change(version): Update version to 5.3.4

feat(mbedtls): Add support for RSA decryption with DS peripheral (v5.3)

See merge request espressif/esp-idf!40451

.codespellrc

@@ -1,4 +1,4 @@
 [codespell]
 skip = build,*.yuv,components/fatfs/src/*,alice.txt,*.rgb,components/wpa_supplicant/*,components/esp_wifi/*
-ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,ot,wel,parms
+ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,ot,wel,parms,ehen
 write-changes = true

.github/workflows/docker.yml

@@ -60,7 +60,9 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Set up QEMU for multiarch builds
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0-28
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: Build and push

.github/workflows/release_zips.yml

@@ -8,10 +8,11 @@ on:
 jobs:
   release_zips:
     name: Create release zip file
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Create a recursive clone source zip
-        uses: espressif/github-actions/release_zips@master
-        env:
-            RELEASE_PROJECT_NAME: ESP-IDF
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: espressif/release-zips-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_project_name: ESP-IDF
+          git_extra_args: --shallow-since="1 year ago"

.gitlab/ci/build.yml

@@ -219,7 +219,7 @@ pytest_build_system_macos:
     PYENV_VERSION: "3.8"
     # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
     CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
-    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
+
 build_docker:
   extends:
     - .before_script:minimal

.gitlab/ci/common.yml

@@ -6,9 +6,9 @@ stages:
   - pre_check
   - build
   - assign_test
+  - build_doc
   - target_test
   - host_test
-  - build_doc
   - test_deploy
   - deploy
   - post_deploy
@@ -39,7 +39,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.3.2
+  LATEST_GIT_TAG: v5.3.4
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules
@@ -177,13 +177,21 @@ variables:
   fi
 
   # Custom OpenOCD
-  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
+  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
+    machine="$(uname -m)"
+    if [[ "$machine" == "armv7l" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
+    elif [[ "$machine" == "aarch64" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
+    fi
+    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
+      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+      wget $OOCD_DISTRO_URL
+      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+      tar -x -f $ARCH_NAME
+      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+      export PATH=$PWD/openocd-esp32/bin:$PATH
+    fi
   fi
 
   if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then

.gitlab/ci/deploy.yml

@@ -19,6 +19,7 @@ check_submodule_sync:
   dependencies: []
   script:
     - git submodule deinit --force .
+    - rm -rf .git/modules  # remove all the cached metadata
     # setting the default remote URL to the public one, to resolve relative location URLs
     - git config remote.origin.url ${PUBLIC_IDF_URL}
     # check if all submodules are correctly synced to public repository

.gitlab/ci/docs.yml

@@ -37,25 +37,16 @@
 .if-dev-push: &if-dev-push
   if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
 
-.if-schedule: &if-schedule
-  if: '$CI_PIPELINE_SOURCE == "schedule"'
-
 .doc-rules:build:docs-full:
   rules:
     - <<: *if-qa-test-tag
       when: never
-    - <<: *if-schedule
+    - <<: *if-protected
     - <<: *if-label-build_docs
     - <<: *if-label-docs_full
     - <<: *if-dev-push
       changes: *patterns-docs-full
 
-.doc-rules:build:docs-full-prod:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-
 .doc-rules:build:docs-partial:
   rules:
     - <<: *if-qa-test-tag
@@ -92,13 +83,14 @@ check_docs_lang_sync:
   stage: build_doc
   tags:
     - build_docs
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
   script:
     - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
     - cd docs
     - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
-  artifacts:
-    expire_in: 4 days
-    when: always
   parallel:
     matrix:
       - DOCLANG: ["en", "zh_CN"]
@@ -119,26 +111,12 @@ build_docs_html_full:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    paths:
-      - docs/_build/*/*/*.txt
-      - docs/_build/*/*/html/*
-  variables:
-    DOC_BUILDERS: "html"
-
-build_docs_html_full_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/html/*
+    expire_in: 4 days
   variables:
     DOC_BUILDERS: "html"
 
@@ -146,14 +124,12 @@ build_docs_html_partial:
   extends:
     - .build_docs_template
     - .doc-rules:build:docs-partial
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/html/*
+    expire_in: 4 days
   variables:
     DOC_BUILDERS: "html"
   parallel:
@@ -163,43 +139,21 @@ build_docs_html_partial:
       - DOCLANG: "zh_CN"
         DOCTGT: "esp32p4"
 
-build_docs_pdf:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
-build_docs_pdf_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
 .deploy_docs_template:
   image: $ESP_IDF_DOC_ENV_IMAGE
   variables:
     DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
     PYTHONUNBUFFERED: 1
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 0
   stage: test_deploy
   tags:
     - deploy
     - shiny
   script:
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    - git fetch --tags --prune
     - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
     - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
     - deploy-docs
@@ -218,8 +172,6 @@ deploy_docs_preview:
       optional: true
     - job: build_docs_html_full
       optional: true
-    - job: build_docs_pdf
-      optional: true
   variables:
     TYPE: "preview"
     # older branches use DOCS_DEPLOY_KEY, DOCS_SERVER, DOCS_SERVER_USER, DOCS_PATH for preview server so we keep these names for 'preview'
@@ -234,12 +186,12 @@ deploy_docs_production:
   # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
   extends:
     - .deploy_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   dependencies:  # set dependencies to null to avoid missing artifacts issue
   needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full_prod
-    - build_docs_pdf_prod
+    - build_docs_html_full
     - job: push_to_github
       artifacts: false
   variables:
@@ -249,21 +201,23 @@ deploy_docs_production:
     DOCS_DEPLOY_SERVER_USER: "$DOCS_PROD_SERVER_USER"
     DOCS_DEPLOY_PATH: "$DOCS_PROD_PATH"
     DOCS_DEPLOY_URL_BASE: "https://docs.espressif.com/projects/esp-idf"
-    DEPLOY_STABLE: 1
 
 check_doc_links:
   extends:
     - .build_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
   stage: post_deploy
   needs:
     - job: deploy_docs_production
       artifacts: false
   tags: ["build", "amd64", "internet"]
   artifacts:
+    when: always
     paths:
       - docs/_build/*/*/*.txt
       - docs/_build/*/*/linkcheck/*.txt
+    expire_in: 1 week
   allow_failure: true
   script:
     - cd docs

.gitlab/ci/host-test.yml

@@ -133,7 +133,8 @@ test_cli_installer:
   script:
     # Tools must be downloaded for testing
     # We could use "idf_tools.py download all", but we don't want to install clang because of its huge size
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                      cmake@version that is supported
+    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}/tools/test_idf_tools
     - python3 -m pip install jsonschema
     - python3 ./test_idf_tools.py -v
@@ -364,3 +365,17 @@ test_idf_pytest_plugin:
   script:
     - cd tools/ci/idf_pytest
     - pytest --junitxml=${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+
+test_nvs_gen_check:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+      - components/nvs_flash/nvs_partition_tool
+    reports:
+      junit: XUNIT_RESULT.xml
+  variables:
+    LC_ALL: C.UTF-8
+  script:
+    - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
+    - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml

.gitlab/ci/pre_check.yml

@@ -160,6 +160,8 @@ pipeline_variables:
       if [ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]; then
         echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
       fi
+    - echo "OOCD_DISTRO_URL_ARMHF=$OOCD_DISTRO_URL_ARMHF" >> pipeline.env
+    - echo "OOCD_DISTRO_URL_ARM64=$OOCD_DISTRO_URL_ARM64" >> pipeline.env
     - cat pipeline.env
     - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
   artifacts:

.gitlab/ci/test-win.yml

@@ -31,7 +31,8 @@ test_cli_installer_win:
     IDF_PATH: "$CI_PROJECT_DIR"
   script:
     # Tools must be downloaded for testing
-    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                     cmake@version that is supported
+    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}\tools\test_idf_tools
     - python -m pip install jsonschema
     - python .\test_idf_tools.py

.gitmodules

@@ -54,8 +54,10 @@
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-hash = 8f2beb57ddad1f94bed899790b00f46df893ccac
 	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
+	sbom-cve-exclude-list = CVE-2023-26819 Resolved in commit a328d65ad490b64da8c87523cbbfe16050ba5bf6
+	sbom-cve-exclude-list = CVE-2023-53154 Resolved in v1.7.18
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls

.pre-commit-config.yaml

@@ -70,11 +70,6 @@ repos:
         language: python
         pass_filenames: false
         always_run: true
-      - id: check-deprecated-kconfigs-options
-        name: Check if any Kconfig Options Deprecated
-        entry: tools/ci/check_deprecated_kconfigs.py
-        language: python
-        files: 'sdkconfig\.ci$|sdkconfig\.rename$|sdkconfig.*$'
       - id: cmake-lint
         name: Check CMake Files Format
         entry: cmakelint --linelength=120 --spaces=4 --filter=-whitespace/indent
@@ -154,7 +149,7 @@ repos:
         require_serial: true
         additional_dependencies:
           - PyYAML == 5.3.1
-          - idf-build-apps~=2.0
+          - idf-build-apps~=2.5
       - id: sort-yaml-files
         name: sort yaml files
         entry: tools/ci/sort_yaml.py
@@ -236,6 +231,7 @@ repos:
         name: Lint rST files in docs folder using Sphinx Lint
         files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
   - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.3.0
+    rev: v2.5.0
     hooks:
       - id: check-kconfig-files
+      - id: check-deprecated-kconfig-options

CMakeLists.txt

@@ -152,6 +152,10 @@ if(CONFIG_COMPILER_DUMP_RTL_FILES)
     list(APPEND compile_options "-fdump-rtl-expand")
 endif()
 
+idf_build_set_property(GDBINIT_FILES_PREFIX_MAP "${BUILD_DIR}/gdbinit/prefix_map")
+file(MAKE_DIRECTORY "${BUILD_DIR}/gdbinit")
+file(WRITE "${BUILD_DIR}/gdbinit/prefix_map" "")
+
 if(NOT ${CMAKE_C_COMPILER_VERSION} VERSION_LESS 8.0.0)
     if(CONFIG_COMPILER_HIDE_PATHS_MACROS)
         list(APPEND compile_options "-fmacro-prefix-map=${CMAKE_SOURCE_DIR}=.")

Kconfig

@@ -655,5 +655,4 @@ mainmenu "Espressif IoT Development Framework Configuration"
             - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
             - CONFIG_ESP_WIFI_EAP_TLS1_3
             - CONFIG_ESP_WIFI_ENABLE_ROAMING_APP
-            - CONFIG_USB_HOST_EXT_PORT_SUPPORT_LS
             - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS

components/app_trace/app_trace_membufs_proto.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -92,7 +92,7 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
     // switch to new block
     proto->state.in_block++;
 
-    proto->hw->swap(new_block_num);
+    proto->hw->swap(new_block_num, proto->state.markers[prev_block_num]);
 
     // handle data from host
     esp_hostdata_hdr_t *hdr = (esp_hostdata_hdr_t *)proto->blocks[new_block_num].start;
@@ -148,6 +148,18 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
         if (res != ESP_OK) {
             break;
         }
+#if CONFIG_IDF_TARGET_ESP32S3
+        /*
+        * ESP32S3 has a serious data corruption issue with the transferred data to host.
+        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
+        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
+        * the current thread continues execution. While this doesn't completely prevent
+        * memory access from other threads/cores/ISRs, it has shown to significantly improve
+        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
+        * number of retries needed to read an entire block without corruption.
+        */
+        esp_rom_delay_us(100);
+#endif
     }
     return res;
 }
@@ -339,7 +351,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
     esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
     // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
     // higher prio tasks and the latter can not allocate buffers at all
     // this is abnormal situation can be detected on host which will receive only uncompleted buffers

components/app_trace/port/riscv/port.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -50,14 +50,20 @@ static uint8_t *esp_apptrace_riscv_down_buffer_get(esp_apptrace_riscv_data_t *hw
 static esp_err_t esp_apptrace_riscv_down_buffer_put(esp_apptrace_riscv_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_riscv_host_is_connected(esp_apptrace_riscv_data_t *hw_data);
 static esp_err_t esp_apptrace_riscv_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_riscv_host_data_pending(void);
 
 
 const static char *TAG = "esp_apptrace";
 
-static esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];
+#if SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE
+#define APPTRACE_DRAM_ATTR TCM_DRAM_ATTR
+#else
+#define APPTRACE_DRAM_ATTR
+#endif
+
+static APPTRACE_DRAM_ATTR esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];
 
 esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 {
@@ -92,7 +98,7 @@ esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 }
 
 /* Advertises apptrace control block address to host.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
    e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_addr)
 {
@@ -103,7 +109,7 @@ __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_add
 }
 
 /* Returns up buffers config.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
    e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) void esp_apptrace_get_up_buffers(esp_apptrace_mem_block_t mem_blocks_cfg[2])
 {
@@ -165,7 +171,7 @@ static esp_err_t esp_apptrace_riscv_init(esp_apptrace_riscv_data_t *hw_data)
     }
     // notify host about control block address
     int res = esp_apptrace_advertise_ctrl_block(&s_tracing_ctrl[core_id]);
-    assert(res == 0 && "Falied to send config to host!");
+    assert(res == 0 && "Failed to send config to host!");
 
     return ESP_OK;
 }
@@ -347,7 +353,7 @@ static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint3
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
     /* do nothing */
     return ESP_OK;

components/app_trace/port/xtensa/port.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -12,7 +12,7 @@
 // ======================
 
 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================
 
-// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,9 +55,15 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//   See 'Targets Connection' setion for details.
+//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//    See 'Targets Connection' section for details.
+//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
+//    The register has the following format:
+//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
+//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
+//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
+//    This allows the host to verify data integrity of the received trace data.
 
 // 3. Modes of operation
 // =====================
@@ -127,7 +133,7 @@
 
 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -142,9 +148,9 @@
 
 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When wating on trace data lock.
+// - Trace data are locked by another task/ISR. When waiting on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -159,11 +165,15 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "esp_rom_crc.h"
 
 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
+#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
+
+#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)
 
 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -198,7 +208,7 @@ static uint8_t *esp_apptrace_trax_down_buffer_get(esp_apptrace_trax_data_t *hw_d
 static esp_err_t esp_apptrace_trax_down_buffer_put(esp_apptrace_trax_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_trax_host_is_connected(esp_apptrace_trax_data_t *hw_data);
 static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_trax_host_data_pending(void);
 
@@ -498,7 +508,8 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
         uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
         uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
         if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32, esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
+                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                 curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
             res = ESP_ERR_NO_MEM;
             goto _on_err;
@@ -514,14 +525,22 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
     uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
     uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
+
     eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
               host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
     esp_apptrace_trax_buffer_swap_unlock();
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
+    /* Before switching to the new block, calculate CRC16 of the current block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
     esp_apptrace_trax_select_memory_block(new_block_id);
     return ESP_OK;
 }

components/app_trace/private_include/esp_app_trace_membufs_proto.h

@@ -29,7 +29,7 @@ typedef struct {
 
 typedef struct {
     esp_err_t (*swap_start)(uint32_t curr_block_id);
-    esp_err_t (*swap)(uint32_t new_block_id);
+    esp_err_t (*swap)(uint32_t new_block_id, uint32_t prev_block_len);
     esp_err_t (*swap_end)(uint32_t new_block_id, uint32_t prev_block_len);
     bool (*host_data_pending)(void);
 } esp_apptrace_membufs_proto_hw_t;

components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c

@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-static U64 _cbGetTime(void) {
+__attribute__((unused)) static U64 _cbGetTime(void) {
   U64 Time;
 
   Time = xTaskGetTickCountFromISR();
@@ -260,7 +260,10 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  _cbGetTime,
+  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
+     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
+     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
+  NULL,
   _cbSendTaskList,
 };
 

components/app_trace/sys_view/ext/heap_trace_module.c

@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif
 
 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
     .NumEvents = 2,
 };
 

components/app_update/esp_ota_ops.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -41,6 +41,7 @@ typedef struct ota_ops_entry_ {
     bool need_erase;
     uint32_t wrote_size;
     uint8_t partial_bytes;
+    bool ota_resumption;
     WORD_ALIGNED_ATTR uint8_t partial_data[16];
     LIST_ENTRY(ota_ops_entry_) entries;
 } ota_ops_entry_t;
@@ -111,6 +112,22 @@ static esp_ota_img_states_t set_new_state_otadata(void)
 #endif
 }
 
+static ota_ops_entry_t* esp_ota_init_entry(const esp_partition_t *partition)
+{
+    ota_ops_entry_t *new_entry = (ota_ops_entry_t *) calloc(1, sizeof(ota_ops_entry_t));
+    if (new_entry == NULL) {
+        return NULL;
+    }
+
+    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
+
+    new_entry->part = partition;
+    new_entry->handle = ++s_ota_ops_last_handle;
+
+    return new_entry;
+}
+
+
 esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp_ota_handle_t *out_handle)
 {
     ota_ops_entry_t *new_entry;
@@ -144,6 +161,13 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
     }
 #endif
 
+    new_entry = esp_ota_init_entry(partition);
+    if (new_entry == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    *out_handle = new_entry->handle;
+
     if (image_size != OTA_WITH_SEQUENTIAL_WRITES) {
         // If input image size is 0 or OTA_SIZE_UNKNOWN, erase entire partition
         if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
@@ -157,16 +181,44 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
         }
     }
 
-    new_entry = (ota_ops_entry_t *) calloc(sizeof(ota_ops_entry_t), 1);
+    return ESP_OK;
+}
+
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle)
+{
+    ota_ops_entry_t *new_entry;
+
+    if ((partition == NULL) || (out_handle == NULL)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (image_offset > partition->size) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    partition = esp_partition_verify(partition);
+    if (partition == NULL) {
+        return ESP_ERR_NOT_FOUND;
+    }
+
+    // The staging partition cannot be of type Factory, but the final partition can be.
+    if (!is_ota_partition(partition)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    const esp_partition_t* running_partition = esp_ota_get_running_partition();
+    if (partition == running_partition) {
+        return ESP_ERR_OTA_PARTITION_CONFLICT;
+    }
+
+    new_entry = esp_ota_init_entry(partition);
     if (new_entry == NULL) {
         return ESP_ERR_NO_MEM;
     }
 
-    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
-
-    new_entry->part = partition;
-    new_entry->handle = ++s_ota_ops_last_handle;
-    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    new_entry->ota_resumption = true;
+    new_entry->wrote_size = image_offset;
+    new_entry->need_erase = (erase_size == OTA_WITH_SEQUENTIAL_WRITES);
     *out_handle = new_entry->handle;
     return ESP_OK;
 }

components/app_update/include/esp_ota_ops.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -99,6 +99,32 @@ int esp_ota_get_app_elf_sha256(char* dst, size_t size) __attribute__((deprecated
  */
 esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp_ota_handle_t* out_handle);
 
+/**
+ * @brief   Resume an interrupted OTA update by continuing to write to the specified partition.
+ *
+ * This function is used when an OTA update was previously started and needs to be resumed after an interruption.
+ * It continues the OTA process from the specified offset within the partition.
+ *
+ * Unlike esp_ota_begin(), this function does not erase the partition which receives the OTA update, but rather expects that part of the image
+ * has already been written correctly, and it resumes writing from the given offset.
+ *
+ * @param partition Pointer to info for the partition which is receiving the OTA update. Required.
+ * @param erase_size Specifies how much flash memory to erase before resuming OTA, depending on whether a sequential write or a bulk erase is being used.
+ * @param image_offset Offset from where to resume the OTA process. Should be set to the number of bytes already written.
+ * @param out_handle On success, returns a handle that should be used for subsequent esp_ota_write() and esp_ota_end() calls.
+ *
+ * @return
+ *    - ESP_OK: OTA operation resumed successfully.
+ *    - ESP_ERR_INVALID_ARG: partition, out_handle were NULL or image_offset arguments is negative, or partition doesn't point to an OTA app partition.
+ *    - ESP_ERR_NO_MEM: Cannot allocate memory for OTA operation.
+ *    - ESP_ERR_OTA_PARTITION_CONFLICT: Partition holds the currently running firmware, cannot update in place.
+ *    - ESP_ERR_NOT_FOUND: Partition argument not found in partition table.
+ *    - ESP_ERR_OTA_SELECT_INFO_INVALID: The OTA data partition contains invalid data.
+ *    - ESP_ERR_INVALID_SIZE: Partition doesn't fit in configured flash size.
+ *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
+ */
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle);
+
 /**
  * @brief   Write OTA update data to partition
  *

components/app_update/test_apps/.build-test-rules.yml

@@ -1,7 +0,0 @@
-# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
-
-components/app_update/test_apps:
-  disable:
-    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32c5"]
-      temporary: true
-      reason: target esp32c6, esp32h2 esp32c5 is not supported yet # TODO: [ESP32C5] IDF-8638

components/app_update/test_apps/pytest_app_update_ut.py

@@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
-# SPDX-License-Identifier: Unlicense OR CC0-1.0
-import re
-
-import pytest
-from pytest_embedded import Dut
-
-DEFAULT_TIMEOUT = 20
-TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
-
-
-def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
-    for stage in range(1, stages + 1):
-        dut.write(str(test_case_num))
-        dut.expect(TEST_SUBMENU_PATTERN_PYTEST, timeout=DEFAULT_TIMEOUT)
-        dut.write(str(stage))
-        if stage != stages:
-            dut.expect_exact('Press ENTER to see the list of tests.')
-
-
-@pytest.mark.supported_targets
-@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
-@pytest.mark.generic
-def test_app_update(dut: Dut) -> None:
-    extra_data = dut.parse_test_menu()
-    for test_case in extra_data:
-        if test_case.type != 'multi_stage':
-            dut.write(str(test_case.index))
-        else:
-            run_multiple_stages(dut, test_case.index, len(test_case.subcases))
-        dut.expect_unity_test_output(timeout=90)
-        dut.expect_exact("Enter next test, or 'enter' to see menu")

components/app_update/test_apps/test_app_update/.build-test-rules.yml

@@ -0,0 +1,12 @@
+# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
+
+components/app_update/test_apps:
+  enable:
+    - if: CONFIG_NAME == "defaults" and IDF_TARGET != "linux"
+    - if: CONFIG_NAME == "xip_psram" and IDF_TARGET in ["esp32s2", "esp32s3", "esp32p4"]
+    # S2 doesn't have ROM for flash
+    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and IDF_TARGET in ["esp32s3", "esp32p4"]
+  disable:
+    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32c5", "esp32c61"]
+      temporary: true
+      reason: target esp32c6, esp32h2 esp32c5 is not supported yet # TODO: [ESP32C5] IDF-8638

components/app_update/test_apps/test_app_update/main/CMakeLists.txt

@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
                        PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
                       WHOLE_ARCHIVE)

components/app_update/test_apps/test_app_update/main/test_ota_ops.c

@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@@ -113,3 +114,11 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
     };
     TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
+
+TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
+{
+    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
+    const esp_partition_t* part = esp_ota_get_running_partition();
+    ESP_LOGI("running bin", "0x%p", (void*)part->address);
+    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
+}

components/app_update/test_apps/test_app_update/main/test_switch_ota.c

@@ -842,7 +842,7 @@ static void test_flow6(void)
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
 
 //IDF-5145
-TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
 {
     const esp_partition_t *cur_app = esp_ota_get_running_partition();
     ESP_LOGI(TAG, "copy current app to next part");

components/app_update/test_apps/test_app_update/pytest_app_update_ut.py

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import re
+
+import pytest
+from pytest_embedded import Dut
+
+DEFAULT_TIMEOUT = 20
+TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'defaults',
+    ],
+    indirect=True,
+)
+def test_app_update(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram_with_rom_impl',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)

components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults

@@ -0,0 +1,2 @@
+# don't delete.
+# used for CI to compile a default config when 'sdkconfig.ci.xxxx' is exist

components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram

@@ -0,0 +1,2 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_XIP_FROM_PSRAM=y

components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl

@@ -0,0 +1,3 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_XIP_FROM_PSRAM=y
+CONFIG_SPI_FLASH_ROM_IMPL=y

components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3

@@ -0,0 +1,2 @@
+CONFIG_IDF_TARGET="esp32s3"
+CONFIG_BOOTLOADER_NUM_PIN_APP_TEST=18

components/bootloader/Kconfig.projbuild

@@ -801,6 +801,33 @@ menu "Security features"
             This can lead to permanent bricking of the device, in case all keys are revoked
             because of signature verification failure.
 
+    config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+        bool "Do not disable the ability to further read protect eFuses"
+        depends on SECURE_BOOT_V2_ENABLED
+        default n
+        help
+            If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
+            efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
+
+            If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
+            Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+            BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the secure boot public key digest,
+            causing an immediate denial of service and possibly allowing an additional fault injection attack to
+            bypass the signature protection.
+
+            The option must be set when you need to program any read-protected key type into the efuses,
+            e.g., HMAC, ECDSA etc. after secure boot has already been enabled on the device.
+            Please refer to secure boot V2 documentation guide for more details.
+
+            NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+            NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+            "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+            then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+            However, efuse can be read/written from the application
+
+            Please refer to the Secure Boot V2 documentation guide for more information.
+
     config SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT
         bool "Flash bootloader along with other artifacts when using the default flash command"
         depends on SECURE_BOOT_V2_ENABLED && SECURE_BOOT_BUILD_SIGNED_BINARIES
@@ -981,26 +1008,6 @@ menu "Security features"
                 image to this length. It is generally not recommended to set this option, unless you have a legacy
                 partitioning scheme which doesn't support 64KB aligned partition lengths.
 
-        config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
-            bool "Allow additional read protecting of efuses"
-            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
-            help
-                If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
-                efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
-
-                If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
-                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
-                immediate denial of service and possibly allowing an additional fault injection attack to
-                bypass the signature protection.
-
-                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
-
-                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
-                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
-                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
-                However, efuse can be read/written from the application
-
         config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
             bool "Leave unused digest slots available (not revoke)"
             depends on SECURE_BOOT_INSECURE && SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -1131,6 +1138,44 @@ menu "Security features"
 
             If not set, the app does not care if the flash encryption eFuse bit is set or not.
 
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
     config SECURE_ROM_DL_MODE_ENABLED
         bool
         default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
@@ -1182,7 +1227,7 @@ menu "Security features"
                 It is also possible to enable secure download mode at runtime by calling
                 esp_efuse_enable_rom_secure_download_mode()
 
-                Note: Secure Download mode is not available for ESP32 (includes revisions till ECO3).
+                Note: Secure Download mode is not available for ESP32.
 
         config SECURE_INSECURE_ALLOW_DL_MODE
             bool "UART ROM download mode (Enabled (not recommended))"

components/bootloader_support/CMakeLists.txt

@@ -36,6 +36,10 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
         )
 endif()
 
+if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
+    list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
+endif()
+
 if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
     set(include_dirs "include" "bootloader_flash/include"
         "private_include")
@@ -50,10 +54,6 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
     "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
     )
     list(APPEND priv_requires hal)
-    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
-        list(APPEND srcs
-            "src/${IDF_TARGET}/bootloader_ecdsa.c")
-    endif()
 else()
     list(APPEND srcs
         "src/idf/bootloader_sha.c")

components/bootloader_support/include/bootloader_memory_utils.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2010-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2010-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -28,7 +28,21 @@ extern "C" {
  */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    return ((SOC_DRAM_LOW == SOC_IRAM_LOW) && (SOC_DRAM_HIGH == SOC_IRAM_HIGH));
+}
+
+/**
+ * @brief Check if the RTC IRAM and RTC DRAM are separate or using the same memory space
+ *
+ * @return true if the RTC DRAM and RTC IRAM are sharing the same memory space, false otherwise
+ */
+__attribute__((always_inline))
+inline static bool esp_rtc_dram_match_rtc_iram(void) {
+#if SOC_RTC_FAST_MEM_SUPPORTED
+    return ((SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW) && (SOC_RTC_IRAM_HIGH == SOC_RTC_DRAM_HIGH));
+#else
+    return false;
+#endif
 }
 
 /**
@@ -82,6 +96,7 @@ __attribute__((always_inline))
 inline static bool esp_ptr_in_diram_iram(const void *p) {
 // TODO: IDF-5980 esp32c6 D/I RAM share the same address
 #if SOC_DIRAM_IRAM_LOW == SOC_DIRAM_DRAM_LOW
+    (void)p;
     return false;
 #else
     return ((intptr_t)p >= SOC_DIRAM_IRAM_LOW && (intptr_t)p < SOC_DIRAM_IRAM_HIGH);
@@ -100,6 +115,7 @@ inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
     return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
+    (void)p;
     return false;
 #endif
 }
@@ -116,6 +132,7 @@ inline static bool esp_ptr_in_rtc_dram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
     return ((intptr_t)p >= SOC_RTC_DRAM_LOW && (intptr_t)p < SOC_RTC_DRAM_HIGH);
 #else
+    (void)p;
     return false;
 #endif
 }
@@ -151,6 +168,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }
 
+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM
 
    - Address must be word aligned

components/bootloader_support/src/bootloader_common_loader.c

@@ -28,6 +28,7 @@
 
 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
 #define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
 static const char* TAG = "boot_comm";
 
@@ -242,7 +243,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
     #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
     static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
     return s_bootloader_retain_mem;

components/bootloader_support/src/esp32h2/bootloader_esp32h2.c

@@ -91,6 +91,8 @@ static inline void bootloader_hardware_init(void)
     SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_FORCE_RFPLL);
     /* Enable analog i2c master clock */
     SET_PERI_REG_MASK(MODEM_LPCON_CLK_CONF_REG, MODEM_LPCON_CLK_I2C_MST_EN);
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }
 
 static inline void bootloader_ana_reset_config(void)
@@ -160,7 +162,7 @@ esp_err_t bootloader_init(void)
     }
 #endif // !CONFIG_APP_BUILD_TYPE_RAM
 
-    // check whether a WDT reset happend
+    // check whether a WDT reset happened
     bootloader_check_wdt_reset();
     // config WDT
     bootloader_config_wdt();

components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c

@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"
 
 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
 
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
 
+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
     // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
     // otherwise the Flash Encryption key cannot be read protected

components/bootloader_support/src/esp32h2/secure_boot_secure_features.c

@@ -1,10 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
 #include <strings.h>
+#include "hal/ecdsa_ll.h"
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
     ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+    }
+#endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable hardware & software JTAG...");
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);

components/bootloader_support/src/esp_image_format.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -47,7 +47,12 @@ static const char *TAG = "esp_image";
 
 #define HASH_LEN ESP_IMAGE_HASH_LEN
 
-#define SIXTEEN_MB 0x1000000
+#if SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    UINT32_MAX
+#else
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    0x1000000
+#endif
+
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF
 
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
@@ -138,7 +143,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     verify_sha = (part->offset != ESP_BOOTLOADER_OFFSET) && do_verify;
 #endif
 
-    if (part->size > SIXTEEN_MB) {
+    if (part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         err = ESP_ERR_INVALID_ARG;
         FAIL_LOAD("partition size 0x%"PRIx32" invalid, larger than 16MB", part->size);
     }
@@ -297,7 +302,7 @@ esp_err_t esp_image_verify(esp_image_load_mode_t mode, const esp_partition_pos_t
 esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_metadata_t *metadata)
 {
     esp_err_t err;
-    if (metadata == NULL || part == NULL || part->size > SIXTEEN_MB) {
+    if (metadata == NULL || part == NULL || part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -751,7 +756,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
 static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
 {
     if ((segment->data_len & 3) != 0
-            || segment->data_len >= SIXTEEN_MB) {
+            || segment->data_len >= ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         if (!silent) {
             ESP_LOGE(TAG, "invalid segment length 0x%"PRIx32, segment->data_len);
         }

components/bootloader_support/src/flash_encrypt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"
 
 //TODO:[ESP32C61] IDf-9232
 
@@ -209,6 +212,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32
 
+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
     esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -453,6 +463,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
     }
     result &= secure;
 
+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
     return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32

components/bootloader_support/src/secure_boot.c

@@ -12,6 +12,10 @@
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
 
+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static __attribute__((unused)) const char *TAG = "secure_boot";
 
@@ -331,6 +335,23 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
     }
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+        if (!secure) {
+            uint8_t current_curve;
+            esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+            if (err == ESP_OK) {
+                if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+                    // If not P256 mode
+                    result &= secure;
+                    ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+                }
+            }
+        }
+    }
+#endif
+
 #ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
     secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
     result &= secure;

components/bt/CMakeLists.txt

@@ -34,6 +34,7 @@ set(common_include_dirs
     common/btc/profile/esp/blufi/include
     common/btc/profile/esp/include
     common/hci_log/include
+    common/ble_log/include
 )
 
 set(ble_mesh_include_dirs
@@ -99,17 +100,20 @@ if(CONFIG_BT_ENABLED)
             list(APPEND ldscripts "linker_rw_bt_controller.lf")
 
         elseif(CONFIG_IDF_TARGET_ESP32C2)
-            list(APPEND srcs "controller/esp32c2/bt.c")
+            list(APPEND srcs "controller/esp32c2/bt.c"
+                             "controller/esp32c2/ble.c")
             if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
                 list(APPEND srcs "controller/esp32c2/dummy.c")
             endif()
             set(ldscripts "linker_esp32c2.lf")
 
         elseif(CONFIG_IDF_TARGET_ESP32C6)
+            list(APPEND srcs "controller/esp32c6/ble.c")
             list(APPEND srcs "controller/esp32c6/bt.c")
             list(APPEND ldscripts "linker_esp_ble_controller.lf")
 
         elseif(CONFIG_IDF_TARGET_ESP32H2)
+            list(APPEND srcs "controller/esp32h2/ble.c")
             list(APPEND srcs "controller/esp32h2/bt.c")
             list(APPEND ldscripts "linker_esp_ble_controller.lf")
 
@@ -155,6 +159,7 @@ if(CONFIG_BT_ENABLED)
          "common/osi/osi.c"
          "common/osi/semaphore.c"
          "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
          )
 
     # Host Bluedroid
@@ -463,6 +468,19 @@ if(CONFIG_BT_ENABLED)
             list(APPEND srcs "esp_ble_mesh/core/bluedroid_host/adapter.c")
         endif()
 
+        if(CONFIG_BT_BLE_FEAT_ISO_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_iso.c"
+                            "host/bluedroid/btc/profile/std/iso/btc_iso_ble.c"
+                            "host/bluedroid/api/esp_ble_iso_api.c"
+                            "host/bluedroid/hci/ble_hci_iso.c")
+        endif()
+
+        if(CONFIG_BT_BLE_FEAT_CTE_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_cte.c"
+                            "host/bluedroid/btc/profile/std/cte/btc_ble_cte.c"
+                            "host/bluedroid/api/esp_ble_cte_api.c")
+        endif()
+
     endif()
 
     if(CONFIG_BLE_MESH)
@@ -640,23 +658,25 @@ if(CONFIG_BT_ENABLED)
 
     if(NOT (CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS))
         list(APPEND include_dirs
-                porting/ext/tinycrypt/include
+                common/tinycrypt/include
+                common/tinycrypt/port
             )
-        list(APPEND srcs "porting/ext/tinycrypt/src/utils.c"
-                "porting/ext/tinycrypt/src/sha256.c"
-                "porting/ext/tinycrypt/src/ecc.c"
-                "porting/ext/tinycrypt/src/ctr_prng.c"
-                "porting/ext/tinycrypt/src/ctr_mode.c"
-                "porting/ext/tinycrypt/src/aes_decrypt.c"
-                "porting/ext/tinycrypt/src/aes_encrypt.c"
-                "porting/ext/tinycrypt/src/ccm_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dsa.c"
-                "porting/ext/tinycrypt/src/cmac_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dh.c"
-                "porting/ext/tinycrypt/src/hmac_prng.c"
-                "porting/ext/tinycrypt/src/ecc_platform_specific.c"
-                "porting/ext/tinycrypt/src/hmac.c"
-                "porting/ext/tinycrypt/src/cbc_mode.c")
+        list(APPEND srcs "common/tinycrypt/src/utils.c"
+                "common/tinycrypt/src/sha256.c"
+                "common/tinycrypt/src/ecc.c"
+                "common/tinycrypt/src/ctr_prng.c"
+                "common/tinycrypt/src/ctr_mode.c"
+                "common/tinycrypt/src/aes_decrypt.c"
+                "common/tinycrypt/src/aes_encrypt.c"
+                "common/tinycrypt/src/ccm_mode.c"
+                "common/tinycrypt/src/ecc_dsa.c"
+                "common/tinycrypt/src/cmac_mode.c"
+                "common/tinycrypt/src/ecc_dh.c"
+                "common/tinycrypt/src/hmac_prng.c"
+                "common/tinycrypt/src/ecc_platform_specific.c"
+                "common/tinycrypt/src/hmac.c"
+                "common/tinycrypt/src/cbc_mode.c"
+                "common/tinycrypt/port/esp_tinycrypt_port.c")
     endif()
 
     if(CONFIG_BT_NIMBLE_ENABLED)
@@ -753,6 +773,7 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                 )
 
             if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
@@ -867,11 +888,27 @@ if(CONFIG_BT_ENABLED)
 
 endif()
 
+
+set(bt_priv_requires
+    nvs_flash
+    soc
+    esp_pm
+    esp_phy
+    esp_coex
+    mbedtls
+    esp_driver_uart
+    vfs
+    esp_ringbuf
+    esp_driver_spi
+    esp_driver_gpio
+    esp_gdbstub
+)
+
 idf_component_register(SRCS "${srcs}"
                        INCLUDE_DIRS "${include_dirs}"
                        PRIV_INCLUDE_DIRS "${priv_include_dirs}"
                        REQUIRES esp_timer esp_wifi
-                       PRIV_REQUIRES nvs_flash soc esp_pm esp_phy esp_coex mbedtls esp_driver_uart vfs esp_ringbuf
+                       PRIV_REQUIRES "${bt_priv_requires}"
                        LDFRAGMENTS "${ldscripts}")
 
 if(CONFIG_BT_ENABLED)
@@ -898,13 +935,19 @@ if(CONFIG_BT_ENABLED)
             target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
         endif()
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
+        endif()
         if(CONFIG_IDF_TARGET_ESP32C6)
-            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a"
+                                 REQUIRES esp_phy)
         else()
-            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
-                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a"
+                                     REQUIRES esp_phy)
             else()
-                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a"
+                                     REQUIRES esp_phy)
             endif()
         endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)

components/bt/Kconfig

@@ -81,8 +81,6 @@ menu "Bluetooth"
             So this option will disable the PMP (ESP_SYSTEM_PMP_IDRAM_SPLIT)
 
     menu "Common Options"
-        visible if (BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED)
-
         source "$IDF_PATH/components/bt/common/Kconfig.in"
     endmenu
 

components/bt/common/Kconfig.in

@@ -1,6 +1,199 @@
 config BT_ALARM_MAX_NUM
     int "Maximum number of Bluetooth alarms"
     default 50
+    depends on (BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED)
     help
         This option decides the maximum number of alarms which
         could be used by Bluetooth host.
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_UL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for upper layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    bool "Enable HCI log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
+
+config BT_BLE_LOG_SPI_OUT_HCI_BUF_SIZE
+    int "SPI transaction buffer size for HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for HCI logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_TASK_CNT
+    int "HCI task count"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1
+    help
+        HCI task count
+
+config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    bool "Enable Host log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
+        When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
+
+config BT_BLE_LOG_SPI_OUT_HOST_BUF_SIZE
+    int "SPI transaction buffer size for host logs"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for host logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HOST_TASK_CNT
+    int "Host task count"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 2
+    help
+        Host task count.
+
+config BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    bool "Enable Controller log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    depends on BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable controller log output to SPI bus.
+
+config BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for lower layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
+    int "SPI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for lower layer ISR logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_HCI_BUF_SIZE
+    int "SPI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer HCI logs.
+        There will be 2 SPI DMA buffers with the same size
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+        GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+        GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+        GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+        Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+        GPIO number of SYNC IO
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_SLEEP_SUPPORT
+    bool "Enable ble log & logic analyzer log time sync sleep support"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default y
+    help
+        Enable ble log & logic analyzer log time sync sleep support
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    bool "Enable periodic buffer flush out"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable periodic buffer flush out
+        Not recommended when SPI receiver is unavailable
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT
+    int "Buffer flush out period in unit of ms"
+    depends on BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    default 1000
+    help
+        Buffer flush out period in unit of ms
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    bool "Enable LE Audio log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable LE Audio log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_BUF_SIZE
+    int "SPI transaction buffer size for LE Audio logs"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for LE Audio logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_TASK_CNT
+    int "LE audio task count"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1
+    help
+        LE audio task count
+
+config BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    bool "Enable BLE mesh log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable BLE mesh log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_MESH_BUF_SIZE
+    int "SPI transaction buffer size for BLE mesh logs"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for BLE mesh logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MESH_TASK_CNT
+    int "Mesh task count"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 3
+    help
+        Mesh task count

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -0,0 +1,64 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+#include "esp_heap_caps.h"
+
+// Public enums
+enum {
+    BLE_LOG_SPI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY,
+    BLE_LOG_SPI_OUT_SOURCE_BLUEDROID,
+    BLE_LOG_SPI_OUT_SOURCE_NIMBLE,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_LL_HCI,
+    BLE_LOG_SPI_OUT_SOURCE_LE_AUDIO,
+    BLE_LOG_SPI_OUT_SOURCE_MESH,
+    BLE_LOG_SPI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_SPI_OUT_SOURCE_SSC = 0xFD,
+    BLE_LOG_SPI_OUT_SOURCE_SYNC,
+    BLE_LOG_SPI_OUT_SOURCE_LOSS,
+};
+
+#define BLE_LOG_SPI_OUT_LEVEL_NONE                  0
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR                 1
+#define BLE_LOG_SPI_OUT_LEVEL_WARN                  2
+#define BLE_LOG_SPI_OUT_LEVEL_INFO                  3
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG                 4
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE               5
+#define BLE_LOG_SPI_OUT_STR(x)                      #x
+#define BLE_LOG_SPI_OUT_XSTR(x)                     BLE_LOG_SPI_OUT_STR(x)
+#define BLE_LOG_SPI_OUT_BUILD_PREFIX(LEVEL, TAG)    "[" BLE_LOG_SPI_OUT_XSTR(LEVEL) "][" TAG "]"
+
+// Public functions
+int ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_timer_control(bool enable);
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,\
+                              const uint8_t *addr_append, uint32_t flag);
+void ble_log_spi_out_ll_log_ev_proc(void);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+void ble_log_spi_out_dump_all(void);
+void ble_log_spi_out_enable(bool enable);
+void ble_log_spi_out_flush(void);
+void ble_log_spi_out_le_audio_write(const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_host_write(uint8_t source, const char *prefix, const char *format, ...);
+int ble_log_spi_out_hci_write(uint8_t source, const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_mesh_write(const char *prefix, const char *format, ...);
+
+#endif // __BT_SPI_OUT_H__

components/bt/common/btc/core/btc_manage.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -16,6 +16,12 @@ void **btc_profile_cb_tab;
 
 void esp_profile_cb_reset(void)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return;
+    }
+    #endif
+
     int i;
 
     for (i = 0; i < BTC_PID_NUM; i++) {
@@ -25,6 +31,12 @@ void esp_profile_cb_reset(void)
 
 int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return -1;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return -1;
     }
@@ -36,6 +48,12 @@ int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 
 void *btc_profile_cb_get(btc_pid_t profile_id)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return NULL;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return NULL;
     }

components/bt/common/btc/core/btc_task.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -24,6 +24,8 @@
 #include "btc_gattc.h"
 #include "btc_gatt_common.h"
 #include "btc_gap_ble.h"
+#include "btc_iso_ble.h"
+#include "btc_ble_cte.h"
 #include "btc/btc_dm.h"
 #include "bta/bta_gatt_api.h"
 #if CLASSIC_BT_INCLUDED
@@ -210,7 +212,7 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
     [BTC_PID_RPR_CLIENT]        = {btc_ble_mesh_rpr_client_call_handler,        btc_ble_mesh_rpr_client_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_CLI */
 #if CONFIG_BLE_MESH_RPR_SRV
-    [BTC_PID_RPR_SERVER]        = {NULL,                                        btc_ble_mesh_rpr_server_cb_handler       },
+    [BTC_PID_RPR_SERVER]        = {btc_ble_mesh_rpr_server_call_handler,        btc_ble_mesh_rpr_server_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_SRV */
 #if CONFIG_BLE_MESH_SAR_CLI
     [BTC_PID_SAR_CLIENT]        = {btc_ble_mesh_sar_client_call_handler,        btc_ble_mesh_sar_client_cb_handler       },
@@ -258,6 +260,12 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
     [BTC_PID_BLE_MESH_BLE_COEX] = {btc_ble_mesh_ble_call_handler,               btc_ble_mesh_ble_cb_handler              },
 #endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    [BTC_PID_ISO_BLE]           = {btc_iso_ble_call_handler,                    btc_iso_ble_cb_handler                   },
+#endif  // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    [BTC_PID_BLE_CTE]           = {btc_ble_cte_call_handler,                    btc_ble_cte_cb_handler                   },
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
 };
 
 /*****************************************************************************
@@ -383,6 +391,7 @@ static void btc_deinit_mem(void) {
     }
 
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
+#if (BLE_42_ADV_EN == TRUE)
     if (gl_bta_adv_data_ptr) {
         osi_free(gl_bta_adv_data_ptr);
         gl_bta_adv_data_ptr = NULL;
@@ -392,6 +401,7 @@ static void btc_deinit_mem(void) {
         osi_free(gl_bta_scan_rsp_data_ptr);
         gl_bta_scan_rsp_data_ptr = NULL;
     }
+#endif // #if (BLE_42_ADV_EN == TRUE)
 #endif // BLE_42_FEATURE_SUPPORT
 
 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
@@ -446,6 +456,7 @@ static bt_status_t btc_init_mem(void) {
 
 #if BTC_DYNAMIC_MEMORY == TRUE
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
+#if (BLE_42_ADV_EN == TRUE)
     if ((gl_bta_adv_data_ptr = (tBTA_BLE_ADV_DATA *)osi_malloc(sizeof(tBTA_BLE_ADV_DATA))) == NULL) {
         goto error_exit;
     }
@@ -455,6 +466,7 @@ static bt_status_t btc_init_mem(void) {
         goto error_exit;
     }
     memset((void *)gl_bta_scan_rsp_data_ptr, 0, sizeof(tBTA_BLE_ADV_DATA));
+#endif // #if (BLE_42_ADV_EN == TRUE)
 #endif // (BLE_42_FEATURE_SUPPORT == TRUE)
 #endif // BTC_DYNAMIC_MEMORY == TRUE
 
@@ -472,10 +484,10 @@ static bt_status_t btc_init_mem(void) {
 #endif
 
 #if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
-    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(sizeof(hf_local_param_t))) == NULL) {
         goto error_exit;
     }
-    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+    memset((void *)hf_local_param_ptr, 0, sizeof(hf_local_param_t));
 #endif
 
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
@@ -518,21 +530,30 @@ bt_status_t btc_init(void)
         return BT_STATUS_NOMEM;
     }
 #endif
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_init();
+#endif
 
 #if (BLE_INCLUDED == TRUE)
     btc_gap_callback_init();
+#if (BLE_FEAT_ISO_EN == TRUE)
+    btc_iso_callback_init();
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    btc_cte_callback_init();
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
     btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE
 
-#if SCAN_QUEUE_CONGEST_CHECK
-    btc_adv_list_init();
-#endif
     /* TODO: initial the profile_tab */
     return BT_STATUS_SUCCESS;
 }
 
 void btc_deinit(void)
 {
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_deinit();
+#endif
 #if BTC_DYNAMIC_MEMORY
     btc_deinit_mem();
 #endif
@@ -542,18 +563,6 @@ void btc_deinit(void)
 #if (BLE_INCLUDED == TRUE)
     btc_gap_ble_deinit();
 #endif  ///BLE_INCLUDED == TRUE
-#if SCAN_QUEUE_CONGEST_CHECK
-    btc_adv_list_deinit();
-#endif
-}
-
-bool btc_check_queue_is_congest(void)
-{
-    if (osi_thread_queue_wait_size(btc_thread, 0) >= BT_QUEUE_CONGEST_SIZE) {
-        return true;
-    }
-
-    return false;
 }
 
 int get_btc_work_queue_size(void)

components/bt/common/btc/include/btc/btc_task.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -105,6 +105,12 @@ typedef enum {
     BTC_PID_MBT_SERVER,
     BTC_PID_BLE_MESH_BLE_COEX,
 #endif /* CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    BTC_PID_ISO_BLE,
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    BTC_PID_BLE_CTE,
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
     BTC_PID_NUM,
 } btc_pid_t; //btc profile id
 
@@ -123,8 +129,8 @@ extern "C" {
 /**
  * transfer an message to another module in the different task.
  * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
  * @param  copy_func deep copy function
  * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
@@ -134,7 +140,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
                                     btc_arg_deep_free_t free_func);
 
 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
  * @param  msg       message
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail
@@ -143,7 +149,6 @@ bt_status_t btc_inter_profile_call(btc_msg_t *msg);
 
 bt_status_t btc_init(void);
 void btc_deinit(void);
-bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);
 
 /**

components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         if (p_data->req_data.p_data->write_req.is_prep) {
             tBTA_GATT_STATUS status = GATT_SUCCESS;
 
-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                 if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                 }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);
 
             memset(&rsp, 0, sizeof(tGATTS_RSP));
             rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     uint16_t checksum, checksum_pkt;
     int ret;
 

components/bt/common/btc/profile/esp/blufi/include/blufi_int.h

@@ -36,7 +36,9 @@ typedef struct {
     UINT32                  trans_id;
     UINT8                   congest;
     UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
     uint8_t                 *prepare_buf;
     int                     prepare_len;
     /* Control reference */

components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h

@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a
 
 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -240,6 +240,32 @@ static void init_gatt_values(void)
 
 }
 
+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
     int rc;
@@ -260,7 +286,19 @@ int esp_blufi_gatt_svr_init(void)
     return 0;
 }
 
-static int
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
+int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
     struct ble_gap_conn_desc desc;
@@ -293,7 +331,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         }
         if (event->connect.status != 0) {
             /* Connection failed; resume advertising. */
-            esp_blufi_adv_start();
+           ((void(*)(void))arg)();
         }
         return 0;
     case BLE_GAP_EVENT_DISCONNECT:
@@ -328,7 +366,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
     case BLE_GAP_EVENT_ADV_COMPLETE:
         ESP_LOGI(TAG, "advertise complete; reason=%d",
                  event->adv_complete.reason);
-        esp_blufi_adv_start();
+        ((void(*)(void))arg)();
         return 0;
 
     case BLE_GAP_EVENT_SUBSCRIBE:
@@ -423,7 +461,7 @@ void esp_blufi_adv_start(void)
     adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
     adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
     rc = ble_gap_adv_start(own_addr_type, NULL, BLE_HS_FOREVER,
-                           &adv_params, esp_blufi_gap_event, NULL);
+                           &adv_params, esp_blufi_gap_event, esp_blufi_adv_start);
     if (rc != 0) {
         ESP_LOGE(TAG, "error enabling advertisement; rc=%d", rc);
         return;
@@ -473,7 +511,10 @@ void esp_blufi_disconnect(void)
     ble_gap_terminate(blufi_env.conn_id, BLE_ERR_REM_USER_CONN_TERM);
 }
 
-void esp_blufi_adv_stop(void) {}
+void esp_blufi_adv_stop(void)
+{
+    ble_gap_adv_stop();
+}
 
 void esp_blufi_send_encap(void *arg)
 {

components/bt/common/hci_log/bt_hci_log.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -10,6 +10,7 @@
 #include "bt_common.h"
 #include "osi/mutex.h"
 #include "esp_attr.h"
+#include "esp_timer.h"
 
 #if (BT_HCI_LOG_INCLUDED == TRUE)
 #define BT_HCI_LOG_PRINT_TAG                     (1)
@@ -124,6 +125,11 @@ static char IRAM_ATTR *bt_data_type_to_str(uint8_t data_type)
         // self-defining data
         tag = "S";
         break;
+    case HCI_LOG_DATA_TYPE_ISO_DATA:
+        // 5.2 iso data
+        tag = "I";
+        break;
+        break;
     default:
         // unknown data type
         tag = "U";
@@ -203,6 +209,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 {
     osi_mutex_t mutex_lock;
     uint8_t *g_hci_log_buffer;
+    int64_t ts;
+    uint8_t *temp_buf;
 
     if (!p_hci_log_ctl->p_hci_log_buffer) {
         return ESP_FAIL;
@@ -214,6 +222,16 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         return ESP_FAIL;
     }
 
+    ts = esp_timer_get_time();
+
+    temp_buf = (uint8_t *)malloc(data_len + 8);
+    memset(temp_buf, 0x0, data_len + 8);
+
+    memcpy(temp_buf, &ts, 8);
+    memcpy(temp_buf + 8, data, data_len);
+
+    data_len += 8;
+
     mutex_lock = p_hci_log_ctl->mutex_lock;
     osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
 
@@ -245,7 +263,7 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         bt_hci_log_record_string(p_hci_log_ctl, str);
     }
 
-    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+    bt_hci_log_record_hex(p_hci_log_ctl, temp_buf, data_len);
 
     g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';
 
@@ -261,6 +279,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 
     osi_mutex_unlock(&mutex_lock);
 
+    free(temp_buf);
+
     return ESP_OK;
 }
 

components/bt/common/hci_log/include/hci_log/bt_hci_log.h

@@ -21,6 +21,7 @@ extern "C" {
 #define    HCI_LOG_DATA_TYPE_ADV             (5)
 #define    HCI_LOG_DATA_TYPE_SELF_DEFINE     (6)
 #define    HCI_LOG_DATA_TYPE_C2H_ACL         (7)
+#define    HCI_LOG_DATA_TYPE_ISO_DATA        (8)
 
 /**
  *

components/bt/common/include/bt_common.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -84,6 +84,20 @@
 #define BT_HCI_LOG_INCLUDED  FALSE
 #endif
 
+// HCI LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+// BLURDROID LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/common/include/bt_user_config.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -126,6 +126,20 @@
 #define UC_BT_HCI_LOG_DEBUG_EN  FALSE
 #endif
 
+//HCI LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+//BLUEDROID LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else

components/bt/common/osi/include/osi/fixed_pkt_queue.h

@@ -76,4 +76,8 @@ void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
 
 void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif

components/bt/common/osi/pkt_queue.c

@@ -25,6 +25,7 @@ struct pkt_queue *pkt_queue_create(void)
     }
     if (osi_mutex_new(&queue->lock) != 0) {
         osi_free(queue);
+        return NULL;
     }
     struct pkt_queue_header *p = &queue->header;
     STAILQ_INIT(p);

components/bt/common/tinycrypt/include/tinycrypt/aes.h

@@ -1,4 +1,8 @@
-/* aes.h - TinyCrypt interface to an AES-128 implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cbc_mode.h

@@ -1,4 +1,8 @@
-/* cbc_mode.h - TinyCrypt interface to a CBC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ccm_mode.h

@@ -1,4 +1,8 @@
-/* ccm_mode.h - TinyCrypt interface to a CCM mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cmac_mode.h

@@ -1,4 +1,8 @@
-/*  cmac_mode.h -- interface to a CMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved

components/bt/common/tinycrypt/include/tinycrypt/constants.h

@@ -1,4 +1,8 @@
-/* constants.h - TinyCrypt interface to constants */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_mode.h

@@ -1,4 +1,8 @@
-/* ctr_mode.h - TinyCrypt interface to CTR mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_prng.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_prng.h - TinyCrypt interface to a CTR-PRNG implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc.h - TinyCrypt interface to common ECC functions */
 
 /* Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dh.h

@@ -1,4 +1,8 @@
-/* ecc_dh.h - TinyCrypt interface to EC-DH implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dsa.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc_dh.h - TinyCrypt interface to EC-DSA implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc_platform_specific.h

@@ -1,4 +1,8 @@
-/*  uECC_platform_specific.h - Interface to platform specific functions*/
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /* Copyright (c) 2014, Kenneth MacKay
  * All rights reserved.

components/bt/common/tinycrypt/include/tinycrypt/hmac.h

@@ -1,4 +1,8 @@
-/* hmac.h - TinyCrypt interface to an HMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -124,7 +128,7 @@ int tc_hmac_update(TCHmacState_t ctx, const void *data,
  *                key == NULL or
  *                taglen != TC_SHA256_DIGEST_SIZE
  *  @note ctx is erased before exiting. This should never be changed/removed.
- *  @note Assumes the tag bufer is at least sizeof(hmac_tag_size(state)) bytes
+ *  @note Assumes the tag buffer is at least sizeof(hmac_tag_size(state)) bytes
  *  state has been initialized by tc_hmac_init
  *  @param tag IN/OUT -- buffer to receive computed HMAC tag
  *  @param taglen IN -- size of tag in bytes

components/bt/common/tinycrypt/include/tinycrypt/hmac_prng.h

@@ -1,4 +1,8 @@
-/* hmac_prng.h - TinyCrypt interface to an HMAC-PRNG implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/sha256.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* sha256.h - TinyCrypt interface to a SHA-256 implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/utils.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* utils.h - TinyCrypt interface to platform-dependent run-time operations */
 
 /*

components/bt/common/tinycrypt/port/esp_tinycrypt_port.c

@@ -0,0 +1,87 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_tinycrypt_port.h"
+
+#include "esp_crypto_lock.h"
+#include "esp_private/esp_crypto_lock_internal.h"
+
+#if SOC_ECC_SUPPORTED
+#include "hal/ecc_hal.h"
+#include "hal/ecc_ll.h"
+#endif /* SOC_ECC_SUPPORTED */
+
+
+#if SOC_ECC_SUPPORTED
+static void  esp_tinycrypt_acquire_ecc_hardware(void)
+{
+    esp_crypto_ecc_lock_acquire();
+
+    ECC_RCC_ATOMIC() {
+        ecc_ll_enable_bus_clock(true);
+        ecc_ll_power_up();
+        ecc_ll_reset_register();
+    }
+}
+
+static void  esp_tinycrypt_release_ecc_hardware(void)
+{
+    ECC_RCC_ATOMIC() {
+        ecc_ll_enable_bus_clock(false);
+        ecc_ll_power_down();
+    }
+
+    esp_crypto_ecc_lock_release();
+}
+
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length)
+{
+    int result;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_verify_param(pk_x, pk_y, length);
+    ecc_hal_set_mode(ECC_MODE_VERIFY);
+    ecc_hal_start_calc();
+    while (!ecc_hal_is_calc_finished());
+    result = ecc_hal_read_verify_result();
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    if (result == 1) {
+        return 0;
+    } else {
+        return -1;
+    }
+}
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first)
+{
+    int ret = -1;
+    ecc_mode_t work_mode = verify_first ? ECC_MODE_VERIFY_THEN_POINT_MUL : ECC_MODE_POINT_MUL;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_mul_param(scalar, p_x, p_y, num_bytes);
+    ecc_hal_set_mode(work_mode);
+    /*
+     * Enable constant-time point multiplication operations for the ECC hardware accelerator,
+     * if supported for the given target. This protects the ECC multiplication operation from
+     * timing attacks. This increases the time taken (by almost 50%) for some point
+     * multiplication operations performed by the ECC hardware accelerator.
+     */
+    ecc_hal_enable_constant_time_point_mul(true);
+    ecc_hal_start_calc();
+
+    while (!ecc_hal_is_calc_finished());
+
+    ret = ecc_hal_read_mul_result(r_x, r_y, num_bytes);
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    return ret;
+}
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/port/esp_tinycrypt_port.h

@@ -0,0 +1,15 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include <stdbool.h>
+#include "soc/soc_caps.h"
+
+#if SOC_ECC_SUPPORTED
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length);
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first);
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/src/aes_decrypt.c

@@ -1,4 +1,8 @@
-/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+
 #include <tinycrypt/aes.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/aes_encrypt.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* aes_encrypt.c - TinyCrypt implementation of AES encryption procedure */
 
 /*

components/bt/common/tinycrypt/src/cbc_mode.c

@@ -1,4 +1,8 @@
-/* cbc_mode.c - TinyCrypt implementation of CBC mode encryption & decryption */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ccm_mode.c

@@ -1,4 +1,8 @@
-/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+
 #include <tinycrypt/ccm_mode.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/cmac_mode.c

@@ -1,4 +1,8 @@
-/* cmac_mode.c - TinyCrypt CMAC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ctr_mode.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_mode.c - TinyCrypt CTR mode implementation */
 
 /*