-esp32-bt:
  rules:
    - <<: *if-revert-branch
@@ -1245,6 +1276,19 @@
    - <<: *if-label-component_ut_esp32c2
    - <<: *if-label-unit_test_esp32c2

+.rules:test:component_ut-esp32c2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32c2
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
+
 .rules:test:component_ut-esp32c2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1304,6 +1348,19 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:test:component_ut-esp32c3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
+
 .rules:test:component_ut-esp32c3-bt:
  rules:
    - <<: *if-revert-branch
@@ -1363,6 +1420,19 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:test:component_ut-esp32h2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32h2
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
+
 .rules:test:component_ut-esp32h2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1422,6 +1492,19 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:test:component_ut-esp32s2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc
+
 .rules:test:component_ut-esp32s2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1473,8 +1556,26 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-component_ut
+
+.rules:test:component_ut-esp32s3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-component_ut-adc

 .rules:test:component_ut-esp32s3-bt:
  rules:
@@ -1533,6 +1634,17 @@
    - <<: *if-dev-push
      changes: *patterns-custom_test

+.rules:test:custom_test-esp32-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-target_test
+
 .rules:test:custom_test-esp32-bt:
  rules:
    - <<: *if-revert-branch
@@ -1586,6 +1698,17 @@
      when: never
    - <<: *if-label-custom_test_esp32c2

+.rules:test:custom_test-esp32c2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32c2
+    - <<: *if-label-target_test
+
 .rules:test:custom_test-esp32c2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1643,6 +1766,17 @@
    - <<: *if-dev-push
      changes: *patterns-custom_test

+.rules:test:custom_test-esp32c3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-target_test
+
 .rules:test:custom_test-esp32c3-bt:
  rules:
    - <<: *if-revert-branch
@@ -1700,6 +1834,17 @@
    - <<: *if-dev-push
      changes: *patterns-custom_test

+.rules:test:custom_test-esp32h2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32h2
+    - <<: *if-label-target_test
+
 .rules:test:custom_test-esp32h2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1757,6 +1902,17 @@
    - <<: *if-dev-push
      changes: *patterns-custom_test

+.rules:test:custom_test-esp32s2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-target_test
+
 .rules:test:custom_test-esp32s2-bt:
  rules:
    - <<: *if-revert-branch
@@ -1808,7 +1964,22 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-custom_test
+
+.rules:test:custom_test-esp32s3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test

 .rules:test:custom_test-esp32s3-bt:
  rules:
@@ -1869,6 +2040,17 @@
    - <<: *if-dev-push
      changes: *patterns-example_test

+.rules:test:example_test-esp32-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32
+    - <<: *if-label-target_test
+
 .rules:test:example_test-esp32-bt:
  rules:
    - <<: *if-revert-branch
@@ -1937,6 +2119,17 @@
      when: never
    - <<: *if-label-example_test_esp32c2

+.rules:test:example_test-esp32c2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32c2
+    - <<: *if-label-target_test
+
 .rules:test:example_test-esp32c2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2002,6 +2195,17 @@
    - <<: *if-dev-push
      changes: *patterns-example_test

+.rules:test:example_test-esp32c3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-target_test
+
 .rules:test:example_test-esp32c3-bt:
  rules:
    - <<: *if-revert-branch
@@ -2076,6 +2280,17 @@
    - <<: *if-dev-push
      changes: *patterns-example_test

+.rules:test:example_test-esp32h2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32h2
+    - <<: *if-label-target_test
+
 .rules:test:example_test-esp32h2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2141,6 +2356,17 @@
    - <<: *if-dev-push
      changes: *patterns-example_test

+.rules:test:example_test-esp32s2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-target_test
+
 .rules:test:example_test-esp32s2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2198,7 +2424,24 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+
+.rules:test:example_test-esp32s3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test

 .rules:test:example_test-esp32s3-bt:
  rules:
@@ -2297,6 +2540,17 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test

+.rules:test:unit_test-esp32-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32
+
 .rules:test:unit_test-esp32-bt:
  rules:
    - <<: *if-revert-branch
@@ -2352,6 +2606,17 @@
      when: never
    - <<: *if-label-unit_test_esp32c2

+.rules:test:unit_test-esp32c2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32c2
+
 .rules:test:unit_test-esp32c2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2411,6 +2676,17 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test

+.rules:test:unit_test-esp32c3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32c3
+
 .rules:test:unit_test-esp32c3-bt:
  rules:
    - <<: *if-revert-branch
@@ -2470,6 +2746,17 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test

+.rules:test:unit_test-esp32h2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32h2
+
 .rules:test:unit_test-esp32h2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2529,6 +2816,17 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test

+.rules:test:unit_test-esp32s2-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32s2
+
 .rules:test:unit_test-esp32s2-bt:
  rules:
    - <<: *if-revert-branch
@@ -2582,6 +2880,21 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-unit_test
+
+.rules:test:unit_test-esp32s3-adc:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3

 .rules:test:unit_test-esp32s3-bt:
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@@ -1,7 +1,7 @@
 # pre_check stage
 clang_tidy_check:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:patterns:clang_tidy
  image: ${CLANG_STATIC_ANALYSIS_IMAGE}
  artifacts:
@@ -14,7 +14,6 @@ clang_tidy_check:
    RULES_FILE: ${CI_PROJECT_DIR}/tools/ci/static-analysis-rules.yml
    OUTPUT_DIR: ${CI_PROJECT_DIR}/clang_tidy_reports
  script:
-    - python -m pip install -U pip
    - internal_pip_install $CLANG_TIDY_RUNNER_PROJ pyclang
    - export PATH=$PATH:$(python -c "import sys; print(sys.executable.rsplit('/', 1)[0])")
    - dirs=$(cat ${CLANG_TIDY_DIRS_TXT} | while read line; do echo ${CI_PROJECT_DIR}/${line}; done | xargs)
@@ -26,7 +25,7 @@ clang_tidy_check:

 check_pylint:
  extends:
-    - .pre_check_base_template
+    - .pre_check_template
    - .rules:patterns:python-files
    - .before_script_minimal
  image: $SONARQUBE_SCANNER_IMAGE
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@@ -1,8 +1,20 @@
-.pytest_template:
+.target_test_template:
  image: $TARGET_TEST_ENV_IMAGE
  stage: target_test
  timeout: 1 hour
-  extends: .before_script_pytest
+  variables:
+    GIT_DEPTH: 1
+    SUBMODULES_TO_FETCH: "none"
+  cache:
+    # Usually do not need submodule-cache in target_test
+    - key: pip-cache
+      paths:
+        - .cache/pip
+      policy: pull
+
+.pytest_template:
+  extends:
+    - .target_test_template
  artifacts:
    when: always
    paths:
@@ -11,9 +23,6 @@
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
-  variables:
-    GIT_DEPTH: 1
-    SUBMODULES_TO_FETCH: "none"
  script:
    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    # get runner env config file
@@ -70,6 +79,14 @@ example_test_pytest_esp32c2_generic:
    - build_pytest_examples_esp32c2
  tags: [ esp32c2, generic, xtal_40mhz ]

+example_test_pytest_esp32c2_26mhz:
+  extends:
+    - .pytest_examples_dir_template
+    - .rules:test:example_test-esp32c2
+  needs:
+    - build_pytest_examples_esp32c2
+  tags: [ esp32c2, xtal_26mhz ]
+
 example_test_pytest_esp32c3_generic:
  extends:
    - .pytest_examples_dir_template
@@ -203,6 +220,14 @@ component_ut_pytest_esp32_generic:
    - build_pytest_components_esp32
  tags: [ esp32, generic ]

+component_ut_pytest_esp32_adc:
+  extends:
+    - .pytest_components_dir_template
+    - .rules:test:component_ut-esp32-adc
+  needs:
+    - build_pytest_components_esp32
+  tags: [ esp32, adc ]
+
 component_ut_pytest_esp32_ip101:
  extends:
    - .pytest_components_dir_template
@@ -235,6 +260,14 @@ component_ut_pytest_esp32s2_generic:
    - build_pytest_components_esp32s2
  tags: [ esp32s2, generic ]

+component_ut_pytest_esp32s2_adc:
+  extends:
+    - .pytest_components_dir_template
+    - .rules:test:component_ut-esp32s2-adc
+  needs:
+    - build_pytest_components_esp32s2
+  tags: [ esp32s2, adc ]
+
 component_ut_pytest_esp32s3_generic:
  extends:
    - .pytest_components_dir_template
@@ -243,6 +276,14 @@ component_ut_pytest_esp32s3_generic:
    - build_pytest_components_esp32s3
  tags: [ esp32s3, generic ]

+component_ut_pytest_esp32s3_adc:
+  extends:
+    - .pytest_components_dir_template
+    - .rules:test:component_ut-esp32s3-adc
+  needs:
+    - build_pytest_components_esp32s3
+  tags: [ esp32s3, adc ]
+
 component_ut_pytest_esp32s3_octal_psram:
  extends:
    - .pytest_components_dir_template
@@ -275,6 +316,14 @@ component_ut_pytest_esp32c2_generic:
    - build_pytest_components_esp32c2
  tags: [ esp32c2, generic, xtal_40mhz ]

+component_ut_pytest_esp32c2_adc:
+  extends:
+    - .pytest_components_dir_template
+    - .rules:test:component_ut-esp32c2-adc
+  needs:
+    - build_pytest_components_esp32c2
+  tags: [ esp32c2, adc ]
+
 component_ut_pytest_esp32c2_xtal_26mhz:
  extends:
    - .pytest_components_dir_template
@@ -291,6 +340,14 @@ component_ut_pytest_esp32c3_generic:
    - build_pytest_components_esp32c3
  tags: [ esp32c3, generic ]

+component_ut_pytest_esp32c3_adc:
+  extends:
+    - .pytest_components_dir_template
+    - .rules:test:component_ut-esp32c3-adc
+  needs:
+    - build_pytest_components_esp32c3
+  tags: [ esp32c3, adc ]
+
 component_ut_pytest_esp32c3_flash_encryption:
  extends:
    - .pytest_components_dir_template
@@ -340,6 +397,14 @@ test_app_test_pytest_esp32c2_generic:
    - build_pytest_test_apps_esp32c2
  tags: [ esp32c2, generic, xtal_40mhz ]

+test_app_test_pytest_esp32c2_26mhz:
+  extends:
+    - .pytest_test_apps_dir_template
+    - .rules:test:custom_test-esp32c2
+  needs:
+    - build_pytest_test_apps_esp32c2
+  tags: [ esp32c2, xtal_26mhz ]
+
 test_app_test_pytest_esp32c3_generic:
  extends:
    - .pytest_test_apps_dir_template
@@ -348,13 +413,29 @@ test_app_test_pytest_esp32c3_generic:
    - build_pytest_test_apps_esp32c3
  tags: [ esp32c3, generic ]

-test_app_test_pytest_esp32s2_usb_host:
+test_app_test_pytest_esp32s3_mspi_f8r8:
  extends:
    - .pytest_test_apps_dir_template
-    - .rules:test:custom_test-esp32s2
+    - .rules:test:custom_test-esp32s3
  needs:
-    - build_pytest_test_apps_esp32s2
-  tags: [ esp32s2, usb_host ]
+    - build_pytest_test_apps_esp32s3
+  tags: [ esp32s3, MSPI_F8R8 ]
+
+test_app_test_pytest_esp32s3_mspi_f4r8:
+  extends:
+    - .pytest_test_apps_dir_template
+    - .rules:test:custom_test-esp32s3
+  needs:
+    - build_pytest_test_apps_esp32s3
+  tags: [ esp32s3, MSPI_F4R8 ]
+
+test_app_test_pytest_esp32s3_mspi_f4r4:
+  extends:
+    - .pytest_test_apps_dir_template
+    - .rules:test:custom_test-esp32s3
+  needs:
+    - build_pytest_test_apps_esp32s3
+  tags: [ esp32s3, MSPI_F4R4 ]

 # for parallel jobs, CI_JOB_NAME will be "job_name index/total" (for example, "IT_001 1/2")
 # we need to convert to pattern "job_name_index.yml"
@@ -364,9 +445,8 @@ test_app_test_pytest_esp32s2_usb_host:
  CONFIG_FILE="${CONFIG_FILE_PATH}/${JOB_FULL_NAME}.yml"

 .target_test_job_template:
-  stage: target_test
-  timeout: 1 hour
-  image: $TARGET_TEST_ENV_IMAGE
+  extends:
+    - .target_test_template
  artifacts:
    when: always
    paths:
@@ -378,11 +458,9 @@ test_app_test_pytest_esp32s2_usb_host:
      junit: $LOG_PATH/*/XUNIT_RESULT.xml
    expire_in: 1 week
  variables:
-    GIT_DEPTH: 1
    TEST_FW_PATH: "$CI_PROJECT_DIR/tools/tiny-test-fw"
    LOG_PATH: "$CI_PROJECT_DIR/TEST_LOGS"
    ENV_FILE: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/EnvConfig.yml"
-    SUBMODULES_TO_FETCH: "none"
  script:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
@@ -405,13 +483,6 @@ test_app_test_pytest_esp32s2_usb_host:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"

-.example_debug_template:
-  extends:
-    - .example_test_template
-    - .rules:test:example_test-esp32
-  variables:
-    SUBMODULES_TO_FETCH: "all"
-
 test_weekend_mqtt:
  extends:
    - .test_app_esp32_template
@@ -543,12 +614,10 @@ example_test_010:
    - Example_ExtFlash

 example_test_011:
-  extends: .example_debug_template
+  extends: .example_test_esp32_template
  tags:
    - ESP32
    - Example_T2_RS485
-  variables:
-    SETUP_TOOLS: "1"

 example_test_013:
  extends: .example_test_esp32_template
@@ -575,6 +644,12 @@ example_test_C3_GENERIC:
    - ESP32C3
    - Example_GENERIC

+example_test_C2_GENERIC:
+  extends: .example_test_esp32c2_template
+  tags:
+    - ESP32C2
+    - Example_GENERIC
+
 example_test_ESP32_SDSPI:
  extends: .example_test_esp32_template
  tags:
@@ -654,6 +729,12 @@ test_app_test_esp32c2_generic:
    - Example_GENERIC
    - xtal_40mhz

+test_app_test_esp32c2_26mhz:
+  extends: .test_app_esp32c2_template
+  tags:
+    - ESP32C2
+    - xtal_26mhz
+
 test_app_test_005:
  extends: .test_app_esp32c3_template
  tags:
@@ -672,24 +753,6 @@ test_app_test_esp32_generic:
    - ESP32
    - Example_GENERIC

-test_app_test_flash_psram_f4r4:
-  extends: .test_app_esp32s3_template
-  tags:
-    - ESP32S3
-    - MSPI_F4R4
-
-test_app_test_flash_psram_f4r8:
-  extends: .test_app_esp32s3_template
-  tags:
-    - ESP32S3
-    - MSPI_F4R8
-
-test_app_test_flash_psram_f8r8:
-  extends: .test_app_esp32s3_template
-  tags:
-    - ESP32S3
-    - MSPI_F8R8
-
 .unit_test_template:
  extends: .target_test_job_template
  needs: # the assign already needs all the build jobs
@@ -923,6 +986,13 @@ UT_C2:
    - UT_T1_1
    - xtal_40mhz

+UT_C2_26M:
+  extends: .unit_test_esp32c2_template
+  tags:
+    - ESP32C2_IDF
+    - UT_T1_1
+    - xtal_26mhz
+
 UT_C3:
  extends: .unit_test_esp32c3_template
  parallel: 31
@@ -993,8 +1063,9 @@ UT_S3_FLASH:
  extends:
    - .target_test_job_template
    - .rules:test:integration_test
-    # needn't install idf python env
-    - .before_script_integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  cache: []
  needs: # the assign already needs all the build jobs
    - assign_integration_test
  variables:
@@ -1005,22 +1076,23 @@ UT_S3_FLASH:
    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/tools/ci/integration_test/KnownIssues"
    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
    PREPARE_TEST_BIN_SCRIPT: "${CI_PROJECT_DIR}/tools/ci/integration_test/prepare_test_bins.py"
-    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${PYTHONPATH}"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${CI_PROJECT_DIR}/tools/ci/python_packages:${PYTHONPATH}"
    INITIAL_CONDITION_RETRY_COUNT: "1"
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
    # clone local test env configs
+    - add_gitlab_ssh_keys
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # Merge known issues
    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
    # run test
    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
@@ -1047,20 +1119,16 @@ nvs_compatible_test:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
-    # prepare test utilities
-    - source tools/ci/setup_python.sh
-    - add_gitlab_ssh_keys
-    - fetch_submodules
    # clone local test env configs
+    - add_gitlab_ssh_keys
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    # prepare nvs bins
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # prepare nvs bins
    - ./tools/prepare_nvs_bin.sh
    # run test
    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
--- a/.gitlab/ci/upload_cache.yml
+++ b/.gitlab/ci/upload_cache.yml
@@ -9,6 +9,7 @@
 upload-pip-cache:
  extends:
    - .upload_cache_template
+    - .before_script_minimal
    - .rules:patterns:python-cache
  tags:
    - $GEO
@@ -18,15 +19,9 @@ upload-pip-cache:
    paths:
      - .cache/pip
    policy: push
-  before_script: []
  script:
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - source tools/ci/setup_python.sh
    - rm -rf .cache/pip  # clear old packages
-    - $IDF_PATH/tools/idf_tools.py install-python-env --features pytest
-    # TODO: remove this, IDFCI-1207
-    - pip install esptool -c ~/.espressif/${CI_PYTHON_CONSTRAINT_FILE}
+    - bash install.sh --enable-ci --enable-pytest
  parallel:
    matrix:
      - GEO: [ 'shiny',  'brew' ]
@@ -34,6 +29,7 @@ upload-pip-cache:
 upload-submodules-cache:
  extends:
    - .upload_cache_template
+    - .before_script_minimal
    - .rules:patterns:submodule
  tags:
    - $GEO
@@ -43,12 +39,11 @@ upload-submodules-cache:
    paths:
      - .cache/submodule_archives
    policy: push
-  before_script: []
  script:
-    - source tools/ci/utils.sh
-    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
-    - source tools/ci/setup_python.sh
+    # use the default gitlab server
+    - unset LOCAL_GITLAB_HTTPS_HOST
    - rm -rf .cache/submodule_archives  # clear old submodule archives
+    - add_gitlab_ssh_keys
    - fetch_submodules
  parallel:
    matrix:
--- a/.gitmodules
+++ b/.gitmodules
@@ -47,14 +47,6 @@
 	path = components/esp_wifi/lib
 	url = ../../espressif/esp32-wifi-lib.git

-[submodule "components/tinyusb/tinyusb"]
-	path = components/tinyusb/tinyusb
-	url = ../../espressif/tinyusb.git
-
-[submodule "examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib"]
-	path = examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib
-	url = ../../espressif/esp-cryptoauthlib.git
-
 [submodule "components/cmock/CMock"]
 	path = components/cmock/CMock
 	url = ../../ThrowTheSwitch/CMock.git
@@ -86,3 +78,7 @@
 [submodule "components/bt/controller/lib_esp32c2/esp32c2-bt-lib"]
 	path = components/bt/controller/lib_esp32c2/esp32c2-bt-lib
 	url = ../../espressif/esp32c2-bt-lib.git
+
+[submodule "components/heap/tlsf"]
+	path = components/heap/tlsf
+	url = ../../espressif/tlsf.git
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -21,7 +21,8 @@ repos:
            .+test_idf_monitor\/tests\/.+|
            .*_pb2.py|
            .*.pb-c.h|
-            .*.pb-c.c
+            .*.pb-c.c|
+            .*.yuv
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@@ -29,8 +30,8 @@ repos:
      - id: mixed-line-ending
        args: ['-f=lf']
      - id: double-quote-string-fixer
-  - repo: https://gitlab.com/pycqa/flake8
-    rev: 3.9.2
+  - repo: https://github.com/PyCQA/flake8
+    rev: 5.0.4
    hooks:
      - id: flake8
        args: ['--config=.flake8', '--tee', '--benchmark']
--- a/1
+++ b/1
@@ -82,7 +82,6 @@ mainmenu "Espressif IoT Development Framework Configuration"
        config IDF_TARGET_ESP32H2_BETA_VERSION_2
            bool
            prompt "ESP32-H2 beta2"
-            select ESPTOOLPY_NO_STUB    # TODO: IDF-4288
    endchoice

    config IDF_TARGET_ESP32C2
--- a/components/README.md
+++ b/components/README.md
@@ -42,7 +42,7 @@ This can also contain files provided by the architecture vendor.
 Example:

 - `xt_set_exception_handler`
- `riscv_global_interrupts_enable`
+- `rv_utils_intr_enable`
 - `ERI_PERFMON_MAX`

 #### `esp_common`
--- a/components/app_trace/test/CMakeLists.txt
+++ b/components/app_trace/test/CMakeLists.txt
@@ -1,3 +1,4 @@
 idf_component_register(SRC_DIRS "."
                    PRIV_INCLUDE_DIRS "."
                    PRIV_REQUIRES cmock driver)
+target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
--- a/components/app_update/CMakeLists.txt
+++ b/components/app_update/CMakeLists.txt
@@ -1,30 +1,7 @@
-idf_component_register(SRCS "esp_ota_ops.c"
-                            "esp_app_desc.c"
+idf_component_register(SRCS "esp_ota_ops.c" "esp_ota_app_desc.c"
                    INCLUDE_DIRS "include"
-                    REQUIRES spi_flash partition_table bootloader_support
-                    PRIV_REQUIRES esptool_py efuse)
-
-# esp_app_desc structure is added as an undefined symbol because otherwise the
-# linker will ignore this structure as it has no other files depending on it.
-target_link_libraries(${COMPONENT_LIB} INTERFACE "-u esp_app_desc")
-
-if(CONFIG_APP_PROJECT_VER_FROM_CONFIG)
-    # Ignore current PROJECT_VER (which was set in __project_get_revision()).
-    # Gets the version from the CONFIG_APP_PROJECT_VER.
-    idf_build_set_property(PROJECT_VER "${CONFIG_APP_PROJECT_VER}")
-endif()
-
-# cut PROJECT_VER and PROJECT_NAME to required 32 characters.
-idf_build_get_property(project_ver PROJECT_VER)
-idf_build_get_property(project_name PROJECT_NAME)
-string(SUBSTRING "${project_ver}" 0 31 PROJECT_VER_CUT)
-string(SUBSTRING "${project_name}" 0 31 PROJECT_NAME_CUT)
-message(STATUS "App \"${PROJECT_NAME_CUT}\" version: ${PROJECT_VER_CUT}")
-
-set_source_files_properties(
-    SOURCE "esp_app_desc.c"
-    PROPERTIES COMPILE_DEFINITIONS
-    "PROJECT_VER=\"${PROJECT_VER_CUT}\"; PROJECT_NAME=\"${PROJECT_NAME_CUT}\"")
+                    REQUIRES partition_table bootloader_support esp_app_format esp_partition
+                    PRIV_REQUIRES esptool_py efuse spi_flash)

 if(NOT BOOTLOADER_BUILD)
    partition_table_get_partition_info(otadata_offset "--partition-type data --partition-subtype ota" "offset")
--- a/components/app_update/esp_ota_app_desc.c
+++ b/components/app_update/esp_ota_app_desc.c
@@ -0,0 +1,21 @@
+/*
+ * SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <assert.h>
+#include <sys/param.h>
+#include "esp_ota_ops.h"
+#include "esp_attr.h"
+#include "sdkconfig.h"
+
+const esp_app_desc_t *esp_ota_get_app_description(void)
+{
+    return esp_app_get_description();
+}
+
+int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
+{
+   return esp_app_get_elf_sha256(dst, size);
+}
--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -14,7 +14,6 @@

 #include "esp_err.h"
 #include "esp_partition.h"
-#include "spi_flash_mmap.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
 #include "esp_flash_encrypt.h"
@@ -84,16 +83,16 @@ static const esp_partition_t *read_otadata(esp_ota_select_entry_t *two_otadata)
        return NULL;
    }

-    spi_flash_mmap_handle_t ota_data_map;
+    esp_partition_mmap_handle_t ota_data_map;
    const void *result = NULL;
-    esp_err_t err = esp_partition_mmap(otadata_partition, 0, otadata_partition->size, SPI_FLASH_MMAP_DATA, &result, &ota_data_map);
+    esp_err_t err = esp_partition_mmap(otadata_partition, 0, otadata_partition->size, ESP_PARTITION_MMAP_DATA, &result, &ota_data_map);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "mmap otadata filed. Err=0x%8x", err);
        return NULL;
    } else {
        memcpy(&two_otadata[0], result, sizeof(esp_ota_select_entry_t));
        memcpy(&two_otadata[1], result + SPI_FLASH_SEC_SIZE, sizeof(esp_ota_select_entry_t));
-        spi_flash_munmap(ota_data_map);
+        esp_partition_munmap(ota_data_map);
    }
    return otadata_partition;
 }
@@ -651,8 +650,14 @@ esp_err_t esp_ota_get_partition_description(const esp_partition_t *partition, es

 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
 static esp_err_t esp_ota_set_anti_rollback(void) {
-    const esp_app_desc_t *app_desc = esp_ota_get_app_description();
-    return esp_efuse_update_secure_version(app_desc->secure_version);
+    const esp_partition_t* partition = esp_ota_get_running_partition();
+    esp_app_desc_t app_desc = {0};
+
+    esp_err_t err = esp_ota_get_partition_description(partition, &app_desc);
+    if (err == ESP_OK) {
+        return esp_efuse_update_secure_version(app_desc.secure_version);
+    }
+    return err;
 }
 #endif

--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@@ -12,7 +12,7 @@
 #include <stddef.h>
 #include "esp_err.h"
 #include "esp_partition.h"
-#include "esp_image_format.h"
+#include "esp_app_desc.h"
 #include "esp_flash_partitions.h"
 #include "soc/soc_caps.h"

@@ -44,20 +44,27 @@ typedef uint32_t esp_ota_handle_t;
 /**
 * @brief   Return esp_app_desc structure. This structure includes app version.
 *
+ * @note This API is present for backward compatibility reasons. Alternative function
+ * with the same functionality is `esp_app_get_description`
+ *
 * Return description for running app.
 * @return Pointer to esp_app_desc structure.
 */
-const esp_app_desc_t *esp_ota_get_app_description(void);
+const esp_app_desc_t *esp_ota_get_app_description(void) __attribute__((deprecated("Please use esp_app_get_description instead")));

 /**
 * @brief   Fill the provided buffer with SHA256 of the ELF file, formatted as hexadecimal, null-terminated.
 * If the buffer size is not sufficient to fit the entire SHA256 in hex plus a null terminator,
 * the largest possible number of bytes will be written followed by a null.
+ *
+* @note This API is present for backward compatibility reasons. Alternative function
+ * with the same functionality is `esp_app_get_elf_sha256`
+ *
 * @param dst   Destination buffer
 * @param size  Size of the buffer
 * @return      Number of bytes written to dst (including null terminator)
 */
-int esp_ota_get_app_elf_sha256(char* dst, size_t size);
+int esp_ota_get_app_elf_sha256(char* dst, size_t size) __attribute__((deprecated("Please use esp_app_get_elf_sha256 instead")));

 /**
 * @brief   Commence an OTA update writing to the specified partition.
--- a/components/app_update/test/CMakeLists.txt
+++ b/components/app_update/test/CMakeLists.txt
@@ -1,4 +1,5 @@
 idf_component_register(SRC_DIRS "."
                       PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
                      )
+target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
--- a/components/app_update/test/test_ota_ops.c
+++ b/components/app_update/test/test_ota_ops.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -13,7 +13,6 @@
 #include <unity.h>
 #include <test_utils.h>
 #include <esp_ota_ops.h>
-#include "bootloader_common.h"

 /* These OTA tests currently don't assume an OTA partition exists
   on the device, so they're a bit limited
@@ -91,6 +90,8 @@ TEST_CASE("esp_ota_get_next_update_partition logic", "[ota]")

 TEST_CASE("esp_ota_get_partition_description", "[ota]")
 {
+    extern esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc);
+
    const esp_partition_t *running = esp_ota_get_running_partition();
    TEST_ASSERT_NOT_NULL(running);
    esp_app_desc_t app_desc1, app_desc2;
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -366,7 +366,7 @@ menu "Bootloader config"
        # only available if both Secure Boot and Check Signature on Boot are disabled
        depends on !SECURE_SIGNED_ON_BOOT
        default n
-        select BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP
+        select BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP if SOC_RTC_FAST_MEM_SUPPORTED
        select BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
        help
            Selecting this option prevents the bootloader from ever validating the app image before
--- a/components/bootloader/subproject/main/ld/esp32c2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c2/bootloader.ld
@@ -5,15 +5,41 @@
 */
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-C2 ROM static data usage is as follows:
+ *  - 0x3fccb264 - 0x3fcdcb70: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdcb70 - 0x3fcdeb70: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdeb70 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fcdcb70).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x6e0000;
+
+/* We consider 0x3fcdcb70 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdcb70;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403AE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403B0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@@ -183,17 +209,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_B0B0
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_C9C0
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_E9C0
+ * 0x3fccb264 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdcb70 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdeb70 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdf4bc ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfa70 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfa74 ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
@@ -5,15 +5,41 @@
 */
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-C3 ROM static data usage is as follows:
+ *  - 0x3fccae00 - 0x3fcdc710: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdc710 - 0x3fcde710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcde710 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fcdc710).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fcdc710 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdc710;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x1600
-  iram_loader_seg (RWX) :           org = 0x403CF600, len = 0x6A00
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@@ -184,17 +210,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_AE00
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_C710
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_E710
+ * 0x3fccae00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdc710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcde710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdf060 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdf664 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdf830 ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
@@ -5,15 +5,41 @@
 */
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-H2 ROM static data usage is as follows:
+ *  - 0x3fccb900 - 0x3fcdd210: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdd210 - 0x3fcdf210: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdf210 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdd120;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@@ -181,17 +207,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_B900
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_D210
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_F210
+ * 0x3fccb81c ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdd120 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdf120 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdfa6c ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfe40 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfe4c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
@@ -233,3 +233,42 @@ SECTIONS
  }

 }
+
+/**
+ *  Appendix: Memory Usage of ROM bootloader
+ *
+ * 0x3fcd7e00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fce9710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fceb710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x3fced710 ------------------> __stack_app (app cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fceee34 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcef770 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcef81c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fcf0000 ------------------> _data_end_interface
+ */
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -19,7 +19,7 @@ set(srcs
 if(BOOTLOADER_BUILD)
    set(include_dirs "include" "bootloader_flash/include"
        "private_include")
-    set(priv_requires micro-ecc spi_flash efuse)
+    set(priv_requires micro-ecc spi_flash efuse esp_app_format)
    list(APPEND srcs
    "src/bootloader_init.c"
    "src/bootloader_clock_loader.c"
@@ -37,7 +37,7 @@ else()
    set(include_dirs "include" "bootloader_flash/include")
    set(priv_include_dirs "private_include")
    # heap is required for `heap_memory_layout.h` header
-    set(priv_requires spi_flash mbedtls efuse app_update heap)
+    set(priv_requires spi_flash mbedtls efuse heap esp_app_format)
 endif()

 if(BOOTLOADER_BUILD)
@@ -86,6 +86,15 @@ idf_component_register(SRCS "${srcs}"
                    REQUIRES "${requires}"
                    PRIV_REQUIRES "${priv_requires}")

+if(NOT BOOTLOADER_BUILD)
+    if(CONFIG_SECURE_SIGNED_ON_UPDATE)
+        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR
+           CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
+            target_link_libraries(${COMPONENT_LIB} PRIVATE idf::app_update)
+        endif()
+    endif()
+endif()
+
 if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME))
    if(BOOTLOADER_BUILD)
        # Whether CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES or not, we need verification key to embed
@@ -148,3 +157,5 @@ endif()
 if(BOOTLOADER_BUILD)
    target_link_libraries(${COMPONENT_LIB} INTERFACE "-u abort")
 endif()
+
+target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@@ -7,7 +7,6 @@
 #pragma once
 #include "esp_flash_partitions.h"
 #include "esp_image_format.h"
-#include "esp_app_format.h"

 #ifdef __cplusplus
 extern "C" {
@@ -151,20 +150,6 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata);
 */
 int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata, bool *valid_two_otadata, bool max);

-/**
- * @brief Returns esp_app_desc structure for app partition. This structure includes app version.
- *
- * Returns a description for the requested app partition.
- * @param[in] partition      App partition description.
- * @param[out] app_desc      Structure of info about app.
- * @return
- *  - ESP_OK:                Successful.
- *  - ESP_ERR_INVALID_ARG:   The arguments passed are not valid.
- *  - ESP_ERR_NOT_FOUND:     app_desc structure is not found. Magic word is incorrect.
- *  - ESP_FAIL:              mapping is fail.
- */
-esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc);
-
 /**
 * @brief Get chip package
 *
--- a/components/bootloader_support/include/esp_app_format.h
+++ b/components/bootloader_support/include/esp_app_format.h
@@ -106,25 +106,3 @@ typedef struct {
 } esp_image_segment_header_t;

 #define ESP_IMAGE_MAX_SEGMENTS 16           /*!< Max count of segments in the image. */
-
-#define ESP_APP_DESC_MAGIC_WORD 0xABCD5432  /*!< The magic word for the esp_app_desc structure that is in DROM. */
-
-/**
- * @brief Description about application.
- */
-typedef struct {
-    uint32_t magic_word;        /*!< Magic word ESP_APP_DESC_MAGIC_WORD */
-    uint32_t secure_version;    /*!< Secure version */
-    uint32_t reserv1[2];        /*!< reserv1 */
-    char version[32];           /*!< Application version */
-    char project_name[32];      /*!< Project name */
-    char time[16];              /*!< Compile time */
-    char date[16];              /*!< Compile date*/
-    char idf_ver[32];           /*!< Version IDF */
-    uint8_t app_elf_sha256[32]; /*!< sha256 of elf file */
-    uint32_t reserv2[20];       /*!< reserv2 */
-} esp_app_desc_t;
-
-/** @cond */
-_Static_assert(sizeof(esp_app_desc_t) == 256, "esp_app_desc_t should be 256 bytes");
-/** @endcond */
--- a/components/bootloader_support/src/bootloader_clock_init.c
+++ b/components/bootloader_support/src/bootloader_clock_init.c
@@ -42,13 +42,6 @@ __attribute__((weak)) void bootloader_clock_configure(void)

    if (esp_rom_get_reset_reason(0) != RESET_REASON_CPU0_SW || rtc_clk_apb_freq_get() < APB_CLK_FREQ) {
        rtc_clk_config_t clk_cfg = RTC_CLK_CONFIG_DEFAULT();
-#if CONFIG_IDF_TARGET_ESP32
-        clk_cfg.xtal_freq = CONFIG_ESP32_XTAL_FREQ;
-#endif
-#if CONFIG_IDF_TARGET_ESP32C2
-        clk_cfg.xtal_freq = CONFIG_ESP32C2_XTAL_FREQ;
-#endif
-        /* For other chips, there is no XTAL_FREQ choice */
        clk_cfg.cpu_freq_mhz = cpu_freq_mhz;
        clk_cfg.slow_clk_src = rtc_clk_slow_src_get();
        if (clk_cfg.slow_clk_src == SOC_RTC_SLOW_CLK_SRC_INVALID) {
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@@ -112,30 +112,6 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,
    return active_otadata;
 }

-esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc)
-{
-    if (partition == NULL || app_desc == NULL || partition->offset == 0) {
-        return ESP_ERR_INVALID_ARG;
-    }
-
-    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
-    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
-    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
-    if (image == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
-        return ESP_FAIL;
-    }
-
-    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
-    bootloader_munmap(image);
-
-    if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
-        return ESP_ERR_NOT_FOUND;
-    }
-
-    return ESP_OK;
-}
-
 #if defined( CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP ) || defined( CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC )

 #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
@@ -162,7 +138,7 @@ static void update_rtc_retain_mem_crc(void)
    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc));
 }

-void bootloader_common_reset_rtc_retain_mem(void)
+NOINLINE_ATTR void bootloader_common_reset_rtc_retain_mem(void)
 {
    #pragma GCC diagnostic push
    #pragma GCC diagnostic ignored "-Wstringop-overflow"
--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@@ -41,7 +41,10 @@ esp_err_t bootloader_read_bootloader_header(void)

 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    ESP_LOGI(TAG, "chip revision: V%03d", efuse_hal_chip_revision());
+    unsigned int revision = efuse_hal_chip_revision();
+    unsigned int major = revision / 100;
+    unsigned int minor = revision % 100;
+    ESP_LOGI(TAG, "chip revision: v%d.%d", major, minor);
    /* compare with the one set in bootloader image header */
    if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
        return ESP_FAIL;
--- a/components/bootloader_support/src/bootloader_panic.c
+++ b/components/bootloader_support/src/bootloader_panic.c
@@ -12,7 +12,11 @@

 void __assert_func(const char *file, int line, const char *func, const char *expr)
 {
+
+#if !CONFIG_OPTIMIZATION_ASSERTIONS_SILENT
    esp_rom_printf("Assert failed in %s, %s:%d (%s)\r\n", func, file, line, expr);
+#endif
+
    while (1) {
    }
 }
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -60,6 +60,7 @@

 #include "esp_cpu.h"
 #include "esp_image_format.h"
+#include "esp_app_desc.h"
 #include "esp_secure_boot.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
@@ -119,6 +120,31 @@ static esp_err_t read_otadata(const esp_partition_pos_t *ota_info, esp_ota_selec
    return ESP_OK;
 }

+esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc)
+{
+    if (partition == NULL || app_desc == NULL || partition->offset == 0) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
+    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
+    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
+    if (image == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
+        return ESP_FAIL;
+    }
+
+    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
+    bootloader_munmap(image);
+
+    if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
+        return ESP_ERR_NOT_FOUND;
+    }
+
+    return ESP_OK;
+}
+
+
 bool bootloader_utility_load_partition_table(bootloader_state_t *bs)
 {
    const esp_partition_info_t *partitions;
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -36,6 +36,8 @@
 #include "esp32c2/rom/secure_boot.h"
 #endif

+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
 /* Checking signatures as part of verifying images is necessary:
   - Always if secure boot is enabled
   - Differently in bootloader and/or app, depending on kconfig
@@ -107,7 +109,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    while(0)

 static esp_err_t process_image_header(esp_image_metadata_t *data, uint32_t part_offset, bootloader_sha256_handle_t *sha_handle, bool do_verify, bool silent);
-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent);
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent);
 static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data, bool silent, bool skip_check_checksum);

 static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
@@ -159,7 +161,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    CHECK_ERR(process_segments(data, silent, do_load, sha_handle, checksum));
    bool skip_check_checksum = !do_verify || esp_cpu_dbgr_is_attached();
    CHECK_ERR(process_checksum(sha_handle, checksum_word, data, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(data, part->size, do_verify, silent));
+    CHECK_ERR(process_appended_hash_and_sig(data, part->offset, part->size, do_verify, silent));
    if (verify_sha) {
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
        // secure boot images have a signature appended
@@ -299,7 +301,7 @@ esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_meta
    CHECK_ERR(process_segments(metadata, silent, do_load, NULL, NULL));
    bool skip_check_checksum = true;
    CHECK_ERR(process_checksum(NULL, 0, metadata, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(metadata, part->size, true, silent));
+    CHECK_ERR(process_appended_hash_and_sig(metadata, part->offset, part->size, true, silent));
    return ESP_OK;
 err:
    return err;
@@ -762,7 +764,7 @@ esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
                            data);
 }

-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent)
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent)
 {
    esp_err_t err = ESP_OK;
    if (data->image.hash_appended) {
@@ -773,8 +775,34 @@ static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part
        data->image_len += HASH_LEN;
    }

-    if (data->image_len > part_len) {
-        FAIL_LOAD("Image length %d doesn't fit in partition length %d", data->image_len, part_len);
+    uint32_t sig_block_len = 0;
+    const uint32_t end = data->image_len;
+#if CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    // Case I: Bootloader part
+    if (part_offset == ESP_BOOTLOADER_OFFSET) {
+        // For bootloader with secure boot v1, signature stays in an independant flash
+        // sector (offset 0x0)  and does not get appended to the image.
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    } else {
+    // Case II: Application part
+#if CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+        sig_block_len = sizeof(esp_secure_boot_sig_block_t);
+#else
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    }
+#endif // CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    const uint32_t full_image_len = end + sig_block_len;
+    if (full_image_len > part_len) {
+        FAIL_LOAD("Image length %d doesn't fit in partition length %d", full_image_len, part_len);
    }
    return err;
 err:
@@ -835,7 +863,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 #if CONFIG_SECURE_BOOT_V2_ENABLED
    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
-    uint32_t padded_end = (end + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE-1);
+    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
    if (padded_end > end) {
        const void *padding = bootloader_mmap(end, padded_end - end);
        bootloader_sha256_data(sha_handle, padding, padded_end - end);
--- a/components/bootloader_support/test/CMakeLists.txt
+++ b/components/bootloader_support/test/CMakeLists.txt
@@ -1,3 +1,4 @@
 idf_component_register(SRC_DIRS "."
                    PRIV_INCLUDE_DIRS "."
                    PRIV_REQUIRES cmock bootloader_support app_update)
+target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@@ -53,6 +53,8 @@ if(CONFIG_BT_ENABLED)
         "common/osi/buffer.c"
         "common/osi/config.c"
         "common/osi/fixed_queue.c"
+         "common/osi/pkt_queue.c"
+         "common/osi/fixed_pkt_queue.c"
         "common/osi/future.c"
         "common/osi/hash_functions.c"
         "common/osi/hash_map.c"
@@ -715,6 +717,8 @@ if(CONFIG_BT_ENABLED)
        "host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c"
        "host/bluedroid/btc/profile/std/gatt/btc_gatts.c"
        PROPERTIES COMPILE_FLAGS -Wno-address-of-packed-member)
+
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
 endif()

 if(CONFIG_BT_NIMBLE_MESH)
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@@ -60,6 +60,10 @@
 #endif /* #if CLASSIC_BT_INCLUDED */
 #endif

+#if (BLE_INCLUDED == TRUE)
+#include "btc_gap_ble.h"
+#endif
+
 #if CONFIG_BLE_MESH
 #include "btc_ble_mesh_ble.h"
 #include "btc_ble_mesh_prov.h"
@@ -75,6 +79,9 @@
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
 #define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
+#define BTC_TASK_WORKQUEUE_NUM          (2)
+#define BTC_TASK_WORKQUEUE0_LEN         (0)
+#define BTC_TASK_WORKQUEUE1_LEN         (5)

 osi_thread_t *btc_thread;

@@ -211,16 +218,7 @@ static void btc_thread_handler(void *arg)

 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
        return BT_STATUS_BUSY;
    }

@@ -238,30 +236,37 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 */
 bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
 {
-    btc_msg_t lmsg;
+    btc_msg_t* lmsg;

-    if (msg == NULL) {
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
        return BT_STATUS_PARM_INVALID;
    }

    BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);

-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
+    if (lmsg == NULL) {
+        return BT_STATUS_NOMEM;
    }

-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        lmsg->arg = (void *)osi_malloc(arg_len);
+        if (lmsg->arg == NULL) {
+            osi_free(lmsg);
+            return BT_STATUS_NOMEM;
+        }
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    } else {
+        lmsg->arg = NULL;
+    }
+
+    return btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);

 }

@@ -414,7 +419,9 @@ error_exit:;

 bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    const size_t workqueue_len[] = {BTC_TASK_WORKQUEUE0_LEN, BTC_TASK_WORKQUEUE1_LEN};
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE,
+                                   BTC_TASK_WORKQUEUE_NUM, workqueue_len);
    if (btc_thread == NULL) {
        return BT_STATUS_NOMEM;
    }
@@ -427,6 +434,7 @@ bt_status_t btc_init(void)

 #if (BLE_INCLUDED == TRUE)
    btc_gap_callback_init();
+    btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE

 #if SCAN_QUEUE_CONGEST_CHECK
@@ -444,7 +452,9 @@ void btc_deinit(void)

    osi_thread_free(btc_thread);
    btc_thread = NULL;
-
+#if (BLE_INCLUDED == TRUE)
+    btc_gap_ble_deinit();
+#endif  ///BLE_INCLUDED == TRUE
 #if SCAN_QUEUE_CONGEST_CHECK
    btc_adv_list_deinit();
 #endif
@@ -463,3 +473,8 @@ int get_btc_work_queue_size(void)
 {
    return osi_thread_queue_wait_size(btc_thread, 0);
 }
+
+osi_thread_t *btc_get_current_thread(void)
+{
+    return btc_thread;
+}
--- a/components/bt/common/btc/include/btc/btc_task.h
+++ b/components/bt/common/btc/include/btc/btc_task.h
@@ -124,6 +124,13 @@ void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);

+/**
+ * get the BTC thread handle
+ * @return           NULL: fail
+ *                   others: pointer of osi_thread structure of BTC
+ */
+osi_thread_t *btc_get_current_thread(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@@ -85,4 +85,11 @@
 #define UC_BT_BLUFI_ENABLE                  FALSE
 #endif

+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */
--- a/components/bt/common/osi/fixed_pkt_queue.c
+++ b/components/bt/common/osi/fixed_pkt_queue.c
@@ -0,0 +1,161 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/allocator.h"
+#include "osi/pkt_queue.h"
+#include "osi/fixed_pkt_queue.h"
+#include "osi/osi.h"
+#include "osi/semaphore.h"
+
+typedef struct fixed_pkt_queue_t {
+    struct pkt_queue *pkt_list;
+    osi_sem_t enqueue_sem;
+    osi_sem_t dequeue_sem;
+    size_t capacity;
+    fixed_pkt_queue_cb dequeue_ready;
+} fixed_pkt_queue_t;
+
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity)
+{
+    fixed_pkt_queue_t *ret = osi_calloc(sizeof(fixed_pkt_queue_t));
+    if (!ret) {
+        goto error;
+    }
+
+    ret->capacity = capacity;
+    ret->pkt_list = pkt_queue_create();
+    if (!ret->pkt_list) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->enqueue_sem, capacity, capacity);
+    if (!ret->enqueue_sem) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->dequeue_sem, capacity, 0);
+    if (!ret->dequeue_sem) {
+        goto error;
+    }
+
+    return ret;
+
+error:
+    fixed_pkt_queue_free(ret, NULL);
+    return NULL;
+}
+
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    fixed_pkt_queue_unregister_dequeue(queue);
+
+    pkt_queue_destroy(queue->pkt_list, (pkt_queue_free_cb)free_cb);
+    queue->pkt_list = NULL;
+
+    if (queue->enqueue_sem) {
+        osi_sem_free(&queue->enqueue_sem);
+    }
+    if (queue->dequeue_sem) {
+        osi_sem_free(&queue->dequeue_sem);
+    }
+    osi_free(queue);
+}
+
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return true;
+    }
+
+    return pkt_queue_is_empty(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return pkt_queue_length(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    return queue->capacity;
+}
+
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout)
+{
+    bool ret = false;
+
+    assert(queue != NULL);
+    assert(linked_pkt != NULL);
+
+    if (osi_sem_take(&queue->enqueue_sem, timeout) != 0) {
+        return false;
+    }
+
+    ret = pkt_queue_enqueue(queue->pkt_list, linked_pkt);
+
+    assert(ret == true);
+    osi_sem_give(&queue->dequeue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout)
+{
+    pkt_linked_item_t *ret = NULL;
+
+    assert(queue != NULL);
+
+    if (osi_sem_take(&queue->dequeue_sem, timeout) != 0) {
+        return NULL;
+    }
+    ret = pkt_queue_dequeue(queue->pkt_list);
+
+    osi_sem_give(&queue->enqueue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    return pkt_queue_try_peek_first(queue->pkt_list);
+}
+
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb)
+{
+    assert(queue != NULL);
+    assert(ready_cb != NULL);
+
+    queue->dequeue_ready = ready_cb;
+}
+
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    queue->dequeue_ready = NULL;
+}
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    if (queue->dequeue_ready) {
+        queue->dequeue_ready(queue);
+    }
+}
--- a/components/bt/common/osi/include/osi/fixed_pkt_queue.h
+++ b/components/bt/common/osi/include/osi/fixed_pkt_queue.h
@@ -0,0 +1,79 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _FIXED_PKT_QUEUE_H_
+#define _FIXED_PKT_QUEUE_H_
+
+
+#include "osi/pkt_queue.h"
+#include "osi/semaphore.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef FIXED_PKT_QUEUE_SIZE_MAX
+#define FIXED_PKT_QUEUE_SIZE_MAX                    254
+#endif
+
+#define FIXED_PKT_QUEUE_MAX_TIMEOUT                 OSI_SEM_MAX_TIMEOUT
+
+struct fixed_pkt_queue_t;
+
+typedef struct fixed_pkt_queue_t fixed_pkt_queue_t;
+
+typedef void (*fixed_pkt_queue_free_cb)(pkt_linked_item_t *data);
+typedef void (*fixed_pkt_queue_cb)(fixed_pkt_queue_t *queue);
+
+// Creates a new fixed queue with the given |capacity|. If more elements than
+// |capacity| are added to the queue, the caller is blocked until space is
+// made available in the queue. Returns NULL on failure. The caller must free
+// the returned queue with |fixed_pkt_queue_free|.
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity);
+
+// Freeing a queue that is currently in use (i.e. has waiters
+// blocked on it) results in undefined behaviour.
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb);
+
+// Returns a value indicating whether the given |queue| is empty. If |queue|
+// is NULL, the return value is true.
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue);
+
+// Returns the length of the |queue|. If |queue| is NULL, the return value
+// is 0.
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue);
+
+// Returns the maximum number of elements this queue may hold. |queue| may
+// not be NULL.
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue);
+
+// Enqueues the given |data| into the |queue|. The caller will be blocked or immediately return or wait for timeout according to the parameter timeout.
+// If enqueue failed, it will return false, otherwise return true
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout);
+
+// Dequeues the next element from |queue|. If the queue is currently empty,
+// this function will block the caller until an item is enqueued or immediately return or wait for timeout according to the parameter timeout.
+// If dequeue failed, it will return NULL, otherwise return a point.
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout);
+
+// Returns the first element from |queue|, if present, without dequeuing it.
+// This function will never block the caller. Returns NULL if there are no
+// elements in the queue or |queue| is NULL.
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue);
+
+// Registers |queue| with |reactor| for dequeue operations. When there is an element
+// in the queue, ready_cb will be called. The |context| parameter is passed, untouched,
+// to the callback routine. Neither |queue|, nor |reactor|, nor |read_cb| may be NULL.
+// |context| may be NULL.
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb);
+
+// Unregisters the dequeue ready callback for |queue| from whichever reactor
+// it is registered with, if any. This function is idempotent.
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
+
+#endif
--- a/components/bt/common/osi/include/osi/pkt_queue.h
+++ b/components/bt/common/osi/include/osi/pkt_queue.h
@@ -0,0 +1,88 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _PKT_LIST_H_
+#define _PKT_LIST_H_
+
+#include "sys/queue.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct pkt_queue;
+
+typedef struct pkt_linked_item {
+    STAILQ_ENTRY(pkt_linked_item) next;
+    uint8_t data[];
+} pkt_linked_item_t;
+
+#define BT_PKT_LINKED_HDR_SIZE (sizeof (pkt_linked_item_t))
+
+typedef void (*pkt_queue_free_cb)(pkt_linked_item_t *item);
+
+/*
+ * brief: create a pkt_queue instance. pkt_queue is a wrapper class of a FIFO implemented by single linked list.
+ *        The enqueue and dequeue operations of the FIFO are protected against race conditions of multiple tasks
+ * return: NULL if not enough memory, otherwise a valid pointer
+ */
+struct pkt_queue *pkt_queue_create(void);
+
+/*
+ * brief: enqueue one item to the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * param item: the item to be enqueued to the FIFO
+ * return: true if enqueued successfully, false when the arguments passed in are invalid
+ */
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item);
+
+/*
+ * brief: dequeue one item for the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of type pkt_linked_item_t dequeued, NULL if the queue is empty or upon exception
+ */
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue);
+
+/*
+ * brief: get the pointer of the first item from the FIFO but not get it dequeued
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of the first item in the FIFO, NULL if the FIFO is empty
+ */
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the number of items existing in the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: total number of items in the FIFO
+ */
+size_t pkt_queue_length(const struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the status whether the FIFO is empty
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: false if the FIFO is not empty, otherwise true
+ */
+bool pkt_queue_is_empty(const struct pkt_queue *queue);
+
+/*
+ * brief: delete the item in the FIFO one by one
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+/*
+ * brief: delete the items in the FIFO and then destroy the pkt_queue instance.
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/components/bt/common/osi/include/osi/thread.h
+++ b/components/bt/common/osi/include/osi/thread.h
@@ -20,6 +20,7 @@
 #define OSI_THREAD_MAX_TIMEOUT OSI_SEM_MAX_TIMEOUT

 struct osi_thread;
+struct osi_event;

 typedef struct osi_thread osi_thread_t;

@@ -40,7 +41,7 @@ typedef enum {
 * param work_queue_num: speicify queue number, the queue[0] has highest priority, and the priority is decrease by index
 * return : if create successfully, return thread handler; otherwise return NULL.
 */
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num);
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[]);

 /*
 * brief: Destroy a thread or task
@@ -80,4 +81,42 @@ const char *osi_thread_name(osi_thread_t *thread);
 */
 int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx);

+/*
+ * brief: Create an osi_event struct and register the handler function and its argument
+ *        An osi_event is a kind of work that can be posted to the workqueue of osi_thread to process,
+ *        but the work can have at most one instance the thread workqueue before it is processed. This
+ *        allows the "single post, multiple data processing" jobs.
+ * param func: the handler to process the job
+ * param context: the argument to be passed to the handler function when the job is being processed
+ * return: NULL if no memory, otherwise a valid struct pointer
+ */
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context);
+
+/*
+ * brief: Bind an osi_event to a specific work queue for an osi_thread.
+ *        After binding is completed, a function call of API osi_thread_post_event will send a work
+ *        to the workqueue of the thread, with specified queue index.
+ * param func: event: the pointer to osi_event that is created using osi_event_create
+ * param thread: the pointer to osi_thread that is created using osi_thread_create
+ * param queue_idx: the index of the workqueue of the specified osi_thread, with range starting from 0 to work_queue_num - 1
+ * return: true if osi_event binds to the thread's workqueue successfully, otherwise false
+ */
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx);
+
+/*
+ * brief: Destroy the osi_event struct created by osi_event_create and free the allocated memory
+ * param event: the pointer to osi_event
+ */
+void osi_event_delete(struct osi_event* event);
+
+/*
+ * brief: try sending a work to the binded thread's workqueue, so that it can be handled by the worker thread
+ * param event: pointer to osi_event, created by osi_event_create
+ * param timeout: post timeout, OSI_THREAD_MAX_TIMEOUT means blocking forever, 0 means never blocking, others means block millisecond
+ * return: true if the message is enqueued to the thread workqueue, otherwise failed
+ * note: if the return value of function is false, it is the case that the workqueue of the thread is full, and users
+ *       are expected to post the event sometime later to get the work handled.
+ */
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout);
+
 #endif /* __THREAD_H__ */
--- a/components/bt/common/osi/pkt_queue.c
+++ b/components/bt/common/osi/pkt_queue.c
@@ -0,0 +1,144 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/pkt_queue.h"
+#include "osi/allocator.h"
+#include "osi/mutex.h"
+
+
+STAILQ_HEAD(pkt_queue_header, pkt_linked_item);
+
+struct pkt_queue {
+    osi_mutex_t lock;
+    size_t length;
+    struct pkt_queue_header header;
+} pkt_queue_t;
+
+struct pkt_queue *pkt_queue_create(void)
+{
+    struct pkt_queue *queue = calloc(1, sizeof(struct pkt_queue));
+    if (queue == NULL) {
+        return NULL;
+    }
+    if (osi_mutex_new(&queue->lock) != 0) {
+        osi_free(queue);
+    }
+    struct pkt_queue_header *p = &queue->header;
+    STAILQ_INIT(p);
+
+    return queue;
+}
+
+static void pkt_queue_cleanup(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item = STAILQ_FIRST(header);
+    pkt_linked_item_t *tmp;
+
+    pkt_queue_free_cb free_func = (free_cb != NULL) ? free_cb : (pkt_queue_free_cb)osi_free_func;
+
+    while (item != NULL) {
+        tmp = STAILQ_NEXT(item, next);
+        free_func(item);
+        item = tmp;
+        queue->length--;
+    }
+    STAILQ_INIT(header);
+    queue->length = 0;
+}
+
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+}
+
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+
+    osi_mutex_free(&queue->lock);
+    osi_free(queue);
+}
+
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue)
+{
+    if (queue == NULL || queue->length == 0) {
+        return NULL;
+    }
+
+    struct pkt_linked_item *item;
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    item = STAILQ_FIRST(header);
+    if (item != NULL) {
+        STAILQ_REMOVE_HEAD(header, next);
+        if (queue->length > 0) {
+            queue->length--;
+        }
+    }
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}
+
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item)
+{
+    if (queue == NULL || item == NULL) {
+        return false;
+    }
+
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    STAILQ_INSERT_TAIL(header, item, next);
+    queue->length++;
+    osi_mutex_unlock(&queue->lock);
+
+    return true;
+}
+
+size_t pkt_queue_length(const struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return queue->length;
+}
+
+bool pkt_queue_is_empty(const struct pkt_queue *queue)
+{
+    return pkt_queue_length(queue) == 0;
+}
+
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    item = STAILQ_FIRST(header);
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}
--- a/components/bt/common/osi/thread.c
+++ b/components/bt/common/osi/thread.c
@@ -19,16 +19,28 @@
 #include <string.h>

 #include "osi/allocator.h"
-#include "osi/fixed_queue.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/queue.h"
 #include "osi/semaphore.h"
 #include "osi/thread.h"
+#include "osi/mutex.h"
+
+struct work_item {
+    osi_thread_func_t func;
+    void *context;
+};
+
+struct work_queue {
+    QueueHandle_t queue;
+    size_t capacity;
+};

 struct osi_thread {
  TaskHandle_t thread_handle;           /*!< Store the thread object */
  int  thread_id;                       /*!< May for some OS, such as Linux */
  bool stop;
  uint8_t work_queue_num;               /*!< Work queue number */
-  fixed_queue_t **work_queues;          /*!< Point to queue array, and the priority inverse array index */
+  struct work_queue **work_queues;      /*!< Point to queue array, and the priority inverse array index */
  osi_sem_t work_sem;
  osi_sem_t stop_sem;
 };
@@ -39,13 +51,98 @@ struct osi_thread_start_arg {
  int error;
 };

-typedef struct {
-  osi_thread_func_t func;
-  void *context;
-} work_item_t;
+struct osi_event {
+    struct work_item item;
+    osi_mutex_t lock;
+    uint16_t is_queued;
+    uint16_t queue_idx;
+    osi_thread_t *thread;
+};

 static const size_t DEFAULT_WORK_QUEUE_CAPACITY = 100;

+static struct work_queue *osi_work_queue_create(size_t capacity)
+{
+    if (capacity == 0) {
+        return NULL;
+    }
+
+    struct work_queue *wq = (struct work_queue *)osi_malloc(sizeof(struct work_queue));
+    if (wq != NULL) {
+        wq->queue = xQueueCreate(capacity, sizeof(struct work_item));
+        if (wq->queue != 0) {
+            wq->capacity = capacity;
+            return wq;
+        } else {
+            osi_free(wq);
+        }
+    }
+
+    return NULL;
+}
+
+static void osi_work_queue_delete(struct work_queue *wq)
+{
+    if (wq != NULL) {
+        if (wq->queue != 0) {
+            vQueueDelete(wq->queue);
+        }
+        wq->queue = 0;
+        wq->capacity = 0;
+        osi_free(wq);
+    }
+    return;
+}
+
+static bool osi_thead_work_queue_get(struct work_queue *wq, struct work_item *item)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    if (pdTRUE == xQueueReceive(wq->queue, item, 0)) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+static bool osi_thead_work_queue_put(struct work_queue *wq, const struct work_item *item, uint32_t timeout)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    bool ret = true;
+    if (timeout ==  OSI_SEM_MAX_TIMEOUT) {
+        if (xQueueSend(wq->queue, item, portMAX_DELAY) != pdTRUE) {
+            ret = false;
+        }
+    } else {
+        if (xQueueSend(wq->queue, item, timeout / portTICK_PERIOD_MS) != pdTRUE) {
+            ret = false;
+        }
+    }
+
+    return ret;
+}
+
+static size_t osi_thead_work_queue_len(struct work_queue *wq)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (wq->capacity != 0);
+
+    size_t available_spaces = (size_t)uxQueueSpacesAvailable(wq->queue);
+
+    if (available_spaces <= wq->capacity) {
+        return wq->capacity - available_spaces;
+    } else {
+        assert (0);
+    }
+    return 0;
+}
+
 static void osi_thread_run(void *arg)
 {
    struct osi_thread_start_arg *start = (struct osi_thread_start_arg *)arg;
@@ -62,11 +159,10 @@ static void osi_thread_run(void *arg)
            break;
        }

+        struct work_item item;
        while (!thread->stop && idx < thread->work_queue_num) {
-            work_item_t *item = fixed_queue_dequeue(thread->work_queues[idx], 0);
-            if (item) {
-                item->func(item->context);
-                osi_free(item);
+            if (osi_thead_work_queue_get(thread->work_queues[idx], &item) == true) {
+                item.func(item.context);
                idx = 0;
                continue;
            } else {
@@ -107,14 +203,14 @@ static void osi_thread_stop(osi_thread_t *thread)
 }

 //in linux, the stack_size, priority and core may not be set here, the code will be ignore the arguments
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[])
 {
    int ret;
    struct osi_thread_start_arg start_arg = {0};

    if (stack_size <= 0 ||
            core < OSI_THREAD_CORE_0 || core > OSI_THREAD_CORE_AFFINITY ||
-            work_queue_num <= 0) {
+            work_queue_num <= 0 || work_queue_len == NULL) {
        return NULL;
    }

@@ -125,13 +221,14 @@ osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priorit

    thread->stop = false;
    thread->work_queue_num = work_queue_num;
-    thread->work_queues = (fixed_queue_t **)osi_malloc(sizeof(fixed_queue_t *) * work_queue_num);
+    thread->work_queues = (struct work_queue **)osi_malloc(sizeof(struct work_queue *) * work_queue_num);
    if (thread->work_queues == NULL) {
        goto _err;
    }

    for (int i = 0; i < thread->work_queue_num; i++) {
-        thread->work_queues[i] = fixed_queue_new(DEFAULT_WORK_QUEUE_CAPACITY);
+        size_t queue_len = work_queue_len[i] ? work_queue_len[i] : DEFAULT_WORK_QUEUE_CAPACITY;
+        thread->work_queues[i] = osi_work_queue_create(queue_len);
        if (thread->work_queues[i] == NULL) {
            goto _err;
        }
@@ -175,12 +272,14 @@ _err:

        for (int i = 0; i < thread->work_queue_num; i++) {
            if (thread->work_queues[i]) {
-                fixed_queue_free(thread->work_queues[i], osi_free_func);
+                osi_work_queue_delete(thread->work_queues[i]);
            }
+            thread->work_queues[i] = NULL;
        }

        if (thread->work_queues) {
            osi_free(thread->work_queues);
+            thread->work_queues = NULL;
        }

        if (thread->work_sem) {
@@ -206,12 +305,14 @@ void osi_thread_free(osi_thread_t *thread)

    for (int i = 0; i < thread->work_queue_num; i++) {
        if (thread->work_queues[i]) {
-            fixed_queue_free(thread->work_queues[i], osi_free_func);
+            osi_work_queue_delete(thread->work_queues[i]);
+            thread->work_queues[i] = NULL;
        }
    }

    if (thread->work_queues) {
        osi_free(thread->work_queues);
+        thread->work_queues = NULL;
    }

    if (thread->work_sem) {
@@ -235,15 +336,12 @@ bool osi_thread_post(osi_thread_t *thread, osi_thread_func_t func, void *context
        return false;
    }

-    work_item_t *item = (work_item_t *)osi_malloc(sizeof(work_item_t));
-    if (item == NULL) {
-        return false;
-    }
-    item->func = func;
-    item->context = context;
+    struct work_item item;

-    if (fixed_queue_enqueue(thread->work_queues[queue_idx], item, timeout) == false) {
-        osi_free(item);
+    item.func = func;
+    item.context = context;
+
+    if (osi_thead_work_queue_put(thread->work_queues[queue_idx], &item, timeout) == false) {
        return false;
    }

@@ -273,5 +371,83 @@ int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx)
        return -1;
    }

-    return fixed_queue_length(thread->work_queues[wq_idx]);
+    return (int)(osi_thead_work_queue_len(thread->work_queues[wq_idx]));
+}
+
+
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context)
+{
+    struct osi_event *event = osi_calloc(sizeof(struct osi_event));
+    if (event != NULL) {
+        if (osi_mutex_new(&event->lock) == 0) {
+            event->item.func = func;
+            event->item.context = context;
+            return event;
+        }
+        osi_free(event);
+    }
+
+    return NULL;
+}
+
+void osi_event_delete(struct osi_event* event)
+{
+    if (event != NULL) {
+        osi_mutex_free(&event->lock);
+        memset(event, 0, sizeof(struct osi_event));
+        osi_free(event);
+    }
+}
+
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx)
+{
+    if (event == NULL || event->thread != NULL) {
+        return false;
+    }
+
+    if (thread == NULL || queue_idx >= thread->work_queue_num) {
+        return false;
+    }
+
+    event->thread = thread;
+    event->queue_idx = queue_idx;
+
+    return true;
+}
+
+static void osi_thread_generic_event_handler(void *context)
+{
+    struct osi_event *event = (struct osi_event *)context;
+    if (event != NULL && event->item.func != NULL) {
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued = 0;
+        osi_mutex_unlock(&event->lock);
+        event->item.func(event->item.context);
+    }
+}
+
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout)
+{
+    assert(event != NULL && event->thread != NULL);
+    assert(event->queue_idx >= 0 && event->queue_idx < event->thread->work_queue_num);
+    bool ret = false;
+    if (event->is_queued == 0) {
+        uint16_t acquire_cnt = 0;
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued += 1;
+        acquire_cnt = event->is_queued;
+        osi_mutex_unlock(&event->lock);
+
+        if (acquire_cnt == 1) {
+            ret = osi_thread_post(event->thread, osi_thread_generic_event_handler, event, event->queue_idx, timeout);
+            if (!ret) {
+                // clear "is_queued" when post failure, to allow for following event posts
+                osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+                event->is_queued = 0;
+                osi_mutex_unlock(&event->lock);
+            }
+        }
+    }
+
+    return ret;
 }
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@@ -61,6 +61,13 @@
 #define EXT_FUNC_VERSION             0x20220125
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5

+#define BT_ASSERT_PRINT              ets_printf
+
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+/* ACL_DATA_MBUF_LEADINGSPCAE: The leadingspace in user info header for ACL data */
+#define ACL_DATA_MBUF_LEADINGSPCAE    4
+#endif
+
 /* Types definition
 ************************************************************************
 */
@@ -125,6 +132,8 @@ extern int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x,
                                const uint8_t *peer_pub_key_y,
                                const uint8_t *our_priv_key, uint8_t *out_dhkey);
 extern int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv);
+extern int ble_txpwr_set(esp_ble_enhanced_power_type_t power_type, uint16_t handle, int power_level);
+extern int ble_txpwr_get(esp_ble_enhanced_power_type_t power_type, uint16_t handle);

 /* Local Function Declaration
 *********************************************************************
@@ -163,6 +172,8 @@ static DRAM_ATTR bool s_btdm_allow_light_sleep;
 // pm_lock to prevent light sleep when using main crystal as Bluetooth low power clock
 static DRAM_ATTR esp_pm_lock_handle_t s_light_sleep_pm_lock;
 #define BTDM_MIN_TIMER_UNCERTAINTY_US      (200)
+#else
+static bool s_bt_phy_enabled = false;
 #endif /* #ifdef CONFIG_PM_ENABLE */

 #ifdef CONFIG_BT_LE_WAKEUP_SOURCE_BLE_RTC_TIMER
@@ -175,6 +186,7 @@ static void btdm_slp_tmr_callback(void *arg);
 static DRAM_ATTR esp_timer_handle_t s_btdm_slp_tmr = NULL;
 #endif

+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
    ._magic = OSI_COEX_MAGIC_VALUE,
    ._version = OSI_COEX_VERSION,
@@ -215,7 +227,7 @@ static void IRAM_ATTR esp_reset_rpa_moudle(void)

 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2)
 {
-    ESP_LOGE(NIMBLE_PORT_LOG_TAG, "BLE assert: line %d in function %s, param: 0x%x, 0x%x", ln, fn, param1, param2);
+    BT_ASSERT_PRINT("BLE assert: line %d in function %s, param: 0x%x, 0x%x", ln, fn, param1, param2);
    assert(0);
 }

@@ -238,6 +250,7 @@ static void coex_schm_status_bit_clear_wrapper(uint32_t type, uint32_t status)
 #endif
 }
 #ifdef CONFIG_BT_BLUEDROID_ENABLED
+
 bool esp_vhci_host_check_send_available(void)
 {
    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
@@ -295,11 +308,9 @@ void esp_vhci_host_send_packet(uint8_t *data, uint16_t len)
    }

    if (*(data) == DATA_TYPE_ACL) {
-        struct os_mbuf *om = os_msys_get_pkthdr(0, 0);
+        struct os_mbuf *om = os_msys_get_pkthdr(len, ACL_DATA_MBUF_LEADINGSPCAE);
        assert(om);
-        memcpy(om->om_data, &data[1], len - 1);
-        om->om_len = len - 1;
-        OS_MBUF_PKTHDR(om)->omp_len = len - 1;
+        os_mbuf_append(om, &data[1], len - 1);
        ble_hci_trans_hs_acl_tx(om);
    }

@@ -421,7 +432,8 @@ IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
        esp_pm_lock_release(s_pm_lock);
        s_pm_lock_acquired = false;
    }
-
+#else
+    s_bt_phy_enabled = false;
 #endif // CONFIG_PM_ENABLE
 }

@@ -435,6 +447,8 @@ IRAM_ATTR void controller_wakeup_cb(void *arg)
        s_pm_lock_acquired = true;
        esp_pm_lock_acquire(s_pm_lock);
    }
+#else
+    s_bt_phy_enabled = true;
 #endif //CONFIG_PM_ENABLE
 }

@@ -458,6 +472,8 @@ void controller_sleep_init(void)

 #ifdef CONFIG_PM_ENABLE
    s_btdm_allow_light_sleep = false;
+#else
+    s_bt_phy_enabled = true;
 #endif // CONFIG_PM_ENABLE

 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
@@ -540,8 +556,21 @@ void controller_sleep_deinit(void)
 #ifdef CONFIG_PM_ENABLE
 #ifdef CONFIG_BT_LE_WAKEUP_SOURCE_BLE_RTC_TIMER
    r_ble_rtc_wake_up_state_clr();
+    esp_sleep_disable_bt_wakeup();
 #endif
    esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_AUTO);
+
+    /*lock should release first and then delete*/
+    if (s_pm_lock_acquired) {
+        if (s_light_sleep_pm_lock != NULL) {
+            esp_pm_lock_release(s_light_sleep_pm_lock);
+        }
+
+        if (s_pm_lock != NULL) {
+            esp_pm_lock_release(s_pm_lock);
+        }
+    }
+
    if (!s_btdm_allow_light_sleep) {
        if (s_light_sleep_pm_lock != NULL) {
            esp_pm_lock_delete(s_light_sleep_pm_lock);
@@ -559,7 +588,15 @@ void controller_sleep_deinit(void)
        s_btdm_slp_tmr = NULL;
    }
 #endif
-    s_pm_lock_acquired = false;
+    if (s_pm_lock_acquired) {
+        esp_phy_disable();
+        s_pm_lock_acquired = false;
+    }
+#else
+    if (s_bt_phy_enabled) {
+        esp_phy_disable();
+        s_bt_phy_enabled = false;
+    }
 #endif

 }
@@ -571,12 +608,18 @@ void ble_rtc_clk_init(void)
    // LP_TIMER_SEL_XTAL -> 1
    // LP_TIMER_SEL_8M -> 0
    // LP_TIMER_SEL_RTC_SLOW -> 0
-    // LP_TIMER_CLK_DIV_NUM -> 1250
    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_XTAL32K_S);
    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 1, MODEM_CLKRST_LP_TIMER_SEL_XTAL_S);
    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_8M_S);
    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_RTC_SLOW_S);
+
+#ifdef CONFIG_XTAL_FREQ_26
+    // LP_TIMER_CLK_DIV_NUM -> 130
+    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 129, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
+#else
+    // LP_TIMER_CLK_DIV_NUM -> 250
    SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 249, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
+#endif // CONFIG_XTAL_FREQ_26

    // MODEM_CLKRST_ETM_CLK_ACTIVE -> 1
    // MODEM_CLKRST_ETM_CLK_SEL -> 0
@@ -702,7 +745,6 @@ esp_err_t esp_bt_controller_deinit(void)

    npl_freertos_mempool_deinit();

-    esp_phy_disable();
    esp_phy_pd_mem_deinit();

    ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
@@ -764,16 +806,120 @@ esp_bt_controller_status_t esp_bt_controller_get_status(void)
 /* extra functions */
 esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level)
 {
-    ESP_LOGW(NIMBLE_PORT_LOG_TAG, "%s not implemented, return OK", __func__);
-    return ESP_OK;
+    esp_err_t stat = ESP_FAIL;
+
+    switch (power_type) {
+    case ESP_BLE_PWR_TYPE_DEFAULT:
+    case ESP_BLE_PWR_TYPE_ADV:
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_CONN_HDL0:
+    case ESP_BLE_PWR_TYPE_CONN_HDL1:
+    case ESP_BLE_PWR_TYPE_CONN_HDL2:
+    case ESP_BLE_PWR_TYPE_CONN_HDL3:
+    case ESP_BLE_PWR_TYPE_CONN_HDL4:
+    case ESP_BLE_PWR_TYPE_CONN_HDL5:
+    case ESP_BLE_PWR_TYPE_CONN_HDL6:
+    case ESP_BLE_PWR_TYPE_CONN_HDL7:
+    case ESP_BLE_PWR_TYPE_CONN_HDL8:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_CONN, power_type, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    default:
+        stat = ESP_ERR_NOT_SUPPORTED;
+        break;
+    }
+
+    return stat;
+}
+
+esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle, esp_power_level_t power_level)
+{
+    esp_err_t stat = ESP_FAIL;
+    switch (power_type) {
+    case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+    case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
+    case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
+    case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
+        if (ble_txpwr_set(power_type, handle, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    default:
+        stat = ESP_ERR_NOT_SUPPORTED;
+        break;
+    }
+
+    return stat;
 }

 esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
 {
-    ESP_LOGW(NIMBLE_PORT_LOG_TAG, "%s not implemented, return OK", __func__);
-    return ESP_PWR_LVL_N0;
+    int tx_level = 0;
+
+    switch (power_type) {
+    case ESP_BLE_PWR_TYPE_ADV:
+    case ESP_BLE_PWR_TYPE_SCAN:
+    case ESP_BLE_PWR_TYPE_DEFAULT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_CONN_HDL0:
+    case ESP_BLE_PWR_TYPE_CONN_HDL1:
+    case ESP_BLE_PWR_TYPE_CONN_HDL2:
+    case ESP_BLE_PWR_TYPE_CONN_HDL3:
+    case ESP_BLE_PWR_TYPE_CONN_HDL4:
+    case ESP_BLE_PWR_TYPE_CONN_HDL5:
+    case ESP_BLE_PWR_TYPE_CONN_HDL6:
+    case ESP_BLE_PWR_TYPE_CONN_HDL7:
+    case ESP_BLE_PWR_TYPE_CONN_HDL8:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_CONN, power_type);
+        break;
+    default:
+        return ESP_PWR_LVL_INVALID;
+    }
+
+    if (tx_level < 0) {
+        return ESP_PWR_LVL_INVALID;
+    }
+
+    return (esp_power_level_t)tx_level;
 }

+esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle)
+{
+    int tx_level = 0;
+
+    switch (power_type) {
+    case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+    case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
+    case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
+    case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
+    case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
+        tx_level = ble_txpwr_get(power_type, handle);
+        break;
+    default:
+        return ESP_PWR_LVL_INVALID;
+    }
+
+    if (tx_level < 0) {
+       return ESP_PWR_LVL_INVALID;
+    }
+
+    return (esp_power_level_t)tx_level;
+}
+
+
 #if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)

 #define BLE_SM_KEY_ERR 0x17
--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@@ -138,8 +138,6 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
    help
        Specify default Tx power level

-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N24
        bool "-24dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N21
@@ -170,26 +168,28 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
        bool "+15dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
        bool "+18dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
+        bool "+21dBm"
 endchoice

 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
    int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
+    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
+    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
+    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
+    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
+    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
+    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
+    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
+    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
+    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
+    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
+    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
+    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
    default 0

 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
@@ -351,9 +351,9 @@ menu "MODEM SLEEP Options"
            bool "Main crystal"
            help
                Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
+                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, and
+                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
+                than other bluetooth low power clock sources.
        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
            bool "External 32kHz crystal"
            depends on RTC_CLK_SRC_EXT_CRYS
@@ -368,9 +368,18 @@ menu "MODEM SLEEP Options"
            help
                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
    endchoice
+
+    config BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        bool "power up main XTAL during light sleep"
+        depends on (BT_CTRL_LPCLK_SEL_MAIN_XTAL || BT_CTRL_LPCLK_SEL_EXT_32K_XTAL) && FREERTOS_USE_TICKLESS_IDLE
+        default n
+        help
+            If this option is selected, the main crystal will power up during light sleep when the low power clock
+            selects an external 32kHz crystal but the external 32kHz crystal does not exist or the low power clock
+            selects the main crystal.
+
+
 endmenu

 config BT_CTRL_SLEEP_MODE_EFF
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@@ -72,7 +72,8 @@ typedef union {
        uint32_t mac_bb_pd               :  1; // whether hardware(MAC, BB) force-power-down is required during sleep
        uint32_t wakeup_timer_required   :  1; // whether system timer is needed
        uint32_t no_light_sleep          :  1; // do not allow system to enter light sleep after bluetooth is enabled
-        uint32_t reserved                : 26; // reserved
+        uint32_t main_xtal_pu            :  1; // power up main XTAL
+        uint32_t reserved                : 25; // reserved
    };
    uint32_t val;
 } btdm_lpcntl_t;
@@ -1003,12 +1004,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // set default values for global states or resources
        s_lp_stat.val = 0;
        s_lp_cntl.val = 0;
+        s_lp_cntl.main_xtal_pu = 0;
        s_wakeup_req_sem = NULL;
        s_btdm_slp_tmr = NULL;

        // configure and initialize resources
        s_lp_cntl.enable = (cfg->sleep_mode == ESP_BT_SLEEP_MODE_1) ? 1 : 0;
-        s_lp_cntl.no_light_sleep = 1;
+        s_lp_cntl.no_light_sleep = 0;

        if (s_lp_cntl.enable) {
 #if CONFIG_MAC_BB_PD
@@ -1051,33 +1053,41 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // check whether or not EXT_CRYS is working
        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32 kHz XTAL
-            s_lp_cntl.no_light_sleep = 0;
        } else {
-            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
        }
-#elif CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW
-        // check whether or not EXT_CRYS is working
+#elif (CONFIG_BT_CTRL_LPCLK_SEL_MAIN_XTAL)
+        ESP_LOGI(BTDM_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        s_lp_cntl.no_light_sleep = 1;
+#endif
+#elif (CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW)
+        // check whether or not internal 150 kHz RC oscillator is working
        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_RTC_SLOW; // Internal 150 kHz RC oscillator
            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
                 "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
        } else {
-            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
+            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
            assert(0);
        }
-#else
-        s_lp_cntl.no_light_sleep = 1;
 #endif

        bool select_src_ret __attribute__((unused));
        bool set_div_ret __attribute__((unused));
        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
+            s_lp_cntl.main_xtal_pu = 1;
+#endif
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-            set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ);
+            set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() / MHZ);
            assert(select_src_ret && set_div_ret);
            btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-            btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+            btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
        } else if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL32K) {
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
            set_div_ret = btdm_lpclk_set_div(0);
@@ -1096,6 +1106,9 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
            err = ESP_ERR_INVALID_ARG;
            goto error;
        }
+#if CONFIG_SW_COEXIST_ENABLE
+        coex_update_lpclk_interval();
+#endif

 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
@@ -1103,6 +1116,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
                err = ESP_ERR_NO_MEM;
                goto error;
            }
+            ESP_LOGW(BTDM_LOG_TAG, "Light sleep mode will not be able to apply when bluetooth is enabled.");
        }
        if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
            err = ESP_ERR_NO_MEM;
@@ -1173,6 +1187,22 @@ error:
                s_wakeup_req_sem = NULL;
            }
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@@ -1235,6 +1265,21 @@ esp_err_t esp_bt_controller_deinit(void)
            semphr_delete_wrapper(s_wakeup_req_sem);
            s_wakeup_req_sem = NULL;
        }
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@@ -1257,7 +1302,6 @@ esp_err_t esp_bt_controller_deinit(void)
    osi_funcs_p = NULL;

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
-    btdm_lpcycle_us = 0;
    return ESP_OK;
 }

--- a/components/bt/controller/esp32s3/Kconfig.in
+++ b/components/bt/controller/esp32s3/Kconfig.in
@@ -153,8 +153,6 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
    help
        Specify default Tx power level

-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N24
        bool "-24dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N21
@@ -185,27 +183,29 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
        bool "+15dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
        bool "+18dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
+        bool "+21dBm"

 endchoice

 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
    int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
+    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
+    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
+    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
+    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
+    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
+    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
+    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
+    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
+    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
+    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
+    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
+    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21

    default 0

@@ -368,9 +368,9 @@ menu "MODEM SLEEP Options"
            bool "Main crystal"
            help
                Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
+                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, and
+                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
+                than other bluetooth low power clock sources.
        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
            bool "External 32kHz crystal"
            depends on RTC_CLK_SRC_EXT_CRYS
@@ -385,9 +385,17 @@ menu "MODEM SLEEP Options"
            help
                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
    endchoice
+
+    config BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        bool "power up main XTAL during light sleep"
+        depends on (BT_CTRL_LPCLK_SEL_MAIN_XTAL || BT_CTRL_LPCLK_SEL_EXT_32K_XTAL) && FREERTOS_USE_TICKLESS_IDLE
+        default n
+        help
+            If this option is selected, the main crystal will power up during light sleep when the low power clock
+            selects an external 32kHz crystal but the external 32kHz crystal does not exist or the low power clock
+            selects the main crystal.
+
 endmenu

 config BT_CTRL_SLEEP_MODE_EFF
--- a/components/bt/controller/esp32s3/bt.c
+++ b/components/bt/controller/esp32s3/bt.c
@@ -72,7 +72,8 @@ typedef union {
        uint32_t mac_bb_pd               :  1; // whether hardware(MAC, BB) force-power-down is required during sleep
        uint32_t wakeup_timer_required   :  1; // whether system timer is needed
        uint32_t no_light_sleep          :  1; // do not allow system to enter light sleep after bluetooth is enabled
-        uint32_t reserved                : 26; // reserved
+        uint32_t main_xtal_pu            :  1; // power up main XTAL
+        uint32_t reserved                : 25; // reserved
    };
    uint32_t val;
 } btdm_lpcntl_t;
@@ -1035,12 +1036,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // set default values for global states or resources
        s_lp_stat.val = 0;
        s_lp_cntl.val = 0;
+        s_lp_cntl.main_xtal_pu = 0;
        s_wakeup_req_sem = NULL;
        s_btdm_slp_tmr = NULL;

        // configure and initialize resources
        s_lp_cntl.enable = (cfg->sleep_mode == ESP_BT_SLEEP_MODE_1) ? 1 : 0;
-        s_lp_cntl.no_light_sleep = 1;
+        s_lp_cntl.no_light_sleep = 0;

        if (s_lp_cntl.enable) {
 #if CONFIG_MAC_BB_PD
@@ -1083,33 +1085,41 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // check whether or not EXT_CRYS is working
        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32 kHz XTAL
-            s_lp_cntl.no_light_sleep = 0;
        } else {
-            ESP_LOGW(BT_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
+            ESP_LOGW(BT_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
        }
-#elif CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW
-        // check whether or not EXT_CRYS is working
+#elif (CONFIG_BT_CTRL_LPCLK_SEL_MAIN_XTAL)
+        ESP_LOGI(BT_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
+#elif (CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW)
+        // check whether or not internal 150 kHz RC oscillator is working
        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_RTC_SLOW; // Internal 150 kHz RC oscillator
-            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
+            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
                 "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
        } else {
            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
            assert(0);
        }
-#else
-        s_lp_cntl.no_light_sleep = 1;
 #endif

        bool select_src_ret __attribute__((unused));
        bool set_div_ret __attribute__((unused));
        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
+            s_lp_cntl.main_xtal_pu = 1;
+#endif
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-            set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ);
+            set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() / MHZ);
            assert(select_src_ret && set_div_ret);
            btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-            btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+            btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
        } else if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL32K) {
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
            set_div_ret = btdm_lpclk_set_div(0);
@@ -1128,6 +1138,9 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
            err = ESP_ERR_INVALID_ARG;
            goto error;
        }
+#if CONFIG_SW_COEXIST_ENABLE
+        coex_update_lpclk_interval();
+#endif

 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
@@ -1135,6 +1148,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
                err = ESP_ERR_NO_MEM;
                goto error;
            }
+            ESP_LOGW(BT_LOG_TAG, "light sleep mode will not be able to apply when bluetooth is enabled.");
        }
        if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
            err = ESP_ERR_NO_MEM;
@@ -1205,6 +1219,22 @@ error:
                s_wakeup_req_sem = NULL;
            }
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@@ -1267,6 +1297,22 @@ esp_err_t esp_bt_controller_deinit(void)
            semphr_delete_wrapper(s_wakeup_req_sem);
            s_wakeup_req_sem = NULL;
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@@ -1284,7 +1330,6 @@ esp_err_t esp_bt_controller_deinit(void)
    osi_funcs_p = NULL;

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
-    btdm_lpcycle_us = 0;
    return ESP_OK;
 }

--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@@ -803,6 +803,13 @@ if BLE_MESH
            help
                Maximum number of groups to which the LPN can subscribe.

+        config BLE_MESH_LPN_SUB_ALL_NODES_ADDR
+            bool "Automatically subscribe all nodes address"
+            default n
+            help
+                Automatically subscribe all nodes address when friendship
+                established.
+
    endif # BLE_MESH_LOW_POWER

    config BLE_MESH_FRIEND
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_ble.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_ble.c
@@ -82,7 +82,7 @@ static void btc_ble_mesh_ble_callback(esp_ble_mesh_ble_cb_param_t *cb_params, ui
    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_ble_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_ble_cb_param_t),
                         btc_ble_mesh_ble_copy_req_data);
 }

--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_config_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_config_model.c
@@ -298,7 +298,7 @@ static void btc_ble_mesh_config_client_callback(esp_ble_mesh_cfg_client_cb_param
    msg.pid = BTC_PID_CONFIG_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_cfg_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_cfg_client_cb_param_t),
                         btc_ble_mesh_config_client_copy_req_data);
 }

@@ -702,7 +702,7 @@ static void btc_ble_mesh_config_server_callback(esp_ble_mesh_cfg_server_cb_param
    msg.pid = BTC_PID_CONFIG_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_cfg_server_cb_param_t), NULL);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_cfg_server_cb_param_t), NULL);
 }

 void bt_mesh_config_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_generic_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_generic_model.c
@@ -368,7 +368,7 @@ static void btc_ble_mesh_generic_client_callback(esp_ble_mesh_generic_client_cb_
    msg.pid = BTC_PID_GENERIC_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_generic_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_generic_client_cb_param_t),
                         btc_ble_mesh_generic_client_copy_req_data);
 }

@@ -685,7 +685,7 @@ static void btc_ble_mesh_generic_server_callback(esp_ble_mesh_generic_server_cb_
    msg.pid = BTC_PID_GENERIC_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_generic_server_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_generic_server_cb_param_t),
                         btc_ble_mesh_generic_server_copy_req_data);
 }

--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_health_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_health_model.c
@@ -231,7 +231,7 @@ static void btc_ble_mesh_health_client_callback(esp_ble_mesh_health_client_cb_pa
    msg.pid = BTC_PID_HEALTH_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_health_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_health_client_cb_param_t),
                         btc_ble_mesh_health_client_copy_req_data);
 }

@@ -542,7 +542,7 @@ static void btc_ble_mesh_health_server_callback(esp_ble_mesh_health_server_cb_pa
    msg.pid = BTC_PID_HEALTH_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_health_server_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_health_server_cb_param_t),
                         btc_ble_mesh_health_server_copy_req_data);
 }

--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_lighting_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_lighting_model.c
@@ -212,7 +212,7 @@ static void btc_ble_mesh_lighting_client_callback(esp_ble_mesh_light_client_cb_p
    msg.pid = BTC_PID_LIGHTING_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_light_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_light_client_cb_param_t),
                         btc_ble_mesh_lighting_client_copy_req_data);
 }

@@ -497,7 +497,7 @@ static void btc_ble_mesh_lighting_server_callback(esp_ble_mesh_lighting_server_c
    msg.pid = BTC_PID_LIGHTING_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_lighting_server_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_lighting_server_cb_param_t),
                         btc_ble_mesh_lighting_server_copy_req_data);
 }

--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
@@ -368,7 +368,7 @@ static bt_status_t btc_ble_mesh_model_callback(esp_ble_mesh_model_cb_param_t *pa
    msg.pid = BTC_PID_MODEL;
    msg.act = act;

-    ret = btc_transfer_context(&msg, param, sizeof(esp_ble_mesh_model_cb_param_t),
+    ret = btc_transfer_context(&msg, param, param == NULL ? 0 : sizeof(esp_ble_mesh_model_cb_param_t),
                               btc_ble_mesh_model_copy_req_data);
    if (ret != BT_STATUS_SUCCESS) {
        BT_ERR("btc_transfer_context failed");
@@ -528,7 +528,7 @@ static bt_status_t btc_ble_mesh_prov_callback(esp_ble_mesh_prov_cb_param_t *para
    msg.pid = BTC_PID_PROV;
    msg.act = act;

-    ret = btc_transfer_context(&msg, param, sizeof(esp_ble_mesh_prov_cb_param_t), NULL);
+    ret = btc_transfer_context(&msg, param, param == NULL ? 0 : sizeof(esp_ble_mesh_prov_cb_param_t), NULL);
    if (ret != BT_STATUS_SUCCESS) {
        BT_ERR("btc_transfer_context failed");
    }
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c
@@ -450,7 +450,7 @@ static void btc_ble_mesh_sensor_client_callback(esp_ble_mesh_sensor_client_cb_pa
    msg.pid = BTC_PID_SENSOR_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_sensor_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_sensor_client_cb_param_t),
                         btc_ble_mesh_sensor_client_copy_req_data);
 }

@@ -817,7 +817,7 @@ static void btc_ble_mesh_sensor_server_callback(esp_ble_mesh_sensor_server_cb_pa
    msg.pid = BTC_PID_SENSOR_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_sensor_server_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_sensor_server_cb_param_t),
                         btc_ble_mesh_sensor_server_copy_req_data);
 }

--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c
@@ -214,7 +214,7 @@ static void btc_ble_mesh_time_scene_client_callback(esp_ble_mesh_time_scene_clie
    msg.pid = BTC_PID_TIME_SCENE_CLIENT;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_time_scene_client_cb_param_t),
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_time_scene_client_cb_param_t),
                         btc_ble_mesh_time_scene_client_copy_req_data);
 }

@@ -401,7 +401,7 @@ static void btc_ble_mesh_time_scene_server_callback(esp_ble_mesh_time_scene_serv
    msg.pid = BTC_PID_TIME_SCENE_SERVER;
    msg.act = act;

-    btc_transfer_context(&msg, cb_params, sizeof(esp_ble_mesh_time_scene_server_cb_param_t), NULL);
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_time_scene_server_cb_param_t), NULL);
 }

 void bt_mesh_time_scene_server_cb_evt_to_btc(uint8_t evt_type, struct bt_mesh_model *model,
--- a/components/bt/esp_ble_mesh/mesh_core/beacon.c
+++ b/components/bt/esp_ble_mesh/mesh_core/beacon.c
@@ -374,9 +374,19 @@ static void secure_beacon_recv(struct net_buf_simple *buf)

    cache_add(data, sub);

-    /* If we have NetKey0 accept initiation only from it */
+    /* Spec v1.0.1, Section 3.8.4:
+     * If a node on a primary subnet receives an update on
+     * the primary subnet, it shall propagate the IV update
+     * to all other subnets. If a node on a primary subnet
+     * receives an IV update on any other subnet, the update
+     * shall be ignored.
+     * If a node on a primary subnet receives an key update
+     * on any other subnet, the update shall not be ignored.
+     */
    if (bt_mesh_primary_subnet_exist() &&
-            sub->net_idx != BLE_MESH_KEY_PRIMARY) {
+        sub->net_idx != BLE_MESH_KEY_PRIMARY &&
+        BLE_MESH_IV_UPDATE(flags) &&
+        !BLE_MESH_KEY_REFRESH(flags)) {
        BT_WARN("Ignoring secure beacon on non-primary subnet");
        goto update_stats;
    }
@@ -390,7 +400,15 @@ static void secure_beacon_recv(struct net_buf_simple *buf)
        bt_mesh_beacon_ivu_initiator(false);
    }

-    iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    /* If a node on a primary subnet receives an IV update on any other subnet,
+     * the IV update shall be ignored. And if a node on a non-primary subnet
+     * receives an IV update on primary subnet, the IV update shall be ignored,
+     * because it doesn't have a primary network key.
+     */
+    if ((bt_mesh_primary_subnet_exist() && sub->net_idx == BLE_MESH_KEY_PRIMARY) ||
+        (!bt_mesh_primary_subnet_exist() && sub->net_idx != BLE_MESH_KEY_PRIMARY)) {
+        iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    }

    kr_change = bt_mesh_kr_update(sub, BLE_MESH_KEY_REFRESH(flags), new_key);
    if (kr_change) {
--- a/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c
+++ b/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c
@@ -197,6 +197,21 @@ static bool app_key_is_valid(uint16_t app_idx)
    return false;
 }

+static bool mod_pub_app_key_bound(struct bt_mesh_model *model,
+                                  uint16_t app_idx)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(model->keys); i++) {
+        if (model->keys[i] == app_idx) {
+            return true;
+        }
+    }
+
+    BT_ERR("Appkey(0x%02x) not bound to this model.", app_idx);
+    return false;
+}
+
 static uint8_t _mod_pub_set(struct bt_mesh_model *model, uint16_t pub_addr,
                            uint16_t app_idx, uint8_t cred_flag, uint8_t ttl, uint8_t period,
                            uint8_t retransmit, bool store)
@@ -237,7 +252,11 @@ static uint8_t _mod_pub_set(struct bt_mesh_model *model, uint16_t pub_addr,
        return STATUS_SUCCESS;
    }

-    if (!bt_mesh_app_key_find(app_idx)) {
+    /* For case MESH/NODE/CFG/MP/BI-03-C, need to check if appkey
+     * is bound to model identified by the ModelIdentifier.
+     */
+    if (!bt_mesh_app_key_find(app_idx) ||
+        !mod_pub_app_key_bound(model, app_idx)) {
        return STATUS_INVALID_APPKEY;
    }

@@ -3049,7 +3068,7 @@ static void heartbeat_pub_set(struct bt_mesh_model *model,
        goto failed;
    }

-    if (param->period_log > 0x10) {
+    if (param->period_log > 0x11) {
        status = STATUS_CANNOT_SET;
        goto failed;
    }
@@ -3202,19 +3221,18 @@ static void heartbeat_sub_set(struct bt_mesh_model *model,
    }

    if (sub_src == BLE_MESH_ADDR_UNASSIGNED ||
-            sub_dst == BLE_MESH_ADDR_UNASSIGNED ||
-            sub_period == 0x00) {
+        sub_dst == BLE_MESH_ADDR_UNASSIGNED ||
+        sub_period == 0x00) {
        /* Only an explicit address change to unassigned should
         * trigger clearing of the values according to
         * MESH/NODE/CFG/HBS/BV-02-C.
         */
        if (sub_src == BLE_MESH_ADDR_UNASSIGNED ||
-                sub_dst == BLE_MESH_ADDR_UNASSIGNED) {
+            sub_dst == BLE_MESH_ADDR_UNASSIGNED) {
            cfg->hb_sub.src = BLE_MESH_ADDR_UNASSIGNED;
            cfg->hb_sub.dst = BLE_MESH_ADDR_UNASSIGNED;
            cfg->hb_sub.min_hops = BLE_MESH_TTL_MAX;
            cfg->hb_sub.max_hops = 0U;
-            cfg->hb_sub.count = 0U;
        }

        period_ms = 0;
@@ -3240,6 +3258,11 @@ static void heartbeat_sub_set(struct bt_mesh_model *model,

    hb_sub_send_status(model, ctx, STATUS_SUCCESS);

+    /* For case MESH/NODE/CFG/HBS/BV-02-C, set count_log to 0
+     * when Heartbeat Subscription Status message is sent.
+     */
+    cfg->hb_sub.count = 0U;
+
    /* MESH/NODE/CFG/HBS/BV-01-C expects the MinHops to be 0x7f after
     * disabling subscription, but 0x00 for subsequent Get requests.
     */
--- a/components/bt/esp_ble_mesh/mesh_core/friend.c
+++ b/components/bt/esp_ble_mesh/mesh_core/friend.c
@@ -64,6 +64,7 @@ enum {
 };

 static void (*friend_cb)(bool establish, uint16_t lpn_addr, uint8_t reason);
+static void enqueue_update(struct bt_mesh_friend *frnd, uint8_t md);

 static bool friend_init = false;

@@ -233,7 +234,23 @@ void bt_mesh_friend_sec_update(uint16_t net_idx)
        }

        if (net_idx == BLE_MESH_KEY_ANY || frnd->net_idx == net_idx) {
-            frnd->sec_update = 1U;
+            /* For case MESH/NODE/FRND/FN/BV-20-C.
+             * A situation is:
+             * The friend node may receive more than one different secure updates
+             * consecutively. And using the previous approach will cause only the
+             * latest Friend Update message been enqueued.
+             * So we update the implementation here to enqueue the Friend Update
+             * message immediately once a different secure beacon is received.
+             *
+             * A disadvantage of the change is:
+             * A friend node may receive different secure beacons. Then the
+             * beacon_cache mechanism will not work. This will cause the friend
+             * message queue been full of these secure beacons. So before enqueuing
+             * the secure updates, we should check if the currently received one
+             * is already exists in the message queue. Or enhance the beacon cache
+             * filtering mechanism.
+             */
+            enqueue_update(frnd, 1);
        }
    }
 }
@@ -699,7 +716,6 @@ static void enqueue_update(struct bt_mesh_friend *frnd, uint8_t md)
        return;
    }

-    frnd->sec_update = 0U;
    enqueue_buf(frnd, buf);
 }

@@ -1116,10 +1132,6 @@ static void enqueue_friend_pdu(struct bt_mesh_friend *frnd,
    BT_DBG("type %u", type);

    if (type == BLE_MESH_FRIEND_PDU_SINGLE) {
-        if (frnd->sec_update) {
-            enqueue_update(frnd, 1);
-        }
-
        enqueue_buf(frnd, buf);
        return;
    }
@@ -1136,10 +1148,6 @@ static void enqueue_friend_pdu(struct bt_mesh_friend *frnd,
    net_buf_slist_put(&seg->queue, buf);

    if (type == BLE_MESH_FRIEND_PDU_COMPLETE) {
-        if (frnd->sec_update) {
-            enqueue_update(frnd, 1);
-        }
-
        sys_slist_merge_slist(&frnd->queue, &seg->queue);

        frnd->queue_size += seg->seg_count;
--- a/components/bt/esp_ble_mesh/mesh_core/main.c
+++ b/components/bt/esp_ble_mesh/mesh_core/main.c
@@ -78,6 +78,11 @@ int bt_mesh_provision(const uint8_t net_key[16], uint16_t net_idx,

    memcpy(bt_mesh.dev_key, dev_key, 16);

+    if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER) &&
+        IS_ENABLED(CONFIG_BLE_MESH_LPN_SUB_ALL_NODES_ADDR)) {
+        bt_mesh_lpn_group_add(BLE_MESH_ADDR_ALL_NODES);
+    }
+
    if (IS_ENABLED(CONFIG_BLE_MESH_SETTINGS)) {
        BT_DBG("Storing network information persistently");
        bt_mesh_store_net();
@@ -110,6 +115,12 @@ void bt_mesh_node_reset(void)
    bt_mesh_tx_reset();

    if (IS_ENABLED(CONFIG_BLE_MESH_LOW_POWER)) {
+        if (IS_ENABLED(CONFIG_BLE_MESH_LPN_SUB_ALL_NODES_ADDR)) {
+            uint16_t group = BLE_MESH_ADDR_ALL_NODES;
+
+            bt_mesh_lpn_group_del(&group, 1);
+        }
+
        bt_mesh_lpn_disable(true);
    }

--- a/components/bt/esp_ble_mesh/mesh_core/mesh.h
+++ b/components/bt/esp_ble_mesh/mesh_core/mesh.h
@@ -20,7 +20,7 @@ extern "C" {
 #define BLE_MESH_KEY_ANY                0xffff

 #define BLE_MESH_ADDR_IS_UNICAST(addr)  ((addr) && (addr) < 0x8000)
-#define BLE_MESH_ADDR_IS_GROUP(addr)    ((addr) >= 0xc000 && (addr) <= 0xff00)
+#define BLE_MESH_ADDR_IS_GROUP(addr)    ((addr) >= 0xc000 && (addr) < 0xff00)
 #define BLE_MESH_ADDR_IS_VIRTUAL(addr)  ((addr) >= 0x8000 && (addr) < 0xc000)
 #define BLE_MESH_ADDR_IS_RFU(addr)      ((addr) >= 0xff00 && (addr) <= 0xfffb)

--- a/components/bt/esp_ble_mesh/mesh_core/net.c
+++ b/components/bt/esp_ble_mesh/mesh_core/net.c
@@ -1220,6 +1220,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
    }

    if (rx->net_if == BLE_MESH_NET_IF_ADV &&
+            !rx->friend_cred &&
            bt_mesh_relay_get() != BLE_MESH_RELAY_ENABLED &&
            bt_mesh_gatt_proxy_get() != BLE_MESH_GATT_PROXY_ENABLED) {
        return;
@@ -1232,7 +1233,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
     * Anything else (like GATT to adv, or locally originated packets)
     * use the Network Transmit state.
     */
-    if (rx->net_if == BLE_MESH_NET_IF_ADV) {
+    if (rx->net_if == BLE_MESH_NET_IF_ADV && !rx->friend_cred) {
        transmit = bt_mesh_relay_retransmit_get();
    } else {
        transmit = bt_mesh_net_transmit_get();
@@ -1302,6 +1303,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
     */
    if (IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) &&
            (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
+             rx->friend_cred ||
             rx->net_if == BLE_MESH_NET_IF_LOCAL)) {
        if (bt_mesh_proxy_server_relay(&buf->b, rx->ctx.recv_dst) &&
                BLE_MESH_ADDR_IS_UNICAST(rx->ctx.recv_dst)) {
@@ -1309,7 +1311,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
        }
    }

-    if (relay_to_adv(rx->net_if)) {
+    if (relay_to_adv(rx->net_if) || rx->friend_cred) {
 #if !defined(CONFIG_BLE_MESH_RELAY_ADV_BUF)
        bt_mesh_adv_send(buf, NULL, NULL);
 #else
@@ -1378,8 +1380,9 @@ int bt_mesh_net_decode(struct net_buf_simple *data, enum bt_mesh_net_if net_if,
        return -EBADMSG;
    }

+    /* For case MESH/NODE/RLY/BV-01-C, even the DST is RFU, it needs to be forwarded. */
    if (BLE_MESH_ADDR_IS_RFU(rx->ctx.recv_dst)) {
-        BT_ERR("Destination address is RFU; dropping packet");
+        BT_ERR("Destination address is RFU; dropping packet 0x%02x", rx->ctx.recv_dst);
        return -EBADMSG;
    }

--- a/components/bt/esp_ble_mesh/mesh_core/net.h
+++ b/components/bt/esp_ble_mesh/mesh_core/net.h
@@ -95,7 +95,6 @@ struct bt_mesh_friend {
    uint8_t  fsn:1,
             send_last:1,
             pending_req:1,
-             sec_update:1,
             pending_buf:1,
             valid:1,
             established:1;
--- a/components/bt/esp_ble_mesh/mesh_core/prov.c
+++ b/components/bt/esp_ble_mesh/mesh_core/prov.c
@@ -1450,18 +1450,22 @@ static void prov_msg_recv(void)
        return;
    }

-    if (type != PROV_FAILED && type != link.expect) {
-        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
-        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
-        return;
-    }
-
+    /* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
+     * with the Type field set to the lowest unsupported or RFU value, it sends a
+     * Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
+     */
    if (type >= ARRAY_SIZE(prov_handlers)) {
        BT_ERR("Unknown provisioning PDU type 0x%02x", type);
        prov_send_fail_msg(PROV_ERR_NVAL_PDU);
        return;
    }

+    if (type != PROV_FAILED && type != link.expect) {
+        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
+        return;
+    }
+
    if (1 + prov_handlers[type].len != link.rx.buf->len) {
        BT_ERR("Invalid length %u for type 0x%02x",
                link.rx.buf->len, type);
@@ -1666,15 +1670,30 @@ int bt_mesh_pb_gatt_recv(struct bt_mesh_conn *conn, struct net_buf_simple *buf)
        return -EINVAL;
    }

-    type = net_buf_simple_pull_u8(buf);
-    if (type != PROV_FAILED && type != link.expect) {
-        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+    /* For case MESH/NODE/PROV/BI-03-C, if the link is closed, when the node receive
+     * a Provisioning PDU , it will send a Provisioning Failed PDU with the Error Code
+     * field set to Unexpected PDU(0x03).
+     */
+    if (bt_mesh_atomic_test_bit(link.flags, LINK_INVALID)) {
+        BT_WARN("Unexpected msg 0x%02x on invalid link", type);
        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
        return -EINVAL;
    }

+    /* For case MESH/NODE/PROV/BI-15-C, when the node receive a Provisioning PDU
+     * with the Type field set to the lowest unsupported or RFU value, it sends a
+     * Provisioning Failed PDU with the Error Code field set to Invalid PDU(0x01).
+     */
+    type = net_buf_simple_pull_u8(buf);
    if (type >= ARRAY_SIZE(prov_handlers)) {
        BT_ERR("Unknown provisioning PDU type 0x%02x", type);
+        prov_send_fail_msg(PROV_ERR_NVAL_PDU);
+        return -EINVAL;
+    }
+
+    if (type != PROV_FAILED && type != link.expect) {
+        BT_WARN("Unexpected msg 0x%02x != 0x%02x", type, link.expect);
+        prov_send_fail_msg(PROV_ERR_UNEXP_PDU);
        return -EINVAL;
    }

--- a/components/bt/esp_ble_mesh/mesh_core/provisioner_prov.c
+++ b/components/bt/esp_ble_mesh/mesh_core/provisioner_prov.c
@@ -2943,6 +2943,12 @@ static void gen_prov_ack(const uint8_t idx, struct prov_rx *rx, struct net_buf_s
        case PROV_START:
            pub_key_oob = link[idx].conf_inputs[13];
            send_pub_key(idx, pub_key_oob);
+            /* For case MESH/PVNR/PROV/BV-04-C, if using OOB public key,
+             * the value of expect_ack_for shall be PROV_PUB_KEY.
+             */
+            if (pub_key_oob) {
+                return;
+            }
            break;
        case PROV_PUB_KEY:
            prov_gen_dh_key(idx);
--- a/components/bt/esp_ble_mesh/mesh_core/scan.c
+++ b/components/bt/esp_ble_mesh/mesh_core/scan.c
@@ -233,14 +233,11 @@ static void bt_mesh_scan_cb(const bt_mesh_addr_t *addr,

        buf->len = len - 1;

-#if 0
-        /* TODO: Check with BLE Mesh BQB test cases */
        if ((type == BLE_MESH_DATA_MESH_PROV || type == BLE_MESH_DATA_MESH_MESSAGE ||
            type == BLE_MESH_DATA_MESH_BEACON) && (adv_type != BLE_MESH_ADV_NONCONN_IND)) {
            BT_DBG("Ignore mesh packet (type 0x%02x) with adv_type 0x%02x", type, adv_type);
            return;
        }
-#endif

        switch (type) {
        case BLE_MESH_DATA_MESH_MESSAGE:
--- a/components/bt/host/bluedroid/Kconfig.in
+++ b/components/bt/host/bluedroid/Kconfig.in
@@ -173,6 +173,13 @@ config BT_GATT_MAX_SR_PROFILES
    help
        Maximum GATT Server Profiles Count

+config BT_GATT_MAX_SR_ATTRIBUTES
+    int "Max GATT Service Attributes"
+    depends on BT_GATTS_ENABLE && BT_BLUEDROID_ENABLED
+    range 1 500
+    default 100
+    help
+        Maximum GATT Service Attributes Count


 choice BT_GATTS_SEND_SERVICE_CHANGE_MODE
@@ -208,6 +215,14 @@ config BT_GATTC_ENABLE
    help
        This option can be close when the app work only on gatt server mode

+config BT_GATTC_MAX_CACHE_CHAR
+    int "Max gattc cache characteristic for discover"
+    depends on BT_GATTC_ENABLE
+    range 1 500
+    default 40
+    help
+        Maximum GATTC cache characteristic count
+
 config BT_GATTC_CACHE_NVS_FLASH
    bool "Save gattc cache data to nvs flash"
    depends on BT_GATTC_ENABLE
@@ -1030,7 +1045,7 @@ config BT_SMP_ENABLE

 config BT_BLE_ACT_SCAN_REP_ADV_SCAN
    bool "Report adv data and scan response individually when BLE active scan"
-    depends on BT_BLUEDROID_ENABLED && (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    depends on BT_BLUEDROID_ENABLED && BT_BLE_ENABLED
    default n
    help
        Originally, when doing BLE active scan, Bluedroid will not report adv to application layer
--- a/components/bt/host/bluedroid/api/esp_gatts_api.c
+++ b/components/bt/host/bluedroid/api/esp_gatts_api.c
@@ -85,7 +85,7 @@ esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,

 esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db,
                                        esp_gatt_if_t gatts_if,
-                                        uint8_t max_nb_attr,
+                                        uint16_t max_nb_attr,
                                        uint8_t srvc_inst_id)
 {
    btc_msg_t msg = {0};
@@ -93,6 +93,11 @@ esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db

    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);

+    if (max_nb_attr > ESP_GATT_ATTR_HANDLE_MAX) {
+        LOG_ERROR("The number of attribute should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES\n");
+        return ESP_ERR_INVALID_ARG;
+    }
+
    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_GATTS;
    msg.act = BTC_GATTS_ACT_CREATE_ATTR_TAB;
--- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
@@ -17,8 +17,8 @@
 extern "C" {
 #endif

-/**@{
- * BLE_ADV_DATA_FLAG data flag bit definition used for advertising data flag
+/**
+ * @brief BLE_ADV_DATA_FLAG data flag bit definition used for advertising data flag
 */
 #define ESP_BLE_ADV_FLAG_LIMIT_DISC         (0x01 << 0)
 #define ESP_BLE_ADV_FLAG_GEN_DISC           (0x01 << 1)
@@ -26,104 +26,102 @@ extern "C" {
 #define ESP_BLE_ADV_FLAG_DMT_CONTROLLER_SPT (0x01 << 3)
 #define ESP_BLE_ADV_FLAG_DMT_HOST_SPT       (0x01 << 4)
 #define ESP_BLE_ADV_FLAG_NON_LIMIT_DISC     (0x00 )
-/**
- * @}
- */

-/* relate to BTM_LE_KEY_xxx in stack/btm_api.h */
-#define ESP_LE_KEY_NONE                    0                                                                         /* relate to BTM_LE_KEY_NONE in stack/btm_api.h */
-#define ESP_LE_KEY_PENC                    (1 << 0)   /*!< encryption key, encryption information of peer device */  /* relate to BTM_LE_KEY_PENC in stack/btm_api.h */
-#define ESP_LE_KEY_PID                     (1 << 1)   /*!< identity key of the peer device */                        /* relate to BTM_LE_KEY_PID in stack/btm_api.h */
-#define ESP_LE_KEY_PCSRK                   (1 << 2)   /*!< peer SRK */                                               /* relate to BTM_LE_KEY_PCSRK in stack/btm_api.h */
-#define ESP_LE_KEY_PLK                     (1 << 3)   /*!< Link key*/                                                /* relate to BTM_LE_KEY_PLK in stack/btm_api.h */
-#define ESP_LE_KEY_LLK                     (ESP_LE_KEY_PLK << 4)                                                     /* relate to BTM_LE_KEY_LLK in stack/btm_api.h */
-#define ESP_LE_KEY_LENC                    (ESP_LE_KEY_PENC << 4)   /*!< master role security information:div */     /* relate to BTM_LE_KEY_LENC in stack/btm_api.h */
-#define ESP_LE_KEY_LID                     (ESP_LE_KEY_PID << 4)    /*!< master device ID key */                     /* relate to BTM_LE_KEY_LID in stack/btm_api.h */
-#define ESP_LE_KEY_LCSRK                   (ESP_LE_KEY_PCSRK << 4)  /*!< local CSRK has been deliver to peer */      /* relate to BTM_LE_KEY_LCSRK in stack/btm_api.h */
+
+/// relate to BTM_LE_KEY_xxx in stack/btm_api.h
+#define ESP_LE_KEY_NONE                    0           /*!< No encryption key */
+#define ESP_LE_KEY_PENC                    (1 << 0)    /*!< encryption key, encryption information of peer device */
+#define ESP_LE_KEY_PID                     (1 << 1)    /*!< identity key of the peer device */
+#define ESP_LE_KEY_PCSRK                   (1 << 2)    /*!< peer SRK */
+#define ESP_LE_KEY_PLK                     (1 << 3)    /*!< Link key*/
+#define ESP_LE_KEY_LLK                     (ESP_LE_KEY_PLK << 4)      /*!< peer link key*/
+#define ESP_LE_KEY_LENC                    (ESP_LE_KEY_PENC << 4)     /*!< master role security information:div */
+#define ESP_LE_KEY_LID                     (ESP_LE_KEY_PID << 4)      /*!< master device ID key */
+#define ESP_LE_KEY_LCSRK                   (ESP_LE_KEY_PCSRK << 4)    /*!< local CSRK has been deliver to peer */
 typedef uint8_t esp_ble_key_type_t;

-/* relate to BTM_LE_AUTH_xxx in stack/btm_api.h */
-#define ESP_LE_AUTH_NO_BOND                 0x00                                     /*!< 0*/                     /* relate to BTM_LE_AUTH_NO_BOND in stack/btm_api.h */
-#define ESP_LE_AUTH_BOND                    0x01                                     /*!< 1 << 0 */               /* relate to BTM_LE_AUTH_BOND in stack/btm_api.h */
-#define ESP_LE_AUTH_REQ_MITM                (1 << 2)                                 /*!< 1 << 2 */               /* relate to BTM_LE_AUTH_REQ_MITM in stack/btm_api.h */
-#define ESP_LE_AUTH_REQ_BOND_MITM           (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_MITM)/*!< 0101*/
-#define ESP_LE_AUTH_REQ_SC_ONLY             (1 << 3)                                 /*!< 1 << 3 */               /* relate to BTM_LE_AUTH_REQ_SC_ONLY in stack/btm_api.h */
-#define ESP_LE_AUTH_REQ_SC_BOND             (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_SC_ONLY)            /*!< 1001 */  /* relate to BTM_LE_AUTH_REQ_SC_BOND in stack/btm_api.h */
-#define ESP_LE_AUTH_REQ_SC_MITM             (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY)        /*!< 1100 */  /* relate to BTM_LE_AUTH_REQ_SC_MITM in stack/btm_api.h */
-#define ESP_LE_AUTH_REQ_SC_MITM_BOND        (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY | ESP_LE_AUTH_BOND)   /*!< 1101 */  /* relate to BTM_LE_AUTH_REQ_SC_MITM_BOND in stack/btm_api.h */
+/// relate to BTM_LE_AUTH_xxx in stack/btm_api.h
+#define ESP_LE_AUTH_NO_BOND                 0x00        /*!< 0  no bondingv*/
+#define ESP_LE_AUTH_BOND                    0x01        /*!< 1 << 0 device in the bonding with peer */
+#define ESP_LE_AUTH_REQ_MITM                (1 << 2)    /*!< 1 << 2 man in the middle attack */
+#define ESP_LE_AUTH_REQ_BOND_MITM           (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_MITM) /*!< 0101 banding with man in the middle attack */
+#define ESP_LE_AUTH_REQ_SC_ONLY             (1 << 3)                                  /*!< 1 << 3  secure connection */
+#define ESP_LE_AUTH_REQ_SC_BOND             (ESP_LE_AUTH_BOND | ESP_LE_AUTH_REQ_SC_ONLY)            /*!< 1001 secure connection with band*/
+#define ESP_LE_AUTH_REQ_SC_MITM             (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY)        /*!< 1100 secure conn with MITM */
+#define ESP_LE_AUTH_REQ_SC_MITM_BOND        (ESP_LE_AUTH_REQ_MITM | ESP_LE_AUTH_REQ_SC_ONLY | ESP_LE_AUTH_BOND)   /*!< 1101 SC with MITM and Bonding*/
 typedef uint8_t   esp_ble_auth_req_t;         /*!< combination of the above bit pattern */

-#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_DISABLE 0
-#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_ENABLE  1
+#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_DISABLE 0    /*!< authentication disable*/
+#define ESP_BLE_ONLY_ACCEPT_SPECIFIED_AUTH_ENABLE  1    /*!< authentication enable*/

-#define ESP_BLE_OOB_DISABLE 0
-#define ESP_BLE_OOB_ENABLE  1
+#define ESP_BLE_OOB_DISABLE 0    /*!< disbale the out of bond*/
+#define ESP_BLE_OOB_ENABLE  1    /*!< enable the out of bond*/

-/* relate to BTM_IO_CAP_xxx in stack/btm_api.h */
-#define ESP_IO_CAP_OUT                      0   /*!< DisplayOnly */         /* relate to BTM_IO_CAP_OUT in stack/btm_api.h */
-#define ESP_IO_CAP_IO                       1   /*!< DisplayYesNo */        /* relate to BTM_IO_CAP_IO in stack/btm_api.h */
-#define ESP_IO_CAP_IN                       2   /*!< KeyboardOnly */        /* relate to BTM_IO_CAP_IN in stack/btm_api.h */
-#define ESP_IO_CAP_NONE                     3   /*!< NoInputNoOutput */     /* relate to BTM_IO_CAP_NONE in stack/btm_api.h */
-#define ESP_IO_CAP_KBDISP                   4   /*!< Keyboard display */    /* relate to BTM_IO_CAP_KBDISP in stack/btm_api.h */
+/// relate to BTM_IO_CAP_xxx in stack/btm_api.h
+#define ESP_IO_CAP_OUT                      0   /*!< DisplayOnly */
+#define ESP_IO_CAP_IO                       1   /*!< DisplayYesNo */
+#define ESP_IO_CAP_IN                       2   /*!< KeyboardOnly */
+#define ESP_IO_CAP_NONE                     3   /*!< NoInputNoOutput */
+#define ESP_IO_CAP_KBDISP                   4   /*!< Keyboard display */

-#define ESP_BLE_APPEARANCE_UNKNOWN                 0x0000 /* relate to BTM_BLE_APPEARANCE_UNKNOWN in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_PHONE           0x0040 /* relate to BTM_BLE_APPEARANCE_GENERIC_PHONE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_COMPUTER        0x0080 /* relate to BTM_BLE_APPEARANCE_GENERIC_COMPUTER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_WATCH           0x00C0 /* relate to BTM_BLE_APPEARANCE_GENERIC_WATCH in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_SPORTS_WATCH            0x00C1 /* relate to BTM_BLE_APPEARANCE_SPORTS_WATCH in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_CLOCK           0x0100 /* relate to BTM_BLE_APPEARANCE_GENERIC_CLOCK in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_DISPLAY         0x0140 /* relate to BTM_BLE_APPEARANCE_GENERIC_DISPLAY in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_REMOTE          0x0180 /* relate to BTM_BLE_APPEARANCE_GENERIC_REMOTE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_EYEGLASSES      0x01C0 /* relate to BTM_BLE_APPEARANCE_GENERIC_EYEGLASSES in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_TAG             0x0200 /* relate to BTM_BLE_APPEARANCE_GENERIC_TAG in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_KEYRING         0x0240 /* relate to BTM_BLE_APPEARANCE_GENERIC_KEYRING in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER    0x0280 /* relate to BTM_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER 0x02C0 /* relate to BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_THERMOMETER     0x0300 /* relate to BTM_BLE_APPEARANCE_GENERIC_THERMOMETER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_THERMOMETER_EAR         0x0301 /* relate to BTM_BLE_APPEARANCE_THERMOMETER_EAR in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_HEART_RATE      0x0340 /* relate to BTM_BLE_APPEARANCE_GENERIC_HEART_RATE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HEART_RATE_BELT         0x0341 /* relate to BTM_BLE_APPEARANCE_HEART_RATE_BELT in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE  0x0380 /* relate to BTM_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_BLOOD_PRESSURE_ARM      0x0381 /* relate to BTM_BLE_APPEARANCE_BLOOD_PRESSURE_ARM in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST    0x0382 /* relate to BTM_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_HID             0x03C0 /* relate to BTM_BLE_APPEARANCE_GENERIC_HID in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_KEYBOARD            0x03C1 /* relate to BTM_BLE_APPEARANCE_HID_KEYBOARD in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_MOUSE               0x03C2 /* relate to BTM_BLE_APPEARANCE_HID_MOUSE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_JOYSTICK            0x03C3 /* relate to BTM_BLE_APPEARANCE_HID_JOYSTICK in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_GAMEPAD             0x03C4 /* relate to BTM_BLE_APPEARANCE_HID_GAMEPAD in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_DIGITIZER_TABLET    0x03C5 /* relate to BTM_BLE_APPEARANCE_HID_DIGITIZER_TABLET in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_CARD_READER         0x03C6 /* relate to BTM_BLE_APPEARANCE_HID_CARD_READER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_DIGITAL_PEN         0x03C7 /* relate to BTM_BLE_APPEARANCE_HID_DIGITAL_PEN in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_HID_BARCODE_SCANNER     0x03C8 /* relate to BTM_BLE_APPEARANCE_HID_BARCODE_SCANNER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_GLUCOSE         0x0400 /* relate to BTM_BLE_APPEARANCE_GENERIC_GLUCOSE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_WALKING         0x0440 /* relate to BTM_BLE_APPEARANCE_GENERIC_WALKING in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_WALKING_IN_SHOE         0x0441 /* relate to BTM_BLE_APPEARANCE_WALKING_IN_SHOE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_WALKING_ON_SHOE         0x0442 /* relate to BTM_BLE_APPEARANCE_WALKING_ON_SHOE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_WALKING_ON_HIP          0x0443 /* relate to BTM_BLE_APPEARANCE_WALKING_ON_HIP in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_CYCLING         0x0480 /* relate to BTM_BLE_APPEARANCE_GENERIC_CYCLING in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_CYCLING_COMPUTER        0x0481 /* relate to BTM_BLE_APPEARANCE_CYCLING_COMPUTER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_CYCLING_SPEED           0x0482 /* relate to BTM_BLE_APPEARANCE_CYCLING_SPEED in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_CYCLING_CADENCE         0x0483 /* relate to BTM_BLE_APPEARANCE_CYCLING_CADENCE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_CYCLING_POWER           0x0484 /* relate to BTM_BLE_APPEARANCE_CYCLING_POWER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_CYCLING_SPEED_CADENCE   0x0485 /* relate to BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER  0x0C40 /* relate to BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41 /* relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_PULSE_OXIMETER_WRIST    0x0C42 /* relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_WEIGHT          0x0C80 /* relate to BTM_BLE_APPEARANCE_GENERIC_WEIGHT in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_PERSONAL_MOBILITY_DEVICE    0x0CC0 /* relate to BTM_BLE_APPEARANCE_GENERIC_PERSONAL_MOBILITY_DEVICE in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_POWERED_WHEELCHAIR                  0x0CC1 /* relate to BTM_BLE_APPEARANCE_POWERED_WHEELCHAIR in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_MOBILITY_SCOOTER                    0x0CC2 /* relate to BTM_BLE_APPEARANCE_MOBILITY_SCOOTER in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_CONTINUOUS_GLUCOSE_MONITOR  0x0D00 /* relate to BTM_BLE_APPEARANCE_GENERIC_CONTINUOUS_GLUCOSE_MONITOR in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_INSULIN_PUMP                0x0D40 /* relate to BTM_BLE_APPEARANCE_GENERIC_INSULIN_PUMP in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_INSULIN_PUMP_DURABLE_PUMP           0x0D41 /* relate to BTM_BLE_APPEARANCE_INSULIN_PUMP_DURABLE_PUMP in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_INSULIN_PUMP_PATCH_PUMP             0x0D44 /* relate to BTM_BLE_APPEARANCE_INSULIN_PUMP_PATCH_PUMP in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_INSULIN_PEN                         0x0D48 /* relate to BTM_BLE_APPEARANCE_INSULIN_PEN in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_MEDICATION_DELIVERY         0x0D80 /* relate to BTM_BLE_APPEARANCE_GENERIC_MEDICATION_DELIVERY in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS  0x1440             /* relate to BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION 0x1441             /* relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV     0x1442 /* relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD         0x1443 /* relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD in stack/btm_ble_api.h */
-#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV 0x1444 /* relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_UNKNOWN                 0x0000 /*!< relate to BTM_BLE_APPEARANCE_UNKNOWN in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_PHONE           0x0040 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_PHONE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_COMPUTER        0x0080 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_COMPUTER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_WATCH           0x00C0 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_WATCH in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_SPORTS_WATCH            0x00C1 /*!< relate to BTM_BLE_APPEARANCE_SPORTS_WATCH in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_CLOCK           0x0100 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_CLOCK in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_DISPLAY         0x0140 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_DISPLAY in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_REMOTE          0x0180 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_REMOTE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_EYEGLASSES      0x01C0 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_EYEGLASSES in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_TAG             0x0200 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_TAG in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_KEYRING         0x0240 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_KEYRING in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER    0x0280 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER 0x02C0 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_THERMOMETER     0x0300 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_THERMOMETER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_THERMOMETER_EAR         0x0301 /*!< relate to BTM_BLE_APPEARANCE_THERMOMETER_EAR in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_HEART_RATE      0x0340 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_HEART_RATE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HEART_RATE_BELT         0x0341 /*!< relate to BTM_BLE_APPEARANCE_HEART_RATE_BELT in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE  0x0380 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_BLOOD_PRESSURE_ARM      0x0381 /*!< relate to BTM_BLE_APPEARANCE_BLOOD_PRESSURE_ARM in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST    0x0382 /*!< relate to BTM_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_HID             0x03C0 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_HID in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_KEYBOARD            0x03C1 /*!< relate to BTM_BLE_APPEARANCE_HID_KEYBOARD in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_MOUSE               0x03C2 /*!< relate to BTM_BLE_APPEARANCE_HID_MOUSE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_JOYSTICK            0x03C3 /*!< relate to BTM_BLE_APPEARANCE_HID_JOYSTICK in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_GAMEPAD             0x03C4 /*!< relate to BTM_BLE_APPEARANCE_HID_GAMEPAD in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_DIGITIZER_TABLET    0x03C5 /*!< relate to BTM_BLE_APPEARANCE_HID_DIGITIZER_TABLET in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_CARD_READER         0x03C6 /*!< relate to BTM_BLE_APPEARANCE_HID_CARD_READER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_DIGITAL_PEN         0x03C7 /*!< relate to BTM_BLE_APPEARANCE_HID_DIGITAL_PEN in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_HID_BARCODE_SCANNER     0x03C8 /*!< relate to BTM_BLE_APPEARANCE_HID_BARCODE_SCANNER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_GLUCOSE         0x0400 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_GLUCOSE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_WALKING         0x0440 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_WALKING in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_WALKING_IN_SHOE         0x0441 /*!< relate to BTM_BLE_APPEARANCE_WALKING_IN_SHOE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_WALKING_ON_SHOE         0x0442 /*!< relate to BTM_BLE_APPEARANCE_WALKING_ON_SHOE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_WALKING_ON_HIP          0x0443 /*!< relate to BTM_BLE_APPEARANCE_WALKING_ON_HIP in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_CYCLING         0x0480 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_CYCLING in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_CYCLING_COMPUTER        0x0481 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_COMPUTER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_CYCLING_SPEED           0x0482 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_SPEED in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_CYCLING_CADENCE         0x0483 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_CADENCE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_CYCLING_POWER           0x0484 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_POWER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_CYCLING_SPEED_CADENCE   0x0485 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER  0x0C40 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41 /*!< relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_PULSE_OXIMETER_WRIST    0x0C42 /*!< relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_WEIGHT          0x0C80 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_WEIGHT in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_PERSONAL_MOBILITY_DEVICE    0x0CC0 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_PERSONAL_MOBILITY_DEVICE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_POWERED_WHEELCHAIR                  0x0CC1 /*!< relate to BTM_BLE_APPEARANCE_POWERED_WHEELCHAIR in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_MOBILITY_SCOOTER                    0x0CC2 /*!< relate to BTM_BLE_APPEARANCE_MOBILITY_SCOOTER in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_CONTINUOUS_GLUCOSE_MONITOR  0x0D00 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_CONTINUOUS_GLUCOSE_MONITOR in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_INSULIN_PUMP                0x0D40 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_INSULIN_PUMP in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_INSULIN_PUMP_DURABLE_PUMP           0x0D41 /*!< relate to BTM_BLE_APPEARANCE_INSULIN_PUMP_DURABLE_PUMP in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_INSULIN_PUMP_PATCH_PUMP             0x0D44 /*!< relate to BTM_BLE_APPEARANCE_INSULIN_PUMP_PATCH_PUMP in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_INSULIN_PEN                         0x0D48 /*!< relate to BTM_BLE_APPEARANCE_INSULIN_PEN in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_MEDICATION_DELIVERY         0x0D80 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_MEDICATION_DELIVERY in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS  0x1440             /*!< relate to BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION 0x1441             /*!< relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV     0x1442 /*!< relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD         0x1443 /*!< relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV 0x1444 /*!< relate to BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV in stack/btm_ble_api.h */

 typedef uint8_t esp_ble_io_cap_t;               /*!< combination of the io capability */

@@ -139,15 +137,15 @@ typedef enum {
    ESP_GAP_BLE_ADV_START_COMPLETE_EVT,                     /*!< When start advertising complete, the event comes */
    ESP_GAP_BLE_SCAN_START_COMPLETE_EVT,                    /*!< When start scan complete, the event comes */
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
-    ESP_GAP_BLE_AUTH_CMPL_EVT = 8,                          /* Authentication complete indication. */
-    ESP_GAP_BLE_KEY_EVT,                                    /* BLE  key event for peer device keys */
-    ESP_GAP_BLE_SEC_REQ_EVT,                                /* BLE  security request */
-    ESP_GAP_BLE_PASSKEY_NOTIF_EVT,                          /* passkey notification event */
-    ESP_GAP_BLE_PASSKEY_REQ_EVT,                            /* passkey request event */
-    ESP_GAP_BLE_OOB_REQ_EVT,                                /* OOB request event */
-    ESP_GAP_BLE_LOCAL_IR_EVT,                               /* BLE local IR event */
-    ESP_GAP_BLE_LOCAL_ER_EVT,                               /* BLE local ER event */
-    ESP_GAP_BLE_NC_REQ_EVT,                                 /* Numeric Comparison request event */
+    ESP_GAP_BLE_AUTH_CMPL_EVT = 8,                          /*!< Authentication complete indication. */
+    ESP_GAP_BLE_KEY_EVT,                                    /*!< BLE  key event for peer device keys */
+    ESP_GAP_BLE_SEC_REQ_EVT,                                /*!< BLE  security request */
+    ESP_GAP_BLE_PASSKEY_NOTIF_EVT,                          /*!< passkey notification event */
+    ESP_GAP_BLE_PASSKEY_REQ_EVT,                            /*!< passkey request event */
+    ESP_GAP_BLE_OOB_REQ_EVT,                                /*!< OOB request event */
+    ESP_GAP_BLE_LOCAL_IR_EVT,                               /*!< BLE local IR (identity Root 128-bit random static value used to generate Long Term Key) event */
+    ESP_GAP_BLE_LOCAL_ER_EVT,                               /*!< BLE local ER (Encryption Root vakue used to genrate identity resolving key) event */
+    ESP_GAP_BLE_NC_REQ_EVT,                                 /*!< Numeric Comparison request event */
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
    ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT,                      /*!< When stop adv complete, the event comes */
    ESP_GAP_BLE_SCAN_STOP_COMPLETE_EVT,                     /*!< When stop scan complete, the event comes */
@@ -166,45 +164,45 @@ typedef enum {
 #endif //#if (BLE_42_FEATURE_SUPPORT == TRUE)
    ESP_GAP_BLE_SET_CHANNELS_EVT = 29,                           /*!< When setting BLE channels complete, the event comes */
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
-    ESP_GAP_BLE_READ_PHY_COMPLETE_EVT,
-    ESP_GAP_BLE_SET_PREFERRED_DEFAULT_PHY_COMPLETE_EVT,
-    ESP_GAP_BLE_SET_PREFERRED_PHY_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_SET_RAND_ADDR_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_SET_PARAMS_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_DATA_SET_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_SCAN_RSP_DATA_SET_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_START_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_STOP_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_SET_REMOVE_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_SET_CLEAR_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_SET_PARAMS_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_DATA_SET_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_START_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_STOP_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_CREATE_SYNC_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_SYNC_CANCEL_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TERMINATE_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_ADD_DEV_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_REMOVE_DEV_COMPLETE_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_CLEAR_DEV_COMPLETE_EVT,
-    ESP_GAP_BLE_SET_EXT_SCAN_PARAMS_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_SCAN_START_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_SCAN_STOP_COMPLETE_EVT,
-    ESP_GAP_BLE_PREFER_EXT_CONN_PARAMS_SET_COMPLETE_EVT,
-    ESP_GAP_BLE_PHY_UPDATE_COMPLETE_EVT,
-    ESP_GAP_BLE_EXT_ADV_REPORT_EVT,
-    ESP_GAP_BLE_SCAN_TIMEOUT_EVT,
-    ESP_GAP_BLE_ADV_TERMINATED_EVT,
-    ESP_GAP_BLE_SCAN_REQ_RECEIVED_EVT,
-    ESP_GAP_BLE_CHANNEL_SELECT_ALGORITHM_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_REPORT_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_SYNC_LOST_EVT,
-    ESP_GAP_BLE_PERIODIC_ADV_SYNC_ESTAB_EVT,
+    ESP_GAP_BLE_READ_PHY_COMPLETE_EVT,                           /*!< when reading phy complete, this event comes */
+    ESP_GAP_BLE_SET_PREFERRED_DEFAULT_PHY_COMPLETE_EVT,          /*!< when preferred default phy complete, this event comes */
+    ESP_GAP_BLE_SET_PREFERRED_PHY_COMPLETE_EVT,                  /*!< when preferred phy complete , this event comes */
+    ESP_GAP_BLE_EXT_ADV_SET_RAND_ADDR_COMPLETE_EVT,              /*!< when extended set random address complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_SET_PARAMS_COMPLETE_EVT,                 /*!< when extended advertising parameter complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_DATA_SET_COMPLETE_EVT,                   /*!< when extended advertising data complete, the event comes */
+    ESP_GAP_BLE_EXT_SCAN_RSP_DATA_SET_COMPLETE_EVT,              /*!< when extended scan response data complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_START_COMPLETE_EVT,                      /*!< when extended advertising start complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_STOP_COMPLETE_EVT,                       /*!< when extended advertising stop complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_SET_REMOVE_COMPLETE_EVT,                 /*!< when extended advertising set remove complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_SET_CLEAR_COMPLETE_EVT,                  /*!< when extended advertising set clear complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SET_PARAMS_COMPLETE_EVT,            /*!< when periodic advertising parameter complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_DATA_SET_COMPLETE_EVT,              /*!< when periodic advertising data complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_START_COMPLETE_EVT,                 /*!< when periodic advertising start complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_STOP_COMPLETE_EVT,                  /*!< when periodic advertising stop complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_CREATE_SYNC_COMPLETE_EVT,           /*!< when periodic advertising create sync complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_CANCEL_COMPLETE_EVT,           /*!< when extended advertising sync cancel complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TERMINATE_COMPLETE_EVT,        /*!< when extended advertising sync terminate complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_ADD_DEV_COMPLETE_EVT,               /*!< when extended advertising add device complete , the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_REMOVE_DEV_COMPLETE_EVT,            /*!< when extended advertising remove device complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_CLEAR_DEV_COMPLETE_EVT,             /*!< when extended advertising clear device, the event comes */
+    ESP_GAP_BLE_SET_EXT_SCAN_PARAMS_COMPLETE_EVT,                /*!< when extended scan parameter complete, the event comes */
+    ESP_GAP_BLE_EXT_SCAN_START_COMPLETE_EVT,                     /*!< when extended scan start complete, the event comes */
+    ESP_GAP_BLE_EXT_SCAN_STOP_COMPLETE_EVT,                      /*!< when extended scan stop complete, the event comes */
+    ESP_GAP_BLE_PREFER_EXT_CONN_PARAMS_SET_COMPLETE_EVT,         /*!< when extended prefer connection parameter set complete, the event comes */
+    ESP_GAP_BLE_PHY_UPDATE_COMPLETE_EVT,                         /*!< when ble phy update complete, the event comes */
+    ESP_GAP_BLE_EXT_ADV_REPORT_EVT,                              /*!< when extended advertising report complete, the event comes */
+    ESP_GAP_BLE_SCAN_TIMEOUT_EVT,                                /*!< when scan timeout complete, the event comes */
+    ESP_GAP_BLE_ADV_TERMINATED_EVT,                              /*!< when advertising terminate data complete, the event comes */
+    ESP_GAP_BLE_SCAN_REQ_RECEIVED_EVT,                           /*!< when scan req received complete, the event comes */
+    ESP_GAP_BLE_CHANNEL_SELECT_ALGORITHM_EVT,                    /*!< when channel select algorithm complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_REPORT_EVT,                         /*!< when periodic report advertising complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_LOST_EVT,                      /*!< when periodic advertising sync lost complete, the event comes */
+    ESP_GAP_BLE_PERIODIC_ADV_SYNC_ESTAB_EVT,                     /*!< when periodic advertising sync establish complete, the event comes */
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
-    ESP_GAP_BLE_EVT_MAX,
+    ESP_GAP_BLE_EVT_MAX,                                         /*!< when maximum advertising event complete, the event comes */
 } esp_gap_ble_cb_event_t;

-#define ESP_GAP_BLE_CHANNELS_LEN     5
+#define ESP_GAP_BLE_CHANNELS_LEN     5                           /*!< channel length*/
 typedef uint8_t esp_gap_ble_channels[ESP_GAP_BLE_CHANNELS_LEN];

 /// This is the old name, just for backwards compatibility
@@ -288,46 +286,47 @@ typedef enum {

 /* relate to BTA_DM_BLE_SEC_xxx in bta/bta_api.h */
 typedef enum {
-    ESP_BLE_SEC_ENCRYPT = 1,            /* relate to BTA_DM_BLE_SEC_ENCRYPT in bta/bta_api.h. If the device has already
-                                           bonded, the stack will used LTK to encrypt with the remote device directly.
+    ESP_BLE_SEC_ENCRYPT = 1,            /*!< relate to BTA_DM_BLE_SEC_ENCRYPT in bta/bta_api.h. If the device has already
+                                           bonded, the stack will used Long Term Key (LTK) to encrypt with the remote device directly.
                                           Else if the device hasn't bonded, the stack will used the default authentication request
                                           used the esp_ble_gap_set_security_param function set by the user. */
-    ESP_BLE_SEC_ENCRYPT_NO_MITM,        /* relate to BTA_DM_BLE_SEC_ENCRYPT_NO_MITM in bta/bta_api.h. If the device has already
-                                           bonded, the stack will check the LTK Whether the authentication request has been met, if met, used the LTK
-                                           to encrypt with the remote device directly, else Re-pair with the remote device.
-                                           Else if the device hasn't bonded, the stack will used NO MITM authentication request in the current link instead of
-                                           used the authreq in the esp_ble_gap_set_security_param function set by the user. */
-    ESP_BLE_SEC_ENCRYPT_MITM,           /* relate to BTA_DM_BLE_SEC_ENCRYPT_MITM in bta/bta_api.h. If the device has already
-                                           bonded, the stack will check the LTK Whether the authentication request has been met, if met, used the LTK
-                                           to encrypt with the remote device directly, else Re-pair with the remote device.
-                                           Else if the device hasn't bonded, the stack will used MITM authentication request in the current link instead of
-                                           used the authreq in the esp_ble_gap_set_security_param function set by the user. */
+    ESP_BLE_SEC_ENCRYPT_NO_MITM,        /*!< relate to BTA_DM_BLE_SEC_ENCRYPT_NO_MITM in bta/bta_api.h. If the device has been already
+                                           bonded, the stack will check the LTK (Long Term Key) Whether the authentication request has been met, and if met, use the LTK
+                                           to encrypt with the remote device directly, else re-pair with the remote device.
+                                           Else if the device hasn't been bonded, the stack will use NO MITM authentication request in the current link instead of
+                                           using the authreq in the esp_ble_gap_set_security_param function set by the user. */
+    ESP_BLE_SEC_ENCRYPT_MITM,           /*!< relate to BTA_DM_BLE_SEC_ENCRYPT_MITM in bta/bta_api.h. If the device has been already
+                                           bonded, the stack will check the LTK (Long Term Key) whether the authentication request has been met, and if met, use the LTK
+                                           to encrypt with the remote device directly, else re-pair with the remote device.
+                                           Else if the device hasn't been bonded, the stack will use MITM authentication request in the current link instead of
+                                           using the authreq in the esp_ble_gap_set_security_param function set by the user. */
 }esp_ble_sec_act_t;

 typedef enum {
    ESP_BLE_SM_PASSKEY = 0,
-    /* Authentication requirements of local device */
+    /*!< Authentication requirements of local device */
    ESP_BLE_SM_AUTHEN_REQ_MODE,
-    /* The IO capability of local device */
+    /*!< The IO capability of local device */
    ESP_BLE_SM_IOCAP_MODE,
-    /* Initiator Key Distribution/Generation */
+    /*!< Initiator Key Distribution/Generation */
    ESP_BLE_SM_SET_INIT_KEY,
-    /* Responder Key Distribution/Generation */
+    /*!< Responder Key Distribution/Generation */
    ESP_BLE_SM_SET_RSP_KEY,
-    /* Maximum Encryption key size to support */
+    /*!< Maximum Encryption key size to support */
    ESP_BLE_SM_MAX_KEY_SIZE,
-    /* Minimum Encryption key size requirement from Peer */
+    /*!< Minimum Encryption key size requirement from Peer */
    ESP_BLE_SM_MIN_KEY_SIZE,
-    /* Set static Passkey */
+    /*!< Set static Passkey */
    ESP_BLE_SM_SET_STATIC_PASSKEY,
-    /* Reset static Passkey */
+    /*!< Reset static Passkey */
    ESP_BLE_SM_CLEAR_STATIC_PASSKEY,
-    /* Accept only specified SMP Authentication requirement */
+    /*!< Accept only specified SMP Authentication requirement */
    ESP_BLE_SM_ONLY_ACCEPT_SPECIFIED_SEC_AUTH,
-    /* Enable/Disable OOB support */
+    /*!< Enable/Disable OOB support */
    ESP_BLE_SM_OOB_SUPPORT,
-    /* Appl encryption key size */
+    /*!< Appl encryption key size */
    ESP_BLE_APP_ENC_KEY_SIZE,
+    /*!< authentication max param */
    ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;

@@ -673,90 +672,97 @@ typedef uint8_t esp_duplicate_info_t[ESP_BD_ADDR_LEN];
 #endif //#if (BLE_42_FEATURE_SUPPORT == TRUE)

 #if (BLE_50_FEATURE_SUPPORT == TRUE)
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_NONCONN_NONSCANNABLE_UNDIRECTED      (0 << 0) // Non-Connectable and Non-Scannable Undirected advertising
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE                          (1 << 0) // Connectable advertising
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_SCANNABLE                            (1 << 1) // Scannable advertising
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_DIRECTED                             (1 << 2) // Directed advertising
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_HD_DIRECTED                          (1 << 3) // High Duty Cycle Directed Connectable advertising (<= 3.75 ms Advertising Interval)
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY                               (1 << 4) // Use legacy advertising PDUs
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_ANON_ADV                             (1 << 5) // Omit advertiser's address from all PDUs ("anonymous advertising")
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_INCLUDE_TX_PWR                       (1 << 6) // Include TxPower in the extended header of the advertising PDU
-#define ESP_BLE_GAP_SET_EXT_ADV_PROP_MASK                                 (0x7F)   // Reserved for future use
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_NONCONN_NONSCANNABLE_UNDIRECTED      (0 << 0) /*!< Non-Connectable and Non-Scannable Undirected advertising */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE                          (1 << 0) /*!< Connectable advertising */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_SCANNABLE                            (1 << 1) /*!< Scannable advertising */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_DIRECTED                             (1 << 2) /*!< Directed advertising */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_HD_DIRECTED                          (1 << 3) /*!< High Duty Cycle Directed Connectable advertising (<= 3.75 ms Advertising Interval) */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY                               (1 << 4) /*!< Use legacy advertising PDUs */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_ANON_ADV                             (1 << 5) /*!< Omit advertiser's address from all PDUs ("anonymous advertising") */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_INCLUDE_TX_PWR                       (1 << 6) /*!< Include TxPower in the extended header of the advertising PDU */
+#define ESP_BLE_GAP_SET_EXT_ADV_PROP_MASK                                 (0x7F)   /*!< Reserved for future use */

-/*  If extended advertising PDU types are being used (bit 4 = 0) then:
+/*!<  If extended advertising PDU types are being used (bit 4 = 0) then:
    The advertisement shall not be both connectable and scannable.
    High duty cycle directed connectable advertising (<= 3.75 ms advertising interval) shall not be used (bit 3 = 0)
 */
-// ADV_IND
+/*!< ADV_IND */
 #define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY_IND        (ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_SCANNABLE)
-// ADV_DIRECT_IND (low duty cycle)
+/*!< ADV_DIRECT_IND (low duty cycle) */
 #define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY_LD_DIR     (ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_DIRECTED)
-// ADV_DIRECT_IND (high duty cycle)
+/*!< ADV_DIRECT_IND (high duty cycle) */
 #define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY_HD_DIR     (ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_HD_DIRECTED)
-// ADV_SCAN_IND
+/*!< ADV_SCAN_IND */
 #define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY_SCAN       (ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY |\
                                                        ESP_BLE_GAP_SET_EXT_ADV_PROP_SCANNABLE)
-// ADV_NONCONN_IND
+/*!< ADV_NONCONN_IND */
 #define ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY_NONCONN    (ESP_BLE_GAP_SET_EXT_ADV_PROP_LEGACY)
 typedef uint16_t esp_ble_ext_adv_type_mask_t;

-#define ESP_BLE_GAP_PHY_1M                             1
-#define ESP_BLE_GAP_PHY_2M                             2
-#define ESP_BLE_GAP_PHY_CODED                          3
+#define ESP_BLE_GAP_PHY_1M                             1 /*!< Secondery Advertisement PHY is LE1M */
+#define ESP_BLE_GAP_PHY_2M                             2 /*!< Secondery Advertisement PHY is LE2M */
+#define ESP_BLE_GAP_PHY_CODED                          3 /*!< Secondery Advertisement PHY is LE Coded */
 typedef uint8_t esp_ble_gap_phy_t;

-#define ESP_BLE_GAP_NO_PREFER_TRANSMIT_PHY     (1<<0)
-#define ESP_BLE_GAP_NO_PREFER_RECEIVE_PHY      (1<<1)
+#define ESP_BLE_GAP_NO_PREFER_TRANSMIT_PHY     (1<<0) /*!< No Prefer TX PHY supported by controller */
+#define ESP_BLE_GAP_NO_PREFER_RECEIVE_PHY      (1<<1) /*!< No Prefer RX PHY supported by controller */
 typedef uint8_t esp_ble_gap_all_phys_t;

-// Primary phy only support 1M and LE coded phy
-#define ESP_BLE_GAP_PRI_PHY_1M     ESP_BLE_GAP_PHY_1M
-#define ESP_BLE_GAP_PRI_PHY_CODED  ESP_BLE_GAP_PHY_CODED
+/// Primary phy only support 1M and LE coded phy
+#define ESP_BLE_GAP_PRI_PHY_1M     ESP_BLE_GAP_PHY_1M     /*!< Primary Phy is LE1M */
+#define ESP_BLE_GAP_PRI_PHY_CODED  ESP_BLE_GAP_PHY_CODED  /*!< Primary Phy is LE CODED */
 typedef uint8_t esp_ble_gap_pri_phy_t; // primary phy

-#define ESP_BLE_GAP_PHY_1M_PREF_MASK                   (1 << 0)
-#define ESP_BLE_GAP_PHY_2M_PREF_MASK                   (1 << 1)
-#define ESP_BLE_GAP_PHY_CODED_PREF_MASK                (1 << 2)
+#define ESP_BLE_GAP_PHY_1M_PREF_MASK                   (1 << 0) /*!< The Host prefers use the LE1M transmitter or reciever PHY */
+#define ESP_BLE_GAP_PHY_2M_PREF_MASK                   (1 << 1) /*!< The Host prefers use the LE2M transmitter or reciever PHY */
+#define ESP_BLE_GAP_PHY_CODED_PREF_MASK                (1 << 2) /*!< The Host prefers use the LE CODED transmitter or reciever PHY */
 typedef uint8_t esp_ble_gap_phy_mask_t;

-#define ESP_BLE_GAP_PHY_OPTIONS_NO_PREF                  0 // The Host has no preferred coding when transmitting on the LE Coded PHY
-#define ESP_BLE_GAP_PHY_OPTIONS_PREF_S2_CODING           1 // The Host prefers that S=2 coding be used when transmitting on the LE Coded PHY
-#define ESP_BLE_GAP_PHY_OPTIONS_PREF_S8_CODING           2 // The Host prefers that S=8 coding be used when transmitting on the LE Coded PHY
+#define ESP_BLE_GAP_PHY_OPTIONS_NO_PREF                  0 /*!< The Host has no preferred coding when transmitting on the LE Coded PHY */
+#define ESP_BLE_GAP_PHY_OPTIONS_PREF_S2_CODING           1 /*!< The Host prefers that S=2 coding be used when transmitting on the LE Coded PHY */
+#define ESP_BLE_GAP_PHY_OPTIONS_PREF_S8_CODING           2 /*!< The Host prefers that S=8 coding be used when transmitting on the LE Coded PHY */
 typedef uint16_t esp_ble_gap_prefer_phy_options_t;

-#define ESP_BLE_GAP_EXT_SCAN_CFG_UNCODE_MASK           0x01
-#define ESP_BLE_GAP_EXT_SCAN_CFG_CODE_MASK             0x02
+#define ESP_BLE_GAP_EXT_SCAN_CFG_UNCODE_MASK           0x01 /*!< Scan Advertisements on the LE1M PHY */
+#define ESP_BLE_GAP_EXT_SCAN_CFG_CODE_MASK             0x02 /*!< Scan advertisements on the LE coded PHY */
 typedef uint8_t esp_ble_ext_scan_cfg_mask_t;

-#define ESP_BLE_GAP_EXT_ADV_DATA_COMPLETE              0x00
-#define ESP_BLE_GAP_EXT_ADV_DATA_INCOMPLETE            0x01
-#define ESP_BLE_GAP_EXT_ADV_DATA_TRUNCATED             0x02
+/// Advertising data
+#define ESP_BLE_GAP_EXT_ADV_DATA_COMPLETE              0x00 /*!< extended advertising data compete */
+#define ESP_BLE_GAP_EXT_ADV_DATA_INCOMPLETE            0x01 /*!< extended advertising data incomplete */
+#define ESP_BLE_GAP_EXT_ADV_DATA_TRUNCATED             0x02 /*!< extended advertising data truncated mode */
 typedef uint8_t esp_ble_gap_ext_adv_data_status_t;

-#define ESP_BLE_GAP_SYNC_POLICY_BY_ADV_INFO       0
-#define ESP_BLE_GAP_SYNC_POLICY_BY_PERIODIC_LIST  1
+/// Advertising SYNC policy
+#define ESP_BLE_GAP_SYNC_POLICY_BY_ADV_INFO       0 /*!< sync policy by advertising info */
+#define ESP_BLE_GAP_SYNC_POLICY_BY_PERIODIC_LIST  1 /*!< periodic advertising sync policy */
 typedef uint8_t esp_ble_gap_sync_t;

-/* Advertising report */
-#define ESP_BLE_ADV_REPORT_EXT_ADV_IND                    (1<<0)
-#define ESP_BLE_ADV_REPORT_EXT_SCAN_IND                   (1<<1)
-#define ESP_BLE_ADV_REPORT_EXT_DIRECT_ADV                 (1<<2)
-#define ESP_BLE_ADV_REPORT_EXT_SCAN_RSP                   (1<<3)
-/* Bluetooth 5.0, Vol 2, Part E, 7.7.65.13 */
-#define ESP_BLE_LEGACY_ADV_TYPE_IND                       (0x13)
-#define ESP_BLE_LEGACY_ADV_TYPE_DIRECT_IND                (0x15)
-#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_IND                  (0x12)
-#define ESP_BLE_LEGACY_ADV_TYPE_NONCON_IND                (0x10)
-#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_RSP_TO_ADV_IND       (0x1b)
-#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_RSP_TO_ADV_SCAN_IND  (0x1a)
+/// Advertising report
+#define ESP_BLE_ADV_REPORT_EXT_ADV_IND                    (1<<0) /*!< advertising report with extended advertising indication type */
+#define ESP_BLE_ADV_REPORT_EXT_SCAN_IND                   (1<<1) /*!< advertising report with extended scan indication type */
+#define ESP_BLE_ADV_REPORT_EXT_DIRECT_ADV                 (1<<2) /*!< advertising report with extended direct advertising indication type */
+#define ESP_BLE_ADV_REPORT_EXT_SCAN_RSP                   (1<<3) /*!< advertising report with extended scan response indication type */
+
+/*!< Bluetooth 5.0, Vol 2, Part E, 7.7.65.13 */
+#define ESP_BLE_LEGACY_ADV_TYPE_IND                       (0x13) /*!< advertising report with legacy advertising indication type */
+#define ESP_BLE_LEGACY_ADV_TYPE_DIRECT_IND                (0x15) /*!< advertising report with legacy direct indication type */
+#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_IND                  (0x12) /*!< advertising report with legacy scan indication type */
+#define ESP_BLE_LEGACY_ADV_TYPE_NONCON_IND                (0x10) /*!< advertising report with legacy non connectable indication type */
+#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_RSP_TO_ADV_IND       (0x1b) /*!< advertising report with legacy scan response indication type */
+#define ESP_BLE_LEGACY_ADV_TYPE_SCAN_RSP_TO_ADV_SCAN_IND  (0x1a) /*!< advertising report with legacy advertising with scan response indication type */
+
 typedef uint8_t esp_ble_gap_adv_type_t;

+/// Extend advertising tx power, range: [-127, +126] dBm
+#define EXT_ADV_TX_PWR_NO_PREFERENCE                      (127) /*!< host has no preference for tx power */
+
 /**
 * @brief ext adv parameters
 */
@@ -1754,8 +1760,8 @@ esp_err_t esp_ble_get_bond_device_list(int *dev_num, esp_ble_bond_dev_t *dev_lis
 *                  SMP in response to ESP_GAP_BLE_OOB_REQ_EVT
 *
 * @param[in]       bd_addr: BD address of the peer device.
-* @param[in]       TK: TK value, the TK value shall be a 128-bit random number
-* @param[in]       len: length of tk, should always be 128-bit
+* @param[in]       TK: Temporary Key value, the TK value shall be a 128-bit random number
+* @param[in]       len: length of temporary key, should always be 128-bit
 *
 * @return          - ESP_OK : success
 *                  - other  : failed
--- a/components/bt/host/bluedroid/api/include/api/esp_gatt_defs.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_gatt_defs.h
@@ -18,7 +18,7 @@ extern "C" {
 /// GATT INVALID HANDLE
 #define ESP_GATT_ILLEGAL_HANDLE             0
 /// GATT attribute max handle
-#define ESP_GATT_ATTR_HANDLE_MAX            100
+#define ESP_GATT_ATTR_HANDLE_MAX            UC_CONFIG_BT_GATT_MAX_SR_ATTRIBUTES
 #define ESP_GATT_MAX_READ_MULTI_HANDLES     10           /* Max attributes to read in one request */


--- a/components/bt/host/bluedroid/api/include/api/esp_gatts_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_gatts_api.h
@@ -351,7 +351,7 @@ esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
 */
 esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db,
                                            esp_gatt_if_t gatts_if,
-                                            uint8_t max_nb_attr,
+                                            uint16_t max_nb_attr,
                                            uint8_t srvc_inst_id);
 /**
 * @brief           This function is called to add an included service. This function have to be called between
--- a/components/bt/host/bluedroid/bta/av/bta_av_api.c
+++ b/components/bt/host/bluedroid/bta/av/bta_av_api.c
@@ -117,9 +117,8 @@ void BTA_AvRegister(tBTA_AV_CHNL chnl, const char *p_service_name, UINT8 app_id,
        p_buf->hdr.event = BTA_AV_API_REGISTER_EVT;
        if (p_service_name) {
            BCM_STRNCPY_S(p_buf->p_service_name, p_service_name, BTA_SERVICE_NAME_LEN);
-            p_buf->p_service_name[BTA_SERVICE_NAME_LEN - 1] = 0;
        } else {
-            p_buf->p_service_name[0] = 0;
+            p_buf->p_service_name[0] = '\0';
        }
        p_buf->app_id = app_id;
        p_buf->p_app_data_cback = p_data_cback;
@@ -307,9 +306,10 @@ void BTA_AvReconfig(tBTA_AV_HNDL hndl, BOOLEAN suspend, UINT8 sep_info_idx,
        p_buf->num_protect  = num_protect;
        p_buf->suspend      = suspend;
        p_buf->sep_info_idx = sep_info_idx;
-        p_buf->p_protect_info = (UINT8 *)(p_buf + 1);
        memcpy(p_buf->codec_info, p_codec_info, AVDT_CODEC_SIZE);
-        memcpy(p_buf->p_protect_info, p_protect_info, num_protect);
+        if (p_protect_info && num_protect) {
+            memcpy(p_buf->p_protect_info, p_protect_info, num_protect);
+        }
        bta_sys_sendmsg(p_buf);
    }
 }
--- a/components/bt/host/bluedroid/bta/av/bta_av_ci.c
+++ b/components/bt/host/bluedroid/bta/av/bta_av_ci.c
@@ -74,21 +74,17 @@ void bta_av_ci_setconfig(tBTA_AV_HNDL hndl, UINT8 err_code, UINT8 category,
 {
    tBTA_AV_CI_SETCONFIG  *p_buf;

-    if ((p_buf = (tBTA_AV_CI_SETCONFIG *) osi_malloc(sizeof(tBTA_AV_CI_SETCONFIG))) != NULL) {
+    if ((p_buf = (tBTA_AV_CI_SETCONFIG *) osi_malloc(sizeof(tBTA_AV_CI_SETCONFIG) + num_seid)) != NULL) {
        p_buf->hdr.layer_specific   = hndl;
        p_buf->hdr.event = (err_code == AVDT_SUCCESS) ?
                           BTA_AV_CI_SETCONFIG_OK_EVT : BTA_AV_CI_SETCONFIG_FAIL_EVT;
        p_buf->err_code = err_code;
        p_buf->category = category;
        p_buf->recfg_needed = recfg_needed;
-        p_buf->num_seid = num_seid;
        p_buf->avdt_handle = avdt_handle;
+        p_buf->num_seid = num_seid;
        if (p_seid && num_seid) {
-            p_buf->p_seid   = (UINT8 *)(p_buf + 1);
            memcpy(p_buf->p_seid, p_seid, num_seid);
-        } else {
-            p_buf->p_seid   = NULL;
-            p_buf->num_seid = 0;
        }

        bta_sys_sendmsg(p_buf);
--- a/components/bt/host/bluedroid/bta/av/bta_av_main.c
+++ b/components/bt/host/bluedroid/bta/av/bta_av_main.c
@@ -474,6 +474,7 @@ static void bta_av_api_sink_enable(tBTA_AV_DATA *p_data)
    APPL_TRACE_DEBUG("bta_av_api_sink_enable %d \n", activate_sink)
    char p_service_name[BTA_SERVICE_NAME_LEN + 1];
    BCM_STRNCPY_S(p_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    p_service_name[BTA_SERVICE_NAME_LEN] = '\0';

    if (activate_sink) {
        AVDT_SINK_Activate();
@@ -537,6 +538,7 @@ static void bta_av_api_register(tBTA_AV_DATA *p_data)
    UINT8           index = 0;
    char p_avk_service_name[BTA_SERVICE_NAME_LEN + 1];
    BCM_STRNCPY_S(p_avk_service_name, BTIF_AVK_SERVICE_NAME, BTA_SERVICE_NAME_LEN);
+    p_avk_service_name[BTA_SERVICE_NAME_LEN] = '\0';

    memset(&cs, 0, sizeof(tAVDT_CS));

--- a/components/bt/host/bluedroid/bta/av/include/bta_av_int.h
+++ b/components/bt/host/bluedroid/bta/av/include/bta_av_int.h
@@ -264,10 +264,10 @@ typedef struct {
 typedef struct {
    BT_HDR              hdr;
    UINT8               codec_info[AVDT_CODEC_SIZE];    /* codec configuration */
-    UINT8               *p_protect_info;
-    UINT8               num_protect;
    BOOLEAN             suspend;
    UINT8               sep_info_idx;
+    UINT8               num_protect;
+    UINT8               p_protect_info[0];
 } tBTA_AV_API_RCFG;

 /* data type for BTA_AV_CI_SETCONFIG_OK_EVT and BTA_AV_CI_SETCONFIG_FAIL_EVT */
@@ -276,10 +276,10 @@ typedef struct {
    tBTA_AV_HNDL        hndl;
    UINT8               err_code;
    UINT8               category;
-    UINT8               num_seid;
-    UINT8               *p_seid;
    BOOLEAN             recfg_needed;
    UINT8               avdt_handle;  /* local sep type for which this stream will be set up */
+    UINT8               num_seid;
+    UINT8               p_seid[0];
 } tBTA_AV_CI_SETCONFIG;

 /* data type for all stream events from AVDTP */
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
@@ -705,7 +705,7 @@ static BOOLEAN bta_dm_read_remote_device_name (BD_ADDR bd_addr, tBT_TRANSPORT tr
    APPL_TRACE_DEBUG("bta_dm_read_remote_device_name");

    bdcpy(bta_dm_search_cb.peer_bdaddr, bd_addr);
-    bta_dm_search_cb.peer_name[0] = 0;
+    bta_dm_search_cb.peer_name[0] = '\0';

    btm_status = BTM_ReadRemoteDeviceName (bta_dm_search_cb.peer_bdaddr,
                                           (tBTM_CMPL_CB *) bta_dm_remname_cback,
@@ -743,7 +743,7 @@ void bta_dm_read_rmt_name(tBTA_DM_MSG *p_data)
 {
    APPL_TRACE_DEBUG("%s",__func__);
    bdcpy(bta_dm_search_cb.peer_bdaddr, p_data->get_rmt_name.rmt_addr);
-    bta_dm_search_cb.peer_name[0] = 0;
+    bta_dm_search_cb.peer_name[0] = '\0';

    tBTM_STATUS  btm_status = BTM_ReadRemoteDeviceName(bta_dm_search_cb.peer_bdaddr,
                                                       (tBTM_CMPL_CB *) p_data->get_rmt_name.rmt_name_cb,
@@ -1621,7 +1621,7 @@ void bta_dm_discover (tBTA_DM_MSG *p_data)
    bta_dm_search_cb.services_to_search = bta_dm_search_cb.services;
    bta_dm_search_cb.service_index = 0;
    bta_dm_search_cb.services_found = 0;
-    bta_dm_search_cb.peer_name[0] = 0;
+    bta_dm_search_cb.peer_name[0] = '\0';
    bta_dm_search_cb.sdp_search = p_data->discover.sdp_search;
    bta_dm_search_cb.p_btm_inq_info = BTM_InqDbRead (p_data->discover.bd_addr);
    bta_dm_search_cb.transport = p_data->discover.transport;
@@ -1896,8 +1896,8 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                        if (SDP_FindServiceUUIDInRec(p_sdp_rec, &service_uuid)) {
                            /* send result back to app now, one by one */
                            bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN));
-                            result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
+                            BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+                            result.disc_ble_res.bd_name[BD_NAME_LEN] = '\0';
                            result.disc_ble_res.service.len = service_uuid.len;
                            result.disc_ble_res.service.uu.uuid16 = service_uuid.uu.uuid16;

@@ -2037,10 +2037,8 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)

                }
                bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
-
-                /* make sure the string is null terminated */
-                p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
+                BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+                p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN] = '\0';

                bta_sys_sendmsg(p_msg);
            }
@@ -2063,10 +2061,8 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
            p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
-
-            /* make sure the string is null terminated */
-            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN] = '\0';

            bta_sys_sendmsg(p_msg);
        }
@@ -2447,10 +2443,8 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
            p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
-
-            /* make sure the string is terminated */
-            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,bta_dm_get_remname(), BD_NAME_LEN);
+            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN] = '\0';

            bta_sys_sendmsg(p_msg);
        }
@@ -2632,10 +2626,8 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
        p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
        p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
        bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,(char *)bta_dm_search_cb.peer_name, (BD_NAME_LEN - 1));
-
-        /* make sure the string is terminated */
-        p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
+        BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+        p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN] = '\0';

        bta_sys_sendmsg(p_msg);
    }
@@ -2772,11 +2764,11 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
    /* if this is what we are looking for */
    if (!bdcmp( bta_dm_search_cb.peer_bdaddr, bd_addr)) {
        rem_name.length = strlen((char *)bd_name);
-        if (rem_name.length > (BD_NAME_LEN - 1)) {
-            rem_name.length = (BD_NAME_LEN - 1);
-            rem_name.remote_bd_name[(BD_NAME_LEN - 1)] = 0;
+        if (rem_name.length > BD_NAME_LEN) {
+            rem_name.length = BD_NAME_LEN;
        }
-        BCM_STRNCPY_S((char *)rem_name.remote_bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
+        BCM_STRNCPY_S((char *)rem_name.remote_bd_name, (char *)bd_name, BD_NAME_LEN);
+        rem_name.remote_bd_name[BD_NAME_LEN] = '\0';
        rem_name.status = BTM_SUCCESS;

        bta_dm_remname_cback(&rem_name);
@@ -2793,7 +2785,7 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
            APPL_TRACE_WARNING("bta_dm_service_search_remname_cback: BTM_ReadRemoteDeviceName returns 0x%02X", btm_status);

            rem_name.length = 0;
-            rem_name.remote_bd_name[0] = 0;
+            rem_name.remote_bd_name[0] = '\0';
            rem_name.status = btm_status;
            bta_dm_remname_cback(&rem_name);
        }
@@ -2818,8 +2810,8 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
                     p_remote_name->remote_bd_name);
    /* remote name discovery is done but it could be failed */
    bta_dm_search_cb.name_discover_done = TRUE;
-    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name, (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
-    bta_dm_search_cb.peer_name[BD_NAME_LEN] = 0;
+    BCM_STRNCPY_S((char *)bta_dm_search_cb.peer_name, (char *)p_remote_name->remote_bd_name, BD_NAME_LEN);
+    bta_dm_search_cb.peer_name[BD_NAME_LEN] = '\0';

    BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);

@@ -2831,10 +2823,8 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)

    if ((p_msg = (tBTA_DM_REM_NAME *) osi_malloc(sizeof(tBTA_DM_REM_NAME))) != NULL) {
        bdcpy (p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, (char *)p_remote_name->remote_bd_name, (BD_NAME_LEN));
-
-        /* make sure the string is null terminated */
-        p_msg->result.disc_res.bd_name[BD_NAME_LEN] = 0;
+        BCM_STRNCPY_S((char *)p_msg->result.disc_res.bd_name, (char *)p_remote_name->remote_bd_name, BD_NAME_LEN);
+        p_msg->result.disc_res.bd_name[BD_NAME_LEN] = '\0';

        p_msg->hdr.event = BTA_DM_REMT_NAME_EVT;
        bta_sys_sendmsg(p_msg);
@@ -2862,10 +2852,8 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
    bdcpy(sec_event.authorize.bd_addr, bd_addr);
    memcpy(sec_event.authorize.dev_class, dev_class, DEV_CLASS_LEN);

-    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
-
-    /* make sure the string is null terminated */
-    sec_event.authorize.bd_name[BD_NAME_LEN - 1] = 0;
+    BCM_STRNCPY_S((char *)sec_event.authorize.bd_name, (char *)bd_name, BD_NAME_LEN);
+    sec_event.authorize.bd_name[BD_NAME_LEN] = '\0';

 #if ( defined(BTA_JV_INCLUDED) && BTA_JV_INCLUDED == TRUE )
    sec_event.authorize.service = service_id;
@@ -2911,7 +2899,6 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
 {
    tBTM_REMOTE_DEV_NAME *p_result = (tBTM_REMOTE_DEV_NAME *)p_data;
    tBTA_DM_SEC           sec_event;
-    UINT32                bytes_to_copy;
    tBTA_DM_SEC_EVT       event = bta_dm_cb.pin_evt;

    if (BTA_DM_SP_CFM_REQ_EVT == event) {
@@ -2920,15 +2907,13 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
        BTA_COPY_DEVICE_CLASS(sec_event.cfm_req.dev_class, bta_dm_cb.pin_dev_class);

        if (p_result && p_result->status == BTM_SUCCESS) {
-            bytes_to_copy = (p_result->length < (BD_NAME_LEN - 1))
-                            ? p_result->length : (BD_NAME_LEN - 1);
-            memcpy(sec_event.cfm_req.bd_name, p_result->remote_bd_name, bytes_to_copy);
-            sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
+            BCM_STRNCPY_S((char *)sec_event.cfm_req.bd_name, (char *)p_result->remote_bd_name, BD_NAME_LEN);
+            sec_event.cfm_req.bd_name[BD_NAME_LEN] = '\0';
        } else { /* No name found */
-            sec_event.cfm_req.bd_name[0] = 0;
+            sec_event.cfm_req.bd_name[0] = '\0';
        }

-        sec_event.key_notif.passkey    = bta_dm_cb.num_val; /* get PIN code numeric number */
+        sec_event.cfm_req.num_val    = bta_dm_cb.num_val; /* get PIN code numeric number */

        /* 1 additional event data fields for this event */
        sec_event.cfm_req.just_works = bta_dm_cb.just_works;
@@ -2938,12 +2923,10 @@ static UINT8 bta_dm_authorize_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NA
        BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, bta_dm_cb.pin_dev_class);

        if (p_result && p_result->status == BTM_SUCCESS) {
-            bytes_to_copy = (p_result->length < (BD_NAME_LEN - 1))
-                            ? p_result->length : (BD_NAME_LEN - 1);
-            memcpy(sec_event.pin_req.bd_name, p_result->remote_bd_name, bytes_to_copy);
-            sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
+            BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)p_result->remote_bd_name, BD_NAME_LEN);
+            sec_event.pin_req.bd_name[BD_NAME_LEN] = '\0';
        } else { /* No name found */
-            sec_event.pin_req.bd_name[0] = 0;
+            sec_event.pin_req.bd_name[0] = '\0';
        }

        event = bta_dm_cb.pin_evt;
@@ -2976,8 +2959,8 @@ static UINT8 bta_dm_pin_cback (BD_ADDR bd_addr, DEV_CLASS dev_class, BD_NAME bd_

    bdcpy(sec_event.pin_req.bd_addr, bd_addr);
    BTA_COPY_DEVICE_CLASS(sec_event.pin_req.dev_class, dev_class);
-    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)bd_name, (BD_NAME_LEN - 1));
-    sec_event.pin_req.bd_name[BD_NAME_LEN - 1] = 0;
+    BCM_STRNCPY_S((char *)sec_event.pin_req.bd_name, (char *)bd_name, BD_NAME_LEN);
+    sec_event.pin_req.bd_name[BD_NAME_LEN] = '\0';
    sec_event.pin_req.min_16_digit = min_16_digit;

    bta_dm_cb.p_sec_cback(BTA_DM_PIN_REQ_EVT, &sec_event);
@@ -3151,8 +3134,8 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
                   copy these values into key_notif from cfm_req */
                bdcpy(sec_event.key_notif.bd_addr, p_data->cfm_req.bd_addr);
                BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->cfm_req.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->cfm_req.bd_name, (BD_NAME_LEN - 1));
-                sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->cfm_req.bd_name, BD_NAME_LEN);
+                sec_event.key_notif.bd_name[BD_NAME_LEN] = '\0';
            }
        }

@@ -3172,8 +3155,8 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
            } else {
                bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
-                sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, (char *)p_data->key_notif.bd_name, BD_NAME_LEN);
+                sec_event.key_notif.bd_name[BD_NAME_LEN] = '\0';
            }
        }

@@ -3193,8 +3176,8 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
            } else {
                bdcpy(sec_event.key_notif.bd_addr, p_data->key_notif.bd_addr);
                BTA_COPY_DEVICE_CLASS(sec_event.key_notif.dev_class, p_data->key_notif.dev_class);
-                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,(char *)p_data->key_notif.bd_name, (BD_NAME_LEN - 1));
-                sec_event.key_notif.bd_name[BD_NAME_LEN - 1] = 0;
+                BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,(char *)p_data->key_notif.bd_name, BD_NAME_LEN);
+                sec_event.key_notif.bd_name[BD_NAME_LEN] = '\0';
            }
        }
        bta_dm_cb.p_sec_cback(pin_evt, &sec_event);
@@ -3222,8 +3205,8 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)

        bdcpy(sec_event.rmt_oob.bd_addr, p_data->rmt_oob.bd_addr);
        BTA_COPY_DEVICE_CLASS(sec_event.rmt_oob.dev_class, p_data->rmt_oob.dev_class);
-        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, (char *)p_data->rmt_oob.bd_name, (BD_NAME_LEN - 1));
-        sec_event.rmt_oob.bd_name[BD_NAME_LEN - 1] = 0;
+        BCM_STRNCPY_S((char *)sec_event.rmt_oob.bd_name, (char *)p_data->rmt_oob.bd_name, BD_NAME_LEN);
+        sec_event.rmt_oob.bd_name[BD_NAME_LEN] = '\0';

        bta_dm_cb.p_sec_cback(BTA_DM_SP_RMT_OOB_EVT, &sec_event);

@@ -4656,11 +4639,11 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
        bdcpy(sec_event.ble_req.bd_addr, bda);
        p_name = BTM_SecReadDevName(bda);
        if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name,p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.ble_req.bd_name, p_name, BD_NAME_LEN);
+            sec_event.ble_req.bd_name[BD_NAME_LEN] = '\0';
        } else {
-            sec_event.ble_req.bd_name[0] = 0;
+            sec_event.ble_req.bd_name[0] = '\0';
        }
-        sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
        bta_dm_cb.p_sec_cback(BTA_DM_BLE_SEC_REQ_EVT, &sec_event);
        break;

@@ -4668,11 +4651,11 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
        bdcpy(sec_event.key_notif.bd_addr, bda);
        p_name = BTM_SecReadDevName(bda);
        if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name, p_name, BD_NAME_LEN);
+            sec_event.key_notif.bd_name[BD_NAME_LEN] = '\0';
        } else {
-            sec_event.key_notif.bd_name[0] = 0;
+            sec_event.key_notif.bd_name[0] = '\0';
        }
-        sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
        sec_event.key_notif.passkey = p_data->key_notif;
        bta_dm_cb.p_sec_cback(BTA_DM_BLE_PASSKEY_NOTIF_EVT, &sec_event);
        break;
@@ -4689,8 +4672,8 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D

    case BTM_LE_NC_REQ_EVT:
        bdcpy(sec_event.key_notif.bd_addr, bda);
-        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,bta_dm_get_remname(), (BD_NAME_LEN));
-        sec_event.ble_req.bd_name[BD_NAME_LEN] = 0;
+        BCM_STRNCPY_S((char *)sec_event.key_notif.bd_name,bta_dm_get_remname(), BD_NAME_LEN);
+        sec_event.key_notif.bd_name[BD_NAME_LEN] = '\0';
        sec_event.key_notif.passkey = p_data->key_notif;
        bta_dm_cb.p_sec_cback(BTA_DM_BLE_NC_REQ_EVT, &sec_event);
        break;
@@ -4709,9 +4692,10 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
 #endif
        p_name = BTM_SecReadDevName(bda);
        if (p_name != NULL) {
-            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name, p_name, (BD_NAME_LEN));
+            BCM_STRNCPY_S((char *)sec_event.auth_cmpl.bd_name, p_name, BD_NAME_LEN);
+            sec_event.auth_cmpl.bd_name[BD_NAME_LEN] = '\0';
        } else {
-            sec_event.auth_cmpl.bd_name[0] = 0;
+            sec_event.auth_cmpl.bd_name[0] = '\0';
        }
        if (p_data->complt.reason != 0) {
            sec_event.auth_cmpl.fail_reason = BTA_DM_AUTH_CONVERT_SMP_CODE(((UINT8)p_data->complt.reason));
@@ -6197,8 +6181,8 @@ static void bta_dm_gatt_disc_result(tBTA_GATT_ID service_id)

        /* send result back to app now, one by one */
        bdcpy (result.disc_ble_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), (BD_NAME_LEN - 1));
-        result.disc_ble_res.bd_name[BD_NAME_LEN] = 0;
+        BCM_STRNCPY_S((char *)result.disc_ble_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+        result.disc_ble_res.bd_name[BD_NAME_LEN] = '\0';
        memcpy(&result.disc_ble_res.service, &service_id.uuid, sizeof(tBT_UUID));

        bta_dm_search_cb.p_search_cback(BTA_DM_DISC_BLE_RES_EVT, &result);
@@ -6240,10 +6224,8 @@ static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status)
            p_msg->disc_result.result.disc_res.num_uuids = 0;
            p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name,bta_dm_get_remname(), (BD_NAME_LEN - 1));
-
-            /* make sure the string is terminated */
-            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN - 1] = 0;
+            BCM_STRNCPY_S((char *)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
+            p_msg->disc_result.result.disc_res.bd_name[BD_NAME_LEN] = '\0';

            p_msg->disc_result.result.disc_res.device_type |= BT_DEVICE_TYPE_BLE;
            if ( bta_dm_search_cb.ble_raw_used > 0 ) {
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
@@ -174,8 +174,8 @@ void BTA_DmSetDeviceName(const char *p_name)
    if ((p_msg = (tBTA_DM_API_SET_NAME *) osi_malloc(sizeof(tBTA_DM_API_SET_NAME))) != NULL) {
        p_msg->hdr.event = BTA_DM_API_SET_NAME_EVT;
        /* truncate the name if needed */
-        BCM_STRNCPY_S((char *)p_msg->name, p_name, BD_NAME_LEN - 1);
-        p_msg->name[BD_NAME_LEN - 1] = 0;
+        BCM_STRNCPY_S((char *)p_msg->name, p_name, BD_NAME_LEN);
+        p_msg->name[BD_NAME_LEN] = '\0';

        bta_sys_sendmsg(p_msg);
    }
@@ -2820,6 +2820,7 @@ void BTA_DmBleGapExtAdvSetRemove(UINT8 instance)
    if ((p_msg = (tBTA_DM_API_BLE_EXT_ADV_SET_REMOVE *) osi_malloc(sizeof(tBTA_DM_API_BLE_EXT_ADV_SET_REMOVE))) != NULL) {
        memset(p_msg, 0, sizeof(tBTA_DM_API_BLE_EXT_ADV_SET_REMOVE));
        p_msg->hdr.event = BTA_DM_API_EXT_ADV_SET_REMOVE_EVT;
+        p_msg->instance = instance;
        //start sent the msg to the bta system control moudle
        bta_sys_sendmsg(p_msg);
    } else {
--- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c
+++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c
@@ -541,7 +541,6 @@ void bta_gattc_start_disc_char_dscp(UINT16 conn_id, tBTA_GATTC_SERV *p_srvc_cb)
    if (bta_gattc_discover_procedure(conn_id, p_srvc_cb, GATT_DISC_CHAR_DSCPT) != 0) {
        bta_gattc_char_dscpt_disc_cmpl(conn_id, p_srvc_cb);
    }
-
 }

 void bta_gattc_update_include_service(const list_t *services) {
@@ -693,7 +692,9 @@ static void bta_gattc_char_dscpt_disc_cmpl(UINT16 conn_id, tBTA_GATTC_SERV *p_sr
 {
    tBTA_GATTC_ATTR_REC *p_rec = NULL;

-    if (--p_srvc_cb->total_char > 0) {
+    /* Recursive function will cause BTU stack overflow when there are a large number of characteristic
+     * without descriptor to discover. So replace it with while function */
+    while (--p_srvc_cb->total_char > 0) {
        p_rec = p_srvc_cb->p_srvc_list + (++ p_srvc_cb->cur_char_idx);
        /* add the next characteristic into cache */
        bta_gattc_add_char_to_cache (p_srvc_cb,
@@ -701,11 +702,14 @@ static void bta_gattc_char_dscpt_disc_cmpl(UINT16 conn_id, tBTA_GATTC_SERV *p_sr
                                     p_rec->s_handle,
                                     &p_rec->uuid,
                                     p_rec->property);
+        /* start to discover next characteristic for descriptor */
+        if (bta_gattc_discover_procedure(conn_id, p_srvc_cb, GATT_DISC_CHAR_DSCPT) == 0) {
+            /* send att req and wait for att rsp */
+            break;
+        }
+    }

-        /* start discoverying next characteristic for char descriptor */
-        bta_gattc_start_disc_char_dscp(conn_id, p_srvc_cb);
-    } else
-        /* all characteristic has been explored, start with next service if any */
+    if (p_srvc_cb->total_char == 0) /* all characteristic has been explored, start with next service if any */
    {
 #if (defined BTA_GATT_DEBUG && BTA_GATT_DEBUG == TRUE)
        APPL_TRACE_ERROR("all char has been explored");
@@ -772,7 +776,7 @@ static tBTA_GATT_STATUS bta_gattc_add_srvc_to_list(tBTA_GATTC_SERV *p_srvc_cb,
        /* allocate bigger buffer ?? */
        status = GATT_DB_FULL;

-        APPL_TRACE_ERROR("service not added, no resources or wrong state");
+        APPL_TRACE_ERROR("service not added, no resources or wrong state, see CONFIG_BT_GATTC_MAX_CACHE_CHAR");
    }
    return status;
 }
@@ -814,7 +818,7 @@ static tBTA_GATT_STATUS bta_gattc_add_char_to_list(tBTA_GATTC_SERV *p_srvc_cb,
        }
        p_srvc_cb->next_avail_idx ++;
    } else {
-        APPL_TRACE_ERROR("char not added, no resources");
+        APPL_TRACE_ERROR("char not added, no resources, see CONFIG_BT_GATTC_MAX_CACHE_CHAR");
        /* allocate bigger buffer ?? */
        status = BTA_GATT_DB_FULL;
    }
--- a/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h
+++ b/components/bt/host/bluedroid/bta/gatt/include/bta_gattc_int.h
@@ -270,7 +270,6 @@ typedef struct {
 } tBTA_GATTC_ATTR_REC;


-#define BTA_GATTC_MAX_CACHE_CHAR    40
 #define BTA_GATTC_ATTR_LIST_SIZE    (BTA_GATTC_MAX_CACHE_CHAR * sizeof(tBTA_GATTC_ATTR_REC))

 #ifndef BTA_GATTC_CACHE_SRVR_SIZE
@@ -305,10 +304,10 @@ typedef struct {

    tBTA_GATTC_ATTR_REC *p_srvc_list;
    UINT8               cur_srvc_idx;
-    UINT8               cur_char_idx;
-    UINT8               next_avail_idx;
+    UINT16               cur_char_idx;
+    UINT16               next_avail_idx;
    UINT8               total_srvc;
-    UINT8               total_char;
+    UINT16               total_char;
    UINT16              total_attr;
    UINT8               srvc_hdl_chg;   /* service handle change indication pending */
    UINT16              attr_index;     /* cahce NV saving/loading attribute index */
--- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c
+++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_api.c
@@ -123,9 +123,9 @@ void BTA_AgRegister(tBTA_SERVICE_MASK services, tBTA_SEC sec_mask,tBTA_AG_FEAT f
        for (i = 0; i < BTA_AG_NUM_IDX; i++) {
            if(p_service_names[i]) {
                BCM_STRNCPY_S(p_buf->p_name[i], p_service_names[i], BTA_SERVICE_NAME_LEN);
-                p_buf->p_name[i][BTA_SERVICE_NAME_LEN] = 0;
+                p_buf->p_name[i][BTA_SERVICE_NAME_LEN] = '\0';
            } else {
-                p_buf->p_name[i][0] = 0;
+                p_buf->p_name[i][0] = '\0';
            }
        }
        bta_sys_sendmsg(p_buf);
--- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c
+++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_cmd.c
@@ -798,7 +798,7 @@ void bta_ag_at_hsp_cback(tBTA_AG_SCB *p_scb, UINT16 cmd, UINT8 arg_type,
    val.hdr.app_id = p_scb->app_id;
    val.num = (UINT16) int_arg;
    BCM_STRNCPY_S(val.str, p_arg, BTA_AG_AT_MAX_LEN);
-    val.str[BTA_AG_AT_MAX_LEN] = 0;
+    val.str[BTA_AG_AT_MAX_LEN] = '\0';
    /* call callback with event */
    (*bta_ag_cb.p_cback)(bta_ag_hsp_cb_evt[cmd], (tBTA_AG *) &val);
 }
@@ -836,7 +836,7 @@ void bta_ag_at_hfp_cback(tBTA_AG_SCB *p_scb, UINT16 cmd, UINT8 arg_type,
    val.num = int_arg;
    bdcpy(val.bd_addr, p_scb->peer_addr);
    BCM_STRNCPY_S(val.str, p_arg, BTA_AG_AT_MAX_LEN);
-    val.str[BTA_AG_AT_MAX_LEN] = 0;
+    val.str[BTA_AG_AT_MAX_LEN] = '\0';
    event = bta_ag_hfp_cb_evt[cmd];

    switch (cmd)
@@ -1212,7 +1212,7 @@ void bta_ag_at_err_cback(tBTA_AG_SCB *p_scb, BOOLEAN unknown, char *p_arg)
        val.hdr.app_id = p_scb->app_id;
        val.num = 0;
        BCM_STRNCPY_S(val.str, p_arg, BTA_AG_AT_MAX_LEN);
-        val.str[BTA_AG_AT_MAX_LEN] = 0;
+        val.str[BTA_AG_AT_MAX_LEN] = '\0';
        (*bta_ag_cb.p_cback)(BTA_AG_AT_UNAT_EVT, (tBTA_AG *) &val);
    } else {
        bta_ag_send_error(p_scb, BTA_AG_ERR_OP_NOT_SUPPORTED);
@@ -1357,7 +1357,7 @@ void bta_ag_hfp_result(tBTA_AG_SCB *p_scb, tBTA_AG_API_RESULT *p_result)
                }
            }
            APPL_TRACE_DEBUG("CLIP type :%d", p_result->data.num);
-            p_scb->clip[0] = 0;
+            p_scb->clip[0] = '\0';
            if (p_result->data.str[0] != 0) {
                snprintf(p_scb->clip, sizeof(p_scb->clip), "%s,%d", p_result->data.str, p_result->data.num);
            }
--- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c
+++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c
@@ -142,7 +142,7 @@ void BTA_HfClientRegister(tBTA_SEC sec_mask, tBTA_HF_CLIENT_FEAT features,
        p_buf->sec_mask = sec_mask;
        if (p_service_name) {
            BCM_STRNCPY_S(p_buf->name, p_service_name, BTA_SERVICE_NAME_LEN);
-            p_buf->name[BTA_SERVICE_NAME_LEN] = 0;
+            p_buf->name[BTA_SERVICE_NAME_LEN] = '\0';
        } else {
            p_buf->name[0] = '\0';
        }
--- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h
+++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h
@@ -1469,7 +1469,7 @@ typedef struct {
    tBLE_ADDR_TYPE peer_addr_type;
    BD_ADDR peer_addr;
    tBTA_BLE_AFP filter_policy;
-    UINT8 tx_power;
+    INT8 tx_power;
    tBTA_DM_BLE_GAP_PHY primary_phy;
    UINT8 max_skip;
    tBTA_DM_BLE_GAP_PHY secondary_phy;
--- a/components/bt/host/bluedroid/btc/core/btc_dm.c
+++ b/components/bt/host/bluedroid/btc/core/btc_dm.c
@@ -104,7 +104,8 @@ void btc_dm_sec_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *data)
    msg.pid = BTC_PID_DM_SEC;
    msg.act = event;

-    btc_transfer_context(&msg, (btc_dm_sec_args_t *)data, sizeof(btc_dm_sec_args_t), btc_dm_sec_arg_deep_copy);
+    btc_transfer_context(&msg, (btc_dm_sec_args_t *)data,
+                            data == NULL ? 0 : sizeof(btc_dm_sec_args_t), btc_dm_sec_arg_deep_copy);
 }

 static void btc_enable_bluetooth_evt(tBTA_STATUS status)
--- a/components/bt/host/bluedroid/btc/core/btc_main.c
+++ b/components/bt/host/bluedroid/btc/core/btc_main.c
@@ -74,9 +74,6 @@ static void btc_deinit_bluetooth(void)
 #if BTA_DYNAMIC_MEMORY
    xSemaphoreTake(deinit_semaphore, BTA_DISABLE_DELAY / portTICK_PERIOD_MS);
 #endif /* #if BTA_DYNAMIC_MEMORY */
-#if (BLE_INCLUDED == TRUE)
-    btc_gap_ble_deinit();
-#endif  ///BLE_INCLUDED == TRUE
    bta_dm_sm_deinit();
 #if (GATTC_INCLUDED)
    bta_gattc_deinit();
--- a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c
+++ b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_sink.c
@@ -16,7 +16,6 @@
 #include "common/bt_defs.h"
 #include "osi/allocator.h"
 #include "osi/mutex.h"
-#include "osi/semaphore.h"
 #include "osi/thread.h"
 #include "osi/fixed_queue.h"
 #include "stack/a2d_api.h"
@@ -38,8 +37,6 @@

 #if (BTC_AV_SINK_INCLUDED == TRUE)

-extern osi_thread_t *btc_thread;
-
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -82,6 +79,8 @@ enum {
 #define MAX_OUTPUT_A2DP_SNK_FRAME_QUEUE_SZ     (25)
 #define JITTER_BUFFER_WATER_LEVEL (5)

+#define BTC_A2DP_SNK_DATA_QUEUE_IDX            (1)
+
 typedef struct {
    uint32_t sig;
    void *param;
@@ -97,7 +96,7 @@ typedef struct {
 typedef struct {
    BOOLEAN rx_flush; /* discards any incoming data when true */
    UINT8   channel_count;
-    osi_sem_t post_sem;
+    struct osi_event *data_ready_event;
    fixed_queue_t *RxSbcQ;
    UINT32  sample_rate;
 } tBTC_A2DP_SINK_CB;
@@ -214,7 +213,7 @@ bool btc_a2dp_sink_startup(void)

    APPL_TRACE_EVENT("## A2DP SINK START MEDIA THREAD ##");

-    a2dp_sink_local_param.btc_aa_snk_task_hdl = btc_thread;
+    a2dp_sink_local_param.btc_aa_snk_task_hdl = btc_get_current_thread();

    if (btc_a2dp_sink_ctrl(BTC_MEDIA_TASK_SINK_INIT, NULL) == false) {
        goto error_exit;
@@ -294,11 +293,6 @@ void btc_a2dp_sink_on_suspended(tBTA_AV_SUSPEND *p_av)
    return;
 }

-static void btc_a2dp_sink_data_post(void)
-{
-    osi_thread_post(a2dp_sink_local_param.btc_aa_snk_task_hdl, btc_a2dp_sink_data_ready, NULL, 1, OSI_THREAD_MAX_TIMEOUT);
-}
-
 /*******************************************************************************
 **
 ** Function         btc_a2dp_sink_clear_track
@@ -356,7 +350,6 @@ static void btc_a2dp_sink_data_ready(UNUSED_ATTR void *context)
    tBT_SBC_HDR *p_msg;
    int nb_of_msgs_to_process = 0;

-    osi_sem_give(&a2dp_sink_local_param.btc_aa_snk_cb.post_sem);
    if (fixed_queue_is_empty(a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ)) {
        APPL_TRACE_DEBUG("  QUE  EMPTY ");
    } else {
@@ -380,6 +373,10 @@ static void btc_a2dp_sink_data_ready(UNUSED_ATTR void *context)
            nb_of_msgs_to_process--;
        }
        APPL_TRACE_DEBUG(" Process Frames - ");
+
+        if (!fixed_queue_is_empty(a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ)) {
+            osi_thread_post_event(a2dp_sink_local_param.btc_aa_snk_cb.data_ready_event, OSI_THREAD_MAX_TIMEOUT);
+        }
    }
 }

@@ -418,7 +415,8 @@ static void btc_a2dp_sink_handle_decoder_reset(tBTC_MEDIA_SINK_CFG_UPDATE *p_msg
    a2dp_sink_local_param.btc_aa_snk_cb.rx_flush = FALSE;
    APPL_TRACE_EVENT("Reset to sink role");
    status = OI_CODEC_SBC_DecoderReset(&a2dp_sink_local_param.context, a2dp_sink_local_param.contextData,
-                                        sizeof(a2dp_sink_local_param.contextData), 2, 2, FALSE, FALSE);
+                                        sizeof(a2dp_sink_local_param.contextData), a2dp_sink_local_param.btc_aa_snk_cb.channel_count,
+                                        a2dp_sink_local_param.btc_aa_snk_cb.channel_count, FALSE, FALSE);
    if (!OI_SUCCESS(status)) {
        APPL_TRACE_ERROR("OI_CODEC_SBC_DecoderReset failed with error code %d\n", status);
    }
@@ -691,9 +689,7 @@ UINT8 btc_a2dp_sink_enque_buf(BT_HDR *p_pkt)
        APPL_TRACE_VERBOSE("btc_a2dp_sink_enque_buf %d + \n", p_msg->num_frames_to_be_processed);
        fixed_queue_enqueue(a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ, p_msg, FIXED_QUEUE_MAX_TIMEOUT);
        if (fixed_queue_length(a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ) >= JITTER_BUFFER_WATER_LEVEL) {
-            if (osi_sem_take(&a2dp_sink_local_param.btc_aa_snk_cb.post_sem, 0) == 0) {
-                btc_a2dp_sink_data_post();
-            }
+            osi_thread_post_event(a2dp_sink_local_param.btc_aa_snk_cb.data_ready_event, OSI_THREAD_MAX_TIMEOUT);
        }
    } else {
        /* let caller deal with a failed allocation */
@@ -729,9 +725,12 @@ static void btc_a2dp_sink_thread_init(UNUSED_ATTR void *context)
    memset(&a2dp_sink_local_param.btc_aa_snk_cb, 0, sizeof(a2dp_sink_local_param.btc_aa_snk_cb));

    btc_a2dp_sink_state = BTC_A2DP_SINK_STATE_ON;
-    if (!a2dp_sink_local_param.btc_aa_snk_cb.post_sem) {
-        osi_sem_new(&a2dp_sink_local_param.btc_aa_snk_cb.post_sem, 1, 1);
-    }
+
+    struct osi_event *data_event = osi_event_create(btc_a2dp_sink_data_ready, NULL);
+    assert (data_event != NULL);
+    osi_event_bind(data_event, a2dp_sink_local_param.btc_aa_snk_task_hdl, BTC_A2DP_SNK_DATA_QUEUE_IDX);
+    a2dp_sink_local_param.btc_aa_snk_cb.data_ready_event = data_event;
+
    a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ = fixed_queue_new(QUEUE_SIZE_MAX);

    btc_a2dp_control_init();
@@ -749,10 +748,8 @@ static void btc_a2dp_sink_thread_cleanup(UNUSED_ATTR void *context)

    a2dp_sink_local_param.btc_aa_snk_cb.RxSbcQ = NULL;

-    if (a2dp_sink_local_param.btc_aa_snk_cb.post_sem) {
-        osi_sem_free(&a2dp_sink_local_param.btc_aa_snk_cb.post_sem);
-        a2dp_sink_local_param.btc_aa_snk_cb.post_sem = NULL;
-    }
+    osi_event_delete(a2dp_sink_local_param.btc_aa_snk_cb.data_ready_event);
+    a2dp_sink_local_param.btc_aa_snk_cb.data_ready_event = NULL;
 }

 #endif /* BTC_AV_SINK_INCLUDED */
--- a/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
+++ b/components/bt/host/bluedroid/btc/profile/std/a2dp/btc_a2dp_source.c
@@ -42,8 +42,6 @@

 #if BTC_AV_SRC_INCLUDED

-extern osi_thread_t *btc_thread;
-
 /*****************************************************************************
 **  Constants
 *****************************************************************************/
@@ -118,6 +116,8 @@ enum {
 #define MAX_OUTPUT_A2DP_FRAME_QUEUE_SZ         (5)
 #define MAX_OUTPUT_A2DP_SRC_FRAME_QUEUE_SZ     (27) // 18 for 20ms tick

+#define BTC_A2DP_SRC_DATA_QUEUE_IDX            (1)
+
 typedef struct {
    uint32_t sig;
    void *param;
@@ -154,6 +154,7 @@ typedef struct {
    tBTC_AV_MEDIA_FEEDINGS media_feeding;
    SBC_ENC_PARAMS encoder;
    osi_alarm_t *media_alarm;
+    struct osi_event *poll_data;
 } tBTC_A2DP_SOURCE_CB;

 typedef struct {
@@ -283,7 +284,7 @@ bool btc_a2dp_source_startup(void)

    APPL_TRACE_EVENT("## A2DP SOURCE START MEDIA THREAD ##");

-    a2dp_source_local_param.btc_aa_src_task_hdl = btc_thread;
+    a2dp_source_local_param.btc_aa_src_task_hdl = btc_get_current_thread();

    if (btc_a2dp_source_ctrl(BTC_MEDIA_TASK_INIT, NULL) == false) {
        goto error_exit;
@@ -1532,7 +1533,7 @@ static void btc_a2dp_source_aa_stop_tx(void)
 static void btc_a2dp_source_alarm_cb(UNUSED_ATTR void *context)
 {
    if (a2dp_source_local_param.btc_aa_src_task_hdl) {
-        osi_thread_post(a2dp_source_local_param.btc_aa_src_task_hdl, btc_a2dp_source_handle_timer, NULL, 1, OSI_THREAD_MAX_TIMEOUT);
+        osi_thread_post_event(a2dp_source_local_param.btc_aa_src_cb.poll_data, OSI_THREAD_MAX_TIMEOUT);
    } else {
        APPL_TRACE_DEBUG("[%s] A2DP ALREADY FREED", __func__);
        btc_a2dp_source_aa_stop_tx();
@@ -1587,6 +1588,11 @@ static void btc_a2dp_source_thread_init(UNUSED_ATTR void *context)

    btc_a2dp_source_state = BTC_A2DP_SOURCE_STATE_ON;

+    struct osi_event *poll_data = osi_event_create(btc_a2dp_source_handle_timer, NULL);
+    assert(poll_data != NULL);
+    osi_event_bind(poll_data, a2dp_source_local_param.btc_aa_src_task_hdl, BTC_A2DP_SRC_DATA_QUEUE_IDX);
+    a2dp_source_local_param.btc_aa_src_cb.poll_data = poll_data;
+
    a2dp_source_local_param.btc_aa_src_cb.TxAaQ = fixed_queue_new(QUEUE_SIZE_MAX);

    btc_a2dp_control_init();
@@ -1602,6 +1608,9 @@ static void btc_a2dp_source_thread_cleanup(UNUSED_ATTR void *context)
    fixed_queue_free(a2dp_source_local_param.btc_aa_src_cb.TxAaQ, osi_free_func);

    a2dp_source_local_param.btc_aa_src_cb.TxAaQ = NULL;
+
+    osi_event_delete(a2dp_source_local_param.btc_aa_src_cb.poll_data);
+    a2dp_source_local_param.btc_aa_src_cb.poll_data = NULL;
 }

 #endif /* BTC_AV_INCLUDED */
--- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
+++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
@@ -21,6 +21,8 @@
 #include "btc/btc_dm.h"
 #include "btc/btc_util.h"
 #include "osi/mutex.h"
+#include "osi/thread.h"
+#include "osi/pkt_queue.h"
 #include "esp_bt.h"

 #if (BLE_INCLUDED == TRUE)
@@ -48,6 +50,19 @@ static uint16_t btc_adv_list_count = 0;
 #define  BTC_ADV_LIST_MAX_COUNT     200
 #endif

+#define BTC_GAP_BLE_ADV_RPT_QUEUE_IDX            (1)
+#define BTC_GAP_BLE_ADV_RPT_BATCH_SIZE           (10)
+#define BTC_GAP_BLE_ADV_RPT_QUEUE_LEN_MAX        (200)
+
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+typedef struct {
+    struct pkt_queue *adv_rpt_queue;
+    struct osi_event *adv_rpt_ready;
+} btc_gap_ble_env_t;
+
+static btc_gap_ble_env_t btc_gap_ble_env;
+#endif
+
 static inline void btc_gap_ble_cb_to_app(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param)
 {
    esp_gap_ble_cb_t btc_gap_ble_cb = (esp_gap_ble_cb_t)btc_profile_cb_get(BTC_PID_GAP_BLE);
@@ -548,8 +563,82 @@ static void btc_ble_set_scan_params(esp_ble_scan_params_t *scan_params, tBLE_SCA
    }
 }

+static void btc_gap_ble_adv_pkt_handler(void *arg)
+{
+    btc_gap_ble_env_t *p_env = &btc_gap_ble_env;
+    size_t pkts_to_process = pkt_queue_length(p_env->adv_rpt_queue);
+    if (pkts_to_process > BTC_GAP_BLE_ADV_RPT_BATCH_SIZE) {
+        pkts_to_process = BTC_GAP_BLE_ADV_RPT_BATCH_SIZE;
+    }
+
+    for (size_t i = 0; i < pkts_to_process; i++) {
+        pkt_linked_item_t *linked_pkt = pkt_queue_dequeue(p_env->adv_rpt_queue);
+        if (linked_pkt != NULL) {
+            esp_ble_gap_cb_param_t *param = (esp_ble_gap_cb_param_t *)(linked_pkt->data);
+            btc_gap_ble_cb_to_app(ESP_GAP_BLE_SCAN_RESULT_EVT, param);
+            osi_free(linked_pkt);
+        }
+    }
+
+    if (pkt_queue_length(p_env->adv_rpt_queue) != 0) {
+        osi_thread_post_event(p_env->adv_rpt_ready, OSI_THREAD_MAX_TIMEOUT);
+    }
+}
+
+static void btc_process_adv_rpt_pkt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
+{
+#if SCAN_QUEUE_CONGEST_CHECK
+    if(btc_check_queue_is_congest()) {
+        BTC_TRACE_DEBUG("BtcQueue is congested");
+        if(btc_get_adv_list_length() > BTC_ADV_LIST_MAX_LENGTH || btc_adv_list_count > BTC_ADV_LIST_MAX_COUNT) {
+            btc_adv_list_refresh();
+            btc_adv_list_count = 0;
+        }
+        if(btc_check_adv_list(p_data->inq_res.bd_addr, p_data->inq_res.ble_addr_type)) {
+            return;
+        }
+    }
+    btc_adv_list_count ++;
+#endif
+
+    // drop ADV packets if data queue length goes above threshold
+    btc_gap_ble_env_t *p_env = &btc_gap_ble_env;
+    if (pkt_queue_length(p_env->adv_rpt_queue) >= BTC_GAP_BLE_ADV_RPT_QUEUE_LEN_MAX) {
+        return;
+    }
+
+    pkt_linked_item_t *linked_pkt = osi_calloc(BT_PKT_LINKED_HDR_SIZE + sizeof(esp_ble_gap_cb_param_t));
+    if (linked_pkt == NULL) {
+        return;
+    }
+
+    struct ble_scan_result_evt_param *scan_rst = (struct ble_scan_result_evt_param *)linked_pkt->data;
+
+    do {
+        scan_rst->search_evt = event;
+        bdcpy(scan_rst->bda, p_data->inq_res.bd_addr);
+        scan_rst->dev_type = p_data->inq_res.device_type;
+        scan_rst->rssi = p_data->inq_res.rssi;
+        scan_rst->ble_addr_type = p_data->inq_res.ble_addr_type;
+        scan_rst->ble_evt_type = p_data->inq_res.ble_evt_type;
+        scan_rst->flag = p_data->inq_res.flag;
+        scan_rst->num_resps = 1;
+        scan_rst->adv_data_len = p_data->inq_res.adv_data_len;
+        scan_rst->scan_rsp_len = p_data->inq_res.scan_rsp_len;
+        memcpy(scan_rst->ble_adv, p_data->inq_res.p_eir, sizeof(scan_rst->ble_adv));
+    } while (0);
+
+    pkt_queue_enqueue(p_env->adv_rpt_queue, linked_pkt);
+    osi_thread_post_event(p_env->adv_rpt_ready, OSI_THREAD_MAX_TIMEOUT);
+}
+
 static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
 {
+    if (event == BTA_DM_INQ_RES_EVT) {
+        btc_process_adv_rpt_pkt(event, p_data);
+        return;
+    }
+
    esp_ble_gap_cb_param_t param;
    btc_msg_t msg = {0};

@@ -559,32 +648,8 @@ static void btc_search_callback(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data

    param.scan_rst.search_evt = event;
    switch (event) {
-    case BTA_DM_INQ_RES_EVT: {
-#if SCAN_QUEUE_CONGEST_CHECK
-        if(btc_check_queue_is_congest()) {
-            BTC_TRACE_DEBUG("BtcQueue is congested");
-            if(btc_get_adv_list_length() > BTC_ADV_LIST_MAX_LENGTH || btc_adv_list_count > BTC_ADV_LIST_MAX_COUNT) {
-                btc_adv_list_refresh();
-                btc_adv_list_count = 0;
-            }
-            if(btc_check_adv_list(p_data->inq_res.bd_addr, p_data->inq_res.ble_addr_type)) {
-                return;
-            }
-        }
-        btc_adv_list_count ++;
-#endif
-        bdcpy(param.scan_rst.bda, p_data->inq_res.bd_addr);
-        param.scan_rst.dev_type = p_data->inq_res.device_type;
-        param.scan_rst.rssi = p_data->inq_res.rssi;
-        param.scan_rst.ble_addr_type = p_data->inq_res.ble_addr_type;
-        param.scan_rst.ble_evt_type = p_data->inq_res.ble_evt_type;
-        param.scan_rst.flag = p_data->inq_res.flag;
-        param.scan_rst.num_resps = 1;
-        param.scan_rst.adv_data_len = p_data->inq_res.adv_data_len;
-        param.scan_rst.scan_rsp_len = p_data->inq_res.scan_rsp_len;
-        memcpy(param.scan_rst.ble_adv, p_data->inq_res.p_eir, sizeof(param.scan_rst.ble_adv));
+    case BTA_DM_INQ_RES_EVT:
        break;
-    }
    case BTA_DM_INQ_CMPL_EVT: {
        param.scan_rst.num_resps = p_data->inq_cmpl.num_resps;
        BTC_TRACE_DEBUG("%s  BLE observe complete. Num Resp %d\n", __FUNCTION__, p_data->inq_cmpl.num_resps);
@@ -1841,9 +1906,31 @@ void btc_gap_callback_init(void)
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 }

+bool btc_gap_ble_init(void)
+{
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+    btc_gap_ble_env_t *p_env = &btc_gap_ble_env;
+    p_env->adv_rpt_queue = pkt_queue_create();
+    assert(p_env->adv_rpt_queue != NULL);
+
+    p_env->adv_rpt_ready = osi_event_create(btc_gap_ble_adv_pkt_handler, NULL);
+    assert(p_env->adv_rpt_ready != NULL);
+    osi_event_bind(p_env->adv_rpt_ready, btc_get_current_thread(), BTC_GAP_BLE_ADV_RPT_QUEUE_IDX);
+#endif
+    return true;
+}
+
 void btc_gap_ble_deinit(void)
 {
- #if (BLE_42_FEATURE_SUPPORT == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+    btc_gap_ble_env_t *p_env = &btc_gap_ble_env;
+
+    osi_event_delete(p_env->adv_rpt_ready);
+    p_env->adv_rpt_ready = NULL;
+
+    pkt_queue_destroy(p_env->adv_rpt_queue, NULL);
+    p_env->adv_rpt_queue = NULL;
+
    btc_cleanup_adv_data(&gl_bta_adv_data);
    btc_cleanup_adv_data(&gl_bta_scan_rsp_data);
 #endif //  #if (BLE_42_FEATURE_SUPPORT == TRUE)
--- a/Show More
+++ b/Show More