Merge branch 'bugfix/fix_tbtt_timming_error_esp32' into 'release/v5.0'

bugfix: fix tbtt timing error esp32(v5.0)

See merge request espressif/esp-idf!38981

.gitlab/ci/target-test.yml

@@ -199,6 +199,22 @@ example_test_pytest_esp32_wifi_two_dut:
     - build_pytest_examples_esp32
   tags: [ esp32, wifi_two_dut ]
 
+example_test_pytest_esp32c3eco7_wifi_two_dut:
+  extends:
+    - .pytest_examples_dir_template
+    - .rules:test:example_test-esp32c3-wifi
+  needs:
+    - build_pytest_examples_esp32c3
+  tags: [ esp32c3eco7, wifi_two_dut ]
+
+example_test_pytest_esp32c2eco4_wifi_two_dut:
+  extends:
+    - .pytest_examples_dir_template
+    - .rules:test:example_test-esp32c2-wifi
+  needs:
+    - build_pytest_examples_esp32c2
+  tags: [ esp32c2eco4, wifi_two_dut, xtal_26mhz]
+
 example_test_pytest_esp32c3_flash_encryption:
   extends:
     - .pytest_examples_dir_template
@@ -1012,7 +1028,7 @@ UT_S2_SDSPI:
 
 UT_C2:
   extends: .unit_test_esp32c2_template
-  parallel: 23
+  parallel: 24
   tags:
     - ESP32C2_IDF
     - UT_T1_1

components/app_update/test/test_ota_ops.c

@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@@ -113,3 +114,11 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
     };
     TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
+
+TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
+{
+    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
+    const esp_partition_t* part = esp_ota_get_running_partition();
+    ESP_LOGI("running bin", "0x%p", (void*)part->address);
+    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
+}

components/bootloader_support/src/esp32/bootloader_esp32.c

@@ -129,7 +129,7 @@ static esp_err_t bootloader_check_rated_cpu_clock(void)
 {
     int rated_freq = bootloader_clock_get_rated_freq_mhz();
     if (rated_freq < CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ) {
-        ESP_LOGE(TAG, "Chip CPU frequency rated for %dMHz, configured for %dMHz. Modify CPU frequency in menuconfig",
+        ESP_LOGE(TAG, "Chip CPU freq rated for %dMHz, configured for %dMHz. Modify CPU freq in menuconfig",
                  rated_freq, CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ);
         return ESP_FAIL;
     }

components/bt/CMakeLists.txt

@@ -27,7 +27,8 @@ if(CONFIG_BT_ENABLED)
         list(APPEND ldscripts "linker_esp_ble_controller.lf")
 
     elseif(CONFIG_IDF_TARGET_ESP32C2)
-        list(APPEND srcs "controller/esp32c2/bt.c")
+        list(APPEND srcs "controller/esp32c2/bt.c"
+                         "controller/esp32c2/ble.c")
         list(APPEND include_dirs include/esp32c2/include)
         set(ldscripts "linker_esp32c2.lf")
 
@@ -50,6 +51,7 @@ if(CONFIG_BT_ENABLED)
          common/btc/profile/esp/blufi/include
          common/btc/profile/esp/include
          common/hci_log/include
+         common/ble_log/include
         )
 
 
@@ -76,6 +78,7 @@ if(CONFIG_BT_ENABLED)
          "common/osi/osi.c"
          "common/osi/semaphore.c"
          "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
          )
 
     # Host Bluedroid
@@ -514,23 +517,25 @@ if(CONFIG_BT_ENABLED)
 
     if(NOT (CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS))
         list(APPEND include_dirs
-                porting/ext/tinycrypt/include
+                common/tinycrypt/include
+                common/tinycrypt/port
             )
-        list(APPEND srcs "porting/ext/tinycrypt/src/utils.c"
-                "porting/ext/tinycrypt/src/sha256.c"
-                "porting/ext/tinycrypt/src/ecc.c"
-                "porting/ext/tinycrypt/src/ctr_prng.c"
-                "porting/ext/tinycrypt/src/ctr_mode.c"
-                "porting/ext/tinycrypt/src/aes_decrypt.c"
-                "porting/ext/tinycrypt/src/aes_encrypt.c"
-                "porting/ext/tinycrypt/src/ccm_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dsa.c"
-                "porting/ext/tinycrypt/src/cmac_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dh.c"
-                "porting/ext/tinycrypt/src/hmac_prng.c"
-                "porting/ext/tinycrypt/src/ecc_platform_specific.c"
-                "porting/ext/tinycrypt/src/hmac.c"
-                "porting/ext/tinycrypt/src/cbc_mode.c")
+        list(APPEND srcs "common/tinycrypt/src/utils.c"
+                "common/tinycrypt/src/sha256.c"
+                "common/tinycrypt/src/ecc.c"
+                "common/tinycrypt/src/ctr_prng.c"
+                "common/tinycrypt/src/ctr_mode.c"
+                "common/tinycrypt/src/aes_decrypt.c"
+                "common/tinycrypt/src/aes_encrypt.c"
+                "common/tinycrypt/src/ccm_mode.c"
+                "common/tinycrypt/src/ecc_dsa.c"
+                "common/tinycrypt/src/cmac_mode.c"
+                "common/tinycrypt/src/ecc_dh.c"
+                "common/tinycrypt/src/hmac_prng.c"
+                "common/tinycrypt/src/ecc_platform_specific.c"
+                "common/tinycrypt/src/hmac.c"
+                "common/tinycrypt/src/cbc_mode.c"
+                "common/tinycrypt/port/esp_tinycrypt_port.c")
     endif()
 
     if(CONFIG_BT_NIMBLE_ENABLED)
@@ -741,16 +746,20 @@ if(CONFIG_BT_ENABLED)
             endif()
     elseif(CONFIG_IDF_TARGET_ESP32H2 AND CONFIG_BT_CONTROLLER_ENABLED)
         if(CONFIG_IDF_TARGET_ESP32H2_BETA_VERSION_1)
-            add_prebuilt_library(nimblelib "controller/lib_esp32h2/esp32h2-bt-lib/beta1/libble_app.a")
+            add_prebuilt_library(nimblelib "controller/lib_esp32h2/esp32h2-bt-lib/beta1/libble_app.a"
+                                 REQUIRES esp_phy)
         elseif(CONFIG_IDF_TARGET_ESP32H2_BETA_VERSION_2)
-            add_prebuilt_library(nimblelib "controller/lib_esp32h2/esp32h2-bt-lib/beta2/libble_app.a")
+            add_prebuilt_library(nimblelib "controller/lib_esp32h2/esp32h2-bt-lib/beta2/libble_app.a"
+                                 REQUIRES esp_phy)
         endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE nimblelib)
     elseif(CONFIG_IDF_TARGET_ESP32C2 AND CONFIG_BT_CONTROLLER_ENABLED)
         if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
-            add_prebuilt_library(nimblelib "controller/lib_esp32c2/esp32c2-bt-lib/libble_app_flash.a")
+            add_prebuilt_library(nimblelib "controller/lib_esp32c2/esp32c2-bt-lib/libble_app_flash.a"
+                                 REQUIRES esp_phy)
         else()
-            add_prebuilt_library(nimblelib "controller/lib_esp32c2/esp32c2-bt-lib/libble_app.a")
+            add_prebuilt_library(nimblelib "controller/lib_esp32c2/esp32c2-bt-lib/libble_app.a"
+                                 REQUIRES esp_phy)
         endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE nimblelib)
     endif()

components/bt/common/Kconfig.in

@@ -4,3 +4,106 @@ config BT_ALARM_MAX_NUM
     help
         This option decides the maximum number of alarms which
         could be used by Bluetooth host.
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_UL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for upper layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    bool "Enable HCI log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
+
+config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    bool "Enable Host log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
+        When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
+
+config BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    bool "Enable Controller log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    depends on BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable controller log output to SPI bus.
+
+config BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for upper layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
+    int "SPI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer ISR logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+        GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+        GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+        GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+        Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+        GPIO number of SYNC IO
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    bool "Enable periodic buffer flush out"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable periodic buffer flush out
+        Not recommended when SPI receiver is unavailable
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT
+    int "Buffer flush out period in unit of ms"
+    depends on BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    default 1000
+    help
+        Buffer flush out period in unit of ms

components/bt/common/ble_log/ble_log_spi_out.c

@@ -0,0 +1,983 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_spi_out.h"
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+// Private defines
+#define BLE_LOG_TAG "BLE_LOG"
+#define SPI_OUT_BUS SPI2_HOST
+#define SPI_OUT_MAX_TRANSFER_SIZE 10240
+#define SPI_OUT_FRAME_HEAD_LEN 4
+#define SPI_OUT_FRAME_TAIL_LEN 4
+#define SPI_OUT_FRAME_OVERHEAD (SPI_OUT_FRAME_HEAD_LEN + SPI_OUT_FRAME_TAIL_LEN)
+#define SPI_OUT_RECYCLE_TIMEOUT_MS 10
+#define SPI_OUT_TRANS_CB_FLAG_AVAILABLE 0
+#define SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE 1
+#define SPI_OUT_TRANS_CB_FLAG_IN_QUEUE 2
+#define SPI_OUT_FLUSHOUT_TIMEOUT (CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT * 1000)
+#define SPI_OUT_PACKET_LOSS_UL 0
+#define SPI_OUT_PACKET_LOSS_LL_TASK 1
+#define SPI_OUT_PACKET_LOSS_LL_ISR 2
+#define SPI_OUT_PACKET_LOSS_FRAME_SIZE 6
+#define SPI_OUT_INTERFACE_FLAG_IN_ISR (1 << 3)
+#define SPI_OUT_TRANS_ITVL_MIN_US 30
+#define SPI_OUT_SPI_MASTER_QUEUE_SIZE 6
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+#define SPI_OUT_TS_SYNC_TIMEOUT (1000 * 1000)
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private typedefs
+typedef struct {
+    // CRITICAL: 0 for available, 1 for need queue (ISR), 2 for in queue
+    // This flag is for multithreading, must be a word, do not modify
+    volatile uint32_t flag;
+    uint16_t buf_size;
+    uint16_t length;
+    spi_transaction_t trans;
+} spi_out_trans_cb_t;
+
+typedef struct {
+    spi_out_trans_cb_t *trans_cb[2];
+    uint8_t trans_cb_idx;
+    uint8_t frame_cnt;
+    uint32_t bytes_loss_cnt;
+    uint8_t trans_loss_cnt;
+} spi_out_log_cb_t;
+
+// Private variables
+static bool spi_out_inited = false;
+static spi_device_handle_t spi_handle = NULL;
+static uint32_t last_tx_done_ts = 0;
+
+static bool ul_log_inited = false;
+static SemaphoreHandle_t ul_log_mutex = NULL;
+static spi_out_log_cb_t *ul_log_cb = NULL;
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+static esp_timer_handle_t ul_log_flushout_timer = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+static bool ll_log_inited = false;
+static spi_out_log_cb_t *ll_task_log_cb = NULL;
+static spi_out_log_cb_t *ll_isr_log_cb = NULL;
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+static esp_timer_handle_t ll_log_flushout_timer = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static bool ts_sync_inited = false;
+static bool sync_io_level = false;
+static esp_timer_handle_t ts_sync_timer = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Extern function declarations
+extern void esp_panic_handler_feed_wdts(void);
+
+// Private function declarations
+static int spi_out_init_trans(spi_out_trans_cb_t **trans_cb, uint16_t buf_size);
+static void spi_out_deinit_trans(spi_out_trans_cb_t **trans_cb);
+static void spi_out_tx_done_cb(spi_transaction_t *ret_trans);
+static inline int spi_out_append_trans(spi_out_trans_cb_t *trans_cb);
+
+static int spi_out_log_cb_init(spi_out_log_cb_t **log_cb, uint16_t buf_size);
+static void spi_out_log_cb_deinit(spi_out_log_cb_t **log_cb);
+static inline int spi_out_log_cb_check_trans(spi_out_log_cb_t *log_cb, uint16_t len);
+static inline void spi_out_log_cb_append_trans(spi_out_log_cb_t *log_cb);
+static inline void spi_out_log_cb_flush_trans(spi_out_log_cb_t *log_cb);
+static void spi_out_log_cb_write(spi_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len, \
+                                 const uint8_t *addr_append, uint16_t len_append, uint8_t source);
+static void spi_out_log_cb_write_packet_loss(spi_out_log_cb_t *log_cb, uint8_t flag);
+static void spi_out_log_cb_dump(spi_out_log_cb_t *log_cb);
+
+static int spi_out_ul_log_init(void);
+static void spi_out_ul_log_deinit(void);
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+static void esp_timer_cb_ul_log_flushout(void);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+static int spi_out_ll_log_init(void);
+static void spi_out_ll_log_deinit(void);
+static void spi_out_ll_log_ev_proc(void);
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+static void esp_timer_cb_ll_log_flushout(void);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6) || defined(CONFIG_IDF_TARGET_ESP32C5) ||\
+    defined(CONFIG_IDF_TARGET_ESP32C61) || defined(CONFIG_IDF_TARGET_ESP32H21)
+extern void r_ble_log_simple_put_ev(void);
+#define BLE_LOG_LL_PUT_EV r_ble_log_simple_put_ev()
+#elif defined(CONFIG_IDF_TARGET_ESP32C2)
+extern void ble_log_simple_put_ev(void);
+#define BLE_LOG_LL_PUT_EV ble_log_simple_put_ev()
+#else
+#define BLE_LOG_LL_PUT_EV
+#endif
+
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static int spi_out_ts_sync_init(void);
+static void spi_out_ts_sync_deinit(void);
+static void esp_timer_cb_ts_sync(void);
+
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6) || defined(CONFIG_IDF_TARGET_ESP32C5) ||\
+    defined(CONFIG_IDF_TARGET_ESP32C61) || defined(CONFIG_IDF_TARGET_ESP32H21)
+extern uint32_t r_ble_lll_timer_current_tick_get(void);
+#define SPI_OUT_GET_LC_TIME r_ble_lll_timer_current_tick_get()
+#elif defined(CONFIG_IDF_TARGET_ESP32C2)
+extern uint32_t r_os_cputime_get32(void);
+#define SPI_OUT_GET_LC_TIME r_os_cputime_get32()
+#else
+#define SPI_OUT_GET_LC_TIME 0
+#endif
+
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private functions
+static int spi_out_init_trans(spi_out_trans_cb_t **trans_cb, uint16_t buf_size)
+{
+    // Memory allocations
+    *trans_cb = (spi_out_trans_cb_t *)malloc(sizeof(spi_out_trans_cb_t));
+    if (!(*trans_cb)) {
+        return -1;
+    }
+    memset(*trans_cb, 0, sizeof(spi_out_trans_cb_t));
+
+    uint8_t *buf = (uint8_t *)heap_caps_malloc(buf_size, MALLOC_CAP_DMA);
+    if (!buf) {
+        free(*trans_cb);
+        *trans_cb = NULL;
+        return -1;
+    }
+
+    // Initialization
+    (*trans_cb)->buf_size = buf_size;
+    (*trans_cb)->trans.tx_buffer = buf;
+    return 0;
+}
+
+static void spi_out_deinit_trans(spi_out_trans_cb_t **trans_cb)
+{
+    if (!(*trans_cb)) {
+        return;
+    }
+    if ((*trans_cb)->trans.tx_buffer) {
+        free((uint8_t *)(*trans_cb)->trans.tx_buffer);
+        (*trans_cb)->trans.tx_buffer = NULL;
+    }
+
+    free(*trans_cb);
+    *trans_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static void spi_out_tx_done_cb(spi_transaction_t *ret_trans)
+{
+    last_tx_done_ts = esp_timer_get_time();
+    spi_out_trans_cb_t *trans_cb = __containerof(ret_trans, spi_out_trans_cb_t, trans);
+    trans_cb->length = 0;
+    trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_AVAILABLE;
+}
+
+IRAM_ATTR static void spi_out_pre_tx_cb(spi_transaction_t *ret_trans)
+{
+    // SPI slave continuous transaction workaround
+    while (esp_timer_get_time() - last_tx_done_ts < SPI_OUT_TRANS_ITVL_MIN_US) {}
+}
+
+IRAM_ATTR static inline int spi_out_append_trans(spi_out_trans_cb_t *trans_cb)
+{
+    if (trans_cb->flag != SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE || !trans_cb->length) {
+        return -1;
+    }
+
+    // CRITICAL: Length unit conversion from bytes to bits
+    trans_cb->trans.length = trans_cb->length * 8;
+    trans_cb->trans.rxlength = 0;
+    if (spi_device_queue_trans(spi_handle, &(trans_cb->trans), 0) == ESP_OK) {
+        trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_IN_QUEUE;
+        return 0;
+    } else {
+        trans_cb->length = 0;
+        trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_AVAILABLE;
+        return -1;
+    }
+}
+
+static int spi_out_log_cb_init(spi_out_log_cb_t **log_cb, uint16_t buf_size)
+{
+    // Initialize log control block
+    *log_cb = (spi_out_log_cb_t *)malloc(sizeof(spi_out_log_cb_t));
+    if (!(*log_cb)) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize log control block!");
+        return -1;
+    }
+    memset(*log_cb, 0, sizeof(spi_out_log_cb_t));
+
+    // Initialize transactions
+    int ret = 0;
+    for (uint8_t i = 0; i < 2; i++) {
+        ret |= spi_out_init_trans(&((*log_cb)->trans_cb[i]), buf_size);
+    }
+    if (ret != 0) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize SPI transactions!");
+        spi_out_log_cb_deinit(log_cb);
+        return -1;
+    }
+    return 0;
+}
+
+static void spi_out_log_cb_deinit(spi_out_log_cb_t **log_cb)
+{
+    if (!(*log_cb)) {
+        return;
+    }
+
+    for (uint8_t i = 0; i < 2; i++) {
+        if ((*log_cb)->trans_cb[i]) {
+            spi_out_deinit_trans(&((*log_cb)->trans_cb[i]));
+        }
+    }
+    free(*log_cb);
+    *log_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static inline int spi_out_log_cb_check_trans(spi_out_log_cb_t *log_cb, uint16_t len)
+{
+    spi_out_trans_cb_t *trans_cb;
+    uint16_t frame_len = len + SPI_OUT_FRAME_OVERHEAD;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        if (frame_len > trans_cb->buf_size) {
+            goto failed;
+        }
+        if (trans_cb->flag == SPI_OUT_TRANS_CB_FLAG_AVAILABLE) {
+            if ((trans_cb->buf_size - trans_cb->length) >= (len + SPI_OUT_FRAME_OVERHEAD)) {
+                return 0;
+            } else {
+                trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE;
+            }
+        }
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+    }
+failed:
+    log_cb->bytes_loss_cnt += len + SPI_OUT_FRAME_OVERHEAD;
+    log_cb->frame_cnt++;
+    return -1;
+}
+
+// CRITICAL: Shall not be called from ISR!
+IRAM_ATTR static inline void spi_out_log_cb_append_trans(spi_out_log_cb_t *log_cb)
+{
+    spi_out_trans_cb_t *trans_cb;
+    uint8_t idx = !log_cb->trans_cb_idx;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[idx];
+        if (trans_cb->flag == SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE) {
+            if (spi_out_append_trans(trans_cb) != 0) {
+                log_cb->trans_loss_cnt++;
+            }
+        }
+        idx = !idx;
+    }
+}
+
+IRAM_ATTR static inline void spi_out_log_cb_flush_trans(spi_out_log_cb_t *log_cb)
+{
+    spi_out_trans_cb_t *trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+    if (trans_cb->length && (trans_cb->flag == SPI_OUT_TRANS_CB_FLAG_AVAILABLE)) {
+        trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE;
+    }
+}
+
+IRAM_ATTR static void spi_out_log_cb_write(spi_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len, \
+                                           const uint8_t *addr_append, uint16_t len_append, uint8_t source)
+{
+    spi_out_trans_cb_t *trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+
+    uint8_t *buf = (uint8_t *)trans_cb->trans.tx_buffer + trans_cb->length;
+    uint16_t total_length = len + len_append;
+    const uint8_t head[4] = {total_length & 0xFF, (total_length >> 8) & 0xFF, source, log_cb->frame_cnt};
+    uint32_t checksum = 0;
+    for (int i = 0; i < len; i++) {
+        checksum += addr[i];
+    }
+    for (int i = 0; i < len_append; i++) {
+        checksum += addr_append[i];
+    }
+
+    memcpy(buf, head, SPI_OUT_FRAME_HEAD_LEN);
+    memcpy(buf + SPI_OUT_FRAME_HEAD_LEN, addr, len);
+    if (len_append) {
+        memcpy(buf + SPI_OUT_FRAME_HEAD_LEN + len, addr_append, len_append);
+    }
+    memcpy(buf + SPI_OUT_FRAME_HEAD_LEN + total_length, &checksum, SPI_OUT_FRAME_TAIL_LEN);
+
+    trans_cb->length += total_length + SPI_OUT_FRAME_OVERHEAD;
+    log_cb->frame_cnt++;
+    if ((trans_cb->buf_size - trans_cb->length) <= SPI_OUT_FRAME_OVERHEAD) {
+        trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE;
+    }
+    return;
+}
+
+IRAM_ATTR static void spi_out_log_cb_write_packet_loss(spi_out_log_cb_t *log_cb, uint8_t flag)
+{
+    if (!log_cb->bytes_loss_cnt && !log_cb->trans_loss_cnt) {
+        return;
+    }
+    if (spi_out_log_cb_check_trans(log_cb, SPI_OUT_PACKET_LOSS_FRAME_SIZE) == 0) {
+        uint8_t packet_loss_frame[SPI_OUT_PACKET_LOSS_FRAME_SIZE];
+        packet_loss_frame[0] = flag;
+        memcpy(packet_loss_frame + 1, (uint8_t *)&log_cb->bytes_loss_cnt, 4);
+        packet_loss_frame[5] = log_cb->trans_loss_cnt;
+        spi_out_log_cb_write(log_cb, packet_loss_frame, SPI_OUT_PACKET_LOSS_FRAME_SIZE, NULL, 0, BLE_LOG_SPI_OUT_SOURCE_LOSS);
+
+        log_cb->bytes_loss_cnt = 0;
+        log_cb->trans_loss_cnt = 0;
+    }
+}
+
+static void spi_out_log_cb_dump(spi_out_log_cb_t *log_cb)
+{
+    spi_out_trans_cb_t *trans_cb;
+    uint8_t *buf;
+    for (uint8_t i = 0; i < 2; i++) {
+        // Dump the last transaction before dumping the current transaction
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        buf = (uint8_t *)trans_cb->trans.tx_buffer;
+        for (uint16_t j = 0; j < trans_cb->buf_size; j++) {
+            esp_rom_printf("%02x ", buf[j]);
+
+            // Feed watchdogs periodically to avoid wdts timeout
+            if ((j % 100) == 0) {
+                esp_panic_handler_feed_wdts();
+            }
+        }
+    }
+}
+
+static int spi_out_ul_log_init(void)
+{
+    if (ul_log_inited) {
+        return 0;
+    }
+
+    // Initialize mutex
+    ul_log_mutex = xSemaphoreCreateMutex();
+    if (!ul_log_mutex) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to create mutex for upper layer task log!");
+        goto mutex_init_failed;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    // Initialize flushout timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ul_log_flushout,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    if (esp_timer_create(&timer_args, &ul_log_flushout_timer) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize flushout timer upper layer task log!");
+        goto timer_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+    // Initialize log control block
+    if (spi_out_log_cb_init(&ul_log_cb, CONFIG_BT_BLE_LOG_SPI_OUT_UL_TASK_BUF_SIZE) != 0) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize log control blocks for upper layer task log!");
+        goto log_cb_init_failed;
+    }
+
+    // Initialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to initialize upper layer task log!");
+    ul_log_inited = true;
+    return 0;
+
+log_cb_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    esp_timer_delete(ul_log_flushout_timer);
+timer_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    vSemaphoreDelete(ul_log_mutex);
+mutex_init_failed:
+    return -1;
+}
+
+static void spi_out_ul_log_deinit(void)
+{
+    if (!ul_log_inited) {
+        return;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    esp_timer_stop(ul_log_flushout_timer);
+    esp_timer_delete(ul_log_flushout_timer);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    spi_out_log_cb_deinit(&ul_log_cb);
+    xSemaphoreGive(ul_log_mutex);
+
+    vSemaphoreDelete(ul_log_mutex);
+    ul_log_mutex = NULL;
+
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to deinitialize upper layer log!");
+    ul_log_inited = false;
+    return;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+IRAM_ATTR static void esp_timer_cb_ul_log_flushout(void)
+{
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    spi_out_log_cb_flush_trans(ul_log_cb);
+    spi_out_log_cb_append_trans(ul_log_cb);
+    xSemaphoreGive(ul_log_mutex);
+
+    esp_timer_start_once(ul_log_flushout_timer, SPI_OUT_FLUSHOUT_TIMEOUT);
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+static int spi_out_ll_log_init(void)
+{
+    if (ll_log_inited) {
+        return 0;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    // Initialize flushout timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ll_log_flushout,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    if (esp_timer_create(&timer_args, &ll_log_flushout_timer) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize flushout timer for controller log!");
+        goto timer_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+    // Initialize log control blocks for controller task & ISR logs
+    if (spi_out_log_cb_init(&ll_task_log_cb, CONFIG_BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE) != 0) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize log control blocks for controller task!");
+        goto task_log_cb_init_failed;
+    }
+    if (spi_out_log_cb_init(&ll_isr_log_cb, CONFIG_BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE) != 0) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize log control blocks for controller ISR!");
+        goto isr_log_cb_init_failed;
+    }
+
+    // Initialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to initialize log control blocks for controller task & ISR!");
+    ll_log_inited = true;
+    return 0;
+
+isr_log_cb_init_failed:
+    spi_out_log_cb_deinit(&ll_task_log_cb);
+task_log_cb_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    esp_timer_delete(ll_log_flushout_timer);
+timer_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    return -1;
+}
+
+static void spi_out_ll_log_deinit(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    esp_timer_stop(ll_log_flushout_timer);
+    esp_timer_delete(ll_log_flushout_timer);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+
+    spi_out_log_cb_deinit(&ll_isr_log_cb);
+    spi_out_log_cb_deinit(&ll_task_log_cb);
+
+    // Deinitialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to deinitialize controller log!");
+    ll_log_inited = false;
+    return;
+}
+
+IRAM_ATTR static void spi_out_ll_log_ev_proc(void)
+{
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    // Request from flushout timer
+    spi_out_log_cb_flush_trans(ll_isr_log_cb);
+    spi_out_log_cb_append_trans(ll_isr_log_cb);
+
+    spi_out_log_cb_flush_trans(ll_task_log_cb);
+    spi_out_log_cb_append_trans(ll_task_log_cb);
+
+    esp_timer_start_once(ll_log_flushout_timer, SPI_OUT_FLUSHOUT_TIMEOUT);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    return;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+IRAM_ATTR static void esp_timer_cb_ll_log_flushout(void)
+{
+    BLE_LOG_LL_PUT_EV;
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static int spi_out_ts_sync_init(void)
+{
+    if (ts_sync_inited) {
+        return 0;
+    }
+
+    // Initialize sync timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ts_sync,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    if (esp_timer_create(&timer_args, &ts_sync_timer) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize timestamp synchronizer timer!");
+        goto timer_init_failed;
+    }
+
+    // Initialize sync IO
+    gpio_config_t io_conf = {
+        .intr_type = GPIO_INTR_DISABLE,
+        .mode = GPIO_MODE_OUTPUT,
+        .pin_bit_mask = (1UL << CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM),
+        .pull_down_en = 0,
+        .pull_up_en = 0
+    };
+    if (gpio_config(&io_conf) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize timestamp synchronizer IO!");
+        goto gpio_init_failed;
+    }
+
+    // Initialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to initialize timestamp synchronizer!");
+    sync_io_level = false;
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, sync_io_level);
+    ts_sync_inited = true;
+    return 0;
+
+gpio_init_failed:
+    esp_timer_delete(ts_sync_timer);
+timer_init_failed:
+    return -1;
+}
+
+static void spi_out_ts_sync_deinit(void)
+{
+    if (!ts_sync_inited) {
+        return;
+    }
+
+    // Deinitialize timestamp synchronizer
+    esp_timer_stop(ts_sync_timer);
+    esp_timer_delete(ts_sync_timer);
+
+    // Deinitialize sync IO
+    sync_io_level = false;
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, sync_io_level);
+    gpio_reset_pin(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM);
+
+    // Deinitialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to deinitialize timestamp synchronizer!");
+    ts_sync_inited = false;
+    return;
+}
+
+// CRITICAL: This function is called in ESP Timer task
+static void esp_timer_cb_ts_sync(void)
+{
+    // Initialize variables
+    uint32_t lc_ts = 0;
+    uint32_t esp_ts = 0;
+
+    // Toggle sync IO
+    sync_io_level = !sync_io_level;
+
+    // Enter critical
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL(&spinlock);
+
+    // Get LC timestamp
+    lc_ts = SPI_OUT_GET_LC_TIME;
+
+    // Set sync IO level
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+
+    // Get ESP timestamp
+    esp_ts = esp_timer_get_time();
+    portEXIT_CRITICAL(&spinlock);
+    // Exit critical
+
+    // Write timestamp sync log
+    uint8_t sync_frame[9];
+    sync_frame[0] = ((uint8_t)sync_io_level & 0xFF);
+    memcpy(sync_frame + 1, &lc_ts, sizeof(lc_ts));
+    memcpy(sync_frame + 5, &esp_ts, sizeof(esp_ts));
+    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_SYNC, sync_frame, 9);
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Public functions
+int ble_log_spi_out_init(void)
+{
+    // Avoid double init
+    if (spi_out_inited) {
+        return 0;
+    }
+
+    // Initialize SPI
+    spi_bus_config_t bus_config = {
+        .miso_io_num = -1,
+        .mosi_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM,
+        .sclk_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM,
+        .quadwp_io_num = -1,
+        .quadhd_io_num = -1,
+        .max_transfer_sz = SPI_OUT_MAX_TRANSFER_SIZE,
+#if CONFIG_SPI_MASTER_ISR_IN_IRAM
+        .intr_flags = ESP_INTR_FLAG_IRAM
+#endif // CONFIG_SPI_MASTER_ISR_IN_IRAM
+    };
+    spi_device_interface_config_t dev_config = {
+        .clock_speed_hz = SPI_MASTER_FREQ_20M,
+        .mode = 0,
+        .spics_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_CS_IO_NUM,
+        .queue_size = SPI_OUT_SPI_MASTER_QUEUE_SIZE,
+        .post_cb = spi_out_tx_done_cb,
+        .pre_cb = spi_out_pre_tx_cb
+    };
+    if (spi_bus_initialize(SPI_OUT_BUS, &bus_config, SPI_DMA_CH_AUTO) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to initialize SPI bus!");
+        goto spi_bus_init_failed;
+    }
+    if (spi_bus_add_device(SPI_OUT_BUS, &dev_config, &spi_handle) != ESP_OK) {
+        ESP_LOGE(BLE_LOG_TAG, "Failed to add device to SPI bus!");
+        goto spi_device_add_failed;
+    }
+
+    if (spi_out_ul_log_init() != 0) {
+        goto ul_log_init_failed;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    if (spi_out_ll_log_init() != 0) {
+        goto ll_log_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    if (spi_out_ts_sync_init() != 0) {
+        goto ts_sync_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Initialization done
+    ESP_LOGI(BLE_LOG_TAG, "Succeeded to initialize BLE log SPI output interface!");
+    spi_out_inited = true;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    // Start flushout timer
+    esp_timer_start_once(ul_log_flushout_timer, SPI_OUT_FLUSHOUT_TIMEOUT);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    esp_timer_start_once(ll_log_flushout_timer, SPI_OUT_FLUSHOUT_TIMEOUT);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    return 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+ts_sync_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    spi_out_ll_log_deinit();
+ll_log_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    spi_out_ul_log_deinit();
+ul_log_init_failed:
+    spi_bus_remove_device(spi_handle);
+    spi_handle = NULL;
+spi_device_add_failed:
+    spi_bus_free(SPI_OUT_BUS);
+spi_bus_init_failed:
+    return -1;
+}
+
+void ble_log_spi_out_deinit(void)
+{
+    // Avoid double deinit
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Drain all queued transactions
+    assert(spi_device_acquire_bus(spi_handle, portMAX_DELAY) == ESP_OK);
+    spi_device_release_bus(spi_handle);
+
+    // Remove SPI master
+    spi_bus_remove_device(spi_handle);
+    spi_handle = NULL;
+    spi_bus_free(SPI_OUT_BUS);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    spi_out_ts_sync_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    spi_out_ll_log_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+    spi_out_ul_log_deinit();
+
+    // Reset init flag
+    spi_out_inited = false;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+void ble_log_spi_out_ts_sync_start(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Start timestamp sync timer
+    if (ts_sync_timer) {
+        if (!esp_timer_is_active(ts_sync_timer)) {
+            esp_timer_start_periodic(ts_sync_timer, SPI_OUT_TS_SYNC_TIMEOUT);
+        }
+    }
+}
+
+void ble_log_spi_out_ts_sync_stop(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Stop timestamp sync timer
+    if (ts_sync_timer) {
+        if (esp_timer_is_active(ts_sync_timer)) {
+            esp_timer_stop(ts_sync_timer);
+        }
+
+        // Set sync IO to low level
+        sync_io_level = 0;
+        gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+    }
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+// Only LL task has access to this API
+IRAM_ATTR void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,\
+                                        const uint8_t *addr_append, uint32_t flag)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+    bool in_isr = (bool)(flag & SPI_OUT_INTERFACE_FLAG_IN_ISR);
+    uint8_t source = in_isr ? BLE_LOG_SPI_OUT_SOURCE_ESP_ISR : BLE_LOG_SPI_OUT_SOURCE_ESP;
+    spi_out_log_cb_t *log_cb = in_isr ? ll_isr_log_cb : ll_task_log_cb;
+    uint16_t total_length = (uint16_t)(len + len_append);
+    if (spi_out_log_cb_check_trans(log_cb, total_length) == 0) {
+        spi_out_log_cb_write(log_cb, addr, (uint16_t)len, addr_append, (uint16_t)len_append, source);
+        if (in_isr) {
+            spi_out_log_cb_write_packet_loss(log_cb, SPI_OUT_PACKET_LOSS_LL_ISR);
+        } else {
+            spi_out_log_cb_append_trans(ll_isr_log_cb);
+            spi_out_log_cb_append_trans(ll_task_log_cb);
+            spi_out_log_cb_write_packet_loss(log_cb, SPI_OUT_PACKET_LOSS_LL_TASK);
+        }
+    }
+    return;
+}
+
+IRAM_ATTR void ble_log_spi_out_ll_log_ev_proc(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+    return spi_out_ll_log_ev_proc();
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    if (!ul_log_inited) {
+        return -1;
+    }
+
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    if (spi_out_log_cb_check_trans(ul_log_cb, len) == 0) {
+        spi_out_log_cb_write(ul_log_cb, addr, len, NULL, 0, source);
+        spi_out_log_cb_append_trans(ul_log_cb);
+
+        spi_out_log_cb_write_packet_loss(ul_log_cb, SPI_OUT_PACKET_LOSS_UL);
+    }
+    xSemaphoreGive(ul_log_mutex);
+    return 0;
+}
+
+int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
+{
+    if (!ul_log_inited) {
+        return -1;
+    }
+
+    // Get arguments
+    va_list args;
+    va_start(args, format);
+
+    // Get len as ref to allocate heap memory
+    va_list args_copy;
+    va_copy(args_copy, args);
+    int len = vsnprintf(NULL, 0, format, args_copy);
+    va_end(args_copy);
+
+    // Length validation
+    if ((len < 0) || (len > 0xFFFF)) {
+        va_end(args);
+        return -1;
+    }
+
+    // Allocate memory
+    uint8_t *buffer = malloc(len + 1);
+    if (!buffer) {
+        va_end(args);
+        return -1;
+    }
+
+    // Generate string
+    vsnprintf((char *)buffer, len + 1, format, args);
+    va_end(args);
+
+    uint32_t esp_ts = esp_timer_get_time();
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    if (spi_out_log_cb_check_trans(ul_log_cb, sizeof(uint32_t) + len) == 0) {
+        spi_out_log_cb_write(ul_log_cb, (const uint8_t *)&esp_ts, sizeof(uint32_t), (const uint8_t *)buffer, len, source);
+        spi_out_log_cb_append_trans(ul_log_cb);
+
+        spi_out_log_cb_write_packet_loss(ul_log_cb, SPI_OUT_PACKET_LOSS_UL);
+    }
+    xSemaphoreGive(ul_log_mutex);
+
+    // Release
+    free(buffer);
+    return 0;
+}
+
+int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...)
+{
+    if (!ul_log_inited) {
+        return -1;
+    }
+
+    // Create log prefix in the format: "[level][tag] "
+    char prefix[32];
+    int prefix_len = snprintf(prefix, sizeof(prefix), "[%d][%s] ", level, tag ? tag : "NULL");
+
+    // Compute the length of the formatted log message
+    va_list args;
+    va_start(args, format);
+    va_list args_copy;
+    va_copy(args_copy, args);
+    int log_len = vsnprintf(NULL, 0, format, args_copy);
+    va_end(args_copy);
+
+    // Validate length
+    if (log_len < 0 || log_len > 0xFFFF) {
+        va_end(args);
+        return -1;
+    }
+
+    // Compute total log length (prefix + formatted message)
+    int total_len = prefix_len + log_len;
+
+    // Allocate memory for the complete log message
+    uint8_t *buffer = malloc(total_len + 1);
+    if (!buffer) {
+        va_end(args);
+        return -1;
+    }
+
+    // Construct the final log message
+    memcpy(buffer, prefix, prefix_len);  // Copy the prefix
+    vsnprintf((char *)(buffer + prefix_len), log_len + 1, format, args);
+    va_end(args);
+
+    uint32_t esp_ts = esp_timer_get_time();
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    if (spi_out_log_cb_check_trans(ul_log_cb, sizeof(uint32_t) + total_len) == 0) {
+        spi_out_log_cb_write(ul_log_cb, (const uint8_t *)&esp_ts, sizeof(uint32_t), (const uint8_t *)buffer, total_len, source);
+        spi_out_log_cb_append_trans(ul_log_cb);
+
+        spi_out_log_cb_write_packet_loss(ul_log_cb, SPI_OUT_PACKET_LOSS_UL);
+    }
+    xSemaphoreGive(ul_log_mutex);
+
+    free(buffer);
+    return 0;
+}
+
+int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    if (!ul_log_inited) {
+        return -1;
+    }
+
+    uint32_t esp_ts = esp_timer_get_time();
+    xSemaphoreTake(ul_log_mutex, portMAX_DELAY);
+    if (spi_out_log_cb_check_trans(ul_log_cb, sizeof(uint32_t) + len) == 0) {
+        spi_out_log_cb_write(ul_log_cb, (const uint8_t *)&esp_ts, sizeof(uint32_t), addr, len, source);
+        spi_out_log_cb_append_trans(ul_log_cb);
+
+        spi_out_log_cb_write_packet_loss(ul_log_cb, SPI_OUT_PACKET_LOSS_UL);
+    }
+    xSemaphoreGive(ul_log_mutex);
+    return 0;
+}
+
+void ble_log_spi_out_dump_all(void)
+{
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    if (ll_log_inited) {
+        // Dump lower layer log buffer
+        esp_rom_printf("[LL_ISR_LOG_DUMP_START:\n");
+        spi_out_log_cb_dump(ll_isr_log_cb);
+        esp_rom_printf("\n:LL_ISR_LOG_DUMP_END]\n\n");
+
+        esp_rom_printf("[LL_TASK_LOG_DUMP_START:\n");
+        spi_out_log_cb_dump(ll_task_log_cb);
+        esp_rom_printf("\n:LL_TASK_LOG_DUMP_END]\n\n");
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
+
+    if (ul_log_inited) {
+        // Dump upper layer log buffer
+        esp_rom_printf("[UL_LOG_DUMP_START:\n");
+        spi_out_log_cb_dump(ul_log_cb);
+        esp_rom_printf("\n:UL_LOG_DUMP_END]\n\n");
+    }
+    portEXIT_CRITICAL_SAFE(&spinlock);
+}
+
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -0,0 +1,54 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "esp_log.h"
+#include "freertos/semphr.h"
+
+// Public typedefs
+#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
+#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
+#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_ISR 6
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR 7
+#define BLE_LOG_SPI_OUT_SOURCE_USER 0x10
+#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
+#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+
+// SPI Log Level Definitions
+#define BLE_LOG_SPI_OUT_LEVEL_NONE      0  /*!< No log output */
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR     1  /*!< Critical errors that SPI driver cannot recover from */
+#define BLE_LOG_SPI_OUT_LEVEL_WARN      2  /*!< Recoverable error conditions in SPI communication */
+#define BLE_LOG_SPI_OUT_LEVEL_INFO      3  /*!< Informational messages about SPI transactions */
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG     4  /*!< Detailed debug information, such as SPI register values */
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE   5  /*!< Very detailed debugging logs, potentially flooding output */
+#define BLE_LOG_SPI_OUT_LEVEL_MAX       6  /*!< Number of SPI log levels supported */
+
+// Public functions
+int ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_timer_control(bool enable);
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,\
+                              const uint8_t *addr_append, uint32_t flag);
+void ble_log_spi_out_ll_log_ev_proc(void);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+int ble_log_spi_out_printf(uint8_t source, const char *format, ...);
+int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...);
+int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_dump_all(void);
+
+#endif // __BT_SPI_OUT_H__

components/bt/common/btc/core/btc_manage.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -16,6 +16,12 @@ void **btc_profile_cb_tab;
 
 void esp_profile_cb_reset(void)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return;
+    }
+    #endif
+
     int i;
 
     for (i = 0; i < BTC_PID_NUM; i++) {
@@ -25,6 +31,12 @@ void esp_profile_cb_reset(void)
 
 int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return -1;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return -1;
     }
@@ -36,6 +48,12 @@ int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 
 void *btc_profile_cb_get(btc_pid_t profile_id)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return NULL;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return NULL;
     }

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     uint16_t checksum, checksum_pkt;
     int ret;
 

components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h

@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a
 
 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -240,6 +240,32 @@ static void init_gatt_values(void)
 
 }
 
+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
     int rc;
@@ -260,6 +286,18 @@ int esp_blufi_gatt_svr_init(void)
     return 0;
 }
 
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
 static int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {

components/bt/common/include/bt_common.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -84,6 +84,20 @@
 #define BT_HCI_LOG_INCLUDED  FALSE
 #endif
 
+// HCI LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+// BLURDROID LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/common/include/bt_user_config.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -120,6 +120,20 @@
 #define UC_BT_HCI_LOG_DEBUG_EN  FALSE
 #endif
 
+//HCI LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+//BLUEDROID LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/common/osi/include/osi/fixed_pkt_queue.h

@@ -76,4 +76,8 @@ void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
 
 void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif

components/bt/common/tinycrypt/include/tinycrypt/aes.h

@@ -1,4 +1,8 @@
-/* aes.h - TinyCrypt interface to an AES-128 implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cbc_mode.h

@@ -1,4 +1,8 @@
-/* cbc_mode.h - TinyCrypt interface to a CBC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ccm_mode.h

@@ -1,4 +1,8 @@
-/* ccm_mode.h - TinyCrypt interface to a CCM mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cmac_mode.h

@@ -1,4 +1,8 @@
-/*  cmac_mode.h -- interface to a CMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved

components/bt/common/tinycrypt/include/tinycrypt/constants.h

@@ -1,4 +1,8 @@
-/* constants.h - TinyCrypt interface to constants */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_mode.h

@@ -1,4 +1,8 @@
-/* ctr_mode.h - TinyCrypt interface to CTR mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_prng.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_prng.h - TinyCrypt interface to a CTR-PRNG implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc.h - TinyCrypt interface to common ECC functions */
 
 /* Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dh.h

@@ -1,4 +1,8 @@
-/* ecc_dh.h - TinyCrypt interface to EC-DH implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dsa.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc_dh.h - TinyCrypt interface to EC-DSA implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc_platform_specific.h

@@ -1,4 +1,8 @@
-/*  uECC_platform_specific.h - Interface to platform specific functions*/
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /* Copyright (c) 2014, Kenneth MacKay
  * All rights reserved.

components/bt/common/tinycrypt/include/tinycrypt/hmac.h

@@ -1,4 +1,8 @@
-/* hmac.h - TinyCrypt interface to an HMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -124,7 +128,7 @@ int tc_hmac_update(TCHmacState_t ctx, const void *data,
  *                key == NULL or
  *                taglen != TC_SHA256_DIGEST_SIZE
  *  @note ctx is erased before exiting. This should never be changed/removed.
- *  @note Assumes the tag bufer is at least sizeof(hmac_tag_size(state)) bytes
+ *  @note Assumes the tag buffer is at least sizeof(hmac_tag_size(state)) bytes
  *  state has been initialized by tc_hmac_init
  *  @param tag IN/OUT -- buffer to receive computed HMAC tag
  *  @param taglen IN -- size of tag in bytes

components/bt/common/tinycrypt/include/tinycrypt/hmac_prng.h

@@ -1,4 +1,8 @@
-/* hmac_prng.h - TinyCrypt interface to an HMAC-PRNG implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/sha256.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* sha256.h - TinyCrypt interface to a SHA-256 implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/utils.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* utils.h - TinyCrypt interface to platform-dependent run-time operations */
 
 /*

components/bt/common/tinycrypt/port/esp_tinycrypt_port.c

@@ -0,0 +1,70 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_tinycrypt_port.h"
+
+#if SOC_ECC_SUPPORTED
+#include "esp_crypto_lock.h"
+#include "esp_private/periph_ctrl.h"
+
+#include "hal/ecc_hal.h"
+#include "hal/ecc_ll.h"
+
+static void  esp_tinycrypt_acquire_ecc_hardware(void)
+{
+    esp_crypto_ecc_lock_acquire();
+
+    periph_module_enable(PERIPH_ECC_MODULE);
+}
+
+static void  esp_tinycrypt_release_ecc_hardware(void)
+{
+    periph_module_disable(PERIPH_ECC_MODULE);
+
+    esp_crypto_ecc_lock_release();
+}
+
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length)
+{
+    int result;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_verify_param(pk_x, pk_y, length);
+    ecc_hal_set_mode(ECC_MODE_VERIFY);
+    ecc_hal_start_calc();
+    while (!ecc_hal_is_calc_finished());
+    result = ecc_hal_read_verify_result();
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    if (result == 1) {
+        return 0;
+    } else {
+        return -1;
+    }
+}
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first)
+{
+    int ret = -1;
+    ecc_mode_t work_mode = verify_first ? ECC_MODE_VERIFY_THEN_POINT_MUL : ECC_MODE_POINT_MUL;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_mul_param(scalar, p_x, p_y, num_bytes);
+    ecc_hal_set_mode(work_mode);
+    ecc_hal_start_calc();
+
+    while (!ecc_hal_is_calc_finished());
+
+    ret = ecc_hal_read_mul_result(r_x, r_y, num_bytes);
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    return ret;
+}
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/port/esp_tinycrypt_port.h

@@ -0,0 +1,15 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include <stdbool.h>
+#include "soc/soc_caps.h"
+
+#if SOC_ECC_SUPPORTED
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length);
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first);
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/src/aes_decrypt.c

@@ -1,4 +1,8 @@
-/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+
 #include <tinycrypt/aes.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/aes_encrypt.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* aes_encrypt.c - TinyCrypt implementation of AES encryption procedure */
 
 /*

components/bt/common/tinycrypt/src/cbc_mode.c

@@ -1,4 +1,8 @@
-/* cbc_mode.c - TinyCrypt implementation of CBC mode encryption & decryption */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ccm_mode.c

@@ -1,4 +1,8 @@
-/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+
 #include <tinycrypt/ccm_mode.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/cmac_mode.c

@@ -1,4 +1,8 @@
-/* cmac_mode.c - TinyCrypt CMAC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ctr_mode.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_mode.c - TinyCrypt CTR mode implementation */
 
 /*

components/bt/common/tinycrypt/src/ctr_prng.c

@@ -1,4 +1,8 @@
-/* ctr_prng.c - TinyCrypt implementation of CTR-PRNG */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2016, Chris Morrison

components/bt/common/tinycrypt/src/ecc.c

@@ -1,4 +1,8 @@
-/* ecc.c - TinyCrypt implementation of common ECC functions */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay
@@ -55,6 +59,9 @@
 #include <tinycrypt/ecc.h>
 #include <tinycrypt/ecc_platform_specific.h>
 #include <string.h>
+#include <stdio.h>
+
+#include "esp_tinycrypt_port.h"
 
 /* IMPORTANT: Make sure a cryptographically-secure PRNG is set and the platform
  * has access to enough entropy in order to feed the PRNG regularly. */
@@ -635,6 +642,7 @@ void apply_z(uECC_word_t * X1, uECC_word_t * Y1, const uECC_word_t * const Z,
 	uECC_vli_modMult_fast(Y1, Y1, t1, curve); /* y1 * z^3 */
 }
 
+#if !SOC_ECC_SUPPORTED
 /* P = (x1, y1) => 2P, (x2, y2) => P' */
 static void XYcZ_initial_double(uECC_word_t * X1, uECC_word_t * Y1,
 				uECC_word_t * X2, uECC_word_t * Y2,
@@ -658,31 +666,6 @@ static void XYcZ_initial_double(uECC_word_t * X1, uECC_word_t * Y1,
 	apply_z(X2, Y2, z, curve);
 }
 
-void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1,
-	      uECC_word_t * X2, uECC_word_t * Y2,
-	      uECC_Curve curve)
-{
-	/* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
-	uECC_word_t t5[NUM_ECC_WORDS];
-	wordcount_t num_words = curve->num_words;
-
-	uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
-	uECC_vli_modSquare_fast(t5, t5, curve); /* t5 = (x2 - x1)^2 = A */
-	uECC_vli_modMult_fast(X1, X1, t5, curve); /* t1 = x1*A = B */
-	uECC_vli_modMult_fast(X2, X2, t5, curve); /* t3 = x2*A = C */
-	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
-	uECC_vli_modSquare_fast(t5, Y2, curve); /* t5 = (y2 - y1)^2 = D */
-
-	uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
-	uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
-	uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
-	uECC_vli_modMult_fast(Y1, Y1, X2, curve); /* t2 = y1*(C - B) */
-	uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
-	uECC_vli_modMult_fast(Y2, Y2, X2, curve); /* t4 = (y2 - y1)*(B - x3) */
-	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
-
-	uECC_vli_set(X2, t5, num_words);
-}
 
 /* Input P = (x1, y1, Z), Q = (x2, y2, Z)
    Output P + Q = (x3, y3, Z3), P - Q = (x3', y3', Z3)
@@ -725,12 +708,49 @@ static void XYcZ_addC(uECC_word_t * X1, uECC_word_t * Y1,
 
 	uECC_vli_set(X1, t7, num_words);
 }
+#endif /* !SOC_ECC_SUPPORTED */
+
+void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1,
+	      uECC_word_t * X2, uECC_word_t * Y2,
+	      uECC_Curve curve)
+{
+	/* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
+	uECC_word_t t5[NUM_ECC_WORDS];
+	wordcount_t num_words = curve->num_words;
+
+	uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
+	uECC_vli_modSquare_fast(t5, t5, curve); /* t5 = (x2 - x1)^2 = A */
+	uECC_vli_modMult_fast(X1, X1, t5, curve); /* t1 = x1*A = B */
+	uECC_vli_modMult_fast(X2, X2, t5, curve); /* t3 = x2*A = C */
+	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
+	uECC_vli_modSquare_fast(t5, Y2, curve); /* t5 = (y2 - y1)^2 = D */
+
+	uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
+	uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
+	uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
+	uECC_vli_modMult_fast(Y1, Y1, X2, curve); /* t2 = y1*(C - B) */
+	uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
+	uECC_vli_modMult_fast(Y2, Y2, X2, curve); /* t4 = (y2 - y1)*(B - x3) */
+	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
+
+	uECC_vli_set(X2, t5, num_words);
+}
 
 void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
 		   const uECC_word_t * scalar,
 		   const uECC_word_t * initial_Z,
 		   bitcount_t num_bits, uECC_Curve curve)
 {
+#if SOC_ECC_SUPPORTED
+    wordcount_t num_words = curve->num_words;
+
+    /* Only p256r1 is supported currently. */
+    assert (curve == uECC_secp256r1());
+
+    esp_tinycrypt_calc_ecc_mult((const uint8_t *)&point[0], (const uint8_t *)&point[num_words],
+                                (uint8_t *)scalar, (uint8_t *)&result[0], (uint8_t *)&result[num_words],
+                                num_words * uECC_WORD_SIZE, false);
+#else
 	/* R0 and R1 */
 	uECC_word_t Rx[2][NUM_ECC_WORDS];
 	uECC_word_t Ry[2][NUM_ECC_WORDS];
@@ -769,6 +789,7 @@ void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
 
 	uECC_vli_set(result, Rx[0], num_words);
 	uECC_vli_set(result + num_words, Ry[0], num_words);
+#endif /* SOC_ECC_SUPPORTED */
 }
 
 uECC_word_t regularize_k(const uECC_word_t * const k, uECC_word_t *k0,
@@ -862,8 +883,6 @@ int uECC_generate_random_int(uECC_word_t *random, const uECC_word_t *top,
 
 int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve)
 {
-	uECC_word_t tmp1[NUM_ECC_WORDS];
-	uECC_word_t tmp2[NUM_ECC_WORDS];
 	wordcount_t num_words = curve->num_words;
 
 	/* The point at infinity is invalid. */
@@ -877,19 +896,34 @@ int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve)
 		return -2;
 	}
 
+#if SOC_ECC_SUPPORTED
+    /* Only p256r1 is supported currently. */
+    if (curve != uECC_secp256r1()) {
+        return -5;
+    }
+
+    if (esp_tinycrypt_verify_ecc_point((const uint8_t *)&point[0],
+                                       (const uint8_t *)&point[num_words],
+                                       num_words * uECC_WORD_SIZE)) {
+        return -3;
+    }
+#else
+	uECC_word_t tmp1[NUM_ECC_WORDS];
+	uECC_word_t tmp2[NUM_ECC_WORDS];
+
 	uECC_vli_modSquare_fast(tmp1, point + num_words, curve);
 	curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
 
 	/* Make sure that y^2 == x^3 + ax + b */
 	if (uECC_vli_equal(tmp1, tmp2, num_words) != 0)
 		return -3;
+#endif /* SOC_ECC_SUPPORTED */
 
 	return 0;
 }
 
 int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve)
 {
-
 	uECC_word_t _public[NUM_ECC_WORDS * 2];
 
 	uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
@@ -908,7 +942,6 @@ int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve)
 int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key,
 			    uECC_Curve curve)
 {
-
 	uECC_word_t _private[NUM_ECC_WORDS];
 	uECC_word_t _public[NUM_ECC_WORDS * 2];
 

components/bt/common/tinycrypt/src/ecc_dh.c

@@ -1,4 +1,8 @@
-/* ec_dh.c - TinyCrypt implementation of EC-DH */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/src/ecc_dsa.c

@@ -1,4 +1,8 @@
-/* ec_dsa.c - TinyCrypt implementation of EC-DSA */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /* Copyright (c) 2014, Kenneth MacKay
  * All rights reserved.

components/bt/common/tinycrypt/src/ecc_platform_specific.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /*  uECC_platform_specific.c - Implementation of platform specific functions*/
 
 /* Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/src/hmac.c

@@ -1,4 +1,8 @@
-/* hmac.c - TinyCrypt implementation of the HMAC algorithm */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/hmac_prng.c

@@ -1,4 +1,8 @@
-/* hmac_prng.c - TinyCrypt implementation of HMAC-PRNG */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* hmac_prng.c - TinyCrypt implementation of HMAC-PRNG */
+
 #include <tinycrypt/hmac_prng.h>
 #include <tinycrypt/hmac.h>
 #include <tinycrypt/constants.h>

components/bt/common/tinycrypt/src/sha256.c

@@ -1,4 +1,8 @@
-/* sha256.c - TinyCrypt SHA-256 crypto hash algorithm implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/utils.c

@@ -1,4 +1,8 @@
-/* utils.c - TinyCrypt platform-dependent run-time operations */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* utils.c - TinyCrypt platform-dependent run-time operations */
+
 #include <tinycrypt/utils.h>
 #include <tinycrypt/constants.h>
 

components/bt/controller/esp32/Kconfig.in

@@ -23,6 +23,14 @@ config BTDM_CTRL_BLE_MAX_CONN
         BLE maximum connections of bluetooth controller.
         Each connection uses 1KB static DRAM whenever the BT controller is enabled.
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT
+    int "BR/EDR default minimum size of encryption key"
+    depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 7
+    range 7 16
+    help
+        BR/EDR default minimum size of encryption key when start encryption.
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN
     int "BR/EDR ACL Max Connections"
     depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -139,6 +147,11 @@ config BTDM_CTRL_BLE_MAX_CONN_EFF
     default BTDM_CTRL_BLE_MAX_CONN if BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM
     default 0
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT_EFF
+    int
+    default BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 0
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN_EFF
     int
     default BTDM_CTRL_BR_EDR_MAX_ACL_CONN if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -467,6 +480,31 @@ menu "BLE disconnect when instant passed"
             when instant passed in channel map update procedure.
 endmenu
 
+config BTDM_BLE_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BTDM_BLE_PING_EN
+    bool "Enable LE Ping procedure"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+config BTDM_CTRL_CONTROLLER_DEBUG_MODE_1
+    bool "Enable Bluetooth controller debugging mode 1 (for internal use only)"
+    default n
+    depends on BT_ENABLED
+    help
+        Enables specific debugging features for the Bluetooth controller.
+        This option is strictly for internal debugging purposes and should not be enabled in production environments,
+        as it may impact performance and stability.
+
 config BTDM_RESERVE_DRAM
     hex
     default 0xdb5c if BT_ENABLED

components/bt/controller/esp32/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -44,6 +44,10 @@
 #include "esp_rom_sys.h"
 #include "hli_api.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -260,6 +264,16 @@ extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+extern void bt_stack_enableSecCtrlVsCmd(bool en);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+extern void bt_stack_enableCoexVsCmd(bool en);
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
 /* Local Function Declare
  *********************************************************************
  */
@@ -460,7 +474,11 @@ static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit f
 
 #if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
 // used low power clock
-static DRAM_ATTR uint8_t btdm_lpclk_sel;
+#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL;
+#else
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL;
+#endif /* CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL */
 #endif /* #ifdef CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG */
 
 static DRAM_ATTR QueueHandle_t s_wakeup_req_sem = NULL;
@@ -1083,9 +1101,8 @@ static bool async_wakeup_request(int event)
 
     switch (event) {
         case BTDM_ASYNC_WAKEUP_REQ_HCI:
-            btdm_in_wakeup_requesting_set(true);
-            // NO break
         case BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA:
+            btdm_in_wakeup_requesting_set(true);
             if (!btdm_power_state_active()) {
                 do_wakeup_request = true;
 
@@ -1118,10 +1135,10 @@ static void async_wakeup_request_end(int event)
     bool request_lock = false;
     switch (event) {
         case BTDM_ASYNC_WAKEUP_REQ_HCI:
+        case BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA:
             request_lock = true;
             break;
         case BTDM_ASYNC_WAKEUP_REQ_COEX:
-        case BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA:
             request_lock = false;
             break;
         default:
@@ -1543,6 +1560,117 @@ static void hli_queue_setup_pinned_to_core(int core_id)
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
+// init low-power control resources
+static esp_err_t btdm_low_power_mode_init(void)
+{
+    esp_err_t err = ESP_OK;
+
+#ifdef CONFIG_PM_ENABLE
+    s_btdm_allow_light_sleep = false;
+#endif
+
+    // set default sleep clock cycle and its fractional bits
+    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        // check whether or not EXT_CRYS is working
+        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
+#ifdef CONFIG_PM_ENABLE
+            s_btdm_allow_light_sleep = true;
+#endif
+        } else {
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
+                    "light sleep mode will not be able to apply when bluetooth is enabled");
+            btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL; // set default value
+        }
+    } else if (btdm_lpclk_sel != ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        assert(0);
+    }
+
+    bool select_src_ret __attribute__((unused));
+    bool set_div_ret __attribute__((unused));
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
+        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
+        set_div_ret = btdm_lpclk_set_div(0);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
+            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
+        assert(btdm_lpcycle_us != 0);
+    }
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
+
+#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
+#else
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+#endif
+
+#ifdef CONFIG_PM_ENABLE
+    if (!s_btdm_allow_light_sleep) {
+        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+            return err;
+        }
+    }
+    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+        return err;
+    }
+    esp_timer_create_args_t create_args = {
+        .callback = btdm_slp_tmr_callback,
+        .arg = NULL,
+        .name = "btSlp"
+    };
+    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
+        return err;
+    }
+
+    s_pm_lock_acquired = true;
+#endif
+
+    return err;
+}
+
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_INITED &&
+            btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return ESP_BT_SLEEP_CLOCK_NONE;
+    }
+    return btdm_lpclk_sel;
+#else
+    return ESP_BT_SLEEP_CLOCK_NONE;
+#endif
+}
+
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (lpclk < ESP_BT_SLEEP_CLOCK_MAIN_XTAL || lpclk > ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (btdm_controller_status == ESP_BT_CONTROLLER_STATUS_INITED ||
+            btdm_controller_status == ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        ESP_LOGW(BTDM_LOG_TAG, "Please set the Bluetooth sleep clock source before Bluetooth initialization");
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    btdm_lpclk_sel = lpclk;
+    return ESP_OK;
+#else
+    return ESP_ERR_NOT_SUPPORTED;
+#endif
+}
+
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 {
     esp_err_t err;
@@ -1605,58 +1733,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     btdm_controller_mem_init();
 
     periph_module_enable(PERIPH_BT_MODULE);
-
-#ifdef CONFIG_PM_ENABLE
-    s_btdm_allow_light_sleep = false;
-#endif
-
-    // set default sleep clock cycle and its fractional bits
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-
-#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
-
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-    // check whether or not EXT_CRYS is working
-    if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32kHz XTAL
-#ifdef CONFIG_PM_ENABLE
-        s_btdm_allow_light_sleep = true;
-#endif
-    } else {
-        ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-    }
-#else
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#endif
-
-    bool select_src_ret __attribute__((unused));
-    bool set_div_ret __attribute__((unused));
-    if (btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
-        set_div_ret = btdm_lpclk_set_div(0);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
-            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
-        assert(btdm_lpcycle_us != 0);
-    }
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
-
-#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
-#else
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-#endif
+    periph_module_reset(PERIPH_BT_MODULE);
 
 #if CONFIG_BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
     sdk_config_set_uart_flow_ctrl_enable(true);
@@ -1664,31 +1741,22 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     sdk_config_set_uart_flow_ctrl_enable(false);
 #endif
 
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
-            goto error;
-        }
-    }
-    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+    if ((err = btdm_low_power_mode_init()) != ESP_OK) {
+        ESP_LOGE(BTDM_LOG_TAG, "Low power module initialization failed");
         goto error;
     }
-    esp_timer_create_args_t create_args = {
-        .callback = btdm_slp_tmr_callback,
-        .arg = NULL,
-        .name = "btSlp"
-    };
-    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
-        goto error;
-    }
-
-    s_pm_lock_acquired = true;
-#endif
 
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        ESP_LOGE(BTDM_LOG_TAG, "BLE Log SPI output init failed");
+        goto error;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_cfg_mask = btdm_config_mask_load();
 
     err = btdm_controller_init(btdm_cfg_mask, cfg);
@@ -1699,12 +1767,26 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(true);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(true);
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
 
 error:
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     bt_controller_deinit_internal();
 
     return err;
@@ -1716,17 +1798,30 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(false);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(false);
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     return ESP_OK;
 }
 
-static void bt_controller_deinit_internal(void)
+// deinit low power control resources
+static void btdm_low_power_mode_deinit(void)
 {
-    periph_module_disable(PERIPH_BT_MODULE);
-
 #ifdef CONFIG_PM_ENABLE
     if (!s_btdm_allow_light_sleep) {
         esp_pm_lock_delete(s_light_sleep_pm_lock);
@@ -1747,6 +1842,16 @@ static void bt_controller_deinit_internal(void)
     s_pm_lock_acquired = false;
 #endif
 
+    btdm_lpcycle_us = 0;
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+}
+
+static void bt_controller_deinit_internal(void)
+{
+    periph_module_disable(PERIPH_BT_MODULE);
+
+    btdm_low_power_mode_deinit();
+
     if (s_wakeup_req_sem) {
         semphr_delete_wrapper(s_wakeup_req_sem);
         s_wakeup_req_sem = NULL;
@@ -1759,9 +1864,6 @@ static void bt_controller_deinit_internal(void)
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
-    btdm_lpcycle_us = 0;
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-
     esp_bt_power_domain_off();
 
     esp_phy_modem_deinit();
@@ -1872,6 +1974,7 @@ esp_err_t esp_bt_controller_disable(void)
         while (!btdm_power_state_active()) {
             esp_rom_delay_us(1000);
         }
+        async_wakeup_request_end(BTDM_ASYNC_WAKEUP_REQ_CTRL_DISA);
     }
 
     btdm_controller_disable();

components/bt/controller/esp32c2/Kconfig.in

@@ -90,7 +90,7 @@ menu "HCI Config"
     config BT_LE_HCI_TRANS_TASK_STACK_SIZE
         int "HCI transport task stack size"
         depends on !BT_LE_HCI_INTERFACE_USE_RAM
-        default 1024
+        default 2048
         help
             This configures stack size of hci transport task
 endmenu
@@ -308,6 +308,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -347,6 +356,19 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -402,7 +424,7 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
 
 config BT_LE_WHITELIST_SIZE
     int "BLE white list size"
-    range 1 15
+    range 1 31
     default 12
     depends on !BT_NIMBLE_ENABLED
 
@@ -659,6 +681,11 @@ config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
     depends on BT_CTRL_RUN_IN_FLASH_ONLY
     default n
 
+config BT_LE_PLACE_SLEEP_RELATED_INTO_IRAM
+    bool
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_LE_SLEEP_ENABLE
+    default y
+
 config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
     default n
@@ -666,3 +693,33 @@ config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.

components/bt/controller/esp32c2/ble.c

@@ -0,0 +1,71 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+#if DEFAULT_BT_LE_ROLE_BROADCASTER
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if DEFAULT_BT_LE_ROLE_OBSERVER
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_OBSERVER
+
+    chanSel_stack_enableSetCsaVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+#if DEFAULT_BT_LE_ROLE_BROADCASTER
+    adv_stack_enableScanReqRxdVsEvent(en);
+#endif // DEFAULT_BT_LE_ROLE_BROADCASTER
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_enable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+}

components/bt/controller/esp32c2/ble_priv.h

@@ -0,0 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef _BLE_PRIV_H_
+#define _BLE_PRIV_H_
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);
+
+#endif // _BLE_PRIV_H_

components/bt/controller/esp32c2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -61,6 +62,10 @@
 #include "hal/efuse_ll.h"
 #include "soc/rtc.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -109,7 +114,7 @@ struct ext_funcs_t {
 };
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* External functions or variables
@@ -119,10 +124,12 @@ extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int coex_core_ble_conn_dyn_prio_get(bool *low, bool *high);
 extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int ble_log_init_async(interface_func_t interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int ble_log_deinit_async(void);
+extern int ble_log_init_simple(interface_func_t interface, void *handler);
+extern void ble_log_deinit_simple(void);
 extern void ble_log_async_output_dump_all(bool output);
-extern void esp_panic_handler_reconfigure_wdts(void);
+extern void esp_panic_handler_feed_wdts(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@@ -189,10 +196,12 @@ static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
-#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
@@ -202,47 +211,29 @@ void *g_ble_lll_rfmgmt_env_p;
 #endif
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
-enum log_out_mode {
-    LOG_DUMP_MEMORY,
-    LOG_ASYNC_OUT,
-    LOG_STORAGE_TO_FLASH,
-};
+static bool log_is_inited = false;
 
-bool log_is_inited = false;
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-uint8_t log_output_mode = LOG_DUMP_MEMORY;
-#else
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
-#else
-uint8_t log_output_mode = LOG_ASYNC_OUT;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-
-void esp_bt_log_output_mode_set(uint8_t output_mode)
+esp_err_t esp_bt_controller_log_init(void)
 {
-    log_output_mode = output_mode;
-}
-
-uint8_t esp_bt_log_output_mode_get(void)
-{
-    return log_output_mode;
-}
-
-esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
-{
-    esp_err_t ret = ESP_OK;
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    bool task_create;
-    uint8_t buffers = 0;
-
     if (log_is_inited) {
-        return ret;
+        return ESP_OK;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        goto spi_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    if (ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
@@ -250,34 +241,41 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
     buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 
-    switch (log_output_mode) {
-        case LOG_DUMP_MEMORY:
-            task_create = false;
-            break;
-        case LOG_ASYNC_OUT:
-        case LOG_STORAGE_TO_FLASH:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-                esp_bt_ctrl_log_partition_get_and_erase_first_block();
-            }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            break;
-        default:
-            assert(0);
-    }
+    bool task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    task_create = false;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_ctrl_log_partition_get_and_erase_first_block();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
-    ret = ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
-    if (ret == ESP_OK) {
-        log_is_inited = true;
+    if (ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
+        goto log_init_failed;
     }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
-    return ret;
+    log_is_inited = true;
+    return ESP_OK;
+
+log_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+spi_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    return ESP_FAIL;
 }
 
-void esp_bt_ontroller_log_deinit(void)
+void esp_bt_controller_log_deinit(void)
 {
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
     ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
     log_is_inited = false;
 }
 
@@ -370,13 +368,13 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 
     portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts();
+    esp_panic_handler_feed_wdts();
     ble_log_async_output_dump_all(true);
+    esp_bt_controller_log_deinit();
     stop_write = true;
-    esp_bt_ontroller_log_deinit();
-    portEXIT_CRITICAL_SAFE(&spinlock);
 
     buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_feed_wdts();
     if (is_filled) {
         read_index = next_erase_index;
     } else {
@@ -388,7 +386,7 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     while (read_index != write_index) {
         esp_rom_printf("%02x ", buffer[read_index]);
         if (print_len > max_print_len) {
-            vTaskDelay(2);
+            esp_panic_handler_feed_wdts();
             print_len = 0;
         }
 
@@ -396,45 +394,70 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
         read_index = (read_index + 1) % MAX_STORAGE_SIZE;
     }
     esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
     esp_partition_munmap(mmap_handle);
-    err = esp_bt_controller_log_init(log_output_mode);
+    err = esp_bt_controller_log_init();
     assert(err == ESP_OK);
 
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
-{
-    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_controller_log_storage(len, addr, end);
-#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        for (int i = 0; i < len; i++) {
-            esp_rom_printf("%02x ", addr[i]);
-        }
 
-        if (end) {
-            esp_rom_printf("\n");
-        }
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
+{
+    bool end = flag ? true : false;
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_controller_log_storage(len, addr, end);
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    for (int i = 0; i < len; i++) {
+        esp_rom_printf("%02x ", addr[i]);
     }
+
+    if (end) {
+        esp_rom_printf("\n");
+    }
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-   if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_read_ctrl_log_from_flash(output);
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-        portENTER_CRITICAL_SAFE(&spinlock);
-        esp_panic_handler_reconfigure_wdts();
-        BT_ASSERT_PRINT("\r\n[DUMP_START:");
-        ble_log_async_output_dump_all(output);
-        BT_ASSERT_PRINT(":DUMP_END]\r\n");
-        portEXIT_CRITICAL_SAFE(&spinlock);
-    }
+    esp_bt_read_ctrl_log_from_flash(output);
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    BT_ASSERT_PRINT("\r\n[DUMP_START:");
+    ble_log_async_output_dump_all(output);
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif
 }
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -447,6 +470,17 @@ static DRAM_ATTR ble_rtc_slow_clk_src_t s_bt_lpclk_src = BT_SLOW_CLK_SRC_INVALID
 
 #define BLE_RTC_DELAY_US                    (1800)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -556,13 +590,6 @@ static int esp_intr_free_wrapper(void **ret_handle)
     return rc;
 }
 
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-void sleep_modem_light_sleep_overhead_set(uint32_t overhead)
-{
-    esp_ble_set_wakeup_overhead(overhead);
-}
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
-
 ble_rtc_slow_clk_src_t esp_bt_get_lpclk_src(void)
 {
     return s_bt_lpclk_src;
@@ -577,7 +604,7 @@ void esp_bt_set_lpclk_src(ble_rtc_slow_clk_src_t clk_src)
     s_bt_lpclk_src = clk_src;
 }
 
-IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
+void controller_sleep_cb(uint32_t enable_tick, void *arg)
 {
     if (!s_ble_active) {
         return;
@@ -591,7 +618,7 @@ IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
     s_ble_active = false;
 }
 
-IRAM_ATTR void controller_wakeup_cb(void *arg)
+void controller_wakeup_cb(void *arg)
 {
     if (s_ble_active) {
         return;
@@ -631,7 +658,7 @@ esp_err_t controller_sleep_init(ble_rtc_slow_clk_src_t slow_clk_src)
     esp_sleep_enable_bt_wakeup();
     ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Enable light sleep, the wake up source is BLE timer");
 
-    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
     if (rc != ESP_OK) {
         goto error;
     }
@@ -641,7 +668,7 @@ esp_err_t controller_sleep_init(ble_rtc_slow_clk_src_t slow_clk_src)
 error:
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
     esp_sleep_disable_bt_wakeup();
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
     /*lock should release first and then delete*/
     if (s_pm_lock != NULL) {
@@ -658,7 +685,7 @@ void controller_sleep_deinit(void)
     r_ble_rtc_wake_up_state_clr();
     esp_sleep_disable_bt_wakeup();
     esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_AUTO);
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif // CONFIG_FREERTOS_USE_TICKLESS_IDLE
 #ifdef CONFIG_PM_ENABLE
     /*lock should release first and then delete*/
@@ -849,7 +876,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble rom commit:[%s]", r_ble_controller_get_rom_compile_version());
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ret = esp_bt_controller_log_init(log_output_mode);
+    ret = esp_bt_controller_log_init();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto controller_init_err;
@@ -898,7 +925,7 @@ free_controller:
     controller_sleep_deinit();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 controller_init_err:
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     ble_controller_deinit();
 modem_deint:
@@ -928,7 +955,7 @@ esp_err_t esp_bt_controller_deinit(void)
     controller_sleep_deinit();
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     ble_controller_deinit();
 
@@ -982,6 +1009,12 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -991,6 +1024,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1013,7 +1047,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
-
+    ble_stack_disable();
     if (s_ble_active) {
         esp_phy_disable();
 #if CONFIG_PM_ENABLE
@@ -1164,12 +1198,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1196,9 +1238,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1221,11 +1267,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1254,9 +1304,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -226,12 +226,44 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/controller/esp32c3/Kconfig.in

@@ -66,7 +66,7 @@ endchoice
 config BT_CTRL_HCI_TL
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
     help
         HCI mode as VHCI or UART(H4)
@@ -83,13 +83,16 @@ choice BT_BLE_CCA_MODE
     default BT_BLE_CCA_MODE_NONE
     help
         Define BT BLE CCA mode
+        Note that if CCA feature is enabled, the hardware may not transmit packets due to channel busy.
+        Therefore, it may potentially lead to an increase in the time taken for scanning advertising packet
+        and establishing connections, or a decrease in the throughput rate of the connection.
 
     config BT_BLE_CCA_MODE_NONE
         bool "NONE"
     config BT_BLE_CCA_MODE_HW
         bool "Hardware"
     config BT_BLE_CCA_MODE_SW
-        bool "Software"
+        bool "Software (experimental)"
 endchoice
 
 config BT_BLE_CCA_MODE
@@ -445,7 +448,7 @@ config BT_CTRL_SLEEP_CLOCK_EFF
 config BT_CTRL_HCI_TL_EFF
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
 
 config BT_CTRL_AGC_RECORRECT_EN
@@ -550,3 +553,71 @@ config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
+
+menu "Controller debug log Options (Experimental)"
+    config BT_CTRL_LE_LOG_EN
+        depends on BT_CTRL_RUN_IN_FLASH_ONLY
+        bool "Enable BLE debug log"
+        default n
+
+    config BT_CTRL_LE_HCI_LOG_EN
+        depends on BT_CTRL_LE_LOG_EN
+        bool "Enable BLE HCI log"
+        default n
+
+    config BT_CTRL_LE_LOG_DUMP_ONLY
+        depends on BT_CTRL_LE_LOG_EN
+        bool "Enable BLE log dump only"
+        default n
+
+    config BT_CTRL_LE_LOG_STORAGE_EN
+        depends on BT_CTRL_LE_LOG_EN
+        bool "Enable BLE log storage to flash"
+        default n
+
+    config BT_CTRL_LE_LOG_PARTITION_SIZE
+        int "The size of ble controller log partition(Multiples of 4K)"
+        depends on BT_CTRL_LE_LOG_STORAGE_EN
+        default 65536
+        help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+    config BT_CTRL_LE_LOG_SPI_OUT_EN
+        bool "Output ble controller logs to SPI bus"
+        depends on BT_CTRL_LE_LOG_EN
+        depends on !BT_CTRL_LE_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_CTRL_LE_LOG_MODE_EN
+        depends on BT_CTRL_LE_LOG_EN
+        int "Enable log for specified BLE mode"
+        range 0 4095
+        default 4093
+
+    config BT_CTRL_LE_LOG_LEVEL
+        depends on BT_CTRL_LE_LOG_EN
+        int "The level of BLE log"
+        range 0 5
+        default 2
+
+    config BT_CTRL_LE_LOG_BUF1_SIZE
+        depends on BT_CTRL_LE_LOG_EN
+        int "The size of BLE log buffer1"
+        default 1024
+
+    config BT_CTRL_LE_LOG_HCI_BUF_SIZE
+        depends on BT_CTRL_LE_LOG_EN
+        int "The size of BLE log HCI buffer"
+        default 1024
+
+    config BT_CTRL_LE_LOG_BUF2_SIZE
+        depends on BT_CTRL_LE_LOG_EN
+        int "The size of BLE log buffer2"
+        default 1024
+endmenu

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -46,6 +46,13 @@
 #include "xtensa/core-macros.h"
 #include "esp32s3/rom/rom_layout.h"
 #endif
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+#include "esp_partition.h"
+#include "hal/wdt_hal.h"
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -112,12 +119,20 @@ do{\
 } while(0)
 
 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010009
+#define OSI_VERSION              0x0001000A
 #define OSI_MAGIC_VALUE          0xFADEBEAD
 
 #define BLE_PWR_HDL_INVL 0xFFFF
 
 #define BLE_CONTROLLER_MALLOC_CAPS        (MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA)
+
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+#define MAX_STORAGE_SIZE          (CONFIG_BT_CTRL_LE_LOG_PARTITION_SIZE)
+#define BLOCK_SIZE                (4096)
+#define THRESHOLD                 (3072)
+#define PARTITION_NAME            "bt_ctrl_log"
+#endif
+
 /* Types definition
  ************************************************************************
  */
@@ -214,8 +229,13 @@ struct osi_funcs_t {
     void (* _btdm_rom_table_ready)(void);
     bool (* _coex_bt_wakeup_request)(void);
     void (* _coex_bt_wakeup_request_end)(void);
+    int64_t (*_get_time_us)(void);
+    void (* _assert)(void);
 };
 
+#if CONFIG_BT_CTRL_LE_LOG_EN
+typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
 
 /* External functions or values
  ************************************************************************
@@ -276,6 +296,21 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
 extern void btdm_cca_feature_enable(void);
 extern void btdm_aa_check_enhance_enable(void);
 
+/* BLE Log module */
+#if CONFIG_BT_CTRL_LE_LOG_EN
+extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_deinit_async(void);
+extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
+extern void r_ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_feed_wdts(void);
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+extern void chanSel_stack_enableSetCsaVsCmd(bool en);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _bt_controller_bss_start;
@@ -337,6 +372,8 @@ static void btdm_backup_dma_copy_wrapper(uint32_t reg, uint32_t mem_addr, uint32
 static void btdm_funcs_table_ready_wrapper(void);
 static bool coex_bt_wakeup_request(void);
 static void coex_bt_wakeup_request_end(void);
+static int64_t get_time_us_wrapper(void);
+static void assert_wrapper(void);
 
 static void btdm_slp_tmr_callback(void *arg);
 
@@ -344,6 +381,15 @@ static esp_err_t try_heap_caps_add_region(intptr_t start, intptr_t end);
 
 static void bt_controller_deinit_internal(void);
 
+#if CONFIG_BT_CTRL_LE_LOG_EN
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+void esp_bt_read_ctrl_log_from_flash(bool output);
+static int esp_bt_controller_log_storage(uint32_t len, const uint8_t *addr, bool end);
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
+#endif // #if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+
 /* Local variable definition
  ***************************************************************************
  */
@@ -409,6 +455,8 @@ static const struct osi_funcs_t osi_funcs_ro = {
     ._btdm_rom_table_ready = btdm_funcs_table_ready_wrapper,
     ._coex_bt_wakeup_request = coex_bt_wakeup_request,
     ._coex_bt_wakeup_request_end = coex_bt_wakeup_request_end,
+    ._get_time_us = get_time_us_wrapper,
+    ._assert = assert_wrapper,
 };
 
 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;
@@ -437,6 +485,255 @@ static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock;
 static DRAM_ATTR esp_pm_lock_handle_t s_light_sleep_pm_lock;
 #endif
 
+#if CONFIG_BT_CTRL_LE_LOG_EN
+enum log_out_mode {
+    LOG_DUMP_MEMORY,
+    LOG_ASYNC_OUT,
+    LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
+};
+
+const static uint32_t log_bufs_size[] = {CONFIG_BT_CTRL_LE_LOG_BUF1_SIZE, CONFIG_BT_CTRL_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_CTRL_LE_LOG_BUF2_SIZE};
+bool log_is_inited = false;
+#if CONFIG_BT_CTRL_LE_LOG_DUMP_ONLY
+uint8_t log_output_mode = LOG_DUMP_MEMORY;
+#else
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
+uint8_t log_output_mode = LOG_SPI_OUT;
+#else
+uint8_t log_output_mode = LOG_ASYNC_OUT;
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+#endif // CONFIG_BT_CTRL_LE_LOG_DUMP_ONLY
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+static const esp_partition_t *log_partition;
+static uint32_t write_index = 0;
+static uint32_t next_erase_index = BLOCK_SIZE;
+static bool block_erased = false;
+static bool stop_write = false;
+static bool is_filled = false;
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
+{
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+        esp_bt_controller_log_storage(len, addr, end);
+#endif //CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_feed_wdts();
+        for (int i = 0; i < len; i++) {
+            esp_rom_printf("%02x ", addr[i]);
+        }
+
+        if (end) {
+            esp_rom_printf("\n");
+        }
+        portEXIT_CRITICAL_SAFE(&spinlock);
+    }
+}
+
+#if CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
+static IRAM_ATTR void esp_bt_controller_spi_log_interface(uint32_t len, const uint8_t *addr, bool end)
+{
+    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY, addr, len);
+}
+#endif // CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
+
+void esp_ble_controller_log_dump_all(bool output)
+{
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+        esp_bt_read_ctrl_log_from_flash(output);
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_feed_wdts();
+        esp_rom_printf("\r\n[DUMP_START:");
+        r_ble_log_async_output_dump_all(output);
+        esp_rom_printf(":DUMP_END]\r\n");
+        portEXIT_CRITICAL_SAFE(&spinlock);
+    }
+}
+
+void esp_bt_log_output_mode_set(uint8_t output_mode)
+{
+    log_output_mode = output_mode;
+}
+
+uint8_t esp_bt_log_output_mode_get(void)
+{
+    return log_output_mode;
+}
+
+esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
+{
+    esp_err_t ret = ESP_OK;
+    interface_func_t bt_controller_log_interface;
+    bt_controller_log_interface = esp_bt_controller_log_interface;
+    bool task_create;
+    uint8_t buffers = 0;
+
+    if (log_is_inited) {
+        return ret;
+    }
+
+#if CONFIG_BT_CTRL_LE_LOG_EN
+    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+#if CONFIG_BT_CTRL_LE_HCI_LOG_EN
+    buffers |= ESP_BLE_LOG_BUF_HCI;
+#endif // CONFIG_BT_CTRL_LE_HCI_LOG_EN
+
+    switch (log_output_mode) {
+        case LOG_DUMP_MEMORY:
+            task_create = false;
+            break;
+        case LOG_ASYNC_OUT:
+        case LOG_STORAGE_TO_FLASH:
+            task_create = true;
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+                esp_bt_ctrl_log_partition_get_and_erase_first_block();
+            }
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+            break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
+            bt_controller_log_interface = esp_bt_controller_spi_log_interface;
+#endif // CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
+            break;
+        default:
+            assert(0);
+    }
+
+    ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret == ESP_OK) {
+        log_is_inited = true;
+    }
+
+    return ret;
+}
+
+void esp_bt_ontroller_log_deinit(void)
+{
+    r_ble_log_deinit_async();
+    log_is_inited = false;
+}
+
+#if CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void)
+{
+    log_partition = NULL;
+    assert(MAX_STORAGE_SIZE % BLOCK_SIZE == 0);
+    // Find the partition map in the partition table
+    log_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, PARTITION_NAME);
+    assert(log_partition != NULL);
+    // Prepare data to be read later using the mapped address
+    ESP_ERROR_CHECK(esp_partition_erase_range(log_partition, 0, BLOCK_SIZE));
+    write_index = 0;
+    next_erase_index = BLOCK_SIZE;
+    block_erased = false;
+    is_filled = false;
+    stop_write = false;
+}
+
+static int esp_bt_controller_log_storage(uint32_t len, const uint8_t *addr, bool end)
+{
+    if (len > MAX_STORAGE_SIZE) {
+        return -1;
+    }
+
+    if (stop_write) {
+        return 0;
+    }
+
+    if (((write_index) % BLOCK_SIZE) >= THRESHOLD && !block_erased) {
+        // esp_rom_printf("Ers nxt: %d,%d\n", next_erase_index, write_index);
+        esp_partition_erase_range(log_partition, next_erase_index, BLOCK_SIZE);
+        next_erase_index = (next_erase_index + BLOCK_SIZE) % MAX_STORAGE_SIZE;
+        block_erased = true;
+    }
+
+    if (((write_index + len) / BLOCK_SIZE) >  (write_index / BLOCK_SIZE)) {
+        block_erased = false;
+    }
+
+    if (write_index + len <= MAX_STORAGE_SIZE) {
+        esp_partition_write(log_partition, write_index, addr, len);
+        write_index = (write_index + len) % MAX_STORAGE_SIZE;
+    } else {
+        uint32_t first_part_len = MAX_STORAGE_SIZE - write_index;
+        esp_partition_write(log_partition, write_index, addr, first_part_len);
+        esp_partition_write(log_partition, 0, addr + first_part_len, len - first_part_len);
+        write_index = len - first_part_len;
+        is_filled = true;
+        // esp_rom_printf("old idx: %d,%d\n",next_erase_index, write_index);
+    }
+
+    return 0;
+}
+
+void esp_bt_read_ctrl_log_from_flash(bool output)
+{
+    esp_partition_mmap_handle_t mmap_handle;
+    uint32_t read_index;
+    const void *mapped_ptr;
+    const uint8_t *buffer;
+    uint32_t print_len;
+    uint32_t max_print_len;
+    esp_err_t err;
+
+    print_len = 0;
+    max_print_len = 4096;
+    err = esp_partition_mmap(log_partition, 0, MAX_STORAGE_SIZE, ESP_PARTITION_MMAP_DATA, &mapped_ptr, &mmap_handle);
+    if (err != ESP_OK) {
+        ESP_LOGE("FLASH", "Mmap failed: %s", esp_err_to_name(err));
+        return;
+    }
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    r_ble_log_async_output_dump_all(true);
+    esp_bt_ontroller_log_deinit();
+    stop_write = true;
+
+    buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_feed_wdts();
+    if (is_filled) {
+        read_index = next_erase_index;
+    } else {
+        read_index = 0;
+    }
+
+    esp_rom_printf("\r\nREAD_CHECK:%ld,%ld,%d\r\n",read_index, write_index, is_filled);
+    esp_rom_printf("\r\n[DUMP_START:");
+    while (read_index != write_index) {
+        esp_rom_printf("%02x ", buffer[read_index]);
+        if (print_len > max_print_len) {
+            esp_panic_handler_feed_wdts();
+            print_len = 0;
+        }
+
+        print_len++;
+        read_index = (read_index + 1) % MAX_STORAGE_SIZE;
+    }
+
+    esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    esp_partition_munmap(mmap_handle);
+    err = esp_bt_controller_log_init(log_output_mode);
+    assert(err == ESP_OK);
+}
+#endif // CONFIG_BT_CTRL_LE_LOG_STORAGE_EN
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+
 void IRAM_ATTR btdm_hw_mac_power_down_wrapper(void)
 {
 #if CONFIG_MAC_BB_PD
@@ -1017,6 +1314,18 @@ static void coex_bt_wakeup_request_end(void)
     return;
 }
 
+static IRAM_ATTR int64_t get_time_us_wrapper(void)
+{
+    return esp_timer_get_time();
+}
+
+static IRAM_ATTR void assert_wrapper(void)
+{
+#if CONFIG_BT_CTRL_LE_LOG_EN
+    esp_ble_controller_log_dump_all(true);
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+}
+
 bool esp_vhci_host_check_send_available(void)
 {
     if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
@@ -1472,9 +1781,24 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        ESP_LOGE(BT_LOG_TAG, "BLE Log SPI output init failed");
+        goto error;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
+#if CONFIG_BT_CTRL_LE_LOG_EN
+    err = esp_bt_controller_log_init(log_output_mode);
+    if (err != ESP_OK) {
+        ESP_LOGW(BT_LOG_TAG, "ble_controller_log_init failed %d", err);
+        goto error;
+    }
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+
     err = btdm_controller_init(cfg);
 
     if (err != 0) {
@@ -1483,12 +1807,23 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+    chanSel_stack_enableSetCsaVsCmd(true);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
 
 error:
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     bt_controller_deinit_internal();
 
     return err;
@@ -1500,6 +1835,17 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+    chanSel_stack_enableSetCsaVsCmd(false);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();
@@ -1578,6 +1924,10 @@ static void bt_controller_deinit_internal(void)
 #endif
     esp_phy_modem_deinit();
 
+#if CONFIG_BT_CTRL_LE_LOG_EN
+    esp_bt_ontroller_log_deinit();
+#endif // CONFIG_BT_CTRL_LE_LOG_EN
+
     if (osi_funcs_p != NULL) {
         free(osi_funcs_p);
         osi_funcs_p = NULL;

components/bt/esp_ble_mesh/mesh_core/transport.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -322,6 +322,20 @@ static inline void seg_tx_complete(struct seg_tx *tx, int err)
 
 static void schedule_retransmit(struct seg_tx *tx)
 {
+    /* It's possible that a segment broadcast hasn't finished,
+     * but the tx are already released. Only the seg_pending
+     * of this segment remains unprocessed. So, here, we
+     * determine if the tx are released by checking if the
+     * destination (dst) is unassigned, and then process
+     * the seg_pending of this segment.
+     * See BLEMESH25-92 for details */
+    if (tx->dst == BLE_MESH_ADDR_UNASSIGNED) {
+        if (tx->seg_pending) {
+            tx->seg_pending--;
+        }
+        return;
+    }
+
     if (--tx->seg_pending) {
         return;
     }
@@ -448,7 +462,15 @@ static int send_seg(struct bt_mesh_net_tx *net_tx, struct net_buf_simple *sdu,
     }
 
     for (tx = NULL, i = 0; i < ARRAY_SIZE(seg_tx); i++) {
-        if (!seg_tx[i].nack_count) {
+        if (!seg_tx[i].nack_count &&
+            /* In some critical conditions, the tx might be
+             * reset before a segment broadcast is finished.
+             * If this happens, the seg_pending of the segment
+             * hasn't been processed. To avoid assigning this
+             * uncleared tx to a new message, extra checks for
+             * seg_pending being 0 are added. See BLEMESH25-92
+             * for details.*/
+            !seg_tx[i].seg_pending) {
             tx = &seg_tx[i];
             break;
         }

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -1620,6 +1620,18 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
 
 }
 
+esp_err_t esp_ble_gap_get_periodic_list_size(uint8_t *size)
+{
+    if (size == NULL) {
+        return ESP_FAIL;
+    }
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    btc_get_periodic_list_size(size);
+
+    return ESP_OK;
+}
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
@@ -1741,3 +1753,21 @@ esp_err_t esp_ble_gap_vendor_command_send(esp_ble_vendor_cmd_params_t *vendor_cm
     return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free)
                 == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+
+esp_err_t esp_ble_gap_set_vendor_event_mask(uint32_t event_mask)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gap_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_ACT_SET_VENDOR_EVT_MASK;
+    arg.set_vendor_evt_mask.evt_mask = event_mask;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL)
+                == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -20,6 +20,27 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
     bool ret = true;
 
     if (record != NULL) {
+        if (record->hdr.type < ESP_SDP_TYPE_RAW || record->hdr.type > ESP_SDP_TYPE_SAP_SERVER) {
+            LOG_ERROR("Invalid type!\n");
+            return false;
+        }
+        switch (record->hdr.type) {
+        case ESP_SDP_TYPE_MAP_MAS:
+            if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) {
+                LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n");
+               ret = false;
+            }
+            break;
+        case ESP_SDP_TYPE_PBAP_PSE:
+            if (record->pse.supported_repositories >> 8) {
+                LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n");
+               ret = false;
+            }
+            break;
+
+        default:
+            break;
+        }
         if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
             strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
             LOG_ERROR("Invalid server name!\n");

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -230,6 +230,8 @@ typedef enum {
     ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT,                         /*!< When vendor hci command complete, the event comes */
     ESP_GAP_BLE_SET_PRIVACY_MODE_COMPLETE_EVT,                   /*!< When set privacy mode complete, the event comes */
     ESP_GAP_BLE_SET_CSA_SUPPORT_COMPLETE_EVT,                    /*!< When set CSA support complete, the event comes */
+    ESP_GAP_BLE_SET_VENDOR_EVT_MASK_COMPLETE_EVT,                /*!< When set vendor event mask complete, the event comes */
+    ESP_GAP_BLE_VENDOR_HCI_EVT,                                  /*!< When BLE vendor HCI event received, the event comes */
     ESP_GAP_BLE_EVT_MAX,                                         /*!< when maximum advertising event complete, the event comes */
 } esp_gap_ble_cb_event_t;
 
@@ -1578,7 +1580,21 @@ typedef union {
      */
     struct ble_set_csa_support_cmpl_evt_param {
         esp_bt_status_t status;                     /*!< Indicate CSA support set operation success status */
-    } set_csa_support_cmpl;                        /*!< Event parameter of ESP_GAP_BLE_SET_CSA_SUPPORT_COMPLETE_EVT */
+    } set_csa_support_cmpl;                         /*!< Event parameter of ESP_GAP_BLE_SET_CSA_SUPPORT_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_SET_VENDOR_EVT_MASK_COMPLETE_EVT
+     */
+    struct ble_set_vendor_evt_mask_cmpl_evt_param {
+        esp_bt_status_t status;                     /*!< Indicate set vendor event mask operation success status */
+    } set_vendor_evt_mask_cmpl;                     /*!< Event parameter of ESP_GAP_BLE_SET_VENDOR_EVT_MASK_COMPLETE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_VENDOR_HCI_EVT
+     */
+    struct ble_vendor_hci_event_evt_param {
+        uint8_t        subevt_code;                 /*!< Subevent code for vendor HCI event, the range is 0xC0 to 0xFF */
+        uint8_t        param_len;                   /*!< The length of the event parameter buffer */
+        uint8_t        *param_buf;                  /*!< The pointer of the event parameter buffer */
+    } vendor_hci_evt;                               /*!< Event parameter buffer of ESP_GAP_BLE_VENDOR_HCI_EVT */
 } esp_ble_gap_cb_param_t;
 
 /**
@@ -1593,6 +1609,8 @@ typedef void (* esp_gap_ble_cb_t)(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p
  *
  * @param[in]       callback: callback function
  *
+ * @note            Avoid performing time-consuming operations within the callback functions.
+ *
  * @return
  *                  - ESP_OK : success
  *                  - other  : failed
@@ -1643,7 +1661,8 @@ esp_err_t esp_ble_gap_set_scan_params(esp_ble_scan_params_t *scan_params);
 /**
  * @brief           This procedure keep the device scanning the peer device which advertising on the air
  *
- * @param[in]       duration: Keeping the scanning time, the unit is second.
+ * @param[in]       duration: The scanning duration in seconds.
+ *                            Set to 0 for continuous scanning until explicitly stopped.
  *
  * @return
  *                  - ESP_OK : success
@@ -2592,6 +2611,17 @@ esp_err_t esp_ble_gap_prefer_ext_connect_params_set(esp_bd_addr_t addr,
                                                     const esp_ble_gap_conn_params_t *phy_2m_conn_params,
                                                     const esp_ble_gap_conn_params_t *phy_coded_conn_params);
 
+/**
+ * @brief            Retrieve the capacity of the periodic advertiser list in the controller.
+ *
+ * @param[out]       size: Pointer to a variable where the capacity of the periodic advertiser list will be stored.
+ *
+ * @return
+ *                     - ESP_OK : Success
+ *                     - Others : Failure
+ */
+esp_err_t esp_ble_gap_get_periodic_list_size(uint8_t *size);
+
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
@@ -2768,6 +2798,18 @@ esp_err_t esp_ble_gap_set_privacy_mode(esp_ble_addr_type_t addr_type, esp_bd_add
  */
 esp_err_t esp_ble_gap_set_csa_support(uint8_t csa_select);
 
+/**
+ * @brief           This function is used to control which vendor events are generated by the HCI for the Host.
+ *
+ * @param[in]       event_mask: Bit0: Legacy scan request received event
+ *                              Bit1: Vendor channel map update complete event
+ *
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ */
+esp_err_t esp_ble_gap_set_vendor_event_mask(uint32_t event_mask);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,580 +17,606 @@ extern "C" {
 
 /// GATT Server callback function events
 typedef enum {
-    ESP_GATTS_REG_EVT                 = 0,       /*!< When register application id, the event comes */
-    ESP_GATTS_READ_EVT                = 1,       /*!< When gatt client request read operation, the event comes */
-    ESP_GATTS_WRITE_EVT               = 2,       /*!< When gatt client request write operation, the event comes */
-    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< When gatt client request execute write, the event comes */
-    ESP_GATTS_MTU_EVT                 = 4,       /*!< When set mtu complete, the event comes */
-    ESP_GATTS_CONF_EVT                = 5,       /*!< When receive confirm, the event comes */
-    ESP_GATTS_UNREG_EVT               = 6,       /*!< When unregister application id, the event comes */
-    ESP_GATTS_CREATE_EVT              = 7,       /*!< When create service complete, the event comes */
-    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< When add included service complete, the event comes */
-    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< When add characteristic complete, the event comes */
-    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< When add descriptor complete, the event comes */
-    ESP_GATTS_DELETE_EVT              = 11,      /*!< When delete service complete, the event comes */
-    ESP_GATTS_START_EVT               = 12,      /*!< When start service complete, the event comes */
-    ESP_GATTS_STOP_EVT                = 13,      /*!< When stop service complete, the event comes */
-    ESP_GATTS_CONNECT_EVT             = 14,      /*!< When gatt client connect, the event comes */
-    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< When gatt client disconnect, the event comes */
-    ESP_GATTS_OPEN_EVT                = 16,      /*!< When connect to peer, the event comes */
-    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< When disconnect from peer, the event comes */
-    ESP_GATTS_CLOSE_EVT               = 18,      /*!< When gatt server close, the event comes */
-    ESP_GATTS_LISTEN_EVT              = 19,      /*!< When gatt listen to be connected the event comes */
-    ESP_GATTS_CONGEST_EVT             = 20,      /*!< When congest happen, the event comes */
+    ESP_GATTS_REG_EVT                 = 0,       /*!< This event is triggered when a GATT Server application is registered using `esp_ble_gatts_app_register`. */
+    ESP_GATTS_READ_EVT                = 1,       /*!< This event is triggered when the read request from the Client is received. */
+    ESP_GATTS_WRITE_EVT               = 2,       /*!< This event is triggered when the write request from the Client is received. */
+    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< This event is triggered when the write execution request from the Client is received. */
+    ESP_GATTS_MTU_EVT                 = 4,       /*!< This event is triggered when the MTU configuration request from the Client is received. */
+    ESP_GATTS_CONF_EVT                = 5,       /*!< This event is triggered when the confirmation from the Client is received. */
+    ESP_GATTS_UNREG_EVT               = 6,       /*!< This event is triggered when a GATT Server application is unregistered using `esp_ble_gatts_app_unregister`. */
+    ESP_GATTS_CREATE_EVT              = 7,       /*!< This event is triggered when a GATT Server service is created using `esp_ble_gatts_create_service`. */
+    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< This event is triggered when an included service is added using `esp_ble_gatts_add_included_service`. */
+    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< This event is triggered when a characteristic is added to the service using `esp_ble_gatts_add_char`. */
+    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< This event is triggered when a characteristic descriptor is added to the service using `esp_ble_gatts_add_char_descr`. */
+    ESP_GATTS_DELETE_EVT              = 11,      /*!< This event is triggered when the service is deleted using `esp_ble_gatts_delete_service`. */
+    ESP_GATTS_START_EVT               = 12,      /*!< This event is triggered when the service is started using `esp_ble_gatts_start_service`. */
+    ESP_GATTS_STOP_EVT                = 13,      /*!< This event is triggered when the service is stopped using `esp_ble_gatts_stop_service`.  */
+    ESP_GATTS_CONNECT_EVT             = 14,      /*!< This event is triggered when a physical connection is set up. */
+    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< This event is triggered when a physical connection is terminated. */
+    ESP_GATTS_OPEN_EVT                = 16,      /*!< This event is triggered when a virtual connection is created using `esp_ble_gatts_open`. */
+    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< Deprecated. */
+    ESP_GATTS_CLOSE_EVT               = 18,      /*!< This event is triggered when a virtual connection is closed using `esp_ble_gatts_close`. */
+    ESP_GATTS_LISTEN_EVT              = 19,      /*!< Deprecated. */
+    ESP_GATTS_CONGEST_EVT             = 20,      /*!< This event is triggered when the GATT connection is congested. */
     /* following is extra event */
-    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< When gatt send response complete, the event comes */
-    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< When gatt create table complete, the event comes */
-    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< When gatt set attr value complete, the event comes */
-    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< When gatt send service change indication complete, the event comes */
+    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< This event is triggered when a response is sent to the request using `esp_ble_gatts_send_response`. */
+    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< This event is triggered when a service attribute table is created using `esp_ble_gatts_create_attr_tab`. */
+    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< This event is triggered when an attribute value is set using `esp_ble_gatts_set_attr_value`. */
+    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< This event is triggered when a service change indication is sent using `esp_ble_gatts_send_service_change_indication`. */
 } esp_gatts_cb_event_t;
 
 /**
- * @brief Gatt server callback parameters union
+ * @brief GATT Server callback parameters
  */
 typedef union {
     /**
-     * @brief ESP_GATTS_REG_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_REG_EVT`
      */
     struct gatts_reg_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t app_id;                /*!< Application id which input in register API */
-    } reg;                              /*!< Gatt server callback param of ESP_GATTS_REG_EVT */
+        uint16_t app_id;                /*!< Application ID */
+    } reg;                              /*!< Callback parameter for the event `ESP_GATTS_REG_EVT` */
 
     /**
-     * @brief ESP_GATTS_READ_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_READ_EVT`
      */
     struct gatts_read_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been read */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to read */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool is_long;                   /*!< The value is too long or not */
-        bool need_rsp;                  /*!< The read operation need to do response */
-    } read;                             /*!< Gatt server callback param of ESP_GATTS_READ_EVT */
+        uint16_t offset;                /*!< The position offset to read. If the length of value is less than or equal to the MTU size, this value is 0. */
+        bool is_long;                   /*!< True indicates that the length of value is greater than the MTU size; false otherwise. */
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+    } read;                             /*!< Callback parameter for the event `ESP_GATTS_READ_EVT` */
 
 
     /**
-     * @brief ESP_GATTS_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_WRITE_EVT`
      */
     struct gatts_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to write */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool need_rsp;                  /*!< The write operation need to do response */
-        bool is_prep;                   /*!< This write operation is prepare write */
-        uint16_t len;                   /*!< The write attribute value length */
+        uint16_t offset;                /*!< The position offset to write. If the length of value is less than or equal to the MTU size, this value is 0.*/
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+        bool is_prep;                   /*!< True indicates the write operation is a prepared write operation */
+        uint16_t len;                   /*!< The length of the write attribute value in bytes */
         uint8_t *value;                 /*!< The write attribute value */
-    } write;                            /*!< Gatt server callback param of ESP_GATTS_WRITE_EVT */
+    } write;                            /*!< Callback parameter for the event `ESP_GATTS_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_EXEC_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT`
      */
     struct gatts_exec_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
-#define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Prepare write flag to indicate cancel prepare write */
-#define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Prepare write flag to indicate execute prepare write */
-        uint8_t exec_write_flag;        /*!< Execute write flag */
-    } exec_write;                       /*!< Gatt server callback param of ESP_GATTS_EXEC_WRITE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The bluetooth device address to write */
+        #define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Flag to indicate the cancellation of a prepare write operation */
+        #define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Flag to indicate the execution of a prepare write operation */
+        uint8_t exec_write_flag;        /*!< Execute write flag: `ESP_GATT_PREP_WRITE_CANCEL` or `ESP_GATT_PREP_WRITE_EXEC` */
+    } exec_write;                       /*!< Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_MTU_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_MTU_EVT`
      */
     struct gatts_mtu_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
+        uint16_t conn_id;               /*!< Connection ID */
         uint16_t mtu;                   /*!< MTU size */
-    } mtu;                              /*!< Gatt server callback param of ESP_GATTS_MTU_EVT */
+    } mtu;                              /*!< Callback parameter for the event `ESP_GATTS_MTU_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONF_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONF_EVT`
      */
     struct gatts_conf_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< attribute handle */
-        uint16_t len;                   /*!< The indication or notification value length, len is valid when send notification or indication failed */
-        uint8_t *value;                 /*!< The indication or notification value , value is valid when send notification or indication failed */
-    } conf;                             /*!< Gatt server callback param of ESP_GATTS_CONF_EVT (confirm) */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle */
+        uint16_t len;                   /*!< The length of indication or notification value in bytes. The length is invalid if the notification or indication failed. */
+        uint8_t *value;                 /*!< The indication or notification value. The value is invalid if the notification or indication failed. */
+    } conf;                             /*!< Callback parameter for the event `ESP_GATTS_CONF_EVT` */
 
     /**
-     * @brief ESP_GATTS_UNREG_EVT
-     */
-
-    /**
-     * @brief ESP_GATTS_CREATE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREATE_EVT`
      */
     struct gatts_create_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_gatt_srvc_id_t service_id;  /*!< Service id, include service uuid and other information */
-    } create;                           /*!< Gatt server callback param of ESP_GATTS_CREATE_EVT */
+        esp_gatt_srvc_id_t service_id;  /*!< Service ID, including service UUID and other information */
+    } create;                           /*!< Callback parameter for the event `ESP_GATTS_CREATE_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_INCL_SRVC_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT`
      */
     struct gatts_add_incl_srvc_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Included service attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } add_incl_srvc;                    /*!< Gatt server callback param of ESP_GATTS_ADD_INCL_SRVC_EVT */
+    } add_incl_srvc;                    /*!< Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT`
      */
     struct gatts_add_char_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Characteristic attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
-    } add_char;                         /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_EVT */
+        esp_bt_uuid_t char_uuid;        /*!< Characteristic UUID */
+    } add_char;                         /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_DESCR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT`
      */
     struct gatts_add_char_descr_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Descriptor attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
-    } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor UUID */
+    } add_char_descr;                   /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT` */
 
     /**
-     * @brief ESP_GATTS_DELETE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DELETE_EVT`
      */
     struct gatts_delete_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } del;                              /*!< Gatt server callback param of ESP_GATTS_DELETE_EVT */
+    } del;                              /*!< Callback parameter for the event `ESP_GATTS_DELETE_EVT` */
 
     /**
-     * @brief ESP_GATTS_START_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_START_EVT`
      */
     struct gatts_start_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } start;                            /*!< Gatt server callback param of ESP_GATTS_START_EVT */
+    } start;                            /*!< Callback parameter for the event `ESP_GATTS_START_EVT` */
 
     /**
-     * @brief ESP_GATTS_STOP_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_STOP_EVT`
      */
     struct gatts_stop_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } stop;                             /*!< Gatt server callback param of ESP_GATTS_STOP_EVT */
+    } stop;                             /*!< Callback parameter for the event `ESP_GATTS_STOP_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONNECT_EVT`
      */
     struct gatts_connect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint8_t link_role;              /*!< Link role : master role = 0  ; slave role = 1*/
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_params_t conn_params; /*!< current Connection parameters */
-        esp_ble_addr_type_t ble_addr_type;  /*!< Remote BLE device address type */
-        uint16_t conn_handle;           /*!< HCI connection handle */
-    } connect;                          /*!< Gatt server callback param of ESP_GATTS_CONNECT_EVT */
+        uint16_t conn_id;                   /*!< Connection ID */
+        uint8_t link_role;                  /*!< Link role: master role = 0; slave role = 1 */
+        esp_bd_addr_t remote_bda;           /*!< Remote device address */
+        esp_gatt_conn_params_t conn_params; /*!< Current connection parameters */
+        esp_ble_addr_type_t ble_addr_type;  /*!< Remote device address type */
+        uint16_t conn_handle;               /*!< HCI connection handle */
+    } connect;                              /*!< Callback parameter for the event `ESP_GATTS_CONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_DISCONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT`
      */
     struct gatts_disconnect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_reason_t reason;  /*!< Indicate the reason of disconnection */
-    } disconnect;                       /*!< Gatt server callback param of ESP_GATTS_DISCONNECT_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        esp_bd_addr_t remote_bda;       /*!< Remote device address */
+        esp_gatt_conn_reason_t reason;  /*!< The reason of disconnection */
+    } disconnect;                       /*!< Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_OPEN_EVT`
      */
     struct gatts_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } open;                             /*!< Gatt server callback param of ESP_GATTS_OPEN_EVT */
+    } open;                             /*!< Callback parameter for the event `ESP_GATTS_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CANCEL_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT`
      */
     struct gatts_cancel_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } cancel_open;                      /*!< Gatt server callback param of ESP_GATTS_CANCEL_OPEN_EVT */
+    } cancel_open;                      /*!< Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CLOSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CLOSE_EVT`
      */
     struct gatts_close_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-    } close;                            /*!< Gatt server callback param of ESP_GATTS_CLOSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+    } close;                            /*!< Callback parameter for the event `ESP_GATTS_CLOSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_LISTEN_EVT
-     */
-    /**
-     * @brief ESP_GATTS_CONGEST_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONGEST_EVT`
      */
     struct gatts_congest_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        bool congested;                 /*!< Congested or not */
-    } congest;                          /*!< Gatt server callback param of ESP_GATTS_CONGEST_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        bool congested;                 /*!< True indicates the connection is congested; false otherwise. */
+    } congest;                          /*!< Callback parameter for the event `ESP_GATTS_CONGEST_EVT` */
 
     /**
-     * @brief ESP_GATTS_RESPONSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_RESPONSE_EVT`
      */
     struct gatts_rsp_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< Attribute handle which send response */
-    } rsp;                              /*!< Gatt server callback param of ESP_GATTS_RESPONSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle which sends the response */
+    } rsp;                              /*!< Callback parameter for the event `ESP_GATTS_RESPONSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_CREAT_ATTR_TAB_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT`
      */
     struct gatts_add_attr_tab_evt_param{
         esp_gatt_status_t status;       /*!< Operation status */
-        esp_bt_uuid_t svc_uuid;         /*!< Service uuid type */
-        uint8_t svc_inst_id;            /*!< Service id */
-        uint16_t num_handle;            /*!< The number of the attribute handle to be added to the gatts database */
-        uint16_t *handles;              /*!< The number to the handles */
-    } add_attr_tab;                     /*!< Gatt server callback param of ESP_GATTS_CREAT_ATTR_TAB_EVT */
+        esp_bt_uuid_t svc_uuid;         /*!< Service UUID type */
+        uint8_t svc_inst_id;            /*!< Service ID */
+        uint16_t num_handle;            /*!< The number of the attribute handles which have been added to the GATT Service table */
+        uint16_t *handles;              /*!< The handles which have been added to the table */
+    } add_attr_tab;                     /*!< Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT` */
 
 
    /**
-    * @brief ESP_GATTS_SET_ATTR_VAL_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT`
     */
     struct gatts_set_attr_val_evt_param{
         uint16_t srvc_handle;           /*!< The service handle */
-        uint16_t attr_handle;           /*!< The attribute  handle */
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } set_attr_val;                     /*!< Gatt server callback param of ESP_GATTS_SET_ATTR_VAL_EVT */
+        uint16_t attr_handle;           /*!< The attribute handle */
+        esp_gatt_status_t status;       /*!< Operation status */
+    } set_attr_val;                     /*!< Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT` */
 
     /**
-    * @brief ESP_GATTS_SEND_SERVICE_CHANGE_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`
     */
     struct gatts_send_service_change_evt_param{
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } service_change;                    /*!< Gatt server callback param of ESP_GATTS_SEND_SERVICE_CHANGE_EVT */
+        esp_gatt_status_t status;        /*!< Operation status */
+    } service_change;                    /*!< Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT` */
 
 } esp_ble_gatts_cb_param_t;
 
 /**
  * @brief GATT Server callback function type
- * @param event : Event type
- * @param gatts_if : GATT server access interface, normally
- *                   different gatts_if correspond to different profile
- * @param param : Point to callback parameter, currently is union type
+ *
+ * @param[in] event    Event type
+ * @param[in] gatts_if GATT Server access interface. Typically, different `gatts_if` values correspond to different profiles.
+ * @param[in] param    The pointer to the callback parameter, which is of a union type.
  */
 typedef void (* esp_gatts_cb_t)(esp_gatts_cb_event_t event, esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param);
 
 /**
- * @brief           This function is called to register application callbacks
- *                  with BTA GATTS module.
+ * @brief  Register GATT Server application callbacks
+ *
+ * @param[in] callback The pointer to the application callback function
+ *
+ * @note            Avoid performing time-consuming operations within the callback functions.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback);
 
 /**
- * @brief           This function is called to get the current application callbacks
- *                  with BTA GATTS module.
+ * @brief  Get the current GATT Server application callback
  *
  * @return
- *                  - esp_gatts_cb_t : current callback
- *
+ *        - esp_gatts_cb_t: Current callback
  */
 esp_gatts_cb_t esp_ble_gatts_get_callback(void);
 
 /**
- * @brief           This function is called to register application identifier
+ * @brief  Register GATT Server application
+ *
+ * @param[in] app_id: The UUID for different application
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_REG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: The input `app_id` exceeds `ESP_APP_ID_MAX` (0x7fff) defined in esp_bt_defs.h.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_app_register(uint16_t app_id);
 
-
-
 /**
- * @brief           unregister with GATT Server.
+ * @brief  Unregister an GATT Server application
+ *
+ * @param[in]  gatts_if GATT Server access interface.
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_UNREG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
- * @param[in]       gatts_if: GATT server access interface
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if);
 
-
 /**
- * @brief           Create a service. When service creation is done, a callback
- *                  event ESP_GATTS_CREATE_EVT is called to report status
- *                  and service ID to the profile. The service ID obtained in
- *                  the callback function needs to be used when adding included
- *                  service and characteristics/descriptors into the service.
+ * @brief  Create a GATT Server service
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       service_id: service ID.
- * @param[in]       num_handle: number of handle requested for this service.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       service_id The pointer to the Service ID
+ * @param[in]       num_handle The number of handles requested for this service.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CREATE_EVT`.
+ *       2. `num_handle` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
                                        esp_gatt_srvc_id_t *service_id, uint16_t num_handle);
 
 
 /**
- * @brief               Create a service attribute tab.
- * @param[in]       gatts_attr_db: the pointer to the service attr tab
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       max_nb_attr: the number of attribute to be added to the service database.
- * @param[in]       srvc_inst_id: the instance id of the service
+ * @brief  Create a service attribute table
+ *
+ * @param[in]       gatts_attr_db The pointer to the service attribute table
+ * @param[in]       gatts_if      GATT Server access interface
+ * @param[in]       max_nb_attr   The number of attributes to be added to the service database
+ * @param[in]       srvc_inst_id  The instance ID of the service
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CREAT_ATTR_TAB_EVT`.
+ *      2. `max_nb_attr` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid `max_nb_attr`
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db,
                                             esp_gatt_if_t gatts_if,
                                             uint16_t max_nb_attr,
                                             uint8_t srvc_inst_id);
 /**
- * @brief           This function is called to add an included service. This function have to be called between
- *                  'esp_ble_gatts_create_service' and 'esp_ble_gatts_add_char'.  After included
- *                  service is included, a callback event ESP_GATTS_ADD_INCL_SRVC_EVT
- *                  is reported the included service ID.
+ * @brief  Add an included service
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       included_service_handle: the service ID to be included.
+ * @param[in]       service_handle  Target service handle to add
+ * @param[in]       included_service_handle The handle of included service to be added
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_ADD_INCL_SRVC_EVT`.
+ *       2. This function has to be called between `esp_ble_gatts_create_service` and `esp_ble_gatts_add_char`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t included_service_handle);
 
-
-
 /**
- * @brief           This function is called to add a characteristic into a service.
+ * @brief  Add a characteristic into a service.
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       char_uuid : Characteristic UUID.
- * @param[in]       perm      : Characteristic value declaration attribute permission.
- * @param[in]       property  : Characteristic Properties
- * @param[in]       char_val    : Characteristic value
- * @param[in]       control : attribute response control byte
+ * @param[in]       service_handle  Target service handle to add the characteristic
+ * @param[in]       char_uuid       The pointer to the characteristic UUID
+ * @param[in]       perm            Characteristic value declaration attribute permission
+ * @param[in]       property        Characteristic Properties
+ * @param[in]       char_val        The pointer to the characteristic value
+ * @param[in]       control         The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_uuid,
                                  esp_gatt_perm_t perm, esp_gatt_char_prop_t property, esp_attr_value_t *char_val,
                                  esp_attr_control_t *control);
 
-
 /**
- * @brief           This function is called to add characteristic descriptor. When
- *                  it's done, a callback event ESP_GATTS_ADD_DESCR_EVT is called
- *                  to report the status and an ID number for this descriptor.
+ * @brief  Add a characteristic descriptor
+ *
+ * @param[in]       service_handle Target service handle to add the characteristic descriptor
+ * @param[in]       descr_uuid     The pointer to the descriptor UUID
+ * @param[in]       perm           Descriptor access permission
+ * @param[in]       char_descr_val The pointer to the characteristic descriptor value
+ * @param[in]       control        The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_DESCR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
- * @param[in]       service_handle: service handle to which this characteristic descriptor is to
- *                              be added.
- * @param[in]       perm: descriptor access permission.
- * @param[in]       descr_uuid: descriptor UUID.
- * @param[in]       char_descr_val  : Characteristic descriptor value
- * @param[in]       control : attribute response control byte
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
                                         esp_bt_uuid_t   *descr_uuid,
                                         esp_gatt_perm_t perm, esp_attr_value_t *char_descr_val,
                                         esp_attr_control_t *control);
 
-
-
 /**
- * @brief           This function is called to delete a service. When this is done,
- *                  a callback event ESP_GATTS_DELETE_EVT is report with the status.
+ * @brief  Delete a service
  *
- * @param[in]       service_handle: service_handle to be deleted.
+ * @param[in]       service_handle Target service handle to delete
+ *
+ * @note    This function triggers `ESP_GATTS_DELETE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to start a service.
+ * @brief  Start a service
  *
- * @param[in]       service_handle: the service handle to be started.
+ * @param[in]       service_handle Target service handle to start
+ *
+ * @note      This function triggers `ESP_GATTS_START_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_start_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to stop a service.
+ * @brief  Stop a service.
  *
- * @param[in]       service_handle - service to be topped.
+ * @param[in]       service_handle Target service handle to stop
+ *
+ * @note            This function triggers `ESP_GATTS_STOP_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           Send indicate or notify to GATT client.
- *                  Set param need_confirm as false will send notification, otherwise indication.
- *                  Note: the size of indicate or notify data need less than MTU size,see "esp_ble_gattc_send_mtu_req".
+ * @brief  Send indication or notification to a GATT Client
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection id to indicate.
- * @param[in]       attr_handle - attribute handle to indicate.
- * @param[in]       value_len - indicate value length.
- * @param[in]       value: value to indicate.
- * @param[in]       need_confirm - Whether a confirmation is required.
- *                  false sends a GATT notification, true sends a GATT indication.
+ * @param[in]       gatts_if    GATT Server access interface
+ * @param[in]       conn_id     Connection ID
+ * @param[in]       attr_handle Attribute handle to indicate
+ * @param[in]       value_len   Indication value length in bytes
+ * @param[in]       value       Value to indicate
+ * @param[in]       need_confirm True if a confirmation is required, which is a GATT indication; false if the confirmation is not required, which is a GATT notification.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CONF_EVT`.
+ *       2. The size of indication or notification data must be less than or equal to MTU size, see `esp_ble_gattc_send_mtu_req`.
+ *       3. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm);
 
-
 /**
- * @brief           This function is called to send a response to a request.
+ * @brief  Send a response to a request
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection identifier.
- * @param[in]       trans_id - transfer id
- * @param[in]       status - response status
- * @param[in]       rsp - response data.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID
+ * @param[in]       trans_id Transfer ID
+ * @param[in]       status   Response status
+ * @param[in]       rsp      The pointer to the response data
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_RESPONSE_EVT`.
+ *      2. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, uint32_t trans_id,
                                       esp_gatt_status_t status, esp_gatt_rsp_t *rsp);
 
-
 /**
- * @brief           This function is called to set the attribute value by the application
+ * @brief  Set the attribute value
  *
- * @param[in]       attr_handle: the attribute handle which to be set
- * @param[in]       length: the value length
- * @param[in]       value: the pointer to the attribute value
+ * @param[in]       attr_handle Target attribute handle to set the value
+ * @param[in]       length      The value length in bytes
+ * @param[in]       value       The pointer to the attribute value
+ *
+ * @note    This function triggers `ESP_GATTS_SET_ATTR_VAL_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, const uint8_t *value);
 
 /**
- * @brief       Retrieve attribute value
+ * @brief  Retrieve attribute value
  *
- * @param[in]   attr_handle: Attribute handle.
- * @param[out]  length: pointer to the attribute value length
- * @param[out]  value:  Pointer to attribute value payload, the value cannot be modified by user
+ * @param[in]   attr_handle Attribute handle
+ * @param[out]  length      The pointer to the attribute value length in bytes
+ * @param[out]  value       The pointer to attribute value payload. This value cannot be modified by user.
+ *
+ * @note
+ *      1. This function does not trigger any event.
+ *      2. `attr_handle` must be greater than 0.
  *
  * @return
- *                  - ESP_GATT_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_GATT_INVALID_HANDLE: Invalid `attr_handle`
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_gatt_status_t esp_ble_gatts_get_attr_value(uint16_t attr_handle, uint16_t *length, const uint8_t **value);
 
-
 /**
- * @brief           Open a direct open connection or add a background auto connection
+ * @brief  Create an ACL connection when `BT_BLE_42_FEATURES_SUPPORTED` is enabled in the menuconfig
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
- * @param[in]       is_direct: direct connection or background auto connection
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote  device address
+ * @param[in]       is_direct `True` indicates a direct connection, while `False` indicates a background auto connection. Currently, background auto connection is not supported, so please always set this parameter to True.
+ *
+ * @note
+ *      1. The function always triggers `ESP_GATTS_CONNECT_EVT` and `ESP_GATTS_OPEN_EVT`.
+ *      2. When the device acts as GATT Server, besides the above two events, this function triggers `ESP_GATTS_CONNECT_EVT` as well.
+ *      3. This function will establish an ACL connection as a Central and a virtual connection as a GATT Server. If the ACL connection already exists, it will create a virtual connection only.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, bool is_direct);
 
 /**
- * @brief           Close a connection  a remote device.
+ * @brief  Close a connection with a remote device
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id: connection ID to be closed.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID to be closed
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CLOSE_EVT`.
+ *      2. There may be multiple virtual GATT server connections when multiple `app_id` got registered.
+ *      3. This API closes one virtual GATT server connection only, if there exist other virtual GATT server connections. It does not close the physical connection.
+ *      4. The API `esp_ble_gap_disconnect` can be used to disconnect the physical connection directly.
+ *      5. If there is only one virtual GATT connection left, this API will terminate the ACL connection in addition, and trigger `ESP_GATTS_DISCONNECT_EVT`. Then there is no need to call `esp_ble_gap_disconnect` anymore.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id);
 
 /**
- * @brief           Send service change indication
+ * @brief  Send service change indication
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote device address.
  *                  If remote_bda is NULL then it will send service change
  *                  indication to all the connected devices and if not then
- *                  to a specific device
+ *                  to a specific device.
+ *
+ * @note This function triggers `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda);
 
 /**
- * @brief           Print local database (GATT service table)
+ * @brief   Display the Server's local attribute database.
+ *
+ * This API prints the local attribute database of the BLE server, including details
+ * of all services, characteristics, and descriptors.
+ *
+ * @note
+ *    1. This function does not trigger any event.
+ *    2. It is primarily intended for debugging purposes to verify the server's current configuration.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_show_local_database(void);
 

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -4875,7 +4875,9 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         if (p_data->complt.reason != 0) {
             sec_event.auth_cmpl.fail_reason = BTA_DM_AUTH_CONVERT_SMP_CODE(((UINT8)p_data->complt.reason));
             /* delete this device entry from Sec Dev DB */
-            bta_dm_remove_sec_dev_entry (bda);
+            APPL_TRACE_WARNING("%s remove bond,rsn %d, BDA:0x%02X%02X%02X%02X%02X%02X", __func__, sec_event.auth_cmpl.fail_reason,
+                            bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+            bta_dm_remove_sec_dev_entry(bda);
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {
@@ -5768,6 +5770,12 @@ void bta_dm_ble_gap_set_csa_support(tBTA_DM_MSG *p_data)
     BTM_BleSetCsaSupport(p_data->ble_set_csa_support.csa_select, p_data->ble_set_csa_support.p_cback);
 }
 
+void bta_dm_ble_gap_set_vendor_evt_mask(tBTA_DM_MSG *p_data)
+{
+    APPL_TRACE_API("%s, evt_mask = %d", __func__, p_data->ble_set_vendor_evt_mask.evt_mask);
+    BTM_BleSetVendorEventMask(p_data->ble_set_vendor_evt_mask.evt_mask, p_data->ble_set_vendor_evt_mask.p_cback);
+}
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data)
 {

components/bt/host/bluedroid/bta/dm/bta_dm_api.c

@@ -2943,6 +2943,19 @@ void BTA_DmBleGapSetCsaSupport(uint8_t csa_select, tBTA_SET_CSA_SUPPORT_CMPL_CBA
     }
 }
 
+void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask, tBTA_SET_VENDOR_EVT_MASK_CBACK *p_callback)
+{
+    tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK *)osi_malloc(sizeof(tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK)))
+        != NULL) {
+        p_msg->hdr.event = BTA_DM_API_BLE_SET_VENDOR_EVT_MASK_EVT;
+        p_msg->evt_mask = evt_mask;
+        p_msg->p_cback = p_callback;
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         BTA_VendorInit

components/bt/host/bluedroid/bta/dm/bta_dm_main.c

@@ -223,6 +223,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
     bta_dm_ble_gap_add_dev_to_resolving_list, /* BTA_DM_API_ADD_DEV_TO_RESOLVING_LIST_EVT */
     bta_dm_ble_gap_set_privacy_mode, /* BTA_DM_API_SET_PRIVACY_MODE_EVT */
     bta_dm_ble_gap_set_csa_support, /* BTA_DM_API_BLE_SET_CSA_SUPPORT_EVT */
+    bta_dm_ble_gap_set_vendor_evt_mask, /* BTA_DM_API_BLE_SET_VENDOR_EVT_MASK_EVT */
 #endif
 };
 

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -219,6 +219,7 @@ enum {
     BTA_DM_API_ADD_DEV_TO_RESOLVING_LIST_EVT,
     BTA_DM_API_SET_PRIVACY_MODE_EVT,
     BTA_DM_API_BLE_SET_CSA_SUPPORT_EVT,
+    BTA_DM_API_BLE_SET_VENDOR_EVT_MASK_EVT,
 #endif
     BTA_DM_MAX_EVT
 };
@@ -925,6 +926,12 @@ typedef struct {
     tBTA_SET_CSA_SUPPORT_CMPL_CBACK     *p_cback;
 } tBTA_DM_API_BLE_SET_CSA_SUPPORT;
 
+typedef struct {
+    BT_HDR                              hdr;
+    UINT32                              evt_mask;
+    tBTA_SET_VENDOR_EVT_MASK_CBACK      *p_cback;
+} tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK;
+
 #endif /* BLE_INCLUDED */
 
 /* data type for BTA_DM_API_REMOVE_ACL_EVT */
@@ -1324,6 +1331,7 @@ typedef union {
     tBTA_DM_API_CLEAR_ADV           ble_clear_adv;
     tBTA_DM_API_SET_PRIVACY_MODE    ble_set_privacy_mode;
     tBTA_DM_API_BLE_SET_CSA_SUPPORT ble_set_csa_support;
+    tBTA_DM_API_BLE_SET_VENDOR_EVT_MASK ble_set_vendor_evt_mask;
 #endif
 
     tBTA_DM_API_REMOVE_ACL              remove_acl;
@@ -1769,6 +1777,7 @@ extern void bta_dm_ble_gap_set_rpa_timeout(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_add_dev_to_resolving_list(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_set_privacy_mode(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_set_csa_support(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_set_vendor_evt_mask(tBTA_DM_MSG *p_data);
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 extern void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_dtm_enhance_rx_start(tBTA_DM_MSG *p_data);

components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c

@@ -723,10 +723,6 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 } else {
                     APPL_TRACE_ERROR("%s, malloc failed", __func__);
                 }
-            } else {
-                if (p_msg->api_indicate.value) {
-                    APPL_TRACE_ERROR("%s, incorrect length", __func__);
-                }
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
             if (cb_data.req_data.value != NULL) {

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -441,6 +441,8 @@ typedef tBTM_SET_PRIVACY_MODE_CMPL_CBACK tBTA_SET_PRIVACY_MODE_CMPL_CBACK;
 
 typedef tBTM_SET_CSA_SUPPORT_CMPL_CBACK tBTA_SET_CSA_SUPPORT_CMPL_CBACK;
 
+typedef tBTM_SET_VENDOR_EVT_MASK_CBACK tBTA_SET_VENDOR_EVT_MASK_CBACK;
+
 typedef tBTM_CMPL_CB tBTA_CMPL_CB;
 
 typedef tBTM_VSC_CMPL tBTA_VSC_CMPL;
@@ -2860,6 +2862,8 @@ extern void BTA_DmBleSetPrivacyMode(uint8_t addr_type, BD_ADDR addr, uint8_t pri
 
 extern void BTA_DmBleGapSetCsaSupport(uint8_t csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK *p_callback);
 
+extern void BTA_DmBleGapSetVendorEventMask(uint32_t evt_mask, tBTA_SET_VENDOR_EVT_MASK_CBACK *p_callback);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleSetStorageParams

components/bt/host/bluedroid/bta/include/bta/bta_ar_api.h

@@ -18,7 +18,7 @@
 
 /******************************************************************************
  *
- *  This is the public interface file for the simulatenous advanced
+ *  This is the public interface file for the simultaneous advanced
  *  audio/video streaming (AV) source and sink of BTA, Broadcom's Bluetooth
  *  application layer for mobile phones.
  *
@@ -35,6 +35,10 @@
 
 #if (BTA_AR_INCLUDED == TRUE)
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/

components/bt/host/bluedroid/bta/jv/bta_jv_act.c

@@ -1058,7 +1058,7 @@ void sdp_bqb_add_language_attr_ctrl(BOOLEAN enable)
 
 /**
  * @brief       Adds a protocol list and service name (if provided) to an SDP record given by
- *              sdp_handle, and marks it as browseable. This is a shortcut for defining a
+ *              sdp_handle, and marks it as browsable. This is a shortcut for defining a
  *              set of protocols that includes L2CAP, RFCOMM, and optionally OBEX.
  *
  * @param[in]   sdp_handle: SDP handle
@@ -1133,9 +1133,9 @@ static bool create_base_record(const uint32_t sdp_handle, const char *name, cons
         }
     }
 
-    // Mark the service as browseable.
+    // Mark the service as browsable.
     uint16_t list = UUID_SERVCLASS_PUBLIC_BROWSE_GROUP;
-    stage = "browseable";
+    stage = "browsable";
     if (!SDP_AddUuidSequence(sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &list)){
         APPL_TRACE_ERROR("create_base_record: failed to create base service "
                    "record, stage: %s, scn: %d, name: %s, with_obex: %d",
@@ -1754,6 +1754,7 @@ static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle, void* dat
         evt_data.rfc_close.status = BTA_JV_FAILURE;
         evt_data.rfc_close.port_status = code;
         evt_data.rfc_close.async = TRUE;
+        evt_data.rfc_close.user_data = p_pcb->user_data;
         if (p_pcb->state == BTA_JV_ST_CL_CLOSING) {
             evt_data.rfc_close.async = FALSE;
             evt_data.rfc_close.status = BTA_JV_SUCCESS;
@@ -2082,6 +2083,7 @@ static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle, void *dat
         evt_data.rfc_close.status = BTA_JV_FAILURE;
         evt_data.rfc_close.async = TRUE;
         evt_data.rfc_close.port_status = code;
+        evt_data.rfc_close.user_data = user_data;
         p_pcb->cong = FALSE;
 
         tBTA_JV_RFCOMM_CBACK    *p_cback = p_cb->p_cback;

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -40,31 +40,6 @@
 
 #if (SDP_INCLUDED == TRUE)
 
-/*****************************************************************************
-**  Constants
-*****************************************************************************/
-
-static const uint8_t  UUID_OBEX_OBJECT_PUSH[] = {0x00, 0x00, 0x11, 0x05, 0x00, 0x00, 0x10, 0x00,
-                                                 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                                };
-static const uint8_t  UUID_PBAP_PSE[] = {0x00, 0x00, 0x11, 0x2F, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_PBAP_PCE[] = {0x00, 0x00, 0x11, 0x2E, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_MAP_MAS[] = {0x00, 0x00, 0x11, 0x32, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_MAP_MNS[] = {0x00, 0x00, 0x11, 0x33, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_SPP[] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
-static const uint8_t  UUID_SAP[] = {0x00, 0x00, 0x11, 0x2D, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
 // TODO:
 // Both the fact that the UUIDs are declared in multiple places, plus the fact
 // that there is a mess of UUID comparison and shortening methods will have to
@@ -328,7 +303,7 @@ static void bta_create_sap_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     tSDP_PROTOCOL_ELEM pe;
     UINT16 pversion = -1;
 
-    record->sap.hdr.type = SDP_TYPE_MAP_MAS;
+    record->sap.hdr.type = SDP_TYPE_SAP_SERVER;
     record->sap.hdr.service_name_length = 0;
     record->sap.hdr.service_name = NULL;
     record->sap.hdr.rfcomm_channel_number = 0;
@@ -379,6 +354,15 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     record->hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
+static bool check_if_uuid16_match(UINT16 uuid16, tBT_UUID *uuid)
+{
+    // Because it is converted to a short UUID, only uuid16 needs to be checked.
+    if (uuid->len == 2 && uuid->uu.uuid16 == uuid16) {
+        return TRUE;
+    } else {
+        return FALSE;
+    }
+}
 
 /*******************************************************************************
 **
@@ -415,22 +399,22 @@ static void bta_sdp_search_cback(UINT16 result, void *user_data)
             /* generate the matching record data pointer */
             if (p_rec != NULL) {
                 status = BTA_SDP_SUCCESS;
-                if (IS_UUID(UUID_MAP_MAS, uuid->uu.uuid128)) {
+                if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_ACCESS, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MAS) uuid\n", __func__);
                     bta_create_mas_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MNS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_NOTIFICATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MNS) uuid\n", __func__);
                     bta_create_mns_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PSE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PSE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PSE) uuid\n", __func__);
                     bta_create_pse_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PCE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PCE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PCE) uuid\n", __func__);
                     bta_create_pce_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_OBEX_OBJECT_PUSH, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_OBEX_OBJECT_PUSH, &su)) {
                     APPL_TRACE_DEBUG("%s() - found Object Push Server (OPS) uuid\n", __func__);
                     bta_create_ops_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_SAP, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_SAP, &su)) {
                     APPL_TRACE_DEBUG("%s() - found SAP uuid\n", __func__);
                     bta_create_sap_sdp_record(&evt_data.records[count], p_rec);
                 } else {

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -293,6 +293,9 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             status = BT_STATUS_AUTH_REJECTED;
             break;
         default:
+            BTC_TRACE_WARNING ("%s, remove bond in flash bd_addr: %08x%04x", __func__,
+                                (p_auth_cmpl->bd_addr[0] << 24) + (p_auth_cmpl->bd_addr[1] << 16) + (p_auth_cmpl->bd_addr[2] << 8) + p_auth_cmpl->bd_addr[3],
+                                (p_auth_cmpl->bd_addr[4] << 8) + p_auth_cmpl->bd_addr[5]);
             btc_dm_remove_ble_bonding_keys();
             status =  BT_STATUS_FAIL;
             break;

components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -1375,6 +1375,45 @@ static void btc_ble_set_csa_support_callback(UINT8 status)
     }
 }
 
+static void btc_ble_set_vendor_evt_mask_callback(UINT8 status)
+{
+    esp_ble_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg = {0};
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_SET_VENDOR_EVT_MASK_COMPLETE_EVT;
+
+    param.set_csa_support_cmpl.status = btc_btm_status_to_esp_status(status);
+
+    ret = btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), NULL, NULL);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
+static void btc_ble_vendor_hci_event_callback(UINT8 subevt_code, UINT8 param_len, UINT8 *params)
+{
+    esp_ble_gap_cb_param_t param = {0};
+    bt_status_t ret;
+    btc_msg_t msg = {0};
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_VENDOR_HCI_EVT;
+
+    param.vendor_hci_evt.subevt_code = subevt_code;
+    param.vendor_hci_evt.param_len = param_len;
+    param.vendor_hci_evt.param_buf = params;
+    ret = btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), btc_gap_ble_cb_deep_copy, btc_gap_ble_cb_deep_free);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
 void btc_get_whitelist_size(uint16_t *length)
 {
     BTM_BleGetWhiteListSize(length);
@@ -1545,6 +1584,13 @@ static void btc_ble_dtm_enhance_rx_start(uint8_t rx_channel, uint8_t phy, uint8_
 
     BTA_DmBleDtmEnhRxStart(rx_channel, phy, modulation_index, p_dtm_cmpl_cback);
 }
+
+void btc_get_periodic_list_size(uint8_t *size)
+{
+    BTM_BleGetPeriodicAdvListSize(size);
+    return;
+}
+
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 static void btc_ble_dtm_stop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
@@ -1774,6 +1820,18 @@ void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
         }
         break;
     }
+    case ESP_GAP_BLE_VENDOR_HCI_EVT: {
+        if (src->vendor_hci_evt.param_len) {
+            dst->vendor_hci_evt.param_buf = osi_malloc(src->vendor_hci_evt.param_len);
+            if (dst->vendor_hci_evt.param_buf) {
+                memcpy(dst->vendor_hci_evt.param_buf, src->vendor_hci_evt.param_buf,
+                    src->vendor_hci_evt.param_len);
+            } else {
+                BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
+            }
+        }
+        break;
+    }
     default:
        BTC_TRACE_ERROR("%s, Unhandled deep copy %d\n", __func__, msg->act);
        break;
@@ -1902,6 +1960,13 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg)
             }
             break;
         }
+        case ESP_GAP_BLE_VENDOR_HCI_EVT: {
+            void *value = ((esp_ble_gap_cb_param_t *)msg->arg)->vendor_hci_evt.param_buf;
+            if (value) {
+                osi_free(value);
+            }
+            break;
+        }
         default:
             BTC_TRACE_DEBUG("Unhandled deep free %d", msg->act);
             break;
@@ -2397,6 +2462,9 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
     case BTC_GAP_BLE_SET_CSA_SUPPORT:
         BTA_DmBleGapSetCsaSupport(arg->set_csa_support.csa_select, btc_ble_set_csa_support_callback);
         break;
+    case BTC_GAP_BLE_ACT_SET_VENDOR_EVT_MASK:
+        BTA_DmBleGapSetVendorEventMask(arg->set_vendor_evt_mask.evt_mask, btc_ble_set_vendor_evt_mask_callback);
+        break;
     default:
         break;
     }
@@ -2412,6 +2480,7 @@ void btc_gap_callback_init(void)
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     BTM_BleGapRegisterCallback(btc_ble_5_gap_callback);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+    BTM_BleRegisterVendorHciEventCallback(btc_ble_vendor_hci_event_callback);
 }
 
 bool btc_gap_ble_init(void)

components/bt/host/bluedroid/btc/profile/std/include/btc_av_api.h

@@ -23,6 +23,9 @@
 #include "stack/a2d_sbc.h"
 
 #if (BTC_AV_INCLUDED == TRUE)
+#ifdef __cplusplus
+extern "C" {
+#endif
 /*****************************************************************************
  **  Constants and data types
  *****************************************************************************/

components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h

@@ -109,6 +109,7 @@ typedef enum {
     BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT,
     BTC_GAP_BLE_SET_PRIVACY_MODE,
     BTC_GAP_BLE_SET_CSA_SUPPORT,
+    BTC_GAP_BLE_ACT_SET_VENDOR_EVT_MASK,
 } btc_gap_ble_act_t;
 
 /* btc_ble_gap_args_t */
@@ -281,6 +282,10 @@ typedef union {
     struct set_csa_support_args {
         uint8_t csa_select;
     } set_csa_support;
+    // BTC_GAP_BLE_ACT_SET_VENDOR_EVT_MASK
+    struct set_vendor_evt_mask_args {
+        uint32_t evt_mask;
+    } set_vendor_evt_mask;
 } btc_ble_gap_args_t;
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
@@ -441,6 +446,9 @@ typedef union {
 void btc_gap_ble_call_handler(btc_msg_t *msg);
 void btc_gap_ble_cb_handler(btc_msg_t *msg);
 void btc_get_whitelist_size(uint16_t *length);
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+void btc_get_periodic_list_size(uint8_t *length);
+#endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
 void btc_gap_ble_arg_deep_free(btc_msg_t *msg);
 void btc_gap_ble_cb_deep_free(btc_msg_t *msg);

components/bt/host/bluedroid/btc/profile/std/spp/btc_spp.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -909,6 +909,9 @@ static void btc_spp_write(btc_spp_args_t *arg)
         } else {
             if (fixed_queue_enqueue(slot->tx.queue, arg->write.p_data, 0)) {
                 BTA_JvRfcommWrite(arg->write.handle, slot->id, arg->write.len, arg->write.p_data);
+                // The TX queue of SPP will handle this memory properly.
+                // Set it to NULL here to prevent deep free handler from releasing it.
+                arg->write.p_data = NULL;
             } else {
                 ret = ESP_SPP_NO_RESOURCE;
             }
@@ -966,6 +969,13 @@ void btc_spp_arg_deep_free(btc_msg_t *msg)
     case BTC_SPP_ACT_START_DISCOVERY:
         if (arg->start_discovery.p_uuid_list) {
             osi_free(arg->start_discovery.p_uuid_list);
+            arg->start_discovery.p_uuid_list = NULL;
+        }
+        break;
+    case BTC_SPP_ACT_WRITE:
+        if (arg->write.p_data) {
+            osi_free(arg->write.p_data);
+            arg->write.p_data = NULL;
         }
         break;
     default:
@@ -1099,7 +1109,7 @@ void btc_spp_cb_handler(btc_msg_t *msg)
         break;
     case BTA_JV_RFCOMM_WRITE_EVT:
         osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-        slot = spp_find_slot_by_handle(p_data->rfc_write.handle);
+        slot = spp_find_slot_by_id(p_data->rfc_write.req_id);
         if (!slot) {
             BTC_TRACE_ERROR("%s unable to find RFCOMM slot!, handle:%d", __func__, p_data->rfc_write.handle);
         }
@@ -1165,7 +1175,7 @@ void btc_spp_cb_handler(btc_msg_t *msg)
         param.close.async = p_data->rfc_close.async;
         if (spp_local_param.spp_mode == ESP_SPP_MODE_CB) {
             osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-            slot = spp_find_slot_by_handle(p_data->rfc_close.handle);
+            slot = spp_find_slot_by_id((uint32_t)p_data->rfc_close.user_data);
             if (!slot) {
                 param.close.status = ESP_SPP_NO_CONNECTION;
                 osi_mutex_unlock(&spp_local_param.spp_slot_mutex);
@@ -1179,7 +1189,7 @@ void btc_spp_cb_handler(btc_msg_t *msg)
             bool need_call = true;
             do {
                 osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-                slot = spp_find_slot_by_handle(p_data->rfc_close.handle);
+                slot = spp_find_slot_by_id((uint32_t)p_data->rfc_close.user_data);
                 if (!slot) {
                     param.close.status = ESP_SPP_NO_CONNECTION;
                     osi_mutex_unlock(&spp_local_param.spp_slot_mutex);

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -908,9 +908,82 @@
 #define BTM_SEC_MAX_DEVICE_RECORDS  UC_BT_SMP_MAX_BONDS
 #endif
 
-/* The number of security records for services. 32 AS Default*/
+#if BTA_SDP_INCLUDED
+#define BTM_SDP_SEC_SERVICE_RECORDS 1
+#else
+#define BTM_SDP_SEC_SERVICE_RECORDS 0
+#endif
+
+#if BTA_AG_INCLUDED
+#define BTM_AG_SEC_SERVICE_RECORDS 1
+#else
+#define BTM_AG_SEC_SERVICE_RECORDS 0
+#endif
+
+#if BTA_HF_INCLUDED
+#define BTM_HF_SEC_SERVICE_RECORDS 1
+#else
+#define BTM_HF_SEC_SERVICE_RECORDS 0
+#endif
+
+#if BTA_JV_INCLUDED
+#define BTM_JV_SEC_SERVICE_RECORDS (MAX_RFC_PORTS - BTM_HF_SEC_SERVICE_RECORDS - BTM_AG_SEC_SERVICE_RECORDS)
+#else
+#define BTM_JV_SEC_SERVICE_RECORDS 0
+#endif
+
+#if AVCT_INCLUDED
+#if AVCT_BROWSE_INCLUDED
+#define BTM_AVCT_SEC_SERVICE_RECORDS 2
+#else
+#define BTM_AVCT_SEC_SERVICE_RECORDS 1
+#endif // AVCT_BROWSE_INCLUDED
+#else
+#define BTM_AVCT_SEC_SERVICE_RECORDS 0
+#endif
+
+#if AVDT_INCLUDED
+#if AVDT_REPORTING
+#define BTM_AVDT_SEC_SERVICE_RECORDS 3
+#else
+#define BTM_AVDT_SEC_SERVICE_RECORDS 2
+#endif // AVDT_INCLUDED
+#else
+#define BTM_AVDT_SEC_SERVICE_RECORDS 0
+#endif
+
+#if GAP_CONN_INCLUDED
+#define BTM_GAP_SEC_SERVICE_RECORDS GAP_MAX_CONNECTIONS
+#else
+#define BTM_GAP_SEC_SERVICE_RECORDS 0
+#endif
+
+#if HID_DEV_INCLUDED
+#define BTM_HIDD_SEC_SERVICE_RECORDS 3
+#else
+#define BTM_HIDD_SEC_SERVICE_RECORDS 0
+#endif
+
+#if HID_HOST_INCLUDED
+#define BTM_HIDH_SEC_SERVICE_RECORDS 3
+#else
+#define BTM_HIDH_SEC_SERVICE_RECORDS 0
+#endif
+
+#if BLE_INCLUDED
+#define BTM_GATT_SEC_SERVICE_RECORDS 1
+#else
+#define BTM_GATT_SEC_SERVICE_RECORDS 0
+#endif
+
+#define BTM_SEC_DEV_SERVICE_RECORDS  1
+
+/* The number of security records for services. */
 #ifndef BTM_SEC_MAX_SERVICE_RECORDS
-#define BTM_SEC_MAX_SERVICE_RECORDS 8 // 32
+#define BTM_SEC_MAX_SERVICE_RECORDS (BTM_SDP_SEC_SERVICE_RECORDS + BTM_AG_SEC_SERVICE_RECORDS     \
+   + BTM_AVCT_SEC_SERVICE_RECORDS + BTM_AVDT_SEC_SERVICE_RECORDS + BTM_GAP_SEC_SERVICE_RECORDS    \
+   + BTM_HIDD_SEC_SERVICE_RECORDS + BTM_GATT_SEC_SERVICE_RECORDS + BTM_JV_SEC_SERVICE_RECORDS    \
+   + BTM_HIDH_SEC_SERVICE_RECORDS + BTM_SEC_DEV_SERVICE_RECORDS + BTM_HF_SEC_SERVICE_RECORDS)
 #endif
 
 /* If True, force a retrieval of remote device name for each bond in case it's changed */

components/bt/host/bluedroid/common/include/common/bt_trace.h

@@ -25,6 +25,9 @@
 #include "stack/bt_types.h"
 #include "bt_common.h"
 
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+#include "ble_log/ble_log_spi_out.h"
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t len)
 {
     uint16_t i;
@@ -217,20 +220,83 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 
 /* Define tracing for BTM
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define BTM_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(BTM, ERROR)) BT_PRINT_E("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(BTM, WARNING)) BT_PRINT_W("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(BTM, API)) BT_PRINT_I("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(BTM, EVENT)) BT_PRINT_D("BT_BTM", fmt, ## args); \
+}
+
+#define BTM_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_BTM", fmt, ## args); \
+    if (btm_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(BTM, DEBUG)) BT_PRINT_D("BT_BTM", fmt, ## args); \
+}
+
+#else
+
 #define BTM_TRACE_ERROR(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(BTM, ERROR)) BT_PRINT_E("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_WARNING(fmt, args...)     {if (btm_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(BTM, WARNING)) BT_PRINT_W("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_API(fmt, args...)         {if (btm_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(BTM,API)) BT_PRINT_I("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_EVENT(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(BTM,EVENT)) BT_PRINT_D("BT_BTM", fmt, ## args);}
 #define BTM_TRACE_DEBUG(fmt, args...)       {if (btm_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(BTM,DEBUG)) BT_PRINT_D("BT_BTM", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
 /* Define tracing for the L2CAP unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define L2CAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(L2CAP, ERROR)) BT_PRINT_E("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(L2CAP, WARNING)) BT_PRINT_W("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(L2CAP, API)) BT_PRINT_I("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(L2CAP, EVENT)) BT_PRINT_D("BT_L2CAP", fmt, ## args); \
+}
+
+#define L2CAP_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_L2CAP", fmt, ## args); \
+    if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(L2CAP, DEBUG)) BT_PRINT_D("BT_L2CAP", fmt, ## args); \
+}
+
+#else
+
 #define L2CAP_TRACE_ERROR(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(L2CAP, ERROR)) BT_PRINT_E("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_WARNING(fmt, args...)   {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(L2CAP, WARNING)) BT_PRINT_W("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_API(fmt, args...)       {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(L2CAP,API)) BT_PRINT_I("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_EVENT(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(L2CAP,EVENT)) BT_PRINT_D("BT_L2CAP", fmt, ## args);}
 #define L2CAP_TRACE_DEBUG(fmt, args...)     {if (l2cb.l2cap_trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(L2CAP,DEBUG)) BT_PRINT_D("BT_L2CAP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+
 /* Define tracing for the SDP unit
 */
 #define SDP_TRACE_ERROR(fmt, args...)       {if (sdp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SDP, ERROR)) BT_PRINT_E("BT_SDP", fmt, ## args);}
@@ -248,11 +314,38 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 #define RFCOMM_TRACE_DEBUG(fmt, args...)    {if (rfc_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(RFCOMM,DEBUG)) BT_PRINT_D("BT_RFCOMM", fmt, ## args);}
 
 /* Generic Access Profile traces */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define GAP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GAP, ERROR)) BT_PRINT_E("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GAP, WARNING)) BT_PRINT_W("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GAP, API)) BT_PRINT_I("BT_GAP", fmt, ## args); \
+}
+
+#define GAP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GAP", fmt, ## args); \
+    if (gap_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GAP, EVENT)) BT_PRINT_D("BT_GAP", fmt, ## args); \
+}
+
+#else
+
 #define GAP_TRACE_ERROR(fmt, args...)       {if (gap_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GAP, ERROR)) BT_PRINT_E("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_API(fmt, args...)         {if (gap_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GAP,API)) BT_PRINT_I("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_EVENT(fmt, args...)       {if (gap_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GAP,EVENT)) BT_PRINT_D("BT_GAP", fmt, ## args);}
 #define GAP_TRACE_WARNING(fmt, args...)     {if (gap_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GAP, WARNING)) BT_PRINT_W("BT_GAP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+
 /* define traces for HID Host */
 #define HIDH_TRACE_ERROR(fmt, args...)      {if (hh_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(HIDH, ERROR)) BT_PRINT_E("BT_HIDH", fmt, ## args);}
 #define HIDH_TRACE_WARNING(fmt, args...)    {if (hh_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(HIDH, WARNING)) BT_PRINT_W("BT_HIDH", fmt, ## args);}
@@ -326,20 +419,81 @@ static inline void trc_dump_buffer(const char *prefix, uint8_t *data, uint16_t l
 
 /* Define tracing for the ATT/GATT unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define GATT_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GATT, ERROR)) BT_PRINT_E("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GATT, WARNING)) BT_PRINT_W("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GATT, API)) BT_PRINT_I("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GATT, EVENT)) BT_PRINT_D("BT_GATT", fmt, ## args); \
+}
+
+#define GATT_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_GATT", fmt, ## args); \
+    if (gatt_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(GATT, DEBUG)) BT_PRINT_D("BT_GATT", fmt, ## args); \
+}
+
+#else
+
 #define GATT_TRACE_ERROR(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(GATT, ERROR)) BT_PRINT_E("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_WARNING(fmt, args...)    {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(GATT, WARNING)) BT_PRINT_W("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_API(fmt, args...)        {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(GATT,API)) BT_PRINT_I("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_EVENT(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(GATT,EVENT)) BT_PRINT_D("BT_GATT", fmt, ## args);}
 #define GATT_TRACE_DEBUG(fmt, args...)      {if (gatt_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(GATT,DEBUG)) BT_PRINT_D("BT_GATT", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
 /* Define tracing for the SMP unit
 */
+#if (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
+
+#define SMP_TRACE_ERROR(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_ERROR, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SMP, ERROR)) BT_PRINT_E("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_WARNING(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_WARN, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(SMP, WARNING)) BT_PRINT_W("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_API(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_INFO, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(SMP, API)) BT_PRINT_I("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_EVENT(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(SMP, EVENT)) BT_PRINT_D("BT_SMP", fmt, ## args); \
+}
+
+#define SMP_TRACE_DEBUG(fmt, args...) { \
+    ble_log_spi_out_printf_enh(BLE_LOG_SPI_OUT_SOURCE_BLUEDROID, BLE_LOG_SPI_OUT_LEVEL_DEBUG, "BT_SMP", fmt, ## args); \
+    if (smp_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(SMP, DEBUG)) BT_PRINT_D("BT_SMP", fmt, ## args); \
+}
+
+#else
+
 #define SMP_TRACE_ERROR(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_ERROR && BT_LOG_LEVEL_CHECK(SMP, ERROR)) BT_PRINT_E("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_WARNING(fmt, args...)     {if (smp_cb.trace_level >= BT_TRACE_LEVEL_WARNING && BT_LOG_LEVEL_CHECK(SMP, WARNING)) BT_PRINT_W("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_API(fmt, args...)         {if (smp_cb.trace_level >= BT_TRACE_LEVEL_API && BT_LOG_LEVEL_CHECK(SMP,API)) BT_PRINT_I("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_EVENT(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_EVENT && BT_LOG_LEVEL_CHECK(SMP,EVENT)) BT_PRINT_D("BT_SMP", fmt, ## args);}
 #define SMP_TRACE_DEBUG(fmt, args...)       {if (smp_cb.trace_level >= BT_TRACE_LEVEL_DEBUG && BT_LOG_LEVEL_CHECK(SMP,DEBUG)) BT_PRINT_D("BT_SMP", fmt, ## args);}
 
+#endif // (BT_BLE_LOG_SPI_OUT_HOST_ENABLED && !CLASSIC_BT_INCLUDED)
 
 extern UINT8 btif_trace_level;
 

components/bt/host/bluedroid/device/controller.c

@@ -83,6 +83,7 @@ typedef struct {
     bool secure_connections_supported;
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     uint16_t ble_ext_adv_data_max_len;
+    uint16_t get_ble_periodic_advertiser_list_size;
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 } controller_local_param_t;
 
@@ -95,6 +96,7 @@ static controller_local_param_t *controller_param_ptr;
 
 #define AWAIT_COMMAND(command) future_await(controller_param.hci->transmit_command_futured(command))
 
+static bool loaded = false;
 // Module lifecycle functions
 
 static void start_up(void)
@@ -277,6 +279,10 @@ static void start_up(void)
                 response,
                 &controller_param.ble_ext_adv_data_max_len);
         }
+        response = AWAIT_COMMAND(controller_param.packet_factory->make_read_periodic_adv_list_size());
+        controller_param.packet_parser->parse_ble_read_periodic_adv_list_size_response(
+            response,
+            &controller_param.get_ble_periodic_advertiser_list_size);
 #endif // (BLE_50_FEATURE_SUPPORT == TRUE && BLE_42_FEATURE_SUPPORT == FALSE)
 
         if (HCI_LE_DATA_LEN_EXT_SUPPORTED(controller_param.features_ble.as_array)) {
@@ -317,6 +323,17 @@ static void shut_down(void)
     controller_param.readable = false;
 }
 
+#if (BT_BLE_DYNAMIC_ENV_MEMORY == TRUE)
+void free_controller_param(void)
+{
+    if (controller_param_ptr) {
+        osi_free(controller_param_ptr);
+        controller_param_ptr = NULL;
+        loaded = false;
+    }
+}
+#endif
+
 static bool get_is_ready(void)
 {
     return controller_param.readable;
@@ -517,6 +534,12 @@ static uint16_t ble_get_ext_adv_data_max_len(void)
 
     return controller_param.ble_ext_adv_data_max_len;
 }
+static uint8_t get_ble_periodic_adv_list_size(void)
+{
+    assert(controller_param.readable);
+    assert(controller_param.ble_supported);
+    return controller_param.get_ble_periodic_advertiser_list_size;
+}
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
 static uint8_t get_sco_data_size(void)
@@ -577,6 +600,7 @@ static const controller_t interface = {
     set_ble_resolving_list_max_size,
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     ble_get_ext_adv_data_max_len,
+    get_ble_periodic_adv_list_size,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BTM_SCO_HCI_INCLUDED == TRUE)
     get_sco_data_size,
@@ -586,7 +610,6 @@ static const controller_t interface = {
 
 const controller_t *controller_get_interface(void)
 {
-    static bool loaded = false;
     if (!loaded) {
         loaded = true;
 #if (BT_BLE_DYNAMIC_ENV_MEMORY == TRUE)

components/bt/host/bluedroid/device/include/device/controller.h

@@ -82,6 +82,7 @@ typedef struct controller_t {
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     uint16_t (*ble_get_ext_adv_data_max_len)(void);
+    uint8_t (*get_ble_periodic_adv_list_size)(void);
 #endif // BLE_50_FEATURE_SUPPORT
 
 #if (BTM_SCO_HCI_INCLUDED == TRUE)

components/bt/host/bluedroid/hci/hci_hal_h4.c

@@ -41,6 +41,14 @@
 #include "stack/hcimsgs.h"
 #include "hci_log/bt_hci_log.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+
 #define HCI_BLE_EVENT 0x3e
 #define PACKET_TYPE_TO_INBOUND_INDEX(type) ((type) - 2)
 #define PACKET_TYPE_TO_INDEX(type) ((type) - 1)
@@ -214,6 +222,9 @@ static uint16_t transmit_data(serial_data_type_t type,
 #if (BT_HCI_LOG_INCLUDED == TRUE)
     bt_hci_log_record_hci_data(data[0], &data[1], length - 1);
 #endif
+#if (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_NIMBLE, data, length);
+#endif // (CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
     // TX Data to target
     esp_vhci_host_send_packet(data, length);
 
@@ -561,6 +572,9 @@ void bt_record_hci_data(uint8_t *data, uint16_t len)
 
 static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
 {
+#if (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
+    ble_log_spi_out_write_with_ts(BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM, data, len);
+#endif // (BT_BLE_LOG_SPI_OUT_HCI_ENABLED && !SOC_ESP_NIMBLE_CONTROLLER)
     //Target has packet to host, malloc new buffer for packet
     BT_HDR *pkt = NULL;
     pkt_linked_item_t *linked_pkt = NULL;

components/bt/host/bluedroid/hci/hci_packet_factory.c

@@ -223,6 +223,12 @@ static BT_HDR *make_read_max_adv_data_len(void)
 {
     return make_command_no_params(HCI_BLE_RD_MAX_ADV_DATA_LEN);
 }
+
+static BT_HDR *make_read_periodic_adv_list_size(void)
+{
+    return make_command_no_params(HCI_BLE_RD_PERIOD_ADV_LIST_SIZE);
+}
+
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 // Internal functions
 
@@ -270,6 +276,7 @@ static const hci_packet_factory_t interface = {
     make_ble_read_resolving_list_size,
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     make_read_max_adv_data_len,
+    make_read_periodic_adv_list_size,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
     make_ble_read_suggested_default_data_length,
     make_ble_write_suggested_default_data_length,

components/bt/host/bluedroid/hci/hci_packet_parser.c

@@ -221,6 +221,19 @@ static void parse_ble_read_adv_max_len_response(
     }
     osi_free(response);
 }
+
+static void parse_ble_read_periodic_adv_list_size_response(
+    BT_HDR *response,
+    uint16_t *periodic_adv_list_size_ptr)
+{
+
+    uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_PERIOD_ADV_LIST_SIZE, 1 /* bytes after */);
+    if (stream) {
+        // Size: 1 Octets ; Value: 0x01 to 0xFF ; Total number of Periodic Advertiser list entries that can be stored in the Controller
+        STREAM_TO_UINT8(*periodic_adv_list_size_ptr, stream);
+    }
+    osi_free(response);
+}
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 
@@ -283,6 +296,7 @@ static const hci_packet_parser_t interface = {
     parse_ble_read_resolving_list_size_response,
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     parse_ble_read_adv_max_len_response,
+    parse_ble_read_periodic_adv_list_size_response,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
     parse_ble_read_suggested_default_data_length_response
 };

components/bt/host/bluedroid/hci/include/hci/hci_packet_factory.h

@@ -44,6 +44,7 @@ typedef struct {
     BT_HDR *(*make_ble_read_resolving_list_size)(void);
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     BT_HDR *(*make_read_max_adv_data_len)(void);
+    BT_HDR *(*make_read_periodic_adv_list_size)(void);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
     BT_HDR *(*make_ble_read_suggested_default_data_length)(void);
     BT_HDR *(*make_ble_write_suggested_default_data_length)(uint16_t SuggestedMaxTxOctets, uint16_t SuggestedMaxTxTime);

components/bt/host/bluedroid/hci/include/hci/hci_packet_parser.h

@@ -96,9 +96,13 @@ typedef struct {
     );
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
     void (*parse_ble_read_adv_max_len_response) (
-        BT_HDR *respone,
+        BT_HDR *response,
         uint16_t *ble_ext_adv_data_max_len_ptr
     );
+    void (*parse_ble_read_periodic_adv_list_size_response) (
+        BT_HDR *response,
+        uint16_t *periodic_advertiser_list_size
+    );
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
     void (*parse_ble_read_suggested_default_data_length_response)(
         BT_HDR *response,

components/bt/host/bluedroid/main/bte_main.c

@@ -64,6 +64,9 @@ static void bte_main_enable(void);
 bluedroid_init_done_cb_t bluedroid_init_done_cb;
 
 extern void osi_mem_dbg_init(void);
+#if (BT_BLE_DYNAMIC_ENV_MEMORY == TRUE)
+extern void free_controller_param(void);
+#endif
 /******************************************************************************
 **
 ** Function         bte_main_boot_entry
@@ -85,7 +88,7 @@ int bte_main_boot_entry(bluedroid_init_done_cb_t cb)
 
     osi_init();
 
-    //Enbale HCI
+    //Enable HCI
     bte_main_enable();
 
     return 0;
@@ -105,6 +108,11 @@ void bte_main_shutdown(void)
 #if (BLE_INCLUDED == TRUE)
     BTA_VendorCleanup();
 #endif
+
+#if (BT_BLE_DYNAMIC_ENV_MEMORY == TRUE)
+    free_controller_param();
+#endif
+
     bte_main_disable();
 
     osi_deinit();

components/bt/host/bluedroid/stack/btm/btm_acl.c

@@ -335,7 +335,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
 #if (CLASSIC_BT_INCLUDED == TRUE)
                         const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
-                        /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+                        /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
 #if (SMP_INCLUDED == TRUE)
                         btm_sec_set_peer_sec_caps(p, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
@@ -350,7 +350,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
                         return;
                     }
                 } else {
-                    /* If remote features indicated secure connection (SC) mode, check the remote feautres again*/
+                    /* If remote features indicated secure connection (SC) mode, check the remote features again*/
                     /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
                     btm_read_remote_features (p->hci_handle);
                 }
@@ -474,7 +474,7 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
                     BTM_TRACE_DEBUG("Bonded\n");
                 }
             } else {
-                BTM_TRACE_DEBUG("Bletooth link down\n");
+                BTM_TRACE_DEBUG("Bluetooth link down\n");
                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
                                           | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
             }
@@ -531,10 +531,11 @@ void btm_acl_device_down (void)
 *******************************************************************************/
 void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
 {
-    tBTM_BL_UPDATE_DATA  evt;
-    UINT8 busy_level;
-    BTM_TRACE_DEBUG ("btm_acl_update_busy_level\n");
+    UINT8 busy_level_flags = 0;
     BOOLEAN old_inquiry_state = btm_cb.is_inquiry;
+
+    BTM_TRACE_DEBUG ("btm_acl_update_busy_level\n");
+
     switch (event) {
     case BTM_BLI_ACL_UP_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_ACL_UP_EVT\n");
@@ -545,30 +546,31 @@ void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
     case BTM_BLI_PAGE_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_PAGE_EVT\n");
         btm_cb.is_paging = TRUE;
-        evt.busy_level_flags = BTM_BL_PAGING_STARTED;
+        busy_level_flags = BTM_BL_PAGING_STARTED;
         break;
     case BTM_BLI_PAGE_DONE_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_PAGE_DONE_EVT\n");
         btm_cb.is_paging = FALSE;
-        evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
+        busy_level_flags = BTM_BL_PAGING_COMPLETE;
         break;
     case BTM_BLI_INQ_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_INQ_EVT\n");
         btm_cb.is_inquiry = TRUE;
-        evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
+        busy_level_flags = BTM_BL_INQUIRY_STARTED;
         break;
     case BTM_BLI_INQ_CANCEL_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_INQ_CANCEL_EVT\n");
         btm_cb.is_inquiry = FALSE;
-        evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
+        busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
         break;
     case BTM_BLI_INQ_DONE_EVT:
         BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT\n");
         btm_cb.is_inquiry = FALSE;
-        evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
+        busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
         break;
     }
 
+    UINT8 busy_level;
     if (btm_cb.is_paging || btm_cb.is_inquiry) {
         busy_level = 10;
     } else {
@@ -576,8 +578,11 @@ void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
     }
 
     if ((busy_level != btm_cb.busy_level) || (old_inquiry_state != btm_cb.is_inquiry)) {
-        evt.event         = BTM_BL_UPDATE_EVT;
-        evt.busy_level    = busy_level;
+        tBTM_BL_UPDATE_DATA evt = {
+            .event = BTM_BL_UPDATE_EVT,
+            .busy_level = busy_level,
+            .busy_level_flags = busy_level_flags,
+        };
         btm_cb.busy_level = busy_level;
         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
@@ -1016,7 +1021,7 @@ void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
 
     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #if (SMP_INCLUDED == TRUE)
-    /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+    /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
     btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
     BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
@@ -1455,7 +1460,7 @@ void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
 **
 ** Function         btm_acl_role_changed
 **
-** Description      This function is called whan a link's master/slave role change
+** Description      This function is called when a link's master/slave role change
 **                  event or command status event (with error) is received.
 **                  It updates the link control block, and calls
 **                  the registered callback with status and role (if registered).
@@ -2218,6 +2223,18 @@ void BTM_BleGetWhiteListSize(uint16_t *length)
     *length = p_cb->white_list_avail_size;
     return;
 }
+
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+void BTM_BleGetPeriodicAdvListSize(uint8_t *size)
+{
+    tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
+    if (p_cb->periodic_adv_list_size == 0) {
+        BTM_TRACE_WARNING("%s Periodic Adv list is full.", __func__);
+    }
+    *size = p_cb->periodic_adv_list_size;
+}
+#endif  //#if (BLE_50_FEATURE_SUPPORT == TRUE)
+
 #endif  ///BLE_INCLUDED == TRUE
 
 /*******************************************************************************
@@ -2705,7 +2722,7 @@ void btm_acl_connected(BD_ADDR bda, UINT16 handle, UINT8 link_type, UINT8 enc_mo
         l2c_link_hci_conn_comp(status, handle, bda);
     }
 #if BTM_SCO_INCLUDED == TRUE
-    else {
+    else if (link_type == HCI_LINK_TYPE_SCO) {
         memset(&esco_data, 0, sizeof(tBTM_ESCO_DATA));
         esco_data.link_type = HCI_LINK_TYPE_SCO;
         memcpy (esco_data.bd_addr, bda, BD_ADDR_LEN);

components/bt/host/bluedroid/stack/btm/btm_ble.c

@@ -2289,17 +2289,16 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
 
 
         }
-    } else {
-        if (event == SMP_SC_LOC_OOB_DATA_UP_EVT) {
-            tBTM_LE_EVT_DATA evt_data;
-            memcpy(&evt_data.local_oob_data, &p_data->loc_oob_data, sizeof(tSMP_LOC_OOB_DATA));
-            if (btm_cb.api.p_le_callback) {
-                (*btm_cb.api.p_le_callback)(event, bd_addr, &evt_data);
-            }
-        } else {
-            BTM_TRACE_ERROR("btm_proc_smp_cback received for unknown device");
+    }
+
+    if (event == SMP_SC_LOC_OOB_DATA_UP_EVT) {
+        tBTM_LE_EVT_DATA evt_data;
+        memcpy(&evt_data.local_oob_data, &p_data->loc_oob_data, sizeof(tSMP_LOC_OOB_DATA));
+        if (btm_cb.api.p_le_callback) {
+            (*btm_cb.api.p_le_callback)(event, bd_addr, &evt_data);
         }
     }
+
     return 0;
 }
 #endif   ///SMP_INCLUDED == TRUE

components/bt/host/bluedroid/stack/btm/btm_ble_bgconn.c

@@ -423,6 +423,23 @@ void btm_ble_white_list_init(UINT8 white_list_size)
     btm_cb.ble_ctr_cb.white_list_avail_size = white_list_size;
 }
 
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+/*******************************************************************************
+**
+** Function         btm_ble_periodic_adv_list_init
+**
+** Description      Initialize the periodic advertiser list size.
+**
+** Parameters       periodic_adv_size: The size of the periodic advertiser list to be initialized.
+**
+*******************************************************************************/
+void btm_ble_periodic_adv_list_init(UINT8 periodic_adv_size)
+{
+    BTM_TRACE_DEBUG("%s white_list_size = %d", __func__, periodic_adv_size);
+    btm_cb.ble_ctr_cb.periodic_adv_list_size = periodic_adv_size;
+}
+#endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
+
 /*******************************************************************************
 **
 ** Function         btm_ble_add_2_white_list_complete
@@ -724,7 +741,7 @@ void btm_resume_wl_activity(tBTM_BLE_WL_STATE wl_state)
 static void btm_wl_update_to_controller(void)
 {
     /* whitelist will be added in the btm_ble_resume_bg_conn(), we do not
-       support background connection now, so we nedd to use btm_execute_wl_dev_operation
+       support background connection now, so we need to use btm_execute_wl_dev_operation
        to add whitelist directly ,if we support background connection in the future,
        please delete btm_execute_wl_dev_operation(). */
     btm_execute_wl_dev_operation();

components/bt/host/bluedroid/stack/btm/btm_ble_gap.c

@@ -71,6 +71,8 @@ static tBTM_BLE_CTRL_FEATURES_CBACK    *p_ctrl_le_feature_rd_cmpl_cback = NULL;
 #endif
 
 tBTM_CallbackFunc conn_callback_func;
+// BLE vendor HCI event callback
+static tBTM_BLE_VENDOR_HCI_EVT_CBACK *ble_vs_evt_callback = NULL;
 /*******************************************************************************
 **  Local functions
 *******************************************************************************/
@@ -326,6 +328,11 @@ void BTM_BleRegiseterPktLengthChangeCallback(tBTM_SET_PKT_DATA_LENGTH_CBACK *ptk
     conn_callback_func.set_pkt_data_length_cb = ptk_len_chane_cb;
 }
 
+void BTM_BleRegisterVendorHciEventCallback(tBTM_BLE_VENDOR_HCI_EVT_CBACK *vendor_hci_evt_cb)
+{
+    ble_vs_evt_callback = vendor_hci_evt_cb;
+}
+
 /*******************************************************************************
 **
 ** Function         BTM_BleUpdateAdvWhitelist
@@ -4003,7 +4010,6 @@ static void btm_ble_stop_discover(void)
 
     if (!BTM_BLE_IS_SCAN_ACTIVE(p_ble_cb->scan_activity)) {
         /* Clear the inquiry callback if set */
-        btm_cb.ble_ctr_cb.inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE;
         btm_cb.ble_ctr_cb.inq_var.state &= ~BTM_BLE_SCANNING;
         /* stop discovery now */
         if(btsnd_hcic_ble_set_scan_enable (BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE)) {
@@ -4530,6 +4536,26 @@ BOOLEAN btm_ble_update_mode_operation(UINT8 link_role, BD_ADDR bd_addr, UINT8 st
     return bg_con;
 }
 
+static void btm_ble_vs_evt_callback(UINT8 len, UINT8 *p)
+{
+    UINT8 sub_event;
+
+    if (!len || !p) {
+        return;
+    }
+
+    STREAM_TO_UINT8(sub_event, p);
+    len--;
+
+    if (sub_event < HCI_VSE_LE_LEGACY_SCAN_REQ_RECEIVED_EVT) {
+        return;
+    }
+
+    if (ble_vs_evt_callback) {
+        ble_vs_evt_callback(sub_event, len, p);
+    }
+}
+
 /*******************************************************************************
 **
 ** Function         btm_ble_init
@@ -4586,6 +4612,8 @@ void btm_ble_init (void)
 #if BLE_VND_INCLUDED == FALSE
     btm_ble_adv_filter_init();
 #endif
+
+    BTM_RegisterForVSEvents(btm_ble_vs_evt_callback, TRUE);
 }
 
 /*******************************************************************************
@@ -4779,6 +4807,17 @@ BOOLEAN BTM_BleSetCsaSupport(UINT8 csa_select, tBTM_SET_CSA_SUPPORT_CMPL_CBACK *
     return TRUE;
 }
 
+BOOLEAN BTM_BleSetVendorEventMask(UINT32 evt_mask, tBTM_SET_VENDOR_EVT_MASK_CBACK *p_callback)
+{
+    if (btsnd_hcic_ble_set_vendor_evt_mask(evt_mask) != TRUE) {
+        BTM_TRACE_ERROR("LE SetVendorEventMask evt_mask=%x: error", evt_mask);
+        return FALSE;
+    }
+
+    btm_cb.ble_ctr_cb.set_vendor_evt_mask_cmpl_cb = p_callback;
+    return TRUE;
+}
+
 bool btm_ble_adv_pkt_ready(void)
 {
     tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;

components/bt/host/bluedroid/stack/btm/btm_devctl.c

@@ -191,6 +191,9 @@ static void reset_complete(void)
 
     if (controller->supports_ble()) {
         btm_ble_white_list_init(controller->get_ble_white_list_size());
+        #if (BLE_50_FEATURE_SUPPORT == TRUE)
+        btm_ble_periodic_adv_list_init(controller->get_ble_periodic_adv_list_size());
+        #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
         l2c_link_processs_ble_num_bufs(controller->get_acl_buffer_count_ble());
     }
 #endif
@@ -730,6 +733,14 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
             }
             break;
         }
+        case HCI_VENDOR_BLE_SET_EVT_MASK: {
+            uint8_t status;
+            STREAM_TO_UINT8(status, p);
+            if (ble_cb && ble_cb->set_vendor_evt_mask_cmpl_cb) {
+                ble_cb->set_vendor_evt_mask_cmpl_cb(status);
+            }
+            break;
+        }
         default:
             break;
     }
@@ -820,7 +831,7 @@ void btm_vendor_specific_evt (UINT8 *p, UINT8 evt_len)
 
     STREAM_TO_UINT8(sub_event, p_evt);
     /* Check in subevent if authentication is through Legacy Authentication. */
-    if (sub_event == ESP_VS_REM_LEGACY_AUTH_CMP) {
+    if (sub_event == HCI_VENDOR_LEGACY_REM_AUTH_EVT_SUBCODE) {
         UINT16 hci_handle;
         STREAM_TO_UINT16(hci_handle, p_evt);
         btm_sec_handle_remote_legacy_auth_cmp(hci_handle);

components/bt/host/bluedroid/stack/btm/btm_sco.c

@@ -117,8 +117,6 @@ void btm_sco_init (void)
     }
 #endif
     /* Initialize nonzero defaults */
-    btm_cb.sco_cb.sco_disc_reason  = BTM_INVALID_SCO_DISC_REASON;
-
     btm_cb.sco_cb.def_esco_parms = btm_esco_defaults; /* Initialize with defaults */
     btm_cb.sco_cb.desired_sco_mode = BTM_DEFAULT_SCO_MODE;
 }
@@ -1048,7 +1046,6 @@ void btm_sco_connected (UINT8 hci_status, BD_ADDR bda, UINT16 hci_handle,
     tBTM_CHG_ESCO_PARAMS parms;
 #endif
 
-    btm_cb.sco_cb.sco_disc_reason = hci_status;
     BTM_TRACE_API("%s, handle %x", __FUNCTION__, hci_handle);
 #if (BTM_MAX_SCO_LINKS>0)
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
@@ -1224,16 +1221,11 @@ void btm_sco_removed (UINT16 hci_handle, UINT8 reason)
 #if (BTM_MAX_SCO_LINKS>0)
     tSCO_CONN   *p = &btm_cb.sco_cb.sco_db[0];
     UINT16      xx;
-#endif
 
-    btm_cb.sco_cb.sco_disc_reason = reason;
-
-#if (BTM_MAX_SCO_LINKS>0)
     p = &btm_cb.sco_cb.sco_db[0];
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
         if ((p->state != SCO_ST_UNUSED) && (p->state != SCO_ST_LISTENING) && (p->hci_handle == hci_handle)) {
             btm_sco_flush_sco_data(xx);
-
             p->state = SCO_ST_UNUSED;
 #if BTM_SCO_HCI_INCLUDED == TRUE
             btm_cb.sco_cb.xmit_window_size += p->sent_not_acked;
@@ -1375,24 +1367,6 @@ UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx)
 #endif
 }
 
-/*******************************************************************************
-**
-** Function         BTM_ReadScoDiscReason
-**
-** Description      This function is returns the reason why an (e)SCO connection
-**                  has been removed. It contains the value until read, or until
-**                  another (e)SCO connection has disconnected.
-**
-** Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
-**
-*******************************************************************************/
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    UINT16 res = btm_cb.sco_cb.sco_disc_reason;
-    btm_cb.sco_cb.sco_disc_reason = BTM_INVALID_SCO_DISC_REASON;
-    return (res);
-}
-
 /*******************************************************************************
 **
 ** Function         BTM_ReadDeviceScoPacketTypes
@@ -1894,10 +1868,6 @@ UINT8 *BTM_ReadScoBdAddr(UINT16 sco_inx)
 {
     return ((UINT8 *) NULL);
 }
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    return (BTM_INVALID_SCO_DISC_REASON);
-}
 tBTM_STATUS BTM_SetEScoMode (tBTM_SCO_TYPE sco_mode, tBTM_ESCO_PARAMS *p_parms)
 {
     return (BTM_MODE_UNSUPPORTED);

components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h

@@ -353,6 +353,10 @@ typedef struct {
     tBTM_BLE_SEL_CBACK *p_select_cback;
     /* white list information */
     UINT8 white_list_avail_size;
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+    /* periodic list information */
+    UINT8 periodic_adv_list_size;
+#endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
     tBTM_UPDATE_WHITELIST_CBACK *update_wl_cb;
     tBTM_BLE_WL_STATE wl_state;
 
@@ -381,6 +385,7 @@ typedef struct {
     UINT8 link_count[2]; /* total link count master and slave*/
     tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK *update_exceptional_list_cmp_cb;
     tBTM_SET_CSA_SUPPORT_CMPL_CBACK *set_csa_support_cmpl_cb;
+    tBTM_SET_VENDOR_EVT_MASK_CBACK *set_vendor_evt_mask_cmpl_cb;
 } tBTM_BLE_CB;
 
 #ifdef __cplusplus
@@ -540,6 +545,7 @@ void btm_ble_channel_select_algorithm_evt(tBTM_BLE_CHANNEL_SEL_ALG *params);
 void btm_ble_periodic_adv_report_evt(tBTM_PERIOD_ADV_REPORT *params);
 void btm_ble_periodic_adv_sync_lost_evt(tBTM_BLE_PERIOD_ADV_SYNC_LOST *params);
 void btm_ble_periodic_adv_sync_establish_evt(tBTM_BLE_PERIOD_ADV_SYNC_ESTAB *params);
+void btm_ble_periodic_adv_list_init(UINT8 periodic_adv_size);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)