Merge branch 'bugfix/fix_scan_request_ifs_error_v5.2' into 'release/v5.2'

Fixed BLE scan request ifs time error in coexistence scenarios on ESP32(backport v5.2)

See merge request espressif/esp-idf!28574

.gitlab/ci/common.yml

@@ -141,6 +141,10 @@ variables:
     $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
   fi
 
+  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
+  # Needed for pytest junit reports.
+  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
+
   source ./export.sh
 
   # Custom clang

.gitlab/ci/target-test.yml

@@ -463,15 +463,6 @@ pytest_examples_esp32_ethernet_vlan:
       artifacts: false
   tags: [ esp32, ethernet_vlan ]
 
-pytest_examples_esp32_ethernet_ip101:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32
-  needs:
-    - job: build_pytest_examples_esp32
-      artifacts: false
-  tags: [ esp32, ip101 ]
-
 pytest_examples_esp32_ethernet_bridge:
   extends:
     - .pytest_examples_dir_template
@@ -724,15 +715,6 @@ pytest_components_esp32_sdio:
       artifacts: false
   tags: [ esp32, sdio_master_slave ]
 
-pytest_components_esp32_ip101:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - job: build_pytest_components_esp32
-      artifacts: false
-  tags: [ esp32, ip101 ]
-
 pytest_components_esp32_lan8720:
   extends:
     - .pytest_components_dir_template

.gitmodules

@@ -49,12 +49,12 @@
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
-	sbom-version = 1.7.16
+	sbom-version = 1.7.17
 	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = cb8693b058ba302f4829ec6d03f609ac6f848546
+	sbom-hash = 87d8f0961a01bf09bef98ff89bae9fdec42181ee
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls

.pre-commit-config.yaml

@@ -1,6 +1,8 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 
+default_stages: [commit]
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.0.1
@@ -216,6 +218,7 @@ repos:
       args: ['--shell', 'dash', '-x']
       files: 'export.sh'
   - repo: https://github.com/espressif/esp-idf-sbom.git
-    rev: v0.11.0
+    rev: v0.13.0
     hooks:
       - id: validate-sbom-manifest
+        stages: [post-commit]

components/app_update/esp_ota_ops.c

@@ -965,6 +965,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
     }
 
     const esp_partition_t *running_app_part = esp_ota_get_running_partition();
+    esp_err_t ret = ESP_FAIL;
 #ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
     esp_ota_img_states_t running_app_state;
     ret = esp_ota_get_state_partition(running_app_part, &running_app_state);
@@ -979,7 +980,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
 #endif
 
     esp_secure_boot_key_digests_t trusted_keys;
-    esp_err_t ret = esp_secure_boot_read_key_digests(&trusted_keys);
+    ret = esp_secure_boot_read_key_digests(&trusted_keys);
     if (ret != ESP_OK) {
         ESP_LOGE(TAG, "Could not read the secure boot key digests from efuse. Aborting..");
         return ESP_FAIL;

components/bootloader/Kconfig.projbuild

@@ -833,7 +833,6 @@ menu "Security features"
         bool "Enable flash encryption on boot (READ DOCS FIRST)"
         default N
         select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
-        select NVS_ENCRYPTION
         help
             If this option is set, flash contents will be encrypted by the bootloader on first boot.
 

components/bt/CMakeLists.txt

@@ -621,6 +621,8 @@ if(CONFIG_BT_ENABLED)
                     host/nimble/nimble/nimble/host/services/prox/include
                     host/nimble/nimble/nimble/host/services/cts/include
                     host/nimble/nimble/nimble/host/services/tps/include
+                    host/nimble/nimble/nimble/host/services/hid/include
+                    host/nimble/nimble/nimble/host/services/sps/include
                     host/nimble/nimble/nimble/host/util/include
                     host/nimble/nimble/nimble/host/store/ram/include
                     host/nimble/nimble/nimble/host/store/config/include
@@ -641,6 +643,8 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/services/lls/src/ble_svc_lls.c"
                     "host/nimble/nimble/nimble/host/services/prox/src/ble_svc_prox.c"
                     "host/nimble/nimble/nimble/host/services/cts/src/ble_svc_cts.c"
+                    "host/nimble/nimble/nimble/host/services/hid/src/ble_svc_hid.c"
+                    "host/nimble/nimble/nimble/host/services/sps/src/ble_svc_sps.c"
                     "host/nimble/nimble/nimble/host/src/ble_hs_conn.c"
                     "host/nimble/nimble/nimble/host/src/ble_store_util.c"
                     "host/nimble/nimble/nimble/host/src/ble_sm.c"

components/bt/common/osi/config.c

@@ -264,13 +264,13 @@ bool config_update_newest_section(config_t *config, const char *section)
         return false;
     }
     section_t *first_sec = list_node(first_node);
-    if (!strcmp(first_sec->name, section)) {
+    if (strcmp(first_sec->name, section) == 0) {
         return true;
     }
 
     for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
         section_t *sec = list_node(node);
-        if (!strcmp(sec->name, section)) {
+        if (strcmp(sec->name, section) == 0) {
             list_delete(config->sections, sec);
             list_prepend(config->sections, sec);
             return true;

components/bt/controller/esp32c2/Kconfig.in

@@ -253,7 +253,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
     bool "Controller log enable"
     default n
     help
@@ -264,21 +264,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable controller log module
+            Enable controller log module
 
 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
     bool "enable HCI log module"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable hci log module
+            Enable hci log module
 
 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     bool "Controller log dump mode only"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.
 
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"

components/bt/controller/esp32c2/bt.c

@@ -78,7 +78,6 @@
 #define ACL_DATA_MBUF_LEADINGSPCAE    4
 #endif // CONFIG_BT_BLUEDROID_ENABLED
 
-
 /* Types definition
  ************************************************************************
  */
@@ -127,6 +126,7 @@ extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int ble_log_deinit_async(void);
 extern void ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@@ -201,7 +201,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {2048, 1024, 1024};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -1013,12 +1013,13 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
 
     portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
     BT_ASSERT_PRINT("\r\n[DUMP_START:");
     ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -40,6 +40,11 @@ extern "C" {
     #define DEFAULT_BT_NIMBLE_WHITELIST_SIZE MYNEWT_VAL(BLE_LL_WHITELIST_SIZE)
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 
 #else
 
@@ -114,6 +119,11 @@ extern "C" {
     #else
         #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT (8)
     #endif
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 
 #endif
 

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -1153,18 +1153,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     btdm_controller_mem_init();
 
-#if CONFIG_MAC_BB_PD
-    if (esp_register_mac_bb_pd_callback(btdm_mac_bb_power_down_cb) != 0) {
-        err = ESP_ERR_INVALID_ARG;
-        goto error;
-    }
-
-    if (esp_register_mac_bb_pu_callback(btdm_mac_bb_power_up_cb) != 0) {
-        err = ESP_ERR_INVALID_ARG;
-        goto error;
-    }
-#endif
-
     osi_funcs_p = (struct osi_funcs_t *)malloc_internal_wrapper(sizeof(struct osi_funcs_t));
     if (osi_funcs_p == NULL) {
         return ESP_ERR_NO_MEM;
@@ -1405,11 +1393,6 @@ static void bt_controller_deinit_internal(void)
         btdm_lpcycle_us = 0;
     } while (0);
 
-#if CONFIG_MAC_BB_PD
-    esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
-    esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
-#endif
-
     esp_bt_power_domain_off();
 #if CONFIG_MAC_BB_PD
     esp_mac_bb_pd_mem_deinit();
@@ -1458,6 +1441,18 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         s_lp_stat.pm_lock_released = 0;
 #endif
 
+#if CONFIG_MAC_BB_PD
+        if (esp_register_mac_bb_pd_callback(btdm_mac_bb_power_down_cb) != 0) {
+            ret = ESP_ERR_INVALID_ARG;
+            goto error;
+        }
+
+        if (esp_register_mac_bb_pu_callback(btdm_mac_bb_power_up_cb) != 0) {
+            ret = ESP_ERR_INVALID_ARG;
+            goto error;
+        }
+#endif
+
         if (s_lp_cntl.enable) {
             btdm_controller_enable_sleep(true);
         }
@@ -1480,6 +1475,11 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 error:
     // disable low power mode
     do {
+#if CONFIG_MAC_BB_PD
+        esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
+        esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
+#endif
+
         btdm_controller_enable_sleep(false);
 #ifdef CONFIG_PM_ENABLE
         if (s_lp_cntl.no_light_sleep) {
@@ -1526,6 +1526,11 @@ esp_err_t esp_bt_controller_disable(void)
 
     // disable low power mode
     do {
+#if CONFIG_MAC_BB_PD
+        esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
+        esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
+#endif
+
 #ifdef CONFIG_PM_ENABLE
         if (s_lp_cntl.no_light_sleep) {
             esp_pm_lock_release(s_light_sleep_pm_lock);

components/bt/controller/esp32c6/Kconfig.in

@@ -269,7 +269,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
     bool "Controller log enable"
     default n
     help
@@ -280,21 +280,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable controller log module
+            Enable controller log module
 
 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
     bool "enable HCI log module"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable hci log module
+            Enable hci log module
 
 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     bool "Controller log dump mode only"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.
 
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
@@ -361,7 +382,7 @@ config BT_LE_WHITELIST_SIZE
 
 config BT_LE_LL_DUP_SCAN_LIST_COUNT
     int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
     default 20
     help
         config the max count of duplicate scan list
@@ -522,15 +543,6 @@ config BT_LE_SCAN_DUPL_TYPE
     default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
     default 0
 
-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
     int "Duplicate scan list refresh period (seconds)"
     depends on BT_LE_SCAN_DUPL

components/bt/controller/esp32c6/bt.c

@@ -127,6 +127,7 @@ extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool
 extern int ble_log_deinit_async(void);
 extern void ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@@ -202,7 +203,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {6144, 1024, 2048};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -664,7 +665,7 @@ void ble_controller_scan_duplicate_config(void)
     uint32_t duplicate_mode = FILTER_DUPLICATE_DEFAULT;
     uint32_t cache_size = 100;
 #if CONFIG_BT_LE_SCAN_DUPL == true
-    cache_size = CONFIG_BT_LE_SCAN_DUPL_CACHE_SIZE;
+    cache_size = CONFIG_BT_LE_LL_DUP_SCAN_LIST_COUNT;
     if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 0) {
         duplicate_mode = FILTER_DUPLICATE_ADDRESS | FILTER_DUPLICATE_PDUTYPE;
     } else if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 1) {
@@ -910,9 +911,9 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
         esp_pm_lock_acquire(s_pm_lock);
 #endif  // CONFIG_PM_ENABLE
         esp_phy_enable(PHY_MODEM_BT);
-        esp_btbb_enable();
         s_ble_active = true;
     }
+    esp_btbb_enable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
@@ -928,8 +929,8 @@ error:
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
+    esp_btbb_disable();
     if (s_ble_active) {
-        esp_btbb_disable();
         esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
         esp_pm_lock_release(s_pm_lock);
@@ -951,8 +952,8 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
+    esp_btbb_disable();
     if (s_ble_active) {
-        esp_btbb_disable();
         esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
         esp_pm_lock_release(s_pm_lock);
@@ -1185,12 +1186,13 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
 
     portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
     BT_ASSERT_PRINT("\r\n[DUMP_START:");
     ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -40,6 +40,11 @@ extern "C" {
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
     #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #else
 
     #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@@ -119,6 +124,11 @@ extern "C" {
     #else
         #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED (0)
     #endif
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #endif
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF

components/bt/controller/esp32h2/Kconfig.in

@@ -260,7 +260,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
     bool "Controller log enable"
     default n
     help
@@ -271,21 +271,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable controller log module
+            Enable controller log module
 
 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
     bool "enable HCI log module"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Enable hci log module
+            Enable hci log module
 
 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     bool "Controller log dump mode only"
     depends on BT_LE_CONTROLLER_LOG_ENABLED
     default y
     help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.
 
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
@@ -352,7 +373,7 @@ config BT_LE_WHITELIST_SIZE
 
 config BT_LE_LL_DUP_SCAN_LIST_COUNT
     int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
     default 20
     help
         config the max count of duplicate scan list
@@ -514,16 +535,6 @@ config BT_LE_SCAN_DUPL_TYPE
     default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
     default 0
 
-
-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
     int "Duplicate scan list refresh period (seconds)"
     depends on BT_LE_SCAN_DUPL

components/bt/controller/esp32h2/bt.c

@@ -121,6 +121,7 @@ extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool
 extern int ble_log_deinit_async(void);
 extern void ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@@ -196,7 +197,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {6144, 1024, 2048};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -639,7 +640,7 @@ void ble_controller_scan_duplicate_config(void)
     uint32_t duplicate_mode = FILTER_DUPLICATE_DEFAULT;
     uint32_t cache_size = 100;
 #if CONFIG_BT_LE_SCAN_DUPL == true
-    cache_size = CONFIG_BT_LE_SCAN_DUPL_CACHE_SIZE;
+    cache_size = CONFIG_BT_LE_LL_DUP_SCAN_LIST_COUNT;
     if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 0) {
         duplicate_mode = FILTER_DUPLICATE_ADDRESS | FILTER_DUPLICATE_PDUTYPE;
     } else if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 1) {
@@ -1157,12 +1158,13 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
 
     portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
     BT_ASSERT_PRINT("\r\n[DUMP_START:");
     ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -40,6 +40,11 @@ extern "C" {
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
     #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #else
 
     #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@@ -119,6 +124,12 @@ extern "C" {
     #else
         #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED (0)
     #endif
+
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #endif
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF

components/bt/esp_ble_mesh/Kconfig.in

@@ -623,6 +623,21 @@ if BLE_MESH
             number of each node should also be taken into consideration. For example, if
             Provisioner can provision up to 20 nodes and each node contains two elements,
             then the replay protection list size of Provisioner should be at least 40.
+    
+    config BLE_MESH_NOT_RELAY_REPLAY_MSG
+        bool "Not relay replayed messages in a mesh network"
+        depends on BLE_MESH_EXPERIMENTAL
+        default n
+        help
+            There may be many expired messages in a complex mesh network that would be
+            considered replayed messages.
+            Enable this option will refuse to relay such messages, which could help to
+            reduce invalid packets in the mesh network.
+            However, it should be noted that enabling this option may result in packet
+            loss in certain environments.
+            Therefore, users need to decide whether to enable this option according to
+            the actual usage situation.
+
 
     config BLE_MESH_MSG_CACHE_SIZE
         int "Network message cache size"
@@ -1451,7 +1466,7 @@ if BLE_MESH
 
         config BLE_MESH_MBT_CLI
             bool "BLOB Transfer Client model"
-            default y
+            default n
             help
                 Enable support for BLOB Transfer Client model.
 
@@ -1469,7 +1484,7 @@ if BLE_MESH
 
         config BLE_MESH_MBT_SRV
             bool "BLOB Transfer Server model"
-            default y
+            default n
             help
                 Enable support for BLOB Transfer Server model.
 
@@ -1607,4 +1622,12 @@ if BLE_MESH
 
     endmenu
 
+    config BLE_MESH_EXPERIMENTAL
+        bool "Make BLE Mesh experimental features visible"
+        default n
+        help 
+            Make BLE Mesh Experimental features visible.
+            Experimental features list:
+            - CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+
 endif # BLE_MESH

components/bt/esp_ble_mesh/core/net.c

@@ -1542,7 +1542,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 #endif
 
     if (!buf) {
-        BT_ERR("Out of relay buffers");
+        BT_INFO("Out of relay buffers");
         return;
     }
 
@@ -1855,7 +1855,11 @@ void bt_mesh_net_recv(struct net_buf_simple *data, int8_t rssi,
      * was neither a local element nor an LPN we're Friends for.
      */
     if (!BLE_MESH_ADDR_IS_UNICAST(rx.ctx.recv_dst) ||
-        (!rx.local_match && !rx.friend_match)) {
+        (!rx.local_match && !rx.friend_match
+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+        && !rx.replay_msg
+#endif
+        )) {
         net_buf_simple_restore(&buf, &state);
         bt_mesh_net_relay(&buf, &rx);
     }

components/bt/esp_ble_mesh/core/net.h

@@ -391,6 +391,9 @@ struct bt_mesh_net_rx {
              net_if:2,       /* Network interface */
              local_match:1,  /* Matched a local element */
              friend_match:1, /* Matched an LPN we're friends for */
+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+             replay_msg:1,   /* Replayed messages */
+#endif
              sbr_rpl:1;      /* Bridge RPL attacker */
     uint16_t msg_cache_idx;  /* Index of entry in message cache */
 };

components/bt/esp_ble_mesh/core/rpl.c

@@ -64,6 +64,10 @@ static bool rpl_check_and_store(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **
                 return false;
             }
 
+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+            rx->replay_msg = 1;
+#endif
+
             return true;
         }
     }

components/bt/host/bluedroid/Kconfig.in

@@ -29,7 +29,7 @@ config BT_BLUEDROID_PINNED_TO_CORE
 config BT_BTU_TASK_STACK_SIZE
     int "Bluetooth Bluedroid Host Stack task stack size"
     depends on BT_BLUEDROID_ENABLED
-    default 4096
+    default 4352
     help
         This select btu task stack size
 
@@ -221,7 +221,10 @@ config BT_GATTS_ROBUST_CACHING_ENABLED
     depends on BT_GATTS_ENABLE
     default n
     help
-        This option enable gatt robust caching feature on server
+        This option enables the GATT robust caching feature on the server.
+        if turned on, the Client Supported Features characteristic, Database Hash characteristic,
+        and Server Supported Features characteristic will be included in the GAP SERVICE.
+
 
 config BT_GATTS_DEVICE_NAME_WRITABLE
     bool "Allow to write device name by GATT clients"

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -577,6 +577,14 @@ void bta_dm_disable (tBTA_DM_MSG *p_data)
     bta_dm_disable_search_and_disc();
     bta_dm_cb.disabling = TRUE;
 
+#if BLE_INCLUDED == TRUE
+    /* reset scan activity status*/
+    btm_cb.ble_ctr_cb.scan_activity = 0;
+
+    /* reset advertising activity status*/
+    btm_cb.ble_ctr_cb.inq_var.state = 0;
+#endif
+
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
     BTM_BleClearBgConnDev();
 #endif

components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c

@@ -122,8 +122,11 @@ void bta_gattc_reset_discover_st(tBTA_GATTC_SERV *p_srcb, tBTA_GATT_STATUS statu
 static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
 {
     APPL_TRACE_DEBUG("bta_gattc_enable");
-
-    if (p_cb->state == BTA_GATTC_STATE_DISABLED) {
+    /* This is a workaround because the task priority of btc (BTA_GATTC_CLOSE_EVT
+    in that task) is lower than the priority of the btu task.
+    Consequently, the p_cb->state fails to be restored to BTA_GATTC_STATE_DISABLED
+    and remains in the BTA_GATTC_STATE_DISABLING state. */
+    if (p_cb->state == BTA_GATTC_STATE_DISABLED || p_cb->state == BTA_GATTC_STATE_DISABLING) {
         /* initialize control block */
         memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
         bta_gattc_cb.auto_disc = true;
@@ -200,7 +203,11 @@ void bta_gattc_register(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_data)
     cb_data.reg_oper.status = BTA_GATT_NO_RESOURCES;
 
     /* check if  GATTC module is already enabled . Else enable */
-    if (p_cb->state == BTA_GATTC_STATE_DISABLED) {
+    /* This is a workaround because the task priority of btc (BTA_GATTC_CLOSE_EVT
+    in that task) is lower than the priority of the btu task.
+    Consequently, the p_cb->state fails to be restored to BTA_GATTC_STATE_DISABLED
+    and remains in the BTA_GATTC_STATE_DISABLING state. */
+    if (p_cb->state == BTA_GATTC_STATE_DISABLED || p_cb->state == BTA_GATTC_STATE_DISABLING) {
         bta_gattc_enable (p_cb);
     }
     /* todo need to check duplicate uuid */

components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c

@@ -397,10 +397,6 @@ void bta_ag_rfc_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data)
 
     bta_sys_conn_close(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
 
-    /* call close call-out */
-#if (BTM_SCO_HCI_INCLUDED == TRUE)
-    bta_ag_sco_co_close();
-#endif
     /* call close cback */
     (*bta_ag_cb.p_cback)(BTA_AG_CLOSE_EVT, (tBTA_AG *) &close);
 

components/bt/host/bluedroid/bta/hf_ag/bta_ag_sdp.c

@@ -243,13 +243,16 @@ void bta_ag_del_records(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data)
     UNUSED(p_data);
 
     /* get services of all other registered servers */
-    for (i = 0; i < BTA_AG_NUM_IDX; i++, p++) {
+    for (i = 0; i < BTA_AG_NUM_IDX; i++) {
         if (p_scb == p) {
             continue;
         }
         if (p->in_use && p->dealloc == FALSE) {
             others |= p->reg_services;
         }
+        if (i < BTA_AG_NUM_SCB) {
+            p++;
+        }
     }
     others >>= BTA_HSP_SERVICE_ID;
     services = p_scb->reg_services >> BTA_HSP_SERVICE_ID;

components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c

@@ -61,7 +61,8 @@ static const uint8_t bta_hf_client_cb_data_size[] = {
     sizeof(tBTA_HF_CLIENT_VAL),         // #define BTA_HF_CLIENT_BSIR_EVT              19
     sizeof(tBTA_HF_CLIENT_NUMBER),      // #define BTA_HF_CLIENT_BINP_EVT              20
     sizeof(tBTA_HF_CLIENT_VAL),         // #define BTA_HF_CLIENT_RING_INDICATION       21
-    0,                                  // #define BTA_HF_CLIENT_DISABLE_EVT           30
+    0,                                  // #define BTA_HF_CLIENT_DISABLE_EVT           22
+    sizeof(tBTA_SCO_PKT_STAT_NUMS),     // #define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT      23
 };
 /*****************************************************************************
 **  External Function Declarations

components/bt/host/bluedroid/bta/include/bta/bta_hf_client_api.h

@@ -112,8 +112,8 @@ typedef UINT8 tBTA_HF_CLIENT_AT_RESULT_TYPE;
 #define BTA_HF_CLIENT_BSIR_EVT              19 /* in-band ring tone setting changed event */
 #define BTA_HF_CLIENT_BINP_EVT              20 /* binp number event */
 #define BTA_HF_CLIENT_RING_INDICATION       21 /* HF Client ring indication */
-#define BTA_HF_CLIENT_DISABLE_EVT           30 /* HF Client disabled */
-#define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT 31 /* HF Client packet status nums */
+#define BTA_HF_CLIENT_DISABLE_EVT           22 /* HF Client disabled */
+#define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT 23 /* HF Client packet status nums */
 
 typedef UINT8 tBTA_HF_CLIENT_EVT;
 

components/bt/host/bluedroid/bta/jv/bta_jv_act.c

@@ -1248,10 +1248,15 @@ void bta_jv_delete_record(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 static void bta_jv_l2cap_client_cback(UINT16 gap_handle, UINT16 event)
 {
+    if (gap_handle >= BTA_JV_MAX_L2C_CONN) {
+        APPL_TRACE_WARNING("Invalid gap_handle: %u", gap_handle);
+        return;
+    }
+
     tBTA_JV_L2C_CB  *p_cb = &bta_jv_cb.l2c_cb[gap_handle];
     tBTA_JV evt_data = {0};
 
-    if (gap_handle >= BTA_JV_MAX_L2C_CONN && !p_cb->p_cback) {
+    if (!p_cb->p_cback) {
         return;
     }
 
@@ -1402,12 +1407,17 @@ void bta_jv_l2cap_close(tBTA_JV_MSG *p_data)
 *******************************************************************************/
 static void bta_jv_l2cap_server_cback(UINT16 gap_handle, UINT16 event)
 {
+    if (gap_handle >= BTA_JV_MAX_L2C_CONN) {
+        APPL_TRACE_WARNING("Invalid gap_handle: %u", gap_handle);
+        return;
+    }
+
     tBTA_JV_L2C_CB  *p_cb = &bta_jv_cb.l2c_cb[gap_handle];
     tBTA_JV evt_data = {0};
     tBTA_JV_L2CAP_CBACK *p_cback;
     void *user_data;
 
-    if (gap_handle >= BTA_JV_MAX_L2C_CONN && !p_cb->p_cback) {
+    if (!p_cb->p_cback) {
         return;
     }
 

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -706,6 +706,7 @@ static void btc_dm_acl_link_stat(tBTA_DM_ACL_LINK_STAT *p_acl_link_stat)
     }
     }
 
+#if (SMP_INCLUDED == TRUE)
     if (p_acl_link_stat->event == BTA_ACL_LINK_STAT_CONN_CMPL &&
         p_acl_link_stat->link_act.conn_cmpl.status == HCI_SUCCESS) {
         memcpy(bt_addr.address, p_acl_link_stat->link_act.conn_cmpl.bd_addr, sizeof(bt_addr.address));
@@ -716,7 +717,7 @@ static void btc_dm_acl_link_stat(tBTA_DM_ACL_LINK_STAT *p_acl_link_stat)
                             bt_addr.address[4], bt_addr.address[5]);
         }
     }
-
+#endif  ///SMP_INCLUDED == TRUE
     esp_bt_gap_cb_t cb = (esp_bt_gap_cb_t)btc_profile_cb_get(BTC_PID_GAP_BT);
     if (cb) {
         cb(event, &param);

components/bt/host/bluedroid/btc/core/btc_storage.c

@@ -196,6 +196,32 @@ bt_status_t btc_storage_load_bonded_devices(void)
     BTC_TRACE_DEBUG("Storage load rslt %d\n", status);
     return status;
 }
+
+/*******************************************************************************
+**
+** Function         btc_storage_update_active_device
+**
+** Description      BTC storage API - Once an ACL link is established and remote
+**                  bd_addr is already stored in NVRAM, update the config and update
+**                  the remote device to be the newest active device, The updates will
+**                  not be stored into NVRAM immediately.
+**
+** Returns          BT_STATUS_SUCCESS if successful, BT_STATUS_FAIL otherwise
+**
+*******************************************************************************/
+bool btc_storage_update_active_device(bt_bdaddr_t *remote_bd_addr)
+{
+    bdstr_t bdstr;
+    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
+    bool ret = false;
+    BTC_TRACE_DEBUG("Update active device: Remote device:%s\n", bdstr);
+
+    btc_config_lock();
+    ret = btc_config_update_newest_section(bdstr);
+    btc_config_unlock();
+
+    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
+}
 #endif  ///SMP_INCLUDED == TRUE
 
 /*******************************************************************************
@@ -308,32 +334,6 @@ bt_status_t btc_storage_get_bonded_bt_devices_list(bt_bdaddr_t *bond_dev, int *d
     return BT_STATUS_SUCCESS;
 }
 
-/*******************************************************************************
-**
-** Function         btc_storage_update_active_device
-**
-** Description      BTC storage API - Once an ACL link is established and remote
-**                  bd_addr is already stored in NVRAM, update the config and update
-**                  the remote device to be the newest active device, The updates will
-**                  not be stored into NVRAM immediately.
-**
-** Returns          BT_STATUS_SUCCESS if successful, BT_STATUS_FAIL otherwise
-**
-*******************************************************************************/
-bool btc_storage_update_active_device(bt_bdaddr_t *remote_bd_addr)
-{
-    bdstr_t bdstr;
-    bdaddr_to_string(remote_bd_addr, bdstr, sizeof(bdstr));
-    bool ret = false;
-    BTC_TRACE_DEBUG("Update active device: Remote device:%s\n", bdstr);
-
-    btc_config_lock();
-    ret = btc_config_update_newest_section(bdstr);
-    btc_config_unlock();
-
-    return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
-}
-
 #if (defined BTC_HH_INCLUDED && BTC_HH_INCLUDED == TRUE)
 /*******************************************************************************
  *

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gattc.c

@@ -926,6 +926,7 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
     }
     case BTA_GATTC_CONNECT_EVT: {
         tBTA_GATTC_CONNECT *connect = &arg->connect;
+#if (SMP_INCLUDED == TRUE)
         bt_bdaddr_t bt_addr;
 
         memcpy(bt_addr.address, connect->remote_bda, sizeof(bt_addr.address));
@@ -935,7 +936,7 @@ void btc_gattc_cb_handler(btc_msg_t *msg)
                             bt_addr.address[2], bt_addr.address[3],
                             bt_addr.address[4], bt_addr.address[5]);
         }
-
+#endif  ///SMP_INCLUDED == TRUE
         gattc_if = connect->client_if;
         param.connect.conn_id = BTC_GATT_GET_CONN_ID(connect->conn_id);
         param.connect.link_role = connect->link_role;

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -901,6 +901,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
         btc_gatts_cb_to_app(ESP_GATTS_STOP_EVT, gatts_if, &param);
         break;
     case BTA_GATTS_CONNECT_EVT: {
+#if (SMP_INCLUDED == TRUE)
         bt_bdaddr_t bt_addr;
         memcpy(bt_addr.address, p_data->conn.remote_bda, sizeof(bt_addr.address));
         if (btc_storage_update_active_device(&bt_addr)) {
@@ -909,7 +910,7 @@ void btc_gatts_cb_handler(btc_msg_t *msg)
                             bt_addr.address[2], bt_addr.address[3],
                             bt_addr.address[4], bt_addr.address[5]);
         }
-
+#endif  ///SMP_INCLUDED == TRUE
         gatts_if = p_data->conn.server_if;
         param.connect.conn_id = BTC_GATT_GET_CONN_ID(p_data->conn.conn_id);
         param.connect.link_role = p_data->conn.link_role;

components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c

@@ -82,7 +82,7 @@ static bta_ag_co_cb_t *bta_ag_co_cb_ptr;
 #define bta_ag_co_cb (*bta_ag_co_cb_ptr)
 #endif /* HFP_DYNAMIC_MEMORY == FALSE */
 
-static UINT8 hf_air_mode = BTM_SCO_AIR_MODE_TRANSPNT;
+static UINT8 hf_air_mode = BTM_SCO_AIR_MODE_UNKNOWN;
 static UINT8 hf_inout_pkt_size = 0;
 
 /* =========================================================================

components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c

@@ -68,7 +68,7 @@ static UINT16 btc_max_hf_clients = BTC_HF_NUM_CB;
 #if HFP_DYNAMIC_MEMORY == FALSE
 static hf_local_param_t hf_local_param[BTC_HF_NUM_CB];
 #else
-static hf_local_param_t *hf_local_param;
+static hf_local_param_t *hf_local_param = NULL;
 #endif
 
 #if (BTM_WBS_INCLUDED == TRUE)
@@ -317,6 +317,19 @@ bt_status_t btc_hf_init(void)
     int idx = 0;
 
     BTC_TRACE_DEBUG("%s - max_hf_clients=%d", __func__, btc_max_hf_clients);
+
+#if HFP_DYNAMIC_MEMORY == TRUE
+    if (hf_local_param != NULL) {
+        return BT_STATUS_FAIL;
+    }
+
+    if ((hf_local_param = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+        APPL_TRACE_ERROR("%s malloc failed!", __func__);
+        return BT_STATUS_NOMEM;
+    }
+    memset((void *)hf_local_param, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+#endif
+
     /* Invoke the enable service API to the core to set the appropriate service_id
      * Internally, the HSP_SERVICE_ID shall also be enabled if HFP is enabled (phone)
      * othwerwise only HSP is enabled (tablet)*/
@@ -345,13 +358,16 @@ void btc_hf_deinit(void)
 {
     BTC_TRACE_EVENT("%s", __FUNCTION__);
     btc_dm_disable_service(BTA_HFP_SERVICE_ID);
+    hf_local_param[0].btc_hf_cb.initialized = false;
+}
+
+static void btc_hf_cb_release(void)
+{
 #if HFP_DYNAMIC_MEMORY == TRUE
     if (hf_local_param) {
         osi_free(hf_local_param);
         hf_local_param = NULL;
     }
-#else
-    hf_local_param[0].btc_hf_cb.initialized = false;
 #endif
 }
 
@@ -1251,9 +1267,12 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
     switch (event) {
         case BTA_AG_ENABLE_EVT:
-        case BTA_AG_DISABLE_EVT:
             break;
-
+        case BTA_AG_DISABLE_EVT:
+        {
+            btc_hf_cb_release();
+            break;
+        }
         case BTA_AG_REGISTER_EVT:
         {
             idx = p_data->hdr.handle - 1;

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -1018,7 +1018,7 @@
 /* TRUE to include Sniff Subrating */
 #if (BTA_DM_PM_INCLUDED == TRUE)
 #ifndef BTM_SSR_INCLUDED
-#define BTM_SSR_INCLUDED                TRUE
+#define BTM_SSR_INCLUDED                FALSE
 #endif
 #endif /* BTA_DM_PM_INCLUDED */
 

components/bt/host/bluedroid/hci/hci_hal_h4.c

@@ -600,7 +600,8 @@ int
 ble_hs_hci_rx_evt(uint8_t *hci_ev, void *arg)
 {
     if(esp_bluedroid_get_status() == ESP_BLUEDROID_STATUS_UNINITIALIZED) {
-	return 0;
+        ble_hci_trans_buf_free(hci_ev);
+        return 0;
     }
     uint16_t len = hci_ev[1] + 3;
     uint8_t *data = (uint8_t *)malloc(len);

components/bt/host/bluedroid/stack/btm/btm_ble_gap.c

@@ -2090,7 +2090,7 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
 
     STREAM_TO_UINT8(length, p);
 
-    while ( length && (p - p_adv <= BTM_BLE_CACHE_ADV_DATA_MAX)) {
+    while ( length && (p - p_adv < BTM_BLE_CACHE_ADV_DATA_MAX)) {
         STREAM_TO_UINT8(adv_type, p);
 
         if ( adv_type == type ) {
@@ -2098,7 +2098,15 @@ UINT8 *BTM_CheckAdvData( UINT8 *p_adv, UINT8 type, UINT8 *p_length)
             *p_length = length - 1; /* minus the length of type */
             return p;
         }
+
         p += length - 1; /* skip the length of data */
+
+        /* Break loop if advertising data is in an incorrect format,
+           as it may lead to memory overflow */
+        if (p >= p_adv + BTM_BLE_CACHE_ADV_DATA_MAX) {
+            break;
+        }
+
         STREAM_TO_UINT8(length, p);
     }
 

components/bt/host/bluedroid/stack/gatt/gatt_api.c

@@ -122,6 +122,7 @@ BOOLEAN  GATTS_NVRegister (const tGATT_APPL_INFO *p_cb_info)
     return status;
 }
 
+#if GATTS_ROBUST_CACHING_ENABLED
 static void gatt_update_for_database_change(void)
 {
     UINT8 i;
@@ -135,7 +136,7 @@ static void gatt_update_for_database_change(void)
         }
     }
 }
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
 /*******************************************************************************
 **
 ** Function         GATTS_CreateService
@@ -414,7 +415,9 @@ BOOLEAN GATTS_DeleteService (tGATT_IF gatt_if, tBT_UUID *p_svc_uuid, UINT16 svc_
         GATT_TRACE_DEBUG ("Delete a new service changed item - the service has not yet started");
         osi_free(fixed_queue_try_remove_from_queue(gatt_cb.pending_new_srv_start_q, p_buf));
     } else {
+#if GATTS_ROBUST_CACHING_ENABLED
         gatt_update_for_database_change();
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
         if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) {
             gatt_proc_srv_chg();
         }
@@ -527,7 +530,11 @@ tGATT_STATUS GATTS_StartService (tGATT_IF gatt_if, UINT16 service_handle,
     if ( (p_buf = gatt_sr_is_new_srv_chg(&p_list->asgn_range.app_uuid128,
                                          &p_list->asgn_range.svc_uuid,
                                          p_list->asgn_range.svc_inst)) != NULL) {
+
+        #if GATTS_ROBUST_CACHING_ENABLED
         gatt_update_for_database_change();
+        #endif /* GATTS_ROBUST_CACHING_ENABLED */
+
         if (gatt_cb.srv_chg_mode == GATTS_SEND_SERVICE_CHANGE_AUTO) {
             gatt_proc_srv_chg();
         }

components/bt/host/bluedroid/stack/gatt/gatt_attr.c

@@ -40,7 +40,13 @@
 #define BLE_GATT_CL_SUPP_FEAT_BITMASK 0x07
 
 #define GATTP_MAX_NUM_INC_SVR       0
+
+#if GATTS_ROBUST_CACHING_ENABLED
 #define GATTP_MAX_CHAR_NUM          5
+#else
+#define GATTP_MAX_CHAR_NUM          2
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
+
 #define GATTP_MAX_ATTR_NUM          (GATTP_MAX_CHAR_NUM * 2 + GATTP_MAX_NUM_INC_SVR + 1)
 #define GATTP_MAX_CHAR_VALUE_SIZE   50
 
@@ -196,14 +202,15 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
 
     GATT_TRACE_DEBUG("%s handle %x", __func__, p_data->handle);
 
-    UINT8 tcb_idx = GATT_GET_TCB_IDX(conn_id);
-    tGATT_TCB *tcb = gatt_get_tcb_by_idx(tcb_idx);
-
     if (p_data->is_long) {
         p_rsp->attr_value.offset = p_data->offset;
     }
 
     p_rsp->attr_value.handle = p_data->handle;
+#if GATTS_ROBUST_CACHING_ENABLED
+
+    UINT8 tcb_idx = GATT_GET_TCB_IDX(conn_id);
+    tGATT_TCB *tcb = gatt_get_tcb_by_idx(tcb_idx);
 
     /* handle request for reading client supported features */
     if (p_data->handle == gatt_cb.handle_of_cl_supported_feat) {
@@ -229,7 +236,7 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
         memcpy(p_rsp->attr_value.value, &gatt_cb.gatt_sr_supported_feat_mask, 1);
         return GATT_SUCCESS;
     }
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
     /* handle request for reading service changed des and the others */
     status = GATTS_GetAttributeValue(p_data->handle, &len, &value);
     if(status == GATT_SUCCESS && len > 0 && value) {
@@ -241,7 +248,7 @@ tGATT_STATUS gatt_proc_read (UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_READ_RE
     }
     return status;
 }
-
+#if GATTS_ROBUST_CACHING_ENABLED
 static tGATT_STATUS gatt_sr_write_cl_supp_feat(UINT16 conn_id, tGATT_WRITE_REQ *p_data)
 {
     UINT8 val_new;
@@ -286,7 +293,7 @@ static tGATT_STATUS gatt_sr_write_cl_supp_feat(UINT16 conn_id, tGATT_WRITE_REQ *
 #endif
     return GATT_SUCCESS;
 }
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
 /******************************************************************************
 **
 ** Function         gatt_proc_write_req
@@ -301,7 +308,7 @@ tGATT_STATUS gatt_proc_write_req(UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_WRI
     if(p_data->len > GATT_MAX_ATTR_LEN) {
         p_data->len = GATT_MAX_ATTR_LEN;
     }
-
+#if GATTS_ROBUST_CACHING_ENABLED
     if (p_data->handle == gatt_cb.handle_of_h_r) {
         return GATT_WRITE_NOT_PERMIT;
     }
@@ -317,7 +324,7 @@ tGATT_STATUS gatt_proc_write_req(UINT16 conn_id, tGATTS_REQ_TYPE type, tGATT_WRI
     if (p_data->handle == gatt_cb.handle_of_sr_supported_feat) {
         return GATT_WRITE_NOT_PERMIT;
     }
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
     return GATTS_SetAttributeValue(p_data->handle,
                            p_data->len,
                            p_data->value);
@@ -470,7 +477,7 @@ void gatt_profile_db_init (void)
     };
 
     GATTS_AddCharDescriptor (service_handle, GATT_PERM_READ | GATT_PERM_WRITE , &descr_uuid, &attr_val, NULL);
-
+#if GATTS_ROBUST_CACHING_ENABLED
     /* add Client Supported Features characteristic */
     uuid.uu.uuid16 = GATT_UUID_CLIENT_SUP_FEAT;
     gatt_cb.handle_of_cl_supported_feat = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ | GATT_PERM_WRITE,
@@ -483,7 +490,7 @@ void gatt_profile_db_init (void)
     /* add Server Supported Features characteristic */
     uuid.uu.uuid16 = GATT_UUID_SERVER_SUP_FEAT;
     gatt_cb.handle_of_sr_supported_feat = GATTS_AddCharacteristic(service_handle, &uuid, GATT_PERM_READ, GATT_CHAR_PROP_BIT_READ, NULL, NULL);
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
     /* start service */
     status = GATTS_StartService (gatt_cb.gatt_if, service_handle, GATTP_TRANSPORT_SUPPORTED );
 
@@ -689,6 +696,7 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
     gatt_cl_start_config_ccc(p_clcb);
 }
 
+#if GATTS_ROBUST_CACHING_ENABLED
 /*******************************************************************************
 **
 ** Function         gatt_sr_is_cl_robust_caching_supported
@@ -700,14 +708,8 @@ void GATT_ConfigServiceChangeCCC (BD_ADDR remote_bda, BOOLEAN enable, tBT_TRANSP
 *******************************************************************************/
 static BOOLEAN gatt_sr_is_cl_robust_caching_supported(tGATT_TCB *p_tcb)
 {
-    // Server robust caching not enabled
-    if (!GATTS_ROBUST_CACHING_ENABLED) {
-        return FALSE;
-    }
-
     return (p_tcb->cl_supp_feat & BLE_GATT_CL_SUPP_FEAT_ROBUST_CACHING_BITMASK);
 }
-
 /*******************************************************************************
 **
 ** Function         gatt_sr_is_cl_change_aware
@@ -791,4 +793,5 @@ void gatt_sr_update_cl_status(tGATT_TCB *p_tcb, BOOLEAN chg_aware)
 
     GATT_TRACE_DEBUG("%s status %d", __func__, chg_aware);
 }
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
 #endif  /* BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */

components/bt/host/bluedroid/stack/gatt/gatt_db.c

@@ -1241,15 +1241,18 @@ tGATT_STATUS gatts_write_attr_perm_check (tGATT_SVC_DB *p_db, UINT8 op_code,
 // btla-specific ++
                     else if ( (p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) &&
                               (p_attr->uuid == GATT_UUID_CHAR_CLIENT_CONFIG ||
-                               p_attr->uuid == GATT_UUID_CHAR_SRVR_CONFIG) )
+                               p_attr->uuid == GATT_UUID_CHAR_SRVR_CONFIG   ||
+                               p_attr->uuid == GATT_UUID_CLIENT_SUP_FEAT    ||
+                               p_attr->uuid == GATT_UUID_GAP_ICON
+                               ) )
 // btla-specific --
                     {
-                        if (op_code == GATT_REQ_PREPARE_WRITE && offset != 0) { /* does not allow write blob */
-                            status = GATT_NOT_LONG;
-                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_NOT_LONG,handle:0x%04x",handle);
+                        if (op_code == GATT_REQ_PREPARE_WRITE) { /* does not allow write blob */
+                            status = GATT_REQ_NOT_SUPPORTED;
+                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_REQ_NOT_SUPPORTED,handle:0x%04x",handle);
                         } else if (len != max_size) { /* data does not match the required format */
                             status = GATT_INVALID_ATTR_LEN;
-                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INVALID_PDU,handle:0x%04x",handle);
+                            GATT_TRACE_ERROR( "gatts_write_attr_perm_check - GATT_INVALID_ATTR_LEN,handle:0x%04x",handle);
                         } else {
                             status = GATT_SUCCESS;
                         }

components/bt/host/bluedroid/stack/gatt/gatt_main.c

@@ -194,9 +194,7 @@ void gatt_free(void)
 #endif /* #if (GATTS_INCLUDED == TRUE) */
     }
     list_free(gatt_cb.p_tcb_list);
-#if (GATTC_INCLUDED == TRUE)
     list_free(gatt_cb.p_clcb_list);
-#endif //(GATTC_INCLUDED == TRUE)
 
 #if (GATTS_INCLUDED == TRUE)
     for (int i = 0; i < GATT_MAX_SR_PROFILES; i++) {

components/bt/host/bluedroid/stack/gatt/gatt_sr.c

@@ -1448,8 +1448,9 @@ void gatt_attr_process_prepare_write (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 hand
     }
 
     if ((prepare_record->error_code_app == GATT_SUCCESS)
-            && ((status == GATT_INVALID_OFFSET) || (status == GATT_INVALID_ATTR_LEN))){
-            prepare_record->error_code_app = status;
+        // update prepare write status for excute write request
+        && (status == GATT_INVALID_OFFSET || status == GATT_INVALID_ATTR_LEN || status == GATT_REQ_NOT_SUPPORTED)) {
+        prepare_record->error_code_app = status;
     }
 
 }
@@ -1680,9 +1681,10 @@ static BOOLEAN gatts_proc_ind_ack(tGATT_TCB *p_tcb, UINT16 ack_handle)
         gatts_proc_srv_chg_ind_ack(p_tcb);
         /* there is no need to inform the application since srv chg is handled internally by GATT */
         continue_processing = FALSE;
-
+#if GATTS_ROBUST_CACHING_ENABLED
         /* after receiving ack of svc_chg_ind, reset client status */
         gatt_sr_update_cl_status(p_tcb, true);
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
     }
 
     gatts_chk_pending_ind(p_tcb);
@@ -1729,6 +1731,7 @@ void gatts_process_value_conf(tGATT_TCB *p_tcb, UINT8 op_code)
     }
 }
 
+#if GATTS_ROBUST_CACHING_ENABLED
 static BOOLEAN gatts_handle_db_out_of_sync(tGATT_TCB *p_tcb, UINT8 op_code,
                                     UINT16 len, UINT8 *p_data)
 {
@@ -1808,6 +1811,7 @@ static BOOLEAN gatts_handle_db_out_of_sync(tGATT_TCB *p_tcb, UINT8 op_code,
     return should_ignore;
 }
 
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
 /*******************************************************************************
 **
 ** Function         gatt_server_handle_client_req
@@ -1839,11 +1843,12 @@ void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
         }
         /* otherwise, ignore the pkt */
     } else {
+#if GATTS_ROBUST_CACHING_ENABLED
         // handle database out of sync
         if (gatts_handle_db_out_of_sync(p_tcb, op_code, len, p_data)) {
             return;
         }
-
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
         switch (op_code) {
         case GATT_REQ_READ_BY_GRP_TYPE:         /* discover primary services */
         case GATT_REQ_FIND_TYPE_VALUE:          /* discover service by UUID */

components/bt/host/bluedroid/stack/gatt/gatt_utils.c

@@ -1090,9 +1090,9 @@ tGATT_TCB *gatt_allocate_tcb_by_bdaddr(BD_ADDR bda, tBT_TRANSPORT transport)
             p_tcb->transport = transport;
         }
         memcpy(p_tcb->peer_bda, bda, BD_ADDR_LEN);
-#if (GATTS_INCLUDED == TRUE)
+#if GATTS_ROBUST_CACHING_ENABLED
         gatt_sr_init_cl_status(p_tcb);
-#endif  ///GATTS_INCLUDED == TRUE
+#endif /* GATTS_ROBUST_CACHING_ENABLED */
     }
     return p_tcb;
 }

components/bt/host/bluedroid/stack/gatt/include/gatt_int.h

@@ -539,6 +539,7 @@ typedef struct {
     tGATT_PROFILE_CLCB  profile_clcb[GATT_MAX_APPS];
 #endif  ///GATTS_INCLUDED == TRUE
     UINT16              handle_of_h_r;          /* Handle of the handles reused characteristic value */
+#if GATTS_ROBUST_CACHING_ENABLED
     UINT16              handle_of_database_hash;
     UINT16              handle_of_cl_supported_feat;
     UINT16              handle_of_sr_supported_feat;
@@ -546,6 +547,7 @@ typedef struct {
     UINT8               gatt_sr_supported_feat_mask;
     UINT8               gatt_cl_supported_feat_mask;
 
+#endif
     tGATT_APPL_INFO       cb_info;
 
 

components/bt/host/nimble/Kconfig.in

@@ -818,6 +818,29 @@ menu "GAP Service"
 
 endmenu
 
+menu "BLE Services"
+    menuconfig BT_NIMBLE_HID_SERVICE
+        bool "HID service"
+        depends on BT_NIMBLE_ENABLED
+        default n
+        help
+            Enable HID service support
+
+    config BT_NIMBLE_SVC_HID_MAX_INSTANCES
+        depends on BT_NIMBLE_HID_SERVICE
+        int "Maximum HID service instances"
+        default 2
+        help
+            Defines maximum number of HID service instances
+
+    config BT_NIMBLE_SVC_HID_MAX_RPTS
+        depends on BT_NIMBLE_HID_SERVICE
+        int "Maximum HID Report characteristics per service instance"
+        default 3
+        help
+            Defines maximum number of report characteristics per service instance
+endmenu
+
 config BT_NIMBLE_VS_SUPPORT
     bool "Enable support for VSC and VSE"
     help

components/bt/host/nimble/port/include/esp_nimble_cfg.h

@@ -908,6 +908,20 @@
 #ifndef MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_READ_PERM
 #define MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_READ_PERM (0)
 #endif
+
+/*** nimble/host/services/hid */
+#ifndef MYNEWT_VAL_BLE_SVC_HID_SERVICE
+#define MYNEWT_VAL_BLE_SVC_HID_SERVICE CONFIG_BT_NIMBLE_HID_SERVICE
+#endif
+
+#ifndef MYNEWT_VAL_BLE_SVC_HID_MAX_RPTS
+#define MYNEWT_VAL_BLE_SVC_HID_MAX_RPTS CONFIG_BT_NIMBLE_SVC_HID_MAX_RPTS
+#endif
+
+#ifndef MYNEWT_VAL_BLE_SVC_HID_MAX_SVC_INSTANCES
+#define MYNEWT_VAL_BLE_SVC_HID_MAX_SVC_INSTANCES CONFIG_BT_NIMBLE_SVC_HID_MAX_INSTANCES
+#endif
+
 #ifndef MYNEWT_VAL_BLE_MESH_ADV_TASK_PRIO
 #define MYNEWT_VAL_BLE_MESH_ADV_TASK_PRIO (9)
 #endif
@@ -1570,6 +1584,15 @@
 #define MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_READ_PERM (-1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_DEFAULT
+#define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_DEFAULT (NULL)
+#endif
+
+/* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
+#ifndef MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_READ_PERM
+#define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_READ_PERM (-1)
+#endif
+
 /*** @apache-mynewt-nimble/nimble/host/services/gap */
 #ifndef MYNEWT_VAL_BLE_SVC_GAP_APPEARANCE
 #define MYNEWT_VAL_BLE_SVC_GAP_APPEARANCE CONFIG_BT_NIMBLE_SVC_GAP_APPEARANCE

components/bt/include/esp32c2/include/esp_bt.h

@@ -223,9 +223,10 @@ typedef struct {
     uint8_t cca_drop_mode;                       /*!< CCA drop mode */
     int8_t cca_low_tx_pwr;                       /*!< Low TX power setting for CCA */
     uint8_t main_xtal_freq;                      /*!< Main crystal frequency */
-    uint32_t version_num;                        /*!< Version number */
-    uint8_t ignore_wl_for_direct_adv;            /*!< Ignore the white list for directed advertising */
-    uint32_t config_magic;                       /*!< Configuration magic value */
+    uint8_t version_num;                        /*!< Version number */
+    uint8_t ignore_wl_for_direct_adv;           /*!< Ignore the white list for directed advertising */
+    uint8_t csa2_select;                        /*!< Select CSA#2 */
+    uint32_t config_magic;                      /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
 #define BT_CONTROLLER_INIT_CONFIG_DEFAULT() {                                           \
@@ -275,8 +276,9 @@ typedef struct {
     .dis_scan_backoff           = NIMBLE_DISABLE_SCAN_BACKOFF,                          \
     .ble_scan_classify_filter_enable         = 0,                                       \
     .main_xtal_freq             = CONFIG_XTAL_FREQ,                                     \
-    .version_num                = efuse_hal_chip_revision(),                            \
+    .version_num                = esp_ble_get_chip_rev_version(),                       \
     .ignore_wl_for_direct_adv   = 0,                                                    \
+    .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/include/esp32c3/include/esp_bt.h

@@ -144,8 +144,21 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 
 #ifdef CONFIG_BT_CTRL_AGC_RECORRECT_EN
 #define BT_CTRL_AGC_RECORRECT_EN  CONFIG_BT_CTRL_AGC_RECORRECT_EN
+// ESP32-S3
+#if CONFIG_IDF_TARGET_ESP32S3
+#define BT_CTRL_AGC_RECORRECT_NEW       1
+#else
+//Check if chip target is ESP32-C3 101
+#if CONFIG_ESP32C3_REV_MIN_101
+#define BT_CTRL_AGC_RECORRECT_NEW       1
+#else
+#define BT_CTRL_AGC_RECORRECT_NEW       0
+#endif // CONFIG_ESP32C3_REV_MIN_101
+#endif // CONFIG_IDF_TARGET_ESP32S3
+
 #else
 #define BT_CTRL_AGC_RECORRECT_EN        0
+#define BT_CTRL_AGC_RECORRECT_NEW       0
 #endif
 
 #ifdef CONFIG_BT_CTRL_CODED_AGC_RECORRECT_EN
@@ -175,7 +188,7 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 #define BT_BLE_CCA_MODE (0)
 #endif
 
-#define AGC_RECORRECT_EN       ((BT_CTRL_AGC_RECORRECT_EN << 0) | (BT_CTRL_CODED_AGC_RECORRECT <<1))
+#define AGC_RECORRECT_EN       ((BT_CTRL_AGC_RECORRECT_EN << 0) | (BT_CTRL_CODED_AGC_RECORRECT <<1) | (BT_CTRL_AGC_RECORRECT_NEW << 2))
 
 #define CFG_MASK_BIT_SCAN_DUPLICATE_OPTION    (1<<0)
 

components/bt/include/esp32c6/include/esp_bt.h

@@ -216,6 +216,7 @@ typedef struct {
     uint8_t cpu_freq_mhz;                            /*!< CPU frequency in megahertz (MHz) */
     uint8_t ignore_wl_for_direct_adv;                /*!< Ignore the whitelist for direct advertising */
     uint8_t enable_pcl;                              /*!< Enable power control */
+    uint8_t csa2_select;                             /*!< Select CSA#2*/
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
@@ -270,6 +271,7 @@ typedef struct {
     .cpu_freq_mhz               = CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ,                      \
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .enable_pcl                 = DEFAULT_BT_LE_POWER_CONTROL_ENABLED,                  \
+    .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/include/esp32h2/include/esp_bt.h

@@ -220,6 +220,7 @@ typedef struct {
     uint8_t cpu_freq_mhz;                        /*!< CPU frequency in megahertz */
     uint8_t ignore_wl_for_direct_adv;            /*!< Ignore the white list for directed advertising */
     uint8_t enable_pcl;                          /*!< Enable power control */
+    uint8_t csa2_select;                             /*!< Select CSA#2*/
     uint32_t config_magic;                       /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
@@ -274,6 +275,7 @@ typedef struct {
     .cpu_freq_mhz               = CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ,                      \
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .enable_pcl                 = 0,                                                    \
+    .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                      \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/porting/nimble/include/nimble/hci_common.h

@@ -1155,6 +1155,8 @@ struct ble_hci_vs_duplicate_exception_list_cp {
 #define BLE_HCI_OCF_VS_PCL_SET_RSSI                     (MYNEWT_VAL(BLE_HCI_VS_OCF_OFFSET) + (0x0111))
 #endif
 
+#define BLE_HCI_OCF_VS_SET_CHAN_SELECT                  (MYNEWT_VAL(BLE_HCI_VS_OCF_OFFSET) + (0x0112))
+
 /* Command Specific Definitions */
 /* --- Set controller to host flow control (OGF 0x03, OCF 0x0031) --- */
 #define BLE_HCI_CTLR_TO_HOST_FC_OFF         (0)

components/bt/porting/npl/freertos/include/nimble/nimble_npl_os.h

@@ -122,6 +122,7 @@ struct npl_funcs_t {
     void (*p_ble_npl_hw_exit_critical)(uint32_t);
     uint32_t (*p_ble_npl_get_time_forever)(void);
     uint8_t (*p_ble_npl_hw_is_in_critical)(void);
+    void (*p_ble_npl_eventq_put_to_front)(struct ble_npl_eventq *, struct ble_npl_event *);
 };
 
 extern struct npl_funcs_t *npl_funcs;

components/bt/porting/npl/freertos/src/npl_os_freertos.c

@@ -3,7 +3,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2019-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2019-2023 Espressif Systems (Shanghai) CO LTD
  */
 
 #include <assert.h>
@@ -37,11 +37,19 @@ static const char *TAG = "Timer";
 #error "not defined SOC_ESP_NIMBLE_CONTROLLER or SOC_ESP_NIMBLE_CONTROLLER is zero"
 #endif
 
+#if CONFIG_BT_NIMBLE_ENABLED
 #define BLE_HOST_CO_COUNT    (8)
 #define BLE_HOST_EV_COUNT    (11 + BLE_HOST_CO_COUNT)
 #define BLE_HOST_EVQ_COUNT   (3)
 #define BLE_HOST_SEM_COUNT   (10)
 #define BLE_HOST_MUTEX_COUNT (4)
+#else
+#define BLE_HOST_CO_COUNT    (0)
+#define BLE_HOST_EV_COUNT    (0)
+#define BLE_HOST_EVQ_COUNT   (0)
+#define BLE_HOST_SEM_COUNT   (0)
+#define BLE_HOST_MUTEX_COUNT (0)
+#endif
 
 struct os_mempool ble_freertos_ev_pool;
 static os_membuf_t *ble_freertos_ev_buf = NULL;
@@ -133,6 +141,9 @@ npl_freertos_eventq_init(struct ble_npl_eventq *evq)
         memset(eventq, 0, sizeof(*eventq));
         eventq->q = xQueueCreate(ble_freertos_total_event_cnt, sizeof(struct ble_npl_eventq *));
         BLE_LL_ASSERT(eventq->q);
+    } else {
+        eventq = (struct ble_npl_eventq_freertos*)evq->eventq;
+        xQueueReset(eventq->q);
     }
 #else
     if(!evq->eventq) {
@@ -142,6 +153,9 @@ npl_freertos_eventq_init(struct ble_npl_eventq *evq)
         memset(eventq, 0, sizeof(*eventq));
         eventq->q = xQueueCreate(ble_freertos_total_event_cnt, sizeof(struct ble_npl_eventq *));
         BLE_LL_ASSERT(eventq->q);
+    } else {
+        eventq = (struct ble_npl_eventq_freertos*)evq->eventq;
+        xQueueReset(eventq->q);
     }
 #endif
 }
@@ -234,6 +248,32 @@ IRAM_ATTR npl_freertos_eventq_put(struct ble_npl_eventq *evq, struct ble_npl_eve
     BLE_LL_ASSERT(ret == pdPASS);
 }
 
+void
+IRAM_ATTR npl_freertos_eventq_put_to_front(struct ble_npl_eventq *evq, struct ble_npl_event *ev)
+{
+    BaseType_t woken;
+    BaseType_t ret;
+    struct ble_npl_eventq_freertos *eventq = (struct ble_npl_eventq_freertos *)evq->eventq;
+    struct ble_npl_event_freertos *event = (struct ble_npl_event_freertos *)ev->event;
+
+    if (event->queued) {
+        return;
+    }
+
+    event->queued = true;
+
+    if (in_isr()) {
+        ret = xQueueSendToFrontFromISR(eventq->q, &ev, &woken);
+        if( woken == pdTRUE ) {
+            portYIELD_FROM_ISR();
+        }
+    } else {
+        ret = xQueueSendToFront(eventq->q, &ev, portMAX_DELAY);
+    }
+
+    BLE_LL_ASSERT(ret == pdPASS);
+}
+
 void
 IRAM_ATTR npl_freertos_eventq_remove(struct ble_npl_eventq *evq,
                        struct ble_npl_event *ev)
@@ -980,6 +1020,7 @@ const struct npl_funcs_t npl_funcs_ro = {
     .p_ble_npl_eventq_deinit = npl_freertos_eventq_deinit,
     .p_ble_npl_eventq_get = npl_freertos_eventq_get,
     .p_ble_npl_eventq_put = npl_freertos_eventq_put,
+    .p_ble_npl_eventq_put_to_front = npl_freertos_eventq_put_to_front,
     .p_ble_npl_eventq_remove = npl_freertos_eventq_remove,
     .p_ble_npl_event_run = npl_freertos_event_run,
     .p_ble_npl_eventq_is_empty = npl_freertos_eventq_is_empty,

components/driver/i2c/i2c_master.c

@@ -871,6 +871,8 @@ esp_err_t i2c_master_bus_add_device(i2c_master_bus_handle_t bus_handle, const i2
 {
     esp_err_t ret = ESP_OK;
     ESP_RETURN_ON_FALSE((bus_handle != NULL), ESP_ERR_INVALID_ARG, TAG, "this bus is not initialized, please call `i2c_new_master_bus`");
+    ESP_RETURN_ON_FALSE(dev_config, ESP_ERR_INVALID_ARG, TAG, "invalid argument");
+    ESP_RETURN_ON_FALSE(dev_config->scl_speed_hz > 0, ESP_ERR_INVALID_ARG, TAG, "invalid scl frequency");
     if(bus_handle->base->bus_mode != I2C_BUS_MODE_MASTER) {
         ESP_LOGE(TAG, "This is not master bus!");
         return ESP_ERR_INVALID_ARG;

components/driver/i2c/include/driver/i2c_types.h

@@ -86,7 +86,7 @@ typedef struct {
  *
  * @param[in]  i2c_slave Handle for I2C slave.
  * @param[out] evt_data I2C capture event data, fed by driver
- * @param[in]  user_ctx User data, set in `i2c_slave_register_event_callbacks()`
+ * @param[in]  arg User data, set in `i2c_slave_register_event_callbacks()`
  *
  * @return Whether a high priority task has been waken up by this function
  */

components/driver/test_apps/legacy_i2c_driver/main/test_i2c.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Unlicense OR CC0-1.0
  */
@@ -25,16 +25,15 @@
 #define DATA_LENGTH          512  /*!<Data buffer length for test buffer*/
 #define RW_TEST_LENGTH       129  /*!<Data length for r/w test, any value from 0-DATA_LENGTH*/
 
-#define I2C_SLAVE_SCL_IO     0     /*!<gpio number for i2c slave clock  */
-#define I2C_SLAVE_SDA_IO     2     /*!<gpio number for i2c slave data */
+#define I2C_SLAVE_SCL_IO     4     /*!<gpio number for i2c slave clock  */
+#define I2C_SLAVE_SDA_IO     5     /*!<gpio number for i2c slave data  */
 
 #define I2C_SLAVE_NUM I2C_NUM_0    /*!<I2C port number for slave dev */
 #define I2C_SLAVE_TX_BUF_LEN  (2*DATA_LENGTH) /*!<I2C slave tx buffer size */
 #define I2C_SLAVE_RX_BUF_LEN  (2*DATA_LENGTH) /*!<I2C slave rx buffer size */
 
-
-#define I2C_MASTER_SCL_IO     0     /*!<gpio number for i2c master clock  */
-#define I2C_MASTER_SDA_IO     2     /*!<gpio number for i2c master data */
+#define I2C_MASTER_SCL_IO     4     /*!<gpio number for i2c master clock  */
+#define I2C_MASTER_SDA_IO     5     /*!<gpio number for i2c master data  */
 
 #define I2C_MASTER_NUM I2C_NUM_0   /*!< I2C port number for master dev */
 #define I2C_MASTER_TX_BUF_DISABLE   0   /*!< I2C master do not need buffer */

components/esp-tls/esp_tls_errors.h

@@ -10,8 +10,12 @@
 #include "esp_err.h"
 #ifdef CONFIG_ESP_TLS_USING_MBEDTLS
 #include "mbedtls/error.h"
+#include "mbedtls/ssl.h"
+#elif CONFIG_ESP_TLS_USING_WOLFSSL
+#include "wolfssl/wolfcrypt/settings.h"
+#include "wolfssl/ssl.h"
 #endif
-/* For wolfSSL, errors are included through ssl.h which is included by default by esp_tls.h */
+
 
 #ifdef __cplusplus
 extern "C" {

components/esp_coex/include/esp_coex_i154.h

@@ -17,6 +17,7 @@ typedef enum {
 
 void esp_coex_ieee802154_txrx_pti_set(ieee802154_coex_event_t event);
 void esp_coex_ieee802154_ack_pti_set(ieee802154_coex_event_t event);
+void esp_coex_ieee802154_coex_break_notify(void);
 #endif
 
 #endif

components/esp_common/include/esp_err.h

@@ -79,7 +79,6 @@ const char *esp_err_to_name_r(esp_err_t code, char *buf, size_t buflen);
 /** @cond */
 void _esp_error_check_failed(esp_err_t rc, const char *file, int line, const char *function, const char *expression) __attribute__((__noreturn__));
 
-/** @cond */
 void _esp_error_check_failed_without_abort(esp_err_t rc, const char *file, int line, const char *function, const char *expression);
 
 #ifndef __ASSERT_FUNC

components/esp_common/src/esp_err_to_name.c

@@ -457,6 +457,9 @@ static const esp_err_msg_t esp_err_msg_table[] = {
 #   endif
 #   ifdef      ESP_ERR_ESPNOW_IF
     ERR_TBL_IT(ESP_ERR_ESPNOW_IF),                              /* 12396 0x306c Interface error */
+#   endif
+#   ifdef      ESP_ERR_ESPNOW_CHAN
+    ERR_TBL_IT(ESP_ERR_ESPNOW_CHAN),                            /* 12397 0x306d Channel error */
 #   endif
     // components/wpa_supplicant/esp_supplicant/include/esp_dpp.h
 #   ifdef      ESP_ERR_DPP_FAILURE

components/esp_hid/CMakeLists.txt

@@ -19,6 +19,11 @@ if(CONFIG_BT_ENABLED)
              "src/bt_hidh.c"
              "src/bt_hidd.c")
     endif()
+    if(CONFIG_BT_NIMBLE_ENABLED)
+        list(APPEND srcs
+                "src/nimble_hidd.c"
+                "src/nimble_hidh.c")
+    endif()
 endif()
 
 idf_component_register(SRCS "${srcs}"

components/esp_hid/include/esp_hidh_nimble.h

@@ -0,0 +1,28 @@
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+#include "sdkconfig.h"
+
+#if CONFIG_BT_NIMBLE_ENABLED
+/**
+ * @brief Open BlueTooth HID Device using BlueDroid
+ * @param bda               : BT Device Address
+ * @param transport         : BT Device Protocol (Classic/HID)
+ * @param remote_addr_type  : BLE Remote address type
+ *
+ * @return: ESP_OK on success
+ */
+esp_hidh_dev_t *esp_hidh_dev_open(uint8_t *bda, esp_hid_transport_t transport, uint8_t remote_addr_type);
+#endif /* CONFIG_BT_NIMBLE_ENABLED */
+
+#ifdef __cplusplus
+}
+#endif

components/esp_hid/include/esp_hidh_transport.h

@@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #pragma once
 
@@ -28,6 +20,10 @@ extern "C" {
 #include "esp_hidh_bluedroid.h"
 #endif
 
+#if CONFIG_BT_NIMBLE_ENABLED
+#include "esp_hidh_nimble.h"
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/esp_hid/private/ble_hidd.h

@@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #pragma once
 
@@ -22,7 +14,7 @@
 extern "C" {
 #endif
 
-#if CONFIG_GATTS_ENABLE
+#if CONFIG_GATTS_ENABLE || CONFIG_BT_NIMBLE_ENABLED
 
 esp_err_t esp_ble_hidd_dev_init(esp_hidd_dev_t *dev, const esp_hid_device_config_t *config, esp_event_handler_t callback);
 

components/esp_hid/private/ble_hidh.h

@@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #pragma once
 
@@ -20,12 +12,16 @@
 extern "C" {
 #endif
 
-#if CONFIG_GATTC_ENABLE
+#if CONFIG_GATTC_ENABLE || CONFIG_BT_NIMBLE_ENABLED
 
 esp_err_t esp_ble_hidh_init(const esp_hidh_config_t *config);
 esp_err_t esp_ble_hidh_deinit(void);
 
+#if CONFIG_BT_NIMBLE_ENABLED
+esp_hidh_dev_t *esp_ble_hidh_dev_open(uint8_t *bda, uint8_t address_type);
+#else
 esp_hidh_dev_t *esp_ble_hidh_dev_open(esp_bd_addr_t bda, esp_ble_addr_type_t address_type);
+#endif
 
 #endif /* CONFIG_GATTC_ENABLE */
 

components/esp_hid/private/esp_hidh_private.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,6 +17,9 @@
 #include "esp_event.h"
 #include "sys/queue.h"
 #include "esp_timer.h"
+#if CONFIG_BT_NIMBLE_ENABLED
+#include "nimble/ble.h"
+#endif
 
 #ifdef __cplusplus
 extern "C" {
@@ -52,7 +55,11 @@ struct esp_hidh_dev_s {
     esp_timer_handle_t      trans_timer;    //transactiion timer
     uint8_t                 report_type;    //Get_Report tansaction report_type
     uint8_t                 report_id;      //Get_Report tansaction report_id
+#if CONFIG_BT_NIMBLE_ENABLED
+    uint8_t                 *protocol_mode;  // protocol mode is unique for each hid service instance
+#else
     uint8_t                 protocol_mode;  //device protocol mode
+#endif
     bool                    connected;      //we have all required data to communicate
     bool                    opened;         //we opened the device manually, else the device connected to us
     bool                    added;          //If lower layer has added the device
@@ -82,6 +89,9 @@ struct esp_hidh_dev_s {
 #if CONFIG_BLUEDROID_ENABLED
     esp_bd_addr_t bda;
 #endif /* CONFIG_BLUEDROID_ENABLED */
+#if CONFIG_BT_NIMBLE_ENABLED
+    uint8_t bda[6];
+#endif
 
     union {
 #if CONFIG_BT_HID_HOST_ENABLED
@@ -102,6 +112,15 @@ struct esp_hidh_dev_s {
             uint16_t battery_ccc_handle;
         } ble;
 #endif /* CONFIG_GATTC_ENABLE */
+#if CONFIG_BT_NIMBLE_ENABLED
+        struct {
+            uint8_t address_type;
+            int conn_id;
+            uint16_t appearance;
+            uint16_t battery_handle;
+            uint16_t battery_ccc_handle;
+        } ble;
+#endif
     };
     TAILQ_ENTRY(esp_hidh_dev_s) devices;
 };
@@ -115,6 +134,10 @@ esp_hidh_dev_t *esp_hidh_dev_get_by_bda(esp_bd_addr_t bda); //BT/BLE
 esp_hidh_dev_t *esp_hidh_dev_get_by_handle(uint8_t handle); //Classic Bluetooth Only
 esp_hidh_dev_t *esp_hidh_dev_get_by_conn_id(uint16_t conn_id); //BLE Only
 #endif /* CONFIG_BLUEDROID_ENABLED */
+#if CONFIG_BT_NIMBLE_ENABLED
+esp_hidh_dev_t *esp_hidh_dev_get_by_bda(uint8_t* bda); // BLE Only
+esp_hidh_dev_t *esp_hidh_dev_get_by_conn_id(uint16_t conn_id); //BLE Only
+#endif
 
 esp_hidh_dev_report_t *esp_hidh_dev_get_report_by_id_type_proto(esp_hidh_dev_t *dev, size_t map_index, size_t report_id, int report_type, uint8_t protocol_mode);
 esp_hidh_dev_report_t *esp_hidh_dev_get_report_by_id_and_type(esp_hidh_dev_t *dev, size_t map_index, size_t report_id, int report_type);

components/esp_hid/src/esp_hid_common.c

@@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #include <string.h>
 #include "esp_log.h"

components/esp_hid/src/esp_hidd.c

@@ -8,7 +8,7 @@
 #include "esp_hidd_private.h"
 #include "esp_event_base.h"
 
-#if CONFIG_GATTS_ENABLE
+#if CONFIG_GATTS_ENABLE || CONFIG_BT_NIMBLE_ENABLED
 #include "ble_hidd.h"
 #endif /* CONFIG_GATTS_ENABLE */
 
@@ -27,7 +27,7 @@ esp_err_t esp_hidd_dev_init(const esp_hid_device_config_t *config, esp_hid_trans
     }
 
     switch (transport) {
-#if CONFIG_GATTS_ENABLE
+#if CONFIG_GATTS_ENABLE || CONFIG_BT_NIMBLE_ENABLED
     case ESP_HID_TRANSPORT_BLE:
         ret = esp_ble_hidd_dev_init(dev, config, callback);
         break;

components/esp_hid/src/esp_hidh.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -88,7 +88,7 @@ esp_err_t esp_hidh_init(const esp_hidh_config_t *config)
     }
 #endif /* CONFIG_BT_HID_HOST_ENABLED */
 
-#if CONFIG_GATTC_ENABLE
+#if CONFIG_GATTC_ENABLE || CONFIG_BT_NIMBLE_ENABLED
     if (err == ESP_OK) {
         err = esp_ble_hidh_init(config);
     }
@@ -123,7 +123,7 @@ esp_err_t esp_hidh_deinit(void)
     }
 #endif /* CONFIG_BT_HID_HOST_ENABLED */
 
-#if CONFIG_GATTC_ENABLE
+#if CONFIG_GATTC_ENABLE || CONFIG_BT_NIMBLE_ENABLED
     if (err == ESP_OK) {
         err = esp_ble_hidh_deinit();
     }
@@ -150,6 +150,11 @@ esp_hidh_dev_t *esp_hidh_dev_open(esp_bd_addr_t bda, esp_hid_transport_t transpo
         dev = esp_ble_hidh_dev_open(bda, (esp_ble_addr_type_t)remote_addr_type);
     }
 #endif /* CONFIG_GATTC_ENABLE */
+#if CONFIG_BT_NIMBLE_ENABLED
+    if (transport == ESP_HID_TRANSPORT_BLE) {
+        dev = esp_ble_hidh_dev_open(bda, remote_addr_type);
+    }
+#endif /* CONFIG_BT_NIMBLE_ENABLED */
 #if CONFIG_BT_HID_HOST_ENABLED
     if (transport == ESP_HID_TRANSPORT_BT) {
         dev = esp_bt_hidh_dev_open(bda);
@@ -159,6 +164,19 @@ esp_hidh_dev_t *esp_hidh_dev_open(esp_bd_addr_t bda, esp_hid_transport_t transpo
 }
 #endif /* CONFIG_BLUEDROID_ENABLED */
 
+#if CONFIG_BT_NIMBLE_ENABLED
+esp_hidh_dev_t *esp_hidh_dev_open(uint8_t *bda, esp_hid_transport_t transport, uint8_t remote_addr_type)
+{
+    if (esp_hidh_dev_get_by_bda(bda) != NULL) {
+        ESP_LOGE(TAG, "Already Connected");
+        return NULL;
+    }
+    esp_hidh_dev_t *dev = NULL;
+    dev = esp_ble_hidh_dev_open(bda, remote_addr_type);
+    return dev;
+}
+#endif /* CONFIG_BT_NIMBLE_ENABLED */
+
 esp_err_t esp_hidh_dev_close(esp_hidh_dev_t *dev)
 {
     esp_err_t ret = ESP_OK;
@@ -329,6 +347,14 @@ const uint8_t *esp_hidh_dev_bda_get(esp_hidh_dev_t *dev)
         esp_hidh_dev_unlock(dev);
     }
 #endif /* CONFIG_BLUEDROID_ENABLED */
+
+#if CONFIG_BT_NIMBLE_ENABLED
+    if (esp_hidh_dev_exists(dev)) {
+        esp_hidh_dev_lock(dev);
+        ret = dev->bda;
+        esp_hidh_dev_unlock(dev);
+    }
+#endif /* CONFIG_BT_NIMBLE_ENABLED */
     return ret;
 }
 
@@ -823,3 +849,82 @@ void esp_hidh_post_process_event_handler(void *event_handler_arg, esp_event_base
     }
 }
 #endif /* CONFIG_BLUEDROID_ENABLED */
+
+#if CONFIG_BT_NIMBLE_ENABLED
+esp_hidh_dev_t *esp_hidh_dev_get_by_bda(uint8_t *bda)
+{
+    esp_hidh_dev_t * d = NULL;
+    lock_devices();
+    TAILQ_FOREACH(d, &s_esp_hidh_devices, devices) {
+        if (memcmp(bda, d->bda, sizeof(uint8_t) * 6) == 0) {
+            unlock_devices();
+            return d;
+        }
+    }
+    unlock_devices();
+    return NULL;
+}
+
+esp_hidh_dev_t *esp_hidh_dev_get_by_conn_id(uint16_t conn_id)
+{
+    esp_hidh_dev_t * d = NULL;
+    lock_devices();
+    TAILQ_FOREACH(d, &s_esp_hidh_devices, devices) {
+        if (d->ble.conn_id == conn_id) {
+            unlock_devices();
+            return d;
+        }
+    }
+    unlock_devices();
+    return NULL;
+}
+
+/**
+ * The deep copy data append the end of the esp_hidh_event_data_t, move the data pointer to the correct address. This is
+ * a workaround way, it's better to use flexible array in the interface.
+ */
+void esp_hidh_preprocess_event_handler(void *event_handler_arg, esp_event_base_t event_base, int32_t event_id,
+                                       void *event_data)
+{
+    esp_hidh_event_t event = (esp_hidh_event_t)event_id;
+    esp_hidh_event_data_t *param = (esp_hidh_event_data_t *)event_data;
+
+    switch (event) {
+    case ESP_HIDH_INPUT_EVENT:
+        if (param->input.length && param->input.data) {
+            param->input.data = (uint8_t *)param + sizeof(esp_hidh_event_data_t);
+        }
+        break;
+    case ESP_HIDH_FEATURE_EVENT:
+        if (param->feature.length && param->feature.data) {
+            param->feature.data = (uint8_t *)param + sizeof(esp_hidh_event_data_t);
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+void esp_hidh_post_process_event_handler(void *event_handler_arg, esp_event_base_t event_base, int32_t event_id,
+                                         void *event_data)
+{
+    esp_hidh_event_t event = (esp_hidh_event_t)event_id;
+    esp_hidh_event_data_t *param = (esp_hidh_event_data_t *)event_data;
+
+    switch (event) {
+    case ESP_HIDH_OPEN_EVENT:
+        if (param->open.status != ESP_OK) {
+            esp_hidh_dev_t *dev = param->open.dev;
+            if (dev) {
+                esp_hidh_dev_free_inner(dev);
+            }
+        }
+        break;
+    case ESP_HIDH_CLOSE_EVENT:
+        esp_hidh_dev_free_inner(param->close.dev);
+        break;
+    default:
+        break;
+    }
+}
+#endif /* CONFIG_BT_NIMBLE_ENABLED */

components/esp_hid/src/nimble_hidd.c

@@ -0,0 +1,710 @@
+/*
+ * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <string.h>
+#include <stdbool.h>
+
+#include "ble_hidd.h"
+#include "esp_hidd_private.h"
+#include "esp_log.h"
+
+#include <assert.h>
+#include <string.h>
+#include <errno.h>
+#include "nimble/nimble_opt.h"
+#include "host/ble_hs.h"
+#include "host/ble_gap.h"
+#include "host/ble_hs_adv.h"
+#include "host/ble_hs_hci.h"
+#include "host/ble_att.h"
+#include "services/gap/ble_svc_gap.h"
+#include "services/gatt/ble_svc_gatt.h"
+#include "services/bas/ble_svc_bas.h"
+#include "services/hid/ble_svc_hid.h"
+#include "services/dis/ble_svc_dis.h"
+#include "services/sps/ble_svc_sps.h"
+
+#if CONFIG_BT_NIMBLE_HID_SERVICE
+
+static const char *TAG = "NIMBLE_HIDD";
+#define BLE_SVC_BAS_UUID16                    0x180F
+
+
+typedef struct esp_ble_hidd_dev_s esp_ble_hidd_dev_t;
+// there can be only one BLE HID device
+static esp_ble_hidd_dev_t *s_dev = NULL;
+
+typedef hidd_report_item_t hidd_le_report_item_t;
+
+typedef struct {
+    esp_hid_raw_report_map_t    reports_map;
+    uint8_t                     reports_len;
+    hidd_le_report_item_t      *reports;
+    uint16_t                    hid_svc;
+    uint16_t                    hid_control_handle;
+    uint16_t                    hid_protocol_handle;
+} hidd_dev_map_t;
+
+
+
+struct esp_ble_hidd_dev_s {
+    esp_hidd_dev_t             *dev;
+    esp_event_loop_handle_t     event_loop_handle;
+    esp_hid_device_config_t     config;
+    uint16_t                    appearance;
+
+    bool                        connected;
+    uint16_t                    conn_id;
+
+    uint8_t                     control;    // 0x00 suspend, 0x01 suspend off
+    uint8_t                     protocol;   // 0x00 boot, 0x01 report
+
+    uint16_t                    bat_svc_handle;
+    uint16_t                    info_svc_handle;
+    struct ble_gatt_svc         hid_incl_svc;
+
+    uint16_t                    bat_level_handle;
+    uint8_t                     pnp[7]; /* something related to device info service */
+    hidd_dev_map_t             *devices;
+    uint8_t                     devices_len;
+};
+
+// HID Information characteristic value
+static const uint8_t hidInfo[4] = {
+    0x11, 0x01,     // bcdHID (USB HID version)
+    0x00,           // bCountryCode
+    ESP_HID_FLAGS_REMOTE_WAKE | ESP_HID_FLAGS_NORMALLY_CONNECTABLE   // Flags
+};
+
+static int create_hid_db(int device_index)
+{
+    int rc = 0;
+    struct ble_svc_hid_params hparams = {0};
+    int report_mode_rpts = 0;
+
+    /* fill hid info */
+    memcpy(&hparams.hid_info, hidInfo, sizeof hparams.hid_info);
+
+    /* fill report map */
+    memcpy(&hparams.report_map, (uint8_t *)s_dev->devices[device_index].reports_map.data, s_dev->devices[device_index].reports_map.len);
+    hparams.report_map_len = s_dev->devices[device_index].reports_map.len;
+    hparams.external_rpt_ref = BLE_SVC_BAS_UUID16;
+
+    /* fill protocol mode */
+    hparams.proto_mode_present = 1;
+    hparams.proto_mode = s_dev->protocol;
+
+    for (uint8_t i = 0; i < s_dev->devices[device_index].reports_len; i++) {
+        hidd_le_report_item_t *report = &s_dev->devices[device_index].reports[i];
+        if (report->protocol_mode == ESP_HID_PROTOCOL_MODE_REPORT) {
+            /* only consider report mode reports, all boot mode reports will be registered by default */
+            if (report->report_type == ESP_HID_REPORT_TYPE_INPUT) {
+                /* Input Report */
+                hparams.rpts[report_mode_rpts].type = ESP_HID_REPORT_TYPE_INPUT;
+            } else if (report->report_type == ESP_HID_REPORT_TYPE_OUTPUT) {
+                /* Output Report */
+                hparams.rpts[report_mode_rpts].type = ESP_HID_REPORT_TYPE_OUTPUT;
+            } else {
+                /* Feature Report */
+                hparams.rpts[report_mode_rpts].type = ESP_HID_REPORT_TYPE_FEATURE;
+            }
+            hparams.rpts[report_mode_rpts].id = report->report_id;
+            report_mode_rpts++;
+        } else {
+            if (report->report_type == ESP_HID_REPORT_TYPE_INPUT) {
+                /* Boot mode reports */
+                if (report->usage == ESP_HID_USAGE_KEYBOARD) { //Boot Keyboard Input
+                    hparams.kbd_inp_present = 1;
+                } else { //Boot Mouse Input
+                hparams.mouse_inp_present = 1;
+                }
+            } else { //Boot Keyboard Output
+                hparams.kbd_out_present = 1;
+            }
+        }
+    }
+    hparams.rpts_len = report_mode_rpts;
+    /* Add service */
+    rc = ble_svc_hid_add(hparams);
+    if(rc != 0) {
+        return rc;
+    }
+    return rc;
+}
+
+
+static int ble_hid_create_info_db() {
+    int rc;
+
+    rc = 0;
+    ble_svc_dis_init();
+    uint8_t pnp_val[7] = {
+        0x02, //0x1=BT, 0x2=USB
+        s_dev->config.vendor_id & 0xFF, (s_dev->config.vendor_id >> 8) & 0xFF, //VID
+        s_dev->config.product_id & 0xFF, (s_dev->config.product_id >> 8) & 0xFF, //PID
+        s_dev->config.version & 0xFF, (s_dev->config.version >> 8) & 0xFF  //VERSION
+    };
+    memcpy(s_dev->pnp, pnp_val, 7);
+    ble_svc_dis_pnp_id_set((char *)s_dev->pnp);
+    if (s_dev->config.manufacturer_name && s_dev->config.manufacturer_name[0]) {
+        rc = ble_svc_dis_manufacturer_name_set(s_dev->config.manufacturer_name);
+    }
+    if (s_dev->config.serial_number && s_dev->config.serial_number[0]) {
+        rc = ble_svc_dis_serial_number_set(s_dev->config.serial_number);
+    }
+    return rc;
+}
+
+static int nimble_hid_start_gatts(void)
+{
+    int rc = ESP_OK;
+
+    ble_svc_gap_init();
+    ble_svc_gatt_init();
+    ble_svc_sps_init(0, 0); // initialize with 0
+    ble_svc_bas_init();
+    ble_hid_create_info_db();
+
+    for (uint8_t d = 0; d < s_dev->devices_len; d++) {
+        rc = create_hid_db(d);
+        if(rc != 0) {
+            return rc;
+        }
+    }
+    /* init the hid svc */
+    ble_svc_hid_init();
+
+    return rc;
+}
+
+static int nimble_hid_stop_gatts(esp_ble_hidd_dev_t *dev)
+{
+    int rc = ESP_OK;
+
+    /* stop gatt database */
+    ble_gatts_stop();
+    return rc;
+}
+
+/* Identify the reports using the report map */
+static int ble_hid_init_config(esp_ble_hidd_dev_t *dev, const esp_hid_device_config_t *config)
+{
+    memset((uint8_t *)(&dev->config), 0, sizeof(esp_hid_device_config_t));
+    dev->config.vendor_id = config->vendor_id;
+    dev->config.product_id = config->product_id;
+    dev->config.version = config->version;
+    if (config->device_name != NULL) {
+        dev->config.device_name = strdup(config->device_name);
+    }
+    if (config->manufacturer_name != NULL) {
+        dev->config.manufacturer_name = strdup(config->manufacturer_name);
+    }
+    if (config->serial_number != NULL) {
+        dev->config.serial_number = strdup(config->serial_number);
+    }
+    dev->appearance = ESP_HID_APPEARANCE_GENERIC;
+
+    if (config->report_maps_len) {
+        dev->devices = (hidd_dev_map_t *)malloc(config->report_maps_len * sizeof(hidd_dev_map_t));
+        if (dev->devices == NULL) {
+            ESP_LOGE(TAG, "devices malloc(%d) failed", config->report_maps_len);
+            return ESP_FAIL;
+        }
+        memset(dev->devices, 0, config->report_maps_len * sizeof(hidd_dev_map_t));
+        dev->devices_len = config->report_maps_len;
+        for (uint8_t d = 0; d < dev->devices_len; d++) {
+
+            //raw report map
+            uint8_t *map = (uint8_t *)malloc(config->report_maps[d].len);
+            if (map == NULL) {
+                ESP_LOGE(TAG, "report map malloc(%d) failed", config->report_maps[d].len);
+                return ESP_FAIL;
+            }
+            memcpy(map, config->report_maps[d].data, config->report_maps[d].len);
+
+            dev->devices[d].reports_map.data = (const uint8_t *)map;
+            dev->devices[d].reports_map.len = config->report_maps[d].len;
+
+            esp_hid_report_map_t *rmap = esp_hid_parse_report_map(config->report_maps[d].data, config->report_maps[d].len);
+            if (rmap == NULL) {
+                ESP_LOGE(TAG, "hid_parse_report_map[%d](%d) failed", d, config->report_maps[d].len);
+                return ESP_FAIL;
+            }
+            dev->appearance = rmap->appearance;
+            dev->devices[d].reports_len = rmap->reports_len;
+            dev->devices[d].reports = (hidd_le_report_item_t *)malloc(rmap->reports_len * sizeof(hidd_le_report_item_t));
+            if (dev->devices[d].reports == NULL) {
+                ESP_LOGE(TAG, "reports malloc(%d) failed", rmap->reports_len * sizeof(hidd_le_report_item_t));
+                free(rmap);
+                return ESP_FAIL;
+            }
+            for (uint8_t r = 0; r < rmap->reports_len; r++) {
+                dev->devices[d].reports[r].map_index = d;
+                dev->devices[d].reports[r].report_id = rmap->reports[r].report_id;
+                dev->devices[d].reports[r].protocol_mode = rmap->reports[r].protocol_mode;
+                dev->devices[d].reports[r].report_type = rmap->reports[r].report_type;
+                dev->devices[d].reports[r].usage = rmap->reports[r].usage;
+                dev->devices[d].reports[r].value_len = rmap->reports[r].value_len;
+            }
+            free(rmap->reports);
+            free(rmap);
+        }
+    }
+    return ESP_OK;
+}
+
+static int ble_hid_free_config(esp_ble_hidd_dev_t *dev)
+{
+    for (uint8_t d = 0; d < dev->devices_len; d++) {
+        free((void *)dev->devices[d].reports);
+        free((void *)dev->devices[d].reports_map.data);
+    }
+
+    free((void *)dev->devices);
+    free((void *)dev->config.device_name);
+    free((void *)dev->config.manufacturer_name);
+    free((void *)dev->config.serial_number);
+    if (dev->event_loop_handle != NULL) {
+        esp_event_loop_delete(dev->event_loop_handle);
+    }
+    return ESP_OK;
+}
+
+static int nimble_hidd_dev_deinit(void *devp) {
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    if (!s_dev) {
+        ESP_LOGE(TAG, "HID device profile already uninitialized");
+        return ESP_OK;
+    }
+
+    if (s_dev != dev) {
+        ESP_LOGE(TAG, "Wrong HID device provided");
+        return ESP_FAIL;
+    }
+    s_dev = NULL;
+
+    nimble_hid_stop_gatts(dev);
+    esp_event_post_to(dev->event_loop_handle, ESP_HIDD_EVENTS, ESP_HIDD_STOP_EVENT, NULL, 0, portMAX_DELAY);
+    ble_hid_free_config(dev);
+    free(dev);
+    return ESP_OK;
+}
+
+static bool nimble_hidd_dev_connected(void *devp)
+{
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    return (dev != NULL && s_dev == dev && dev->connected);
+}
+
+static int nimble_hidd_dev_battery_set(void *devp, uint8_t level)
+{
+    int rc;
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    if (!dev || s_dev != dev) {
+        return ESP_FAIL;
+    }
+
+    if (!dev->connected) {
+        /* Return success if not yet connected */
+        return ESP_OK;
+    }
+
+    rc = ble_svc_bas_battery_level_set(level);
+    if (rc) {
+        ESP_LOGE(TAG, "esp_ble_gatts_send_notify failed: %d", rc);
+        return ESP_FAIL;
+    }
+
+    return ESP_OK;
+}
+
+/* if mode is NULL, find the first matching report */
+static hidd_le_report_item_t* find_report(uint8_t id, uint8_t type, uint8_t *mode) {
+    hidd_le_report_item_t *rpt;
+    for (uint8_t d = 0; d < s_dev->devices_len; d++) {
+        for (uint8_t i = 0; i < s_dev->devices[d].reports_len; i++) {
+            rpt = &s_dev->devices[d].reports[i];
+            if(rpt->report_id == id && rpt->report_type == type && (!mode || (mode && *mode == rpt->protocol_mode))) {
+                return rpt;
+            }
+        }
+    }
+    return NULL;
+}
+static hidd_le_report_item_t* find_report_by_usage_and_type(uint8_t usage, uint8_t type, uint8_t *mode) {
+    hidd_le_report_item_t *rpt;
+    for (uint8_t d = 0; d < s_dev->devices_len; d++) {
+        for (uint8_t i = 0; i < s_dev->devices[d].reports_len; i++) {
+            rpt = &s_dev->devices[d].reports[i];
+            if(rpt->usage == usage && rpt->report_type == type && (!mode || (mode && *mode == rpt->protocol_mode))) {
+                return rpt;
+            }
+        }
+    }
+    return NULL;
+}
+
+static int nimble_hidd_dev_input_set(void *devp, size_t index, size_t id, uint8_t *data, size_t length)
+{
+    hidd_le_report_item_t *p_rpt;
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    int rc;
+    struct os_mbuf *om;
+    if (!dev || s_dev != dev) {
+        return ESP_FAIL;
+    }
+
+    if (!dev->connected) {
+        ESP_LOGE(TAG, "%s Device Not Connected", __func__);
+        return ESP_FAIL;
+    }
+
+    /* check the protocol mode */
+    /* as the protocol mode is always present, its safe to read the characteristic */
+    rc = ble_att_svr_read_local(s_dev->devices[index].hid_protocol_handle, &om);
+    if(rc != 0) {
+        ESP_LOGE(TAG, "Unable to fetch protocol_mode\n");
+        return ESP_FAIL;
+    }
+    rc = ble_hs_mbuf_to_flat(om, &dev->protocol, sizeof(dev->protocol), NULL);
+    if(rc != 0) {
+        return ESP_FAIL;
+    }
+    /* free the mbuf */
+    os_mbuf_free_chain(om);
+    om = NULL;
+
+    p_rpt = find_report(id, ESP_HID_REPORT_TYPE_INPUT, &dev->protocol);
+    assert(p_rpt != NULL);
+    om = ble_hs_mbuf_from_flat((void*)data, length);
+    assert(om != NULL);
+    /* NOTE : om is freed by stack */
+    rc = ble_att_svr_write_local(p_rpt->handle, om);
+    if (rc != 0) {
+        ESP_LOGE(TAG, "Write Input Report Failed: %d", rc);
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+static int nimble_hidd_dev_feature_set(void *devp, size_t index, size_t id, uint8_t *data, size_t length)
+{
+    /* This function is a no-op for now */
+    hidd_le_report_item_t *p_rpt;
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    int rc;
+    struct os_mbuf *om;
+    if (!dev || s_dev != dev) {
+        return ESP_FAIL;
+    }
+
+    if (!dev->connected) {
+        ESP_LOGE(TAG, "%s Device Not Connected", __func__);
+        return ESP_FAIL;
+    }
+
+    /* check the protocol mode */
+    /* as the protocol mode is always present, its safe to read the characteristic */
+    rc = ble_att_svr_read_local(s_dev->devices[index].hid_protocol_handle, &om);
+    if(rc != 0) {
+        ESP_LOGE(TAG, "Unable to fetch protocol_mode\n");
+        return ESP_FAIL;
+    }
+    rc = ble_hs_mbuf_to_flat(om, &dev->protocol, sizeof(dev->protocol), NULL);
+    if(rc != 0) {
+        return ESP_FAIL;
+    }
+    /* free the mbuf */
+    os_mbuf_free_chain(om);
+    om = NULL;
+
+    p_rpt = find_report(id, ESP_HID_REPORT_TYPE_FEATURE, &dev->protocol);
+    assert(p_rpt != NULL);
+    om = ble_hs_mbuf_from_flat((void*)data, length);
+    assert(om != NULL);
+    /* NOTE : om is freed by stack*/
+    rc = ble_att_svr_write_local(p_rpt->handle, om);
+    if (rc != 0) {
+        ESP_LOGE(TAG, "Set Feature Report Failed: %d", rc);
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+static int nimble_hidd_dev_event_handler_register(void *devp, esp_event_handler_t callback, esp_hidd_event_t event)
+{
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    if (!dev || s_dev != dev) {
+        return ESP_FAIL;
+    }
+    return esp_event_handler_register_with(dev->event_loop_handle, ESP_HIDD_EVENTS, event, callback, dev->dev);
+}
+
+static int esp_ble_hidd_dev_event_handler_unregister(void *devp, esp_event_handler_t callback, esp_hidd_event_t event)
+{
+    esp_ble_hidd_dev_t *dev = (esp_ble_hidd_dev_t *)devp;
+    if (!dev || s_dev != dev) {
+        return ESP_FAIL;
+    }
+    return esp_event_handler_unregister_with(dev->event_loop_handle, ESP_HIDD_EVENTS, event, callback);
+}
+
+static void ble_hidd_dev_free(void)
+{
+    if (s_dev) {
+        ble_hid_free_config(s_dev);
+        free(s_dev);
+        s_dev = NULL;
+    }
+}
+
+static int nimble_hid_gap_event(struct ble_gap_event *event, void *arg)
+{
+    struct ble_gap_conn_desc desc;
+    struct os_mbuf *om;
+    uint8_t data;
+    int rc;
+
+    switch (event->type) {
+    case BLE_GAP_EVENT_CONNECT:
+        /* A new connection was established or a connection attempt failed. */
+        ESP_LOGD(TAG, "connection %s; status=%d",
+                 event->connect.status == 0 ? "established" : "failed",
+                 event->connect.status);
+        rc = ble_gap_conn_find(event->connect.conn_handle, &desc);
+        assert(rc == 0);
+
+        /* save connection handle */
+        s_dev->connected = true;
+        s_dev->conn_id = event->connect.conn_handle;
+        esp_hidd_event_data_t cb_param = {
+            .connect.dev = s_dev->dev,
+            .connect.status = event->connect.status
+        };
+
+        /* reset the protocol mode value */
+        data = ESP_HID_PROTOCOL_MODE_REPORT;
+        om = ble_hs_mbuf_from_flat(&data, 1);
+        if(om == NULL) {
+            ESP_LOGD(TAG, "No memory to allocate mbuf");
+        }
+        /* NOTE : om is freed by stack */
+        for(int i = 0; i < s_dev->devices_len; i++) {
+            rc = ble_att_svr_write_local(s_dev->devices[i].hid_protocol_handle, om);
+            if (rc != 0) {
+                ESP_LOGE(TAG, "Write on Protocol Mode Failed: %d", rc);
+            }
+        }
+
+        esp_event_post_to(s_dev->event_loop_handle, ESP_HIDD_EVENTS, ESP_HIDD_CONNECT_EVENT,
+                          &cb_param, sizeof(esp_hidd_event_data_t), portMAX_DELAY);
+        return 0;
+        break;
+    case BLE_GAP_EVENT_DISCONNECT:
+        ESP_LOGD(TAG, "disconnect; reason=%d", event->disconnect.reason);
+
+        if (s_dev->connected) {
+            s_dev->connected = false;
+            esp_hidd_event_data_t cb_param = {0};
+            cb_param.disconnect.dev = s_dev->dev;
+            cb_param.disconnect.reason = event->disconnect.reason;
+            esp_event_post_to(s_dev->event_loop_handle, ESP_HIDD_EVENTS, ESP_HIDD_DISCONNECT_EVENT,
+                              &cb_param, sizeof(esp_hidd_event_data_t), portMAX_DELAY);
+        }
+        return 0;
+    }
+    return 0;
+}
+
+/** service index is used to identify the hid service instance
+    of the registered characteristic.
+    Assuming the first instance of the hid service is registered first.
+    Increment service index as the hid services get registered */
+static int service_index = -1;
+static void nimble_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *arg)
+{
+    char buf[BLE_UUID_STR_LEN];
+    hidd_le_report_item_t *rpt = NULL;
+    struct os_mbuf *om;
+    uint16_t uuid16;
+    uint16_t report_info;
+    uint8_t report_type, report_id;
+    uint16_t report_handle;
+    uint8_t protocol_mode;
+    int rc;
+    switch (ctxt->op) {
+    case BLE_GATT_REGISTER_OP_SVC:
+        ESP_LOGD(TAG, "registered service %s with handle=%d",
+                 ble_uuid_to_str(ctxt->svc.svc_def->uuid, buf),
+                 ctxt->svc.handle);
+        uuid16 = ble_uuid_u16(ctxt->svc.svc_def->uuid);
+        if(uuid16 == BLE_SVC_HID_UUID16) {
+            ++service_index;
+            s_dev->devices[service_index].hid_svc = ctxt->svc.handle;
+        }
+
+        break;
+
+    case BLE_GATT_REGISTER_OP_CHR:
+        ESP_LOGD(TAG, "registering characteristic %s with "
+                 "def_handle=%d val_handle=%d\n",
+                 ble_uuid_to_str(ctxt->chr.chr_def->uuid, buf),
+                 ctxt->chr.def_handle,
+                 ctxt->chr.val_handle);
+        uuid16 = ble_uuid_u16(ctxt->chr.chr_def->uuid);
+        if(uuid16 == BLE_SVC_HID_CHR_UUID16_HID_CTRL_PT) {
+            /* assuming this characteristic is from the last registered hid service */
+            s_dev->devices[service_index].hid_control_handle = ctxt->chr.val_handle;
+        }
+        if(uuid16 == BLE_SVC_HID_CHR_UUID16_PROTOCOL_MODE) {
+            /* assuming this characteristic is from the last registered hid service */
+            s_dev->devices[service_index].hid_protocol_handle = ctxt->chr.val_handle;
+        }
+        if(uuid16 == BLE_SVC_HID_CHR_UUID16_BOOT_KBD_INP) {
+            protocol_mode = ESP_HID_PROTOCOL_MODE_BOOT;
+            rpt = find_report_by_usage_and_type(ESP_HID_USAGE_KEYBOARD, ESP_HID_REPORT_TYPE_INPUT, &protocol_mode);
+            if(rpt == NULL) {
+                ESP_LOGE(TAG, "Unknown boot kbd input report registration");
+                return;
+            }
+            rpt->handle = ctxt->chr.val_handle;
+        }
+        if(uuid16 == BLE_SVC_HID_CHR_UUID16_BOOT_KBD_OUT) {
+            protocol_mode = ESP_HID_PROTOCOL_MODE_BOOT;
+            rpt = find_report_by_usage_and_type(ESP_HID_USAGE_KEYBOARD, ESP_HID_REPORT_TYPE_OUTPUT, &protocol_mode);
+            if(rpt == NULL) {
+                ESP_LOGE(TAG, "Unknown boot kbd output report registration");
+                return;
+            }
+            rpt->handle = ctxt->chr.val_handle;
+        }
+        if(uuid16 == BLE_SVC_HID_CHR_UUID16_BOOT_MOUSE_INP) {
+            protocol_mode = ESP_HID_PROTOCOL_MODE_BOOT;
+            rpt = find_report_by_usage_and_type(ESP_HID_USAGE_MOUSE, ESP_HID_REPORT_TYPE_INPUT, &protocol_mode);
+            if(rpt == NULL) {
+                ESP_LOGE(TAG, "Unknown boot mouse input report registration");
+                return;
+            }
+            rpt->handle = ctxt->chr.val_handle;
+        }
+        break;
+
+    case BLE_GATT_REGISTER_OP_DSC:
+        ESP_LOGD(TAG, "registering descriptor %s with handle=%d",
+                 ble_uuid_to_str(ctxt->dsc.dsc_def->uuid, buf),
+                 ctxt->dsc.handle);
+        uuid16 = ble_uuid_u16(ctxt->dsc.dsc_def->uuid);
+        if(uuid16 == BLE_SVC_HID_DSC_UUID16_RPT_REF) {
+            rc = ble_att_svr_read_local(ctxt->dsc.handle, &om);
+            assert(rc == 0);
+
+            ble_hs_mbuf_to_flat(om, &report_info, sizeof report_info, NULL);
+            report_type = (uint8_t)((report_info & 0xFF00) >> 8);
+            report_id = report_info & 0x00FF;
+            report_handle = (*(uint16_t*)(ctxt->dsc.dsc_def->arg));
+            protocol_mode = ESP_HID_PROTOCOL_MODE_REPORT;
+            rpt = find_report(report_id, report_type, &protocol_mode);
+            assert(rpt != NULL);
+            rpt->handle = report_handle;
+            /* free the mbuf */
+            os_mbuf_free_chain(om);
+            om = NULL;
+        }
+        break;
+
+    default:
+        assert(0);
+        break;
+    }
+}
+
+static void nimble_host_synced(void) {
+    esp_event_post_to(s_dev->event_loop_handle, ESP_HIDD_EVENTS, ESP_HIDD_START_EVENT, NULL, 0, portMAX_DELAY);
+}
+
+void nimble_host_reset(int reason)
+{
+    MODLOG_DFLT(ERROR, "Resetting state; reason=%d\n", reason);
+}
+
+static struct ble_gap_event_listener nimble_gap_event_listener;
+esp_err_t esp_ble_hidd_dev_init(esp_hidd_dev_t *dev_p, const esp_hid_device_config_t *config, esp_event_handler_t callback)
+{
+    int rc;
+
+    if (s_dev) {
+        ESP_LOGE(TAG, "HID device profile already initialized");
+        return ESP_FAIL;
+    }
+
+    s_dev = (esp_ble_hidd_dev_t *)calloc(1, sizeof(esp_ble_hidd_dev_t));
+    if (s_dev == NULL) {
+        ESP_LOGE(TAG, "HID device could not be allocated");
+        return ESP_FAIL;
+    }
+
+    // Reset the hid device target environment
+    s_dev->control = ESP_HID_CONTROL_EXIT_SUSPEND;
+    s_dev->protocol = ESP_HID_PROTOCOL_MODE_REPORT;
+    s_dev->event_loop_handle = NULL;
+    s_dev->dev = dev_p;
+
+    esp_event_loop_args_t event_task_args = {
+        .queue_size = 5,
+        .task_name = "ble_hidd_events",
+        .task_priority = uxTaskPriorityGet(NULL),
+        .task_stack_size = 2048,
+        .task_core_id = tskNO_AFFINITY
+    };
+    rc = esp_event_loop_create(&event_task_args, &s_dev->event_loop_handle);
+    if (rc != ESP_OK) {
+        ESP_LOGE(TAG, "HID device event loop could not be created");
+        ble_hidd_dev_free();
+        return rc;
+    }
+
+    rc = ble_hid_init_config(s_dev, config);
+    if (rc != ESP_OK) {
+        ble_hidd_dev_free();
+        return rc;
+    }
+
+    dev_p->dev = s_dev;
+    dev_p->connected = nimble_hidd_dev_connected;
+    dev_p->deinit = nimble_hidd_dev_deinit;
+    dev_p->battery_set = nimble_hidd_dev_battery_set;
+    dev_p->input_set = nimble_hidd_dev_input_set;
+    dev_p->feature_set = nimble_hidd_dev_feature_set;
+    dev_p->event_handler_register = nimble_hidd_dev_event_handler_register;
+    dev_p->event_handler_unregister = esp_ble_hidd_dev_event_handler_unregister;
+
+    rc = nimble_hidd_dev_event_handler_register(s_dev, esp_hidd_process_event_data_handler, ESP_EVENT_ANY_ID);
+    if (rc != ESP_OK) {
+        ble_hidd_dev_free();
+        return rc;
+    }
+
+    if (callback != NULL) {
+        rc = nimble_hidd_dev_event_handler_register(s_dev, callback, ESP_EVENT_ANY_ID);
+        if (rc != ESP_OK) {
+            ble_hidd_dev_free();
+            return rc;
+        }
+    }
+
+    ble_hs_cfg.reset_cb = nimble_host_reset;
+    ble_hs_cfg.sync_cb = nimble_host_synced;
+    ble_hs_cfg.gatts_register_cb = nimble_gatt_svr_register_cb;
+    rc = nimble_hid_start_gatts();
+    if(rc != ESP_OK) {
+        return rc;
+    }
+    ble_gap_event_listener_register(&nimble_gap_event_listener,
+                                nimble_hid_gap_event, NULL);
+
+    return rc;
+}
+#endif // CONFIG_BT_NIMBLE_HID_SERVICE

components/esp_hw_support/Kconfig

@@ -141,24 +141,34 @@ menu "Hardware Settings"
                 This option provides a software workaround for this issue. Configure to isolate all
                 GPIO pins in sleep state.
 
-        config ESP_SLEEP_DEEP_SLEEP_WAKEUP_DELAY
-            int "Extra delay in deep sleep wake stub (in us)"
-            depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S3
-            default 2000
+        config ESP_SLEEP_WAIT_FLASH_READY_EXTRA_DELAY
+            int "Extra delay (in us) after flash powerdown sleep wakeup to wait flash ready"
+            default 2000 if IDF_TARGET_ESP32 || IDF_TARGET_ESP32S3
+            default 0
             range 0 5000
             help
-                When the chip exits deep sleep, the CPU and the flash chip are powered on
-                at the same time. CPU will run deep sleep stub first, and then
-                proceed to load code from flash. Some flash chips need sufficient
-                time to pass between power on and first read operation. By default,
-                without any extra delay, this time is approximately 900us, although
+                When the chip exits sleep, the CPU and the flash chip are powered on at the same time.
+                CPU will run rom code (deepsleep) or ram code (lightsleep) first, and then load or execute
+                code from flash.
+
+                Some flash chips need sufficient time to pass between power on and first read operation.
+                By default, without any extra delay, this time is approximately 900us, although
                 some flash chip types need more than that.
 
-                By default extra delay is set to 2000us. When optimizing startup time
+                (!!! Please adjust this value according to the Data Sheet of SPI Flash used in your project.)
+                In Flash Data Sheet, the parameters that define the Flash ready timing after power-up (minimum
+                time from Vcc(min) to CS activeare) usually named tVSL in ELECTRICAL CHARACTERISTICS chapter,
+                and the configuration value here should be:
+                ESP_SLEEP_WAIT_FLASH_READY_EXTRA_DELAY = tVSL - 900
+
+                For esp32 and esp32s3, the default extra delay is set to 2000us. When optimizing startup time
                 for applications which require it, this value may be reduced.
 
-                If you are seeing "flash read err, 1000" message printed to the
-                console after deep sleep reset, try increasing this value.
+                If you are seeing "flash read err, 1000" message printed to the console after deep sleep reset
+                on esp32, or triggered RTC_WDT/LP_WDT after lightsleep wakeup, try increasing this value.
+                (For esp32, the delay will be executed in both deep sleep and light sleep wake up flow.
+                For chips after esp32, the delay will be executed only in light sleep flow, the delay
+                controlled by the EFUSE_FLASH_TPUW in ROM will be executed in deepsleep wake up flow.)
 
         config ESP_SLEEP_CACHE_SAFE_ASSERTION
             bool "Check the cache safety of the sleep wakeup code in sleep process"

components/esp_hw_support/include/esp_private/esp_pau.h

@@ -43,7 +43,7 @@ void pau_regdma_trigger_modem_link_backup(void);
 void pau_regdma_trigger_modem_link_restore(void);
 #endif
 
-#if SOC_PM_RETENTION_HAS_REGDMA_POWER_BUG
+#if SOC_PM_RETENTION_SW_TRIGGER_REGDMA
 /**
  * @brief Set the address of system REGDMA Link in active state
  * @param link_addr linked lists address

components/esp_hw_support/include/esp_private/esp_pmu.h

@@ -291,6 +291,11 @@ void pmu_init(void);
  */
 void pmu_sleep_enable_hp_sleep_sysclk(bool enable);
 
+/**
+ * Get the time overhead used by regdma to work on the retention link during the hardware wake-up process
+ * @return  regdma time cost during hardware wake-up stage in microseconds
+ */
+uint32_t pmu_sleep_get_wakup_retention_cost(void);
 
 #endif //#if SOC_PMU_SUPPORTED
 

components/esp_hw_support/include/esp_private/rtc_clk.h

@@ -44,6 +44,12 @@ void rtc_clk_bbpll_add_consumer(void);
  */
 void rtc_clk_bbpll_remove_consumer(void);
 
+/**
+ * @brief Workaround for C2, S3, C6, H2. Trigger the calibration of PLL. Should be called when the bootloader doesn't provide a good enough PLL accuracy.
+*/
+void rtc_clk_recalib_bbpll(void);
+
+
 #ifdef __cplusplus
 }
 #endif

components/esp_hw_support/include/esp_private/sleep_retention.h

@@ -122,7 +122,7 @@ void sleep_retention_do_extra_retention(bool backup_or_restore);
  */
 uint32_t sleep_retention_get_modules(void);
 
-#if SOC_PM_RETENTION_HAS_REGDMA_POWER_BUG
+#if SOC_PM_RETENTION_SW_TRIGGER_REGDMA
 /**
  * @brief Software trigger REGDMA to do system linked list retention
  *

components/esp_hw_support/port/esp32/Kconfig.rtc

@@ -22,7 +22,7 @@ choice RTC_CLK_SRC
             the internal 150kHz oscillator. It does not require external components.
 
     config RTC_CLK_SRC_INT_RC
-        bool "Internal 150kHz RC oscillator"
+        bool "Internal 150 kHz RC oscillator"
     config RTC_CLK_SRC_EXT_CRYS
         bool "External 32kHz crystal"
         select ESP_SYSTEM_RTC_EXT_XTAL

components/esp_hw_support/port/esp32c2/rtc_clk.c

@@ -126,6 +126,7 @@ static void rtc_clk_bbpll_configure(rtc_xtal_freq_t xtal_freq, int pll_freq)
     clk_ll_bbpll_set_config(pll_freq, xtal_freq);
     /* WAIT CALIBRATION DONE */
     while(!regi2c_ctrl_ll_bbpll_calibration_is_done());
+    esp_rom_delay_us(10);
     /* BBPLL CALIBRATION STOP */
     regi2c_ctrl_ll_bbpll_calibration_stop();
 
@@ -355,6 +356,24 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+void rtc_clk_recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}
+
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/port/esp32c3/Kconfig.hw_support

@@ -40,7 +40,7 @@ config ESP_REV_MIN_FULL
     # MAX Revision
     #
 
-    comment "Maximum Supported ESP32-C3 Revision (Rev v0.99)"
+    comment "Maximum Supported ESP32-C3 Revision (Rev v1.99)"
     # Maximum revision that IDF supports.
     # It can not be changed by user.
     # Only Espressif can change it when a new version will be supported in IDF.
@@ -48,14 +48,9 @@ config ESP_REV_MIN_FULL
 
 config ESP32C3_REV_MAX_FULL
     int
-    default 199 if ESP32C3_REV101_DEVELOPMENT
-    default 99 if !ESP32C3_REV101_DEVELOPMENT
+    default 199
     # keep in sync the "Maximum Supported Revision" description with this value
 
 config ESP_REV_MAX_FULL
     int
     default ESP32C3_REV_MAX_FULL
-
-config ESP32C3_REV101_DEVELOPMENT
-    bool "Develop on ESP32-C3 v1.1 (Preview)"
-    default y if IDF_CI_BUILD

components/esp_hw_support/port/esp32c6/Kconfig.rtc

@@ -5,7 +5,7 @@ choice RTC_CLK_SRC
         Choose which clock is used as RTC clock source.
 
     config RTC_CLK_SRC_INT_RC
-        bool "Internal 136kHz RC oscillator"
+        bool "Internal 150 kHz RC oscillator"
     config RTC_CLK_SRC_EXT_CRYS
         bool "External 32kHz crystal"
         select ESP_SYSTEM_RTC_EXT_XTAL

components/esp_hw_support/port/esp32c6/pmu_sleep.c

@@ -286,3 +286,9 @@ void pmu_sleep_enable_hp_sleep_sysclk(bool enable)
 {
     pmu_ll_hp_set_icg_sysclk_enable(PMU_instance()->hal->dev, HP(SLEEP), enable);
 }
+
+uint32_t pmu_sleep_get_wakup_retention_cost(void)
+{
+    const pmu_sleep_machine_constant_t *mc = (pmu_sleep_machine_constant_t *)PMU_instance()->mc;
+    return mc->hp.regdma_s2a_work_time_us;
+}

components/esp_hw_support/port/esp32c6/private_include/pmu_param.h

@@ -44,6 +44,8 @@ extern "C" {
 #define PMU_HP_XPD_DEEPSLEEP    0
 #define PMU_LP_DRVB_DEEPSLEEP   0
 
+#define PMU_REGDMA_S2A_WORK_TIME_US     480
+
 #define PMU_DBG_ATTEN_DEEPSLEEP_DEFAULT 12
 #define PMU_LP_DBIAS_DEEPSLEEP_0V7      23
 
@@ -456,7 +458,7 @@ typedef struct pmu_sleep_machine_constant {
         .power_supply_wait_time_us      = 2,    \
         .power_up_wait_time_us          = 2,    \
         .regdma_s2m_work_time_us        = 172,  \
-        .regdma_s2a_work_time_us        = 480,  \
+        .regdma_s2a_work_time_us        = PMU_REGDMA_S2A_WORK_TIME_US, \
         .regdma_m2a_work_time_us        = 278,  \
         .regdma_a2s_work_time_us        = 382,  \
         .regdma_rf_on_work_time_us      = 70,   \

components/esp_hw_support/port/esp32c6/rtc_clk.c

@@ -168,6 +168,7 @@ static void rtc_clk_bbpll_configure(rtc_xtal_freq_t xtal_freq, int pll_freq)
     clk_ll_bbpll_set_config(pll_freq, xtal_freq);
     /* WAIT CALIBRATION DONE */
     while(!regi2c_ctrl_ll_bbpll_calibration_is_done());
+    esp_rom_delay_us(10);
     /* BBPLL CALIBRATION STOP */
     regi2c_ctrl_ll_bbpll_calibration_stop();
     rtc_clk_enable_i2c_ana_master_clock(false);
@@ -421,6 +422,25 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+void rtc_clk_recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}
+
+
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/port/esp32h2/Kconfig.rtc

@@ -5,7 +5,7 @@ choice RTC_CLK_SRC
         Choose which clock is used as RTC clock source.
 
     config RTC_CLK_SRC_INT_RC
-        bool "Internal 136kHz RC oscillator"
+        bool "Internal 150 kHz RC oscillator"
     config RTC_CLK_SRC_EXT_CRYS
         bool "External 32kHz crystal"
         select ESP_SYSTEM_RTC_EXT_XTAL

components/esp_hw_support/port/esp32h2/pmu_sleep.c

@@ -24,20 +24,22 @@
 
 void pmu_sleep_enable_regdma_backup(void)
 {
-    /* ESP32H2 does not have PMU HP_AON power domain. because the registers
-     * of PAU REGDMA is included to PMU TOP power domain, cause the contents
-     * of PAU REGDMA registers will be lost when the TOP domain is powered down
-     * during light sleep, so we does not need to enable REGDMA backup here.
-     * We will use the software to trigger REGDMA to backup or restore. */
+    assert(PMU_instance()->hal);
+    /* entry 0, 1, 2 is used by pmu HP_SLEEP and HP_ACTIVE, HP_SLEEP
+        * and HP_MODEM or HP_MODEM and HP_ACTIVE states switching,
+        * respectively. entry 3 is reserved, not used yet! */
+    pmu_hal_hp_set_sleep_active_backup_enable(PMU_instance()->hal);
 }
 
 void pmu_sleep_disable_regdma_backup(void)
 {
+    assert(PMU_instance()->hal);
+    pmu_hal_hp_set_sleep_active_backup_disable(PMU_instance()->hal);
 }
 
 uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_period, uint32_t fastclk_period)
 {
-    const pmu_sleep_machine_constant_t *mc = (pmu_sleep_machine_constant_t *)PMU_instance()->mc;
+    pmu_sleep_machine_constant_t *mc = (pmu_sleep_machine_constant_t *)PMU_instance()->mc;
 
     /* LP core hardware wait time, microsecond */
     const int lp_clk_switch_time_us         = rtc_time_slowclk_to_us(mc->lp.clk_switch_cycle, slowclk_period);
@@ -49,6 +51,11 @@ uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_pe
 
     /* HP core hardware wait time, microsecond */
     const int hp_digital_power_up_wait_time_us = mc->hp.power_supply_wait_time_us + mc->hp.power_up_wait_time_us;
+    if (pd_flags & PMU_SLEEP_PD_TOP) {
+        mc->hp.regdma_s2a_work_time_us = PMU_REGDMA_S2A_WORK_TIME_PD_TOP_US;
+    } else {
+        mc->hp.regdma_s2a_work_time_us = PMU_REGDMA_S2A_WORK_TIME_PU_TOP_US;
+    }
     const int hp_regdma_wait_time_us = mc->hp.regdma_s2a_work_time_us;
     const int hp_clock_wait_time_us = mc->hp.xtal_wait_stable_time_us + mc->hp.pll_wait_stable_time_us;
 
@@ -228,3 +235,9 @@ bool pmu_sleep_finish(void)
 {
     return pmu_ll_hp_is_sleep_reject(PMU_instance()->hal->dev);
 }
+
+uint32_t pmu_sleep_get_wakup_retention_cost(void)
+{
+    const pmu_sleep_machine_constant_t *mc = (pmu_sleep_machine_constant_t *)PMU_instance()->mc;
+    return mc->hp.regdma_s2a_work_time_us;
+}

components/esp_hw_support/port/esp32h2/private_include/pmu_param.h

@@ -41,6 +41,10 @@ extern "C" {
 #define PMU_HP_DBIAS_LIGHTSLEEP_0V6 1
 #define PMU_LP_DBIAS_LIGHTSLEEP_0V7 6
 
+#define PMU_REGDMA_S2A_WORK_TIME_PD_TOP_US     0
+// The current value of this depends on the restoration time overhead of the longest chain in regdma
+#define PMU_REGDMA_S2A_WORK_TIME_PU_TOP_US     390
+
 // FOR DEEPSLEEP
 #define PMU_HP_XPD_DEEPSLEEP    0
 #define PMU_LP_DRVB_DEEPSLEEP   7
@@ -438,7 +442,7 @@ typedef struct pmu_sleep_machine_constant {
         .analog_wait_time_us            = 154,  \
         .power_supply_wait_time_us      = 2,    \
         .power_up_wait_time_us          = 2,    \
-        .regdma_s2a_work_time_us        = 0,    \
+        .regdma_s2a_work_time_us        = PMU_REGDMA_S2A_WORK_TIME_PD_TOP_US, \
         .regdma_a2s_work_time_us        = 0,    \
         .xtal_wait_stable_time_us       = 250,  \
         .pll_wait_stable_time_us        = 1     \

components/esp_hw_support/port/esp32h2/rtc_clk.c

@@ -185,6 +185,7 @@ static void rtc_clk_bbpll_configure(rtc_xtal_freq_t xtal_freq, int pll_freq)
     clk_ll_bbpll_set_config(pll_freq, xtal_freq);
     /* WAIT CALIBRATION DONE */
     while(!regi2c_ctrl_ll_bbpll_calibration_is_done());
+    esp_rom_delay_us(10);
     /* BBPLL CALIBRATION STOP */
     regi2c_ctrl_ll_bbpll_calibration_stop();
     rtc_clk_enable_i2c_ana_master_clock(false);
@@ -474,3 +475,21 @@ bool rtc_dig_8m_enabled(void)
 {
     return clk_ll_rc_fast_digi_is_enabled();
 }
+
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+void rtc_clk_recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue. Flash_PLL comes from the same source as PLL.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL || old_config.source == SOC_CPU_CLK_SRC_FLASH_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}

components/esp_hw_support/port/esp32p4/Kconfig.rtc

@@ -7,7 +7,7 @@ choice RTC_CLK_SRC
         Choose which clock is used as RTC clock source.
 
     config RTC_CLK_SRC_INT_RC
-        bool "Internal 136kHz RC oscillator"
+        bool "Internal 150 kHz RC oscillator"
     config RTC_CLK_SRC_EXT_CRYS
         bool "External 32kHz crystal"
         select ESP_SYSTEM_RTC_EXT_XTAL

components/esp_hw_support/port/esp32s3/rtc_clk.c

@@ -172,6 +172,7 @@ static void rtc_clk_bbpll_configure(rtc_xtal_freq_t xtal_freq, int pll_freq)
     clk_ll_bbpll_set_config(pll_freq, xtal_freq);
     /* WAIT CALIBRATION DONE */
     while(!regi2c_ctrl_ll_bbpll_calibration_is_done());
+    esp_rom_delay_us(10);
     /* BBPLL CALIBRATION STOP */
     regi2c_ctrl_ll_bbpll_calibration_stop();
 
@@ -459,6 +460,25 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+void rtc_clk_recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}
+
+
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/port/pau_regdma.c

@@ -62,7 +62,7 @@ void pau_regdma_trigger_modem_link_restore(void)
 }
 #endif
 
-#if SOC_PM_RETENTION_HAS_REGDMA_POWER_BUG
+#if SOC_PM_RETENTION_SW_TRIGGER_REGDMA
 void IRAM_ATTR pau_regdma_set_system_link_addr(void *link_addr)
 {
     /* ESP32H2 use software to trigger REGDMA to restore instead of PMU,
@@ -88,18 +88,18 @@ void IRAM_ATTR pau_regdma_trigger_system_link_restore(void)
 }
 #endif
 
-void pau_regdma_set_extra_link_addr(void *link_addr)
+void IRAM_ATTR pau_regdma_set_extra_link_addr(void *link_addr)
 {
     pau_hal_set_regdma_extra_link_addr(PAU_instance()->hal, link_addr);
 }
 
-void pau_regdma_trigger_extra_link_backup(void)
+void IRAM_ATTR pau_regdma_trigger_extra_link_backup(void)
 {
     pau_hal_start_regdma_extra_link(PAU_instance()->hal, true);
     pau_hal_stop_regdma_extra_link(PAU_instance()->hal);
 }
 
-void pau_regdma_trigger_extra_link_restore(void)
+void IRAM_ATTR pau_regdma_trigger_extra_link_restore(void)
 {
     pau_hal_start_regdma_extra_link(PAU_instance()->hal, false);
     pau_hal_stop_regdma_extra_link(PAU_instance()->hal);

components/esp_hw_support/sdkconfig.rename.esp32

@@ -21,7 +21,8 @@ CONFIG_SPIRAM_SUPPORT                                   CONFIG_SPIRAM
 CONFIG_ESP32_SPIRAM_SUPPORT                             CONFIG_SPIRAM
 CONFIG_WIFI_LWIP_ALLOCATION_FROM_SPIRAM_FIRST           CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP
 
-CONFIG_ESP32_DEEP_SLEEP_WAKEUP_DELAY                    CONFIG_ESP_SLEEP_DEEP_SLEEP_WAKEUP_DELAY
+CONFIG_ESP32_DEEP_SLEEP_WAKEUP_DELAY                    CONFIG_ESP_SLEEP_WAIT_FLASH_READY_EXTRA_DELAY
+CONFIG_ESP_SLEEP_DEEP_SLEEP_WAKEUP_DELAY                CONFIG_ESP_SLEEP_WAIT_FLASH_READY_EXTRA_DELAY
 
 CONFIG_ESP32_XTAL_FREQ_26                               CONFIG_XTAL_FREQ_26
 CONFIG_ESP32_XTAL_FREQ_40                               CONFIG_XTAL_FREQ_40