change(version): Update version to 5.3.4

feat(mbedtls): Add support for RSA decryption with DS peripheral (v5.3)

See merge request espressif/esp-idf!40451

.github/workflows/release_zips.yml

@@ -8,10 +8,11 @@ on:
 jobs:
   release_zips:
     name: Create release zip file
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Create a recursive clone source zip
-        uses: espressif/github-actions/release_zips@master
-        env:
-            RELEASE_PROJECT_NAME: ESP-IDF
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: espressif/release-zips-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_project_name: ESP-IDF
+          git_extra_args: --shallow-since="1 year ago"

.gitlab/ci/build.yml

@@ -219,7 +219,7 @@ pytest_build_system_macos:
     PYENV_VERSION: "3.8"
     # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
     CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
-    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
+
 build_docker:
   extends:
     - .before_script:minimal

.gitlab/ci/common.yml

@@ -39,7 +39,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.3.3
+  LATEST_GIT_TAG: v5.3.4
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules
@@ -177,13 +177,21 @@ variables:
   fi
 
   # Custom OpenOCD
-  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
+  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
+    machine="$(uname -m)"
+    if [[ "$machine" == "armv7l" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
+    elif [[ "$machine" == "aarch64" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
+    fi
+    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
+      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+      wget $OOCD_DISTRO_URL
+      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+      tar -x -f $ARCH_NAME
+      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+      export PATH=$PWD/openocd-esp32/bin:$PATH
+    fi
   fi
 
   if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then

.gitlab/ci/deploy.yml

@@ -19,6 +19,7 @@ check_submodule_sync:
   dependencies: []
   script:
     - git submodule deinit --force .
+    - rm -rf .git/modules  # remove all the cached metadata
     # setting the default remote URL to the public one, to resolve relative location URLs
     - git config remote.origin.url ${PUBLIC_IDF_URL}
     # check if all submodules are correctly synced to public repository

.gitlab/ci/docs.yml

@@ -144,11 +144,16 @@ build_docs_html_partial:
   variables:
     DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
     PYTHONUNBUFFERED: 1
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 0
   stage: test_deploy
   tags:
     - deploy
     - shiny
   script:
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    - git fetch --tags --prune
     - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
     - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
     - deploy-docs

.gitlab/ci/host-test.yml

@@ -133,7 +133,8 @@ test_cli_installer:
   script:
     # Tools must be downloaded for testing
     # We could use "idf_tools.py download all", but we don't want to install clang because of its huge size
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                      cmake@version that is supported
+    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}/tools/test_idf_tools
     - python3 -m pip install jsonschema
     - python3 ./test_idf_tools.py -v
@@ -364,3 +365,17 @@ test_idf_pytest_plugin:
   script:
     - cd tools/ci/idf_pytest
     - pytest --junitxml=${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+
+test_nvs_gen_check:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+      - components/nvs_flash/nvs_partition_tool
+    reports:
+      junit: XUNIT_RESULT.xml
+  variables:
+    LC_ALL: C.UTF-8
+  script:
+    - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
+    - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml

.gitlab/ci/pre_check.yml

@@ -160,6 +160,8 @@ pipeline_variables:
       if [ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]; then
         echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
       fi
+    - echo "OOCD_DISTRO_URL_ARMHF=$OOCD_DISTRO_URL_ARMHF" >> pipeline.env
+    - echo "OOCD_DISTRO_URL_ARM64=$OOCD_DISTRO_URL_ARM64" >> pipeline.env
     - cat pipeline.env
     - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
   artifacts:

.gitlab/ci/test-win.yml

@@ -31,7 +31,8 @@ test_cli_installer_win:
     IDF_PATH: "$CI_PROJECT_DIR"
   script:
     # Tools must be downloaded for testing
-    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                     cmake@version that is supported
+    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
     - cd ${IDF_PATH}\tools\test_idf_tools
     - python -m pip install jsonschema
     - python .\test_idf_tools.py

.gitmodules

@@ -54,8 +54,10 @@
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-hash = 8f2beb57ddad1f94bed899790b00f46df893ccac
 	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
+	sbom-cve-exclude-list = CVE-2023-26819 Resolved in commit a328d65ad490b64da8c87523cbbfe16050ba5bf6
+	sbom-cve-exclude-list = CVE-2023-53154 Resolved in v1.7.18
 
 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls

.pre-commit-config.yaml

@@ -70,11 +70,6 @@ repos:
         language: python
         pass_filenames: false
         always_run: true
-      - id: check-deprecated-kconfigs-options
-        name: Check if any Kconfig Options Deprecated
-        entry: tools/ci/check_deprecated_kconfigs.py
-        language: python
-        files: 'sdkconfig\.ci$|sdkconfig\.rename$|sdkconfig.*$'
       - id: cmake-lint
         name: Check CMake Files Format
         entry: cmakelint --linelength=120 --spaces=4 --filter=-whitespace/indent
@@ -236,6 +231,7 @@ repos:
         name: Lint rST files in docs folder using Sphinx Lint
         files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
   - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.4.1
+    rev: v2.5.0
     hooks:
       - id: check-kconfig-files
+      - id: check-deprecated-kconfig-options

Kconfig

@@ -655,5 +655,4 @@ mainmenu "Espressif IoT Development Framework Configuration"
             - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
             - CONFIG_ESP_WIFI_EAP_TLS1_3
             - CONFIG_ESP_WIFI_ENABLE_ROAMING_APP
-            - CONFIG_USB_HOST_EXT_PORT_SUPPORT_LS
             - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS

components/app_trace/app_trace_membufs_proto.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -92,7 +92,7 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
     // switch to new block
     proto->state.in_block++;
 
-    proto->hw->swap(new_block_num);
+    proto->hw->swap(new_block_num, proto->state.markers[prev_block_num]);
 
     // handle data from host
     esp_hostdata_hdr_t *hdr = (esp_hostdata_hdr_t *)proto->blocks[new_block_num].start;
@@ -148,6 +148,18 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
         if (res != ESP_OK) {
             break;
         }
+#if CONFIG_IDF_TARGET_ESP32S3
+        /*
+        * ESP32S3 has a serious data corruption issue with the transferred data to host.
+        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
+        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
+        * the current thread continues execution. While this doesn't completely prevent
+        * memory access from other threads/cores/ISRs, it has shown to significantly improve
+        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
+        * number of retries needed to read an entire block without corruption.
+        */
+        esp_rom_delay_us(100);
+#endif
     }
     return res;
 }
@@ -339,7 +351,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
     esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
     // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
     // higher prio tasks and the latter can not allocate buffers at all
     // this is abnormal situation can be detected on host which will receive only uncompleted buffers

components/app_trace/port/riscv/port.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -50,14 +50,20 @@ static uint8_t *esp_apptrace_riscv_down_buffer_get(esp_apptrace_riscv_data_t *hw
 static esp_err_t esp_apptrace_riscv_down_buffer_put(esp_apptrace_riscv_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_riscv_host_is_connected(esp_apptrace_riscv_data_t *hw_data);
 static esp_err_t esp_apptrace_riscv_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_riscv_host_data_pending(void);
 
 
 const static char *TAG = "esp_apptrace";
 
-static esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];
+#if SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE
+#define APPTRACE_DRAM_ATTR TCM_DRAM_ATTR
+#else
+#define APPTRACE_DRAM_ATTR
+#endif
+
+static APPTRACE_DRAM_ATTR esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];
 
 esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 {
@@ -92,7 +98,7 @@ esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 }
 
 /* Advertises apptrace control block address to host.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
    e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_addr)
 {
@@ -103,7 +109,7 @@ __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_add
 }
 
 /* Returns up buffers config.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
    e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) void esp_apptrace_get_up_buffers(esp_apptrace_mem_block_t mem_blocks_cfg[2])
 {
@@ -165,7 +171,7 @@ static esp_err_t esp_apptrace_riscv_init(esp_apptrace_riscv_data_t *hw_data)
     }
     // notify host about control block address
     int res = esp_apptrace_advertise_ctrl_block(&s_tracing_ctrl[core_id]);
-    assert(res == 0 && "Falied to send config to host!");
+    assert(res == 0 && "Failed to send config to host!");
 
     return ESP_OK;
 }
@@ -347,7 +353,7 @@ static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint3
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
     /* do nothing */
     return ESP_OK;

components/app_trace/port/xtensa/port.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0 OR MIT
  */
@@ -12,7 +12,7 @@
 // ======================
 
 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================
 
-// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,9 +55,15 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//   See 'Targets Connection' setion for details.
+//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//    See 'Targets Connection' section for details.
+//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
+//    The register has the following format:
+//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
+//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
+//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
+//    This allows the host to verify data integrity of the received trace data.
 
 // 3. Modes of operation
 // =====================
@@ -127,7 +133,7 @@
 
 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -142,9 +148,9 @@
 
 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When wating on trace data lock.
+// - Trace data are locked by another task/ISR. When waiting on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -159,11 +165,15 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "esp_rom_crc.h"
 
 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
+#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
+
+#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)
 
 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -198,7 +208,7 @@ static uint8_t *esp_apptrace_trax_down_buffer_get(esp_apptrace_trax_data_t *hw_d
 static esp_err_t esp_apptrace_trax_down_buffer_put(esp_apptrace_trax_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_trax_host_is_connected(esp_apptrace_trax_data_t *hw_data);
 static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_trax_host_data_pending(void);
 
@@ -498,7 +508,8 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
         uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
         uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
         if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32, esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
+                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                 curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
             res = ESP_ERR_NO_MEM;
             goto _on_err;
@@ -514,14 +525,22 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
     uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
     uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
+
     eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
               host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
     esp_apptrace_trax_buffer_swap_unlock();
     return ESP_OK;
 }
 
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
+    /* Before switching to the new block, calculate CRC16 of the current block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
     esp_apptrace_trax_select_memory_block(new_block_id);
     return ESP_OK;
 }

components/app_trace/private_include/esp_app_trace_membufs_proto.h

@@ -29,7 +29,7 @@ typedef struct {
 
 typedef struct {
     esp_err_t (*swap_start)(uint32_t curr_block_id);
-    esp_err_t (*swap)(uint32_t new_block_id);
+    esp_err_t (*swap)(uint32_t new_block_id, uint32_t prev_block_len);
     esp_err_t (*swap_end)(uint32_t new_block_id, uint32_t prev_block_len);
     bool (*host_data_pending)(void);
 } esp_apptrace_membufs_proto_hw_t;

components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c

@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-static U64 _cbGetTime(void) {
+__attribute__((unused)) static U64 _cbGetTime(void) {
   U64 Time;
 
   Time = xTaskGetTickCountFromISR();
@@ -260,7 +260,10 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  _cbGetTime,
+  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
+     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
+     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
+  NULL,
   _cbSendTaskList,
 };
 

components/bootloader/Kconfig.projbuild

@@ -801,6 +801,33 @@ menu "Security features"
             This can lead to permanent bricking of the device, in case all keys are revoked
             because of signature verification failure.
 
+    config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+        bool "Do not disable the ability to further read protect eFuses"
+        depends on SECURE_BOOT_V2_ENABLED
+        default n
+        help
+            If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
+            efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
+
+            If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
+            Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+            BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the secure boot public key digest,
+            causing an immediate denial of service and possibly allowing an additional fault injection attack to
+            bypass the signature protection.
+
+            The option must be set when you need to program any read-protected key type into the efuses,
+            e.g., HMAC, ECDSA etc. after secure boot has already been enabled on the device.
+            Please refer to secure boot V2 documentation guide for more details.
+
+            NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+            NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+            "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+            then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+            However, efuse can be read/written from the application
+
+            Please refer to the Secure Boot V2 documentation guide for more information.
+
     config SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT
         bool "Flash bootloader along with other artifacts when using the default flash command"
         depends on SECURE_BOOT_V2_ENABLED && SECURE_BOOT_BUILD_SIGNED_BINARIES
@@ -981,26 +1008,6 @@ menu "Security features"
                 image to this length. It is generally not recommended to set this option, unless you have a legacy
                 partitioning scheme which doesn't support 64KB aligned partition lengths.
 
-        config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
-            bool "Allow additional read protecting of efuses"
-            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
-            help
-                If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
-                efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
-
-                If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
-                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
-                immediate denial of service and possibly allowing an additional fault injection attack to
-                bypass the signature protection.
-
-                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
-
-                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
-                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
-                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
-                However, efuse can be read/written from the application
-
         config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
             bool "Leave unused digest slots available (not revoke)"
             depends on SECURE_BOOT_INSECURE && SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -1220,7 +1227,7 @@ menu "Security features"
                 It is also possible to enable secure download mode at runtime by calling
                 esp_efuse_enable_rom_secure_download_mode()
 
-                Note: Secure Download mode is not available for ESP32 (includes revisions till ECO3).
+                Note: Secure Download mode is not available for ESP32.
 
         config SECURE_INSECURE_ALLOW_DL_MODE
             bool "UART ROM download mode (Enabled (not recommended))"

components/bootloader_support/CMakeLists.txt

@@ -36,6 +36,10 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
         )
 endif()
 
+if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
+    list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
+endif()
+
 if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
     set(include_dirs "include" "bootloader_flash/include"
         "private_include")
@@ -50,10 +54,6 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
     "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
     )
     list(APPEND priv_requires hal)
-    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
-        list(APPEND srcs
-            "src/${IDF_TARGET}/bootloader_ecdsa.c")
-    endif()
 else()
     list(APPEND srcs
         "src/idf/bootloader_sha.c")

components/bootloader_support/include/bootloader_memory_utils.h

@@ -28,12 +28,21 @@ extern "C" {
  */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    bool dram_match_iram = (SOC_DRAM_LOW == SOC_IRAM_LOW) &&
-                             (SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    return ((SOC_DRAM_LOW == SOC_IRAM_LOW) && (SOC_DRAM_HIGH == SOC_IRAM_HIGH));
+}
+
+/**
+ * @brief Check if the RTC IRAM and RTC DRAM are separate or using the same memory space
+ *
+ * @return true if the RTC DRAM and RTC IRAM are sharing the same memory space, false otherwise
+ */
+__attribute__((always_inline))
+inline static bool esp_rtc_dram_match_rtc_iram(void) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
-        dram_match_iram &= (SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW);
+    return ((SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW) && (SOC_RTC_IRAM_HIGH == SOC_RTC_DRAM_HIGH));
+#else
+    return false;
 #endif
-    return dram_match_iram;
 }
 
 /**
@@ -103,7 +112,7 @@ inline static bool esp_ptr_in_diram_iram(const void *p) {
  */
 __attribute__((always_inline))
 inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
-#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+#if SOC_RTC_FAST_MEM_SUPPORTED
     return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
     (void)p;

components/bootloader_support/src/bootloader_common_loader.c

@@ -28,6 +28,7 @@
 
 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
 #define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
 static const char* TAG = "boot_comm";
 
@@ -242,7 +243,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
     #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
     static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
     return s_bootloader_retain_mem;

components/bootloader_support/src/esp32h2/secure_boot_secure_features.c

@@ -1,10 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
 #include <strings.h>
+#include "hal/ecdsa_ll.h"
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
     ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+    }
+#endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
     ESP_LOGI(TAG, "Disable hardware & software JTAG...");
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);

components/bootloader_support/src/esp_image_format.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -47,7 +47,12 @@ static const char *TAG = "esp_image";
 
 #define HASH_LEN ESP_IMAGE_HASH_LEN
 
-#define SIXTEEN_MB 0x1000000
+#if SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    UINT32_MAX
+#else
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    0x1000000
+#endif
+
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF
 
 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
@@ -138,7 +143,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
     verify_sha = (part->offset != ESP_BOOTLOADER_OFFSET) && do_verify;
 #endif
 
-    if (part->size > SIXTEEN_MB) {
+    if (part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         err = ESP_ERR_INVALID_ARG;
         FAIL_LOAD("partition size 0x%"PRIx32" invalid, larger than 16MB", part->size);
     }
@@ -297,7 +302,7 @@ esp_err_t esp_image_verify(esp_image_load_mode_t mode, const esp_partition_pos_t
 esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_metadata_t *metadata)
 {
     esp_err_t err;
-    if (metadata == NULL || part == NULL || part->size > SIXTEEN_MB) {
+    if (metadata == NULL || part == NULL || part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -751,7 +756,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
 static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
 {
     if ((segment->data_len & 3) != 0
-            || segment->data_len >= SIXTEEN_MB) {
+            || segment->data_len >= ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
         if (!silent) {
             ESP_LOGE(TAG, "invalid segment length 0x%"PRIx32, segment->data_len);
         }

components/bootloader_support/src/secure_boot.c

@@ -12,6 +12,10 @@
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
 
+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static __attribute__((unused)) const char *TAG = "secure_boot";
 
@@ -331,6 +335,23 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
     }
 #endif
 
+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+        if (!secure) {
+            uint8_t current_curve;
+            esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+            if (err == ESP_OK) {
+                if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+                    // If not P256 mode
+                    result &= secure;
+                    ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+                }
+            }
+        }
+    }
+#endif
+
 #ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
     secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
     result &= secure;

components/bt/CMakeLists.txt

@@ -468,6 +468,19 @@ if(CONFIG_BT_ENABLED)
             list(APPEND srcs "esp_ble_mesh/core/bluedroid_host/adapter.c")
         endif()
 
+        if(CONFIG_BT_BLE_FEAT_ISO_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_iso.c"
+                            "host/bluedroid/btc/profile/std/iso/btc_iso_ble.c"
+                            "host/bluedroid/api/esp_ble_iso_api.c"
+                            "host/bluedroid/hci/ble_hci_iso.c")
+        endif()
+
+        if(CONFIG_BT_BLE_FEAT_CTE_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_cte.c"
+                            "host/bluedroid/btc/profile/std/cte/btc_ble_cte.c"
+                            "host/bluedroid/api/esp_ble_cte_api.c")
+        endif()
+
     endif()
 
     if(CONFIG_BLE_MESH)
@@ -645,23 +658,25 @@ if(CONFIG_BT_ENABLED)
 
     if(NOT (CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS))
         list(APPEND include_dirs
-                porting/ext/tinycrypt/include
+                common/tinycrypt/include
+                common/tinycrypt/port
             )
-        list(APPEND srcs "porting/ext/tinycrypt/src/utils.c"
-                "porting/ext/tinycrypt/src/sha256.c"
-                "porting/ext/tinycrypt/src/ecc.c"
-                "porting/ext/tinycrypt/src/ctr_prng.c"
-                "porting/ext/tinycrypt/src/ctr_mode.c"
-                "porting/ext/tinycrypt/src/aes_decrypt.c"
-                "porting/ext/tinycrypt/src/aes_encrypt.c"
-                "porting/ext/tinycrypt/src/ccm_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dsa.c"
-                "porting/ext/tinycrypt/src/cmac_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dh.c"
-                "porting/ext/tinycrypt/src/hmac_prng.c"
-                "porting/ext/tinycrypt/src/ecc_platform_specific.c"
-                "porting/ext/tinycrypt/src/hmac.c"
-                "porting/ext/tinycrypt/src/cbc_mode.c")
+        list(APPEND srcs "common/tinycrypt/src/utils.c"
+                "common/tinycrypt/src/sha256.c"
+                "common/tinycrypt/src/ecc.c"
+                "common/tinycrypt/src/ctr_prng.c"
+                "common/tinycrypt/src/ctr_mode.c"
+                "common/tinycrypt/src/aes_decrypt.c"
+                "common/tinycrypt/src/aes_encrypt.c"
+                "common/tinycrypt/src/ccm_mode.c"
+                "common/tinycrypt/src/ecc_dsa.c"
+                "common/tinycrypt/src/cmac_mode.c"
+                "common/tinycrypt/src/ecc_dh.c"
+                "common/tinycrypt/src/hmac_prng.c"
+                "common/tinycrypt/src/ecc_platform_specific.c"
+                "common/tinycrypt/src/hmac.c"
+                "common/tinycrypt/src/cbc_mode.c"
+                "common/tinycrypt/port/esp_tinycrypt_port.c")
     endif()
 
     if(CONFIG_BT_NIMBLE_ENABLED)
@@ -924,12 +939,15 @@ if(CONFIG_BT_ENABLED)
             target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
         endif()
         if(CONFIG_IDF_TARGET_ESP32C6)
-            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a"
+                                 REQUIRES esp_phy)
         else()
             if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
-                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a")
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a"
+                                     REQUIRES esp_phy)
             else()
-                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a"
+                                     REQUIRES esp_phy)
             endif()
         endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)

components/bt/common/Kconfig.in

@@ -12,6 +12,14 @@ config BT_BLE_LOG_SPI_OUT_ENABLED
     help
         Output ble logs to SPI bus
 
+config BT_BLE_LOG_SPI_OUT_UL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for upper layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
 config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
     bool "Enable HCI log output to SPI"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -19,6 +27,21 @@ config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
     help
         Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
 
+config BT_BLE_LOG_SPI_OUT_HCI_BUF_SIZE
+    int "SPI transaction buffer size for HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for HCI logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_TASK_CNT
+    int "HCI task count"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1
+    help
+        HCI task count
+
 config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
     bool "Enable Host log output to SPI"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -27,51 +50,150 @@ config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
         This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
         When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
 
-config BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
-    int "Number of ble log async SPI output queues"
-    depends on BT_BLE_LOG_SPI_OUT_ENABLED
-    default 4
+config BT_BLE_LOG_SPI_OUT_HOST_BUF_SIZE
+    int "SPI transaction buffer size for host logs"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 1024
     help
-            The number of ble log async SPI output queues
+        SPI transaction buffer size for host logs.
+        There will be 2 SPI DMA buffers with the same size.
 
-config BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE
-    int "Size of ble log async SPI output transaction buffer size"
-    depends on BT_BLE_LOG_SPI_OUT_ENABLED
-    default 2048
+config BT_BLE_LOG_SPI_OUT_HOST_TASK_CNT
+    int "Host task count"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 2
     help
-            The size of ble log async SPI output transaction buffer size
+        Host task count.
+
+config BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    bool "Enable Controller log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    depends on BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable controller log output to SPI bus.
+
+config BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for lower layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
+    int "SPI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for lower layer ISR logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_HCI_BUF_SIZE
+    int "SPI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer HCI logs.
+        There will be 2 SPI DMA buffers with the same size
 
 config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
     int "GPIO number of SPI MOSI"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
     default 0
     help
-            GPIO number of SPI MOSI
+        GPIO number of SPI MOSI
 
 config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
     int "GPIO number of SPI SCLK"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
     default 1
     help
-            GPIO number of SPI SCLK
+        GPIO number of SPI SCLK
 
 config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
     int "GPIO number of SPI CS"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
     default 2
     help
-            GPIO number of SPI CS
+        GPIO number of SPI CS
 
 config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
     bool "Enable ble log & logic analyzer log time sync"
     depends on BT_BLE_LOG_SPI_OUT_ENABLED
     default y
     help
-            Enable ble log & logic analyzer log time sync
+        Enable ble log & logic analyzer log time sync
 
 config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
     int "GPIO number of SYNC IO"
     depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
     default 3
     help
-            GPIO number of SYNC IO
+        GPIO number of SYNC IO
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_SLEEP_SUPPORT
+    bool "Enable ble log & logic analyzer log time sync sleep support"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default y
+    help
+        Enable ble log & logic analyzer log time sync sleep support
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    bool "Enable periodic buffer flush out"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable periodic buffer flush out
+        Not recommended when SPI receiver is unavailable
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT
+    int "Buffer flush out period in unit of ms"
+    depends on BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    default 1000
+    help
+        Buffer flush out period in unit of ms
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    bool "Enable LE Audio log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable LE Audio log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_BUF_SIZE
+    int "SPI transaction buffer size for LE Audio logs"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for LE Audio logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_TASK_CNT
+    int "LE audio task count"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1
+    help
+        LE audio task count
+
+config BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    bool "Enable BLE mesh log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable BLE mesh log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_MESH_BUF_SIZE
+    int "SPI transaction buffer size for BLE mesh logs"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for BLE mesh logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MESH_TASK_CNT
+    int "Mesh task count"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 3
+    help
+        Mesh task count

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -12,36 +12,53 @@
 #include "driver/gpio.h"
 #include "esp_timer.h"
 #include "freertos/semphr.h"
+#include "esp_heap_caps.h"
 
-// Public typedefs
-#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
-#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
-#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
-#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
-#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
-#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
-#define BLE_LOG_SPI_OUT_SOURCE_USER 0x10
-#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
-#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+// Public enums
+enum {
+    BLE_LOG_SPI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY,
+    BLE_LOG_SPI_OUT_SOURCE_BLUEDROID,
+    BLE_LOG_SPI_OUT_SOURCE_NIMBLE,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_LL_HCI,
+    BLE_LOG_SPI_OUT_SOURCE_LE_AUDIO,
+    BLE_LOG_SPI_OUT_SOURCE_MESH,
+    BLE_LOG_SPI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_SPI_OUT_SOURCE_SSC = 0xFD,
+    BLE_LOG_SPI_OUT_SOURCE_SYNC,
+    BLE_LOG_SPI_OUT_SOURCE_LOSS,
+};
 
-// SPI Log Level Definitions
-#define BLE_LOG_SPI_OUT_LEVEL_NONE      0  /*!< No log output */
-#define BLE_LOG_SPI_OUT_LEVEL_ERROR     1  /*!< Critical errors that SPI driver cannot recover from */
-#define BLE_LOG_SPI_OUT_LEVEL_WARN      2  /*!< Recoverable error conditions in SPI communication */
-#define BLE_LOG_SPI_OUT_LEVEL_INFO      3  /*!< Informational messages about SPI transactions */
-#define BLE_LOG_SPI_OUT_LEVEL_DEBUG     4  /*!< Detailed debug information, such as SPI register values */
-#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE   5  /*!< Very detailed debugging logs, potentially flooding output */
-#define BLE_LOG_SPI_OUT_LEVEL_MAX       6  /*!< Number of SPI log levels supported */
+#define BLE_LOG_SPI_OUT_LEVEL_NONE                  0
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR                 1
+#define BLE_LOG_SPI_OUT_LEVEL_WARN                  2
+#define BLE_LOG_SPI_OUT_LEVEL_INFO                  3
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG                 4
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE               5
+#define BLE_LOG_SPI_OUT_STR(x)                      #x
+#define BLE_LOG_SPI_OUT_XSTR(x)                     BLE_LOG_SPI_OUT_STR(x)
+#define BLE_LOG_SPI_OUT_BUILD_PREFIX(LEVEL, TAG)    "[" BLE_LOG_SPI_OUT_XSTR(LEVEL) "][" TAG "]"
 
 // Public functions
-void ble_log_spi_out_init(void);
+int ble_log_spi_out_init(void);
 void ble_log_spi_out_deinit(void);
-void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
-void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end);
+void ble_log_spi_out_timer_control(bool enable);
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,\
+                              const uint8_t *addr_append, uint32_t flag);
+void ble_log_spi_out_ll_log_ev_proc(void);
 void ble_log_spi_out_ts_sync_start(void);
 void ble_log_spi_out_ts_sync_stop(void);
-int ble_log_spi_out_printf(uint8_t source, const char *format, ...);
-int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...);
-void ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_dump_all(void);
+void ble_log_spi_out_enable(bool enable);
+void ble_log_spi_out_flush(void);
+void ble_log_spi_out_le_audio_write(const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_host_write(uint8_t source, const char *prefix, const char *format, ...);
+int ble_log_spi_out_hci_write(uint8_t source, const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_mesh_write(const char *prefix, const char *format, ...);
 
 #endif // __BT_SPI_OUT_H__

components/bt/common/btc/core/btc_manage.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -16,6 +16,12 @@ void **btc_profile_cb_tab;
 
 void esp_profile_cb_reset(void)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return;
+    }
+    #endif
+
     int i;
 
     for (i = 0; i < BTC_PID_NUM; i++) {
@@ -25,6 +31,12 @@ void esp_profile_cb_reset(void)
 
 int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return -1;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return -1;
     }
@@ -36,6 +48,12 @@ int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 
 void *btc_profile_cb_get(btc_pid_t profile_id)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return NULL;
+    }
+    #endif
+
     if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
         return NULL;
     }

components/bt/common/btc/core/btc_task.c

@@ -24,6 +24,8 @@
 #include "btc_gattc.h"
 #include "btc_gatt_common.h"
 #include "btc_gap_ble.h"
+#include "btc_iso_ble.h"
+#include "btc_ble_cte.h"
 #include "btc/btc_dm.h"
 #include "bta/bta_gatt_api.h"
 #if CLASSIC_BT_INCLUDED
@@ -210,7 +212,7 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
     [BTC_PID_RPR_CLIENT]        = {btc_ble_mesh_rpr_client_call_handler,        btc_ble_mesh_rpr_client_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_CLI */
 #if CONFIG_BLE_MESH_RPR_SRV
-    [BTC_PID_RPR_SERVER]        = {NULL,                                        btc_ble_mesh_rpr_server_cb_handler       },
+    [BTC_PID_RPR_SERVER]        = {btc_ble_mesh_rpr_server_call_handler,        btc_ble_mesh_rpr_server_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_SRV */
 #if CONFIG_BLE_MESH_SAR_CLI
     [BTC_PID_SAR_CLIENT]        = {btc_ble_mesh_sar_client_call_handler,        btc_ble_mesh_sar_client_cb_handler       },
@@ -258,6 +260,12 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
     [BTC_PID_BLE_MESH_BLE_COEX] = {btc_ble_mesh_ble_call_handler,               btc_ble_mesh_ble_cb_handler              },
 #endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    [BTC_PID_ISO_BLE]           = {btc_iso_ble_call_handler,                    btc_iso_ble_cb_handler                   },
+#endif  // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    [BTC_PID_BLE_CTE]           = {btc_ble_cte_call_handler,                    btc_ble_cte_cb_handler                   },
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
 };
 
 /*****************************************************************************
@@ -476,10 +484,10 @@ static bt_status_t btc_init_mem(void) {
 #endif
 
 #if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
-    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(sizeof(hf_local_param_t))) == NULL) {
         goto error_exit;
     }
-    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+    memset((void *)hf_local_param_ptr, 0, sizeof(hf_local_param_t));
 #endif
 
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
@@ -522,9 +530,18 @@ bt_status_t btc_init(void)
         return BT_STATUS_NOMEM;
     }
 #endif
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_init();
+#endif
 
 #if (BLE_INCLUDED == TRUE)
     btc_gap_callback_init();
+#if (BLE_FEAT_ISO_EN == TRUE)
+    btc_iso_callback_init();
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    btc_cte_callback_init();
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
     btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE
 
@@ -534,6 +551,9 @@ bt_status_t btc_init(void)
 
 void btc_deinit(void)
 {
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_deinit();
+#endif
 #if BTC_DYNAMIC_MEMORY
     btc_deinit_mem();
 #endif

components/bt/common/btc/include/btc/btc_task.h

@@ -105,6 +105,12 @@ typedef enum {
     BTC_PID_MBT_SERVER,
     BTC_PID_BLE_MESH_BLE_COEX,
 #endif /* CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    BTC_PID_ISO_BLE,
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    BTC_PID_BLE_CTE,
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
     BTC_PID_NUM,
 } btc_pid_t; //btc profile id
 

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -298,7 +298,7 @@ int esp_blufi_gatt_svr_deinit(void)
     return 0;
 }
 
-static int
+int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
     struct ble_gap_conn_desc desc;
@@ -331,7 +331,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
         }
         if (event->connect.status != 0) {
             /* Connection failed; resume advertising. */
-            esp_blufi_adv_start();
+           ((void(*)(void))arg)();
         }
         return 0;
     case BLE_GAP_EVENT_DISCONNECT:
@@ -366,7 +366,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
     case BLE_GAP_EVENT_ADV_COMPLETE:
         ESP_LOGI(TAG, "advertise complete; reason=%d",
                  event->adv_complete.reason);
-        esp_blufi_adv_start();
+        ((void(*)(void))arg)();
         return 0;
 
     case BLE_GAP_EVENT_SUBSCRIBE:
@@ -461,7 +461,7 @@ void esp_blufi_adv_start(void)
     adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
     adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
     rc = ble_gap_adv_start(own_addr_type, NULL, BLE_HS_FOREVER,
-                           &adv_params, esp_blufi_gap_event, NULL);
+                           &adv_params, esp_blufi_gap_event, esp_blufi_adv_start);
     if (rc != 0) {
         ESP_LOGE(TAG, "error enabling advertisement; rc=%d", rc);
         return;
@@ -511,7 +511,10 @@ void esp_blufi_disconnect(void)
     ble_gap_terminate(blufi_env.conn_id, BLE_ERR_REM_USER_CONN_TERM);
 }
 
-void esp_blufi_adv_stop(void) {}
+void esp_blufi_adv_stop(void)
+{
+    ble_gap_adv_stop();
+}
 
 void esp_blufi_send_encap(void *arg)
 {

components/bt/common/hci_log/bt_hci_log.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -10,6 +10,7 @@
 #include "bt_common.h"
 #include "osi/mutex.h"
 #include "esp_attr.h"
+#include "esp_timer.h"
 
 #if (BT_HCI_LOG_INCLUDED == TRUE)
 #define BT_HCI_LOG_PRINT_TAG                     (1)
@@ -124,6 +125,11 @@ static char IRAM_ATTR *bt_data_type_to_str(uint8_t data_type)
         // self-defining data
         tag = "S";
         break;
+    case HCI_LOG_DATA_TYPE_ISO_DATA:
+        // 5.2 iso data
+        tag = "I";
+        break;
+        break;
     default:
         // unknown data type
         tag = "U";
@@ -203,6 +209,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 {
     osi_mutex_t mutex_lock;
     uint8_t *g_hci_log_buffer;
+    int64_t ts;
+    uint8_t *temp_buf;
 
     if (!p_hci_log_ctl->p_hci_log_buffer) {
         return ESP_FAIL;
@@ -214,6 +222,16 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         return ESP_FAIL;
     }
 
+    ts = esp_timer_get_time();
+
+    temp_buf = (uint8_t *)malloc(data_len + 8);
+    memset(temp_buf, 0x0, data_len + 8);
+
+    memcpy(temp_buf, &ts, 8);
+    memcpy(temp_buf + 8, data, data_len);
+
+    data_len += 8;
+
     mutex_lock = p_hci_log_ctl->mutex_lock;
     osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
 
@@ -245,7 +263,7 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
         bt_hci_log_record_string(p_hci_log_ctl, str);
     }
 
-    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+    bt_hci_log_record_hex(p_hci_log_ctl, temp_buf, data_len);
 
     g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';
 
@@ -261,6 +279,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 
     osi_mutex_unlock(&mutex_lock);
 
+    free(temp_buf);
+
     return ESP_OK;
 }
 

components/bt/common/hci_log/include/hci_log/bt_hci_log.h

@@ -21,6 +21,7 @@ extern "C" {
 #define    HCI_LOG_DATA_TYPE_ADV             (5)
 #define    HCI_LOG_DATA_TYPE_SELF_DEFINE     (6)
 #define    HCI_LOG_DATA_TYPE_C2H_ACL         (7)
+#define    HCI_LOG_DATA_TYPE_ISO_DATA        (8)
 
 /**
  *

components/bt/common/tinycrypt/include/tinycrypt/aes.h

@@ -1,4 +1,8 @@
-/* aes.h - TinyCrypt interface to an AES-128 implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cbc_mode.h

@@ -1,4 +1,8 @@
-/* cbc_mode.h - TinyCrypt interface to a CBC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ccm_mode.h

@@ -1,4 +1,8 @@
-/* ccm_mode.h - TinyCrypt interface to a CCM mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/cmac_mode.h

@@ -1,4 +1,8 @@
-/*  cmac_mode.h -- interface to a CMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved

components/bt/common/tinycrypt/include/tinycrypt/constants.h

@@ -1,4 +1,8 @@
-/* constants.h - TinyCrypt interface to constants */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_mode.h

@@ -1,4 +1,8 @@
-/* ctr_mode.h - TinyCrypt interface to CTR mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/ctr_prng.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_prng.h - TinyCrypt interface to a CTR-PRNG implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc.h - TinyCrypt interface to common ECC functions */
 
 /* Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dh.h

@@ -1,4 +1,8 @@
-/* ecc_dh.h - TinyCrypt interface to EC-DH implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/include/tinycrypt/ecc_dsa.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ecc_dh.h - TinyCrypt interface to EC-DSA implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/ecc_platform_specific.h

@@ -1,4 +1,8 @@
-/*  uECC_platform_specific.h - Interface to platform specific functions*/
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /* Copyright (c) 2014, Kenneth MacKay
  * All rights reserved.

components/bt/common/tinycrypt/include/tinycrypt/hmac.h

@@ -1,4 +1,8 @@
-/* hmac.h - TinyCrypt interface to an HMAC implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -124,7 +128,7 @@ int tc_hmac_update(TCHmacState_t ctx, const void *data,
  *                key == NULL or
  *                taglen != TC_SHA256_DIGEST_SIZE
  *  @note ctx is erased before exiting. This should never be changed/removed.
- *  @note Assumes the tag bufer is at least sizeof(hmac_tag_size(state)) bytes
+ *  @note Assumes the tag buffer is at least sizeof(hmac_tag_size(state)) bytes
  *  state has been initialized by tc_hmac_init
  *  @param tag IN/OUT -- buffer to receive computed HMAC tag
  *  @param taglen IN -- size of tag in bytes

components/bt/common/tinycrypt/include/tinycrypt/hmac_prng.h

@@ -1,4 +1,8 @@
-/* hmac_prng.h - TinyCrypt interface to an HMAC-PRNG implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/include/tinycrypt/sha256.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* sha256.h - TinyCrypt interface to a SHA-256 implementation */
 
 /*

components/bt/common/tinycrypt/include/tinycrypt/utils.h

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* utils.h - TinyCrypt interface to platform-dependent run-time operations */
 
 /*

components/bt/common/tinycrypt/port/esp_tinycrypt_port.c

@@ -0,0 +1,87 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_tinycrypt_port.h"
+
+#include "esp_crypto_lock.h"
+#include "esp_private/esp_crypto_lock_internal.h"
+
+#if SOC_ECC_SUPPORTED
+#include "hal/ecc_hal.h"
+#include "hal/ecc_ll.h"
+#endif /* SOC_ECC_SUPPORTED */
+
+
+#if SOC_ECC_SUPPORTED
+static void  esp_tinycrypt_acquire_ecc_hardware(void)
+{
+    esp_crypto_ecc_lock_acquire();
+
+    ECC_RCC_ATOMIC() {
+        ecc_ll_enable_bus_clock(true);
+        ecc_ll_power_up();
+        ecc_ll_reset_register();
+    }
+}
+
+static void  esp_tinycrypt_release_ecc_hardware(void)
+{
+    ECC_RCC_ATOMIC() {
+        ecc_ll_enable_bus_clock(false);
+        ecc_ll_power_down();
+    }
+
+    esp_crypto_ecc_lock_release();
+}
+
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length)
+{
+    int result;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_verify_param(pk_x, pk_y, length);
+    ecc_hal_set_mode(ECC_MODE_VERIFY);
+    ecc_hal_start_calc();
+    while (!ecc_hal_is_calc_finished());
+    result = ecc_hal_read_verify_result();
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    if (result == 1) {
+        return 0;
+    } else {
+        return -1;
+    }
+}
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first)
+{
+    int ret = -1;
+    ecc_mode_t work_mode = verify_first ? ECC_MODE_VERIFY_THEN_POINT_MUL : ECC_MODE_POINT_MUL;
+
+    esp_tinycrypt_acquire_ecc_hardware();
+
+    ecc_hal_write_mul_param(scalar, p_x, p_y, num_bytes);
+    ecc_hal_set_mode(work_mode);
+    /*
+     * Enable constant-time point multiplication operations for the ECC hardware accelerator,
+     * if supported for the given target. This protects the ECC multiplication operation from
+     * timing attacks. This increases the time taken (by almost 50%) for some point
+     * multiplication operations performed by the ECC hardware accelerator.
+     */
+    ecc_hal_enable_constant_time_point_mul(true);
+    ecc_hal_start_calc();
+
+    while (!ecc_hal_is_calc_finished());
+
+    ret = ecc_hal_read_mul_result(r_x, r_y, num_bytes);
+
+    esp_tinycrypt_release_ecc_hardware();
+
+    return ret;
+}
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/port/esp_tinycrypt_port.h

@@ -0,0 +1,15 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include <stdbool.h>
+#include "soc/soc_caps.h"
+
+#if SOC_ECC_SUPPORTED
+int esp_tinycrypt_verify_ecc_point(const uint8_t *pk_x, const uint8_t *pk_y, uint8_t length);
+
+int esp_tinycrypt_calc_ecc_mult(const uint8_t *p_x, const uint8_t *p_y, const uint8_t *scalar,
+                                uint8_t *r_x, uint8_t *r_y, uint8_t num_bytes, bool verify_first);
+#endif /* SOC_ECC_SUPPORTED */

components/bt/common/tinycrypt/src/aes_decrypt.c

@@ -1,4 +1,8 @@
-/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* aes_decrypt.c - TinyCrypt implementation of AES decryption procedure */
+
 #include <tinycrypt/aes.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/aes_encrypt.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* aes_encrypt.c - TinyCrypt implementation of AES encryption procedure */
 
 /*

components/bt/common/tinycrypt/src/cbc_mode.c

@@ -1,4 +1,8 @@
-/* cbc_mode.c - TinyCrypt implementation of CBC mode encryption & decryption */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ccm_mode.c

@@ -1,4 +1,8 @@
-/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* ccm_mode.c - TinyCrypt implementation of CCM mode */
+
 #include <tinycrypt/ccm_mode.h>
 #include <tinycrypt/constants.h>
 #include <tinycrypt/utils.h>

components/bt/common/tinycrypt/src/cmac_mode.c

@@ -1,4 +1,8 @@
-/* cmac_mode.c - TinyCrypt CMAC mode implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/ctr_mode.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /* ctr_mode.c - TinyCrypt CTR mode implementation */
 
 /*

components/bt/common/tinycrypt/src/ctr_prng.c

@@ -1,4 +1,8 @@
-/* ctr_prng.c - TinyCrypt implementation of CTR-PRNG */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2016, Chris Morrison

components/bt/common/tinycrypt/src/ecc.c

@@ -1,4 +1,8 @@
-/* ecc.c - TinyCrypt implementation of common ECC functions */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay
@@ -55,6 +59,9 @@
 #include <tinycrypt/ecc.h>
 #include <tinycrypt/ecc_platform_specific.h>
 #include <string.h>
+#include <stdio.h>
+
+#include "esp_tinycrypt_port.h"
 
 /* IMPORTANT: Make sure a cryptographically-secure PRNG is set and the platform
  * has access to enough entropy in order to feed the PRNG regularly. */
@@ -635,6 +642,7 @@ void apply_z(uECC_word_t * X1, uECC_word_t * Y1, const uECC_word_t * const Z,
 	uECC_vli_modMult_fast(Y1, Y1, t1, curve); /* y1 * z^3 */
 }
 
+#if !SOC_ECC_SUPPORTED
 /* P = (x1, y1) => 2P, (x2, y2) => P' */
 static void XYcZ_initial_double(uECC_word_t * X1, uECC_word_t * Y1,
 				uECC_word_t * X2, uECC_word_t * Y2,
@@ -658,31 +666,6 @@ static void XYcZ_initial_double(uECC_word_t * X1, uECC_word_t * Y1,
 	apply_z(X2, Y2, z, curve);
 }
 
-void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1,
-	      uECC_word_t * X2, uECC_word_t * Y2,
-	      uECC_Curve curve)
-{
-	/* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
-	uECC_word_t t5[NUM_ECC_WORDS];
-	wordcount_t num_words = curve->num_words;
-
-	uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
-	uECC_vli_modSquare_fast(t5, t5, curve); /* t5 = (x2 - x1)^2 = A */
-	uECC_vli_modMult_fast(X1, X1, t5, curve); /* t1 = x1*A = B */
-	uECC_vli_modMult_fast(X2, X2, t5, curve); /* t3 = x2*A = C */
-	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
-	uECC_vli_modSquare_fast(t5, Y2, curve); /* t5 = (y2 - y1)^2 = D */
-
-	uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
-	uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
-	uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
-	uECC_vli_modMult_fast(Y1, Y1, X2, curve); /* t2 = y1*(C - B) */
-	uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
-	uECC_vli_modMult_fast(Y2, Y2, X2, curve); /* t4 = (y2 - y1)*(B - x3) */
-	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
-
-	uECC_vli_set(X2, t5, num_words);
-}
 
 /* Input P = (x1, y1, Z), Q = (x2, y2, Z)
    Output P + Q = (x3, y3, Z3), P - Q = (x3', y3', Z3)
@@ -725,12 +708,49 @@ static void XYcZ_addC(uECC_word_t * X1, uECC_word_t * Y1,
 
 	uECC_vli_set(X1, t7, num_words);
 }
+#endif /* !SOC_ECC_SUPPORTED */
+
+void XYcZ_add(uECC_word_t * X1, uECC_word_t * Y1,
+	      uECC_word_t * X2, uECC_word_t * Y2,
+	      uECC_Curve curve)
+{
+	/* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
+	uECC_word_t t5[NUM_ECC_WORDS];
+	wordcount_t num_words = curve->num_words;
+
+	uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
+	uECC_vli_modSquare_fast(t5, t5, curve); /* t5 = (x2 - x1)^2 = A */
+	uECC_vli_modMult_fast(X1, X1, t5, curve); /* t1 = x1*A = B */
+	uECC_vli_modMult_fast(X2, X2, t5, curve); /* t3 = x2*A = C */
+	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
+	uECC_vli_modSquare_fast(t5, Y2, curve); /* t5 = (y2 - y1)^2 = D */
+
+	uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
+	uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
+	uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
+	uECC_vli_modMult_fast(Y1, Y1, X2, curve); /* t2 = y1*(C - B) */
+	uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
+	uECC_vli_modMult_fast(Y2, Y2, X2, curve); /* t4 = (y2 - y1)*(B - x3) */
+	uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
+
+	uECC_vli_set(X2, t5, num_words);
+}
 
 void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
 		   const uECC_word_t * scalar,
 		   const uECC_word_t * initial_Z,
 		   bitcount_t num_bits, uECC_Curve curve)
 {
+#if SOC_ECC_SUPPORTED
+    wordcount_t num_words = curve->num_words;
+
+    /* Only p256r1 is supported currently. */
+    assert (curve == uECC_secp256r1());
+
+    esp_tinycrypt_calc_ecc_mult((const uint8_t *)&point[0], (const uint8_t *)&point[num_words],
+                                (uint8_t *)scalar, (uint8_t *)&result[0], (uint8_t *)&result[num_words],
+                                num_words * uECC_WORD_SIZE, false);
+#else
 	/* R0 and R1 */
 	uECC_word_t Rx[2][NUM_ECC_WORDS];
 	uECC_word_t Ry[2][NUM_ECC_WORDS];
@@ -769,6 +789,7 @@ void EccPoint_mult(uECC_word_t * result, const uECC_word_t * point,
 
 	uECC_vli_set(result, Rx[0], num_words);
 	uECC_vli_set(result + num_words, Ry[0], num_words);
+#endif /* SOC_ECC_SUPPORTED */
 }
 
 uECC_word_t regularize_k(const uECC_word_t * const k, uECC_word_t *k0,
@@ -862,8 +883,6 @@ int uECC_generate_random_int(uECC_word_t *random, const uECC_word_t *top,
 
 int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve)
 {
-	uECC_word_t tmp1[NUM_ECC_WORDS];
-	uECC_word_t tmp2[NUM_ECC_WORDS];
 	wordcount_t num_words = curve->num_words;
 
 	/* The point at infinity is invalid. */
@@ -877,19 +896,34 @@ int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve)
 		return -2;
 	}
 
+#if SOC_ECC_SUPPORTED
+    /* Only p256r1 is supported currently. */
+    if (curve != uECC_secp256r1()) {
+        return -5;
+    }
+
+    if (esp_tinycrypt_verify_ecc_point((const uint8_t *)&point[0],
+                                       (const uint8_t *)&point[num_words],
+                                       num_words * uECC_WORD_SIZE)) {
+        return -3;
+    }
+#else
+	uECC_word_t tmp1[NUM_ECC_WORDS];
+	uECC_word_t tmp2[NUM_ECC_WORDS];
+
 	uECC_vli_modSquare_fast(tmp1, point + num_words, curve);
 	curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
 
 	/* Make sure that y^2 == x^3 + ax + b */
 	if (uECC_vli_equal(tmp1, tmp2, num_words) != 0)
 		return -3;
+#endif /* SOC_ECC_SUPPORTED */
 
 	return 0;
 }
 
 int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve)
 {
-
 	uECC_word_t _public[NUM_ECC_WORDS * 2];
 
 	uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
@@ -908,7 +942,6 @@ int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve)
 int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key,
 			    uECC_Curve curve)
 {
-
 	uECC_word_t _private[NUM_ECC_WORDS];
 	uECC_word_t _public[NUM_ECC_WORDS * 2];
 

components/bt/common/tinycrypt/src/ecc_dh.c

@@ -1,4 +1,8 @@
-/* ec_dh.c - TinyCrypt implementation of EC-DH */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  * Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/src/ecc_dsa.c

@@ -1,4 +1,8 @@
-/* ec_dsa.c - TinyCrypt implementation of EC-DSA */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /* Copyright (c) 2014, Kenneth MacKay
  * All rights reserved.

components/bt/common/tinycrypt/src/ecc_platform_specific.c

@@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 /*  uECC_platform_specific.c - Implementation of platform specific functions*/
 
 /* Copyright (c) 2014, Kenneth MacKay

components/bt/common/tinycrypt/src/hmac.c

@@ -1,4 +1,8 @@
-/* hmac.c - TinyCrypt implementation of the HMAC algorithm */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/hmac_prng.c

@@ -1,4 +1,8 @@
-/* hmac_prng.c - TinyCrypt implementation of HMAC-PRNG */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* hmac_prng.c - TinyCrypt implementation of HMAC-PRNG */
+
 #include <tinycrypt/hmac_prng.h>
 #include <tinycrypt/hmac.h>
 #include <tinycrypt/constants.h>

components/bt/common/tinycrypt/src/sha256.c

@@ -1,4 +1,8 @@
-/* sha256.c - TinyCrypt SHA-256 crypto hash algorithm implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.

components/bt/common/tinycrypt/src/utils.c

@@ -1,4 +1,8 @@
-/* utils.c - TinyCrypt platform-dependent run-time operations */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 /*
  *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
@@ -30,6 +34,8 @@
  *  POSSIBILITY OF SUCH DAMAGE.
  */
 
+/* utils.c - TinyCrypt platform-dependent run-time operations */
+
 #include <tinycrypt/utils.h>
 #include <tinycrypt/constants.h>
 

components/bt/controller/esp32/Kconfig.in

@@ -421,6 +421,7 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
 
 config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
     default n
     help
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
@@ -497,7 +498,6 @@ config BTDM_BLE_PING_EN
         This option is used for some compatibility problems related to LE ping procedure.
 
 config BTDM_CTRL_CONTROLLER_DEBUG_MODE_1
-    visible if 0
     bool "Enable Bluetooth controller debugging mode 1 (for internal use only)"
     default n
     depends on BT_ENABLED

components/bt/controller/esp32/bt.c

@@ -252,6 +252,7 @@ extern uint32_t _bt_controller_data_end;
 extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
+extern void btdm_aa_check_enhance_enable(void);
 
 #ifdef CONFIG_BT_BLUEDROID_ENABLED
 extern void bt_stack_enableSecCtrlVsCmd(bool en);
@@ -965,7 +966,7 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
     assert(us_to_sleep > BTDM_MIN_TIMER_UNCERTAINTY_US);
     // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
     // and set the timer in advance
-    uint32_t uncertainty = (us_to_sleep >> 11);
+    uint32_t uncertainty = (us_to_sleep / 1000);
     if (uncertainty < BTDM_MIN_TIMER_UNCERTAINTY_US) {
         uncertainty = BTDM_MIN_TIMER_UNCERTAINTY_US;
     }
@@ -1540,12 +1541,14 @@ static esp_err_t btdm_low_power_mode_init(void)
     bool select_src_ret __attribute__((unused));
     bool set_div_ret __attribute__((unused));
     if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        ESP_LOGI(BTDM_LOG_TAG, "Using main XTAL as clock source");
         select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
         set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
         assert(select_src_ret && set_div_ret);
         btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
         btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
     } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        ESP_LOGI(BTDM_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
         select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
         set_div_ret = btdm_lpclk_set_div(0);
         assert(select_src_ret && set_div_ret);
@@ -1699,7 +1702,11 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif
 
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
-    ble_log_spi_out_init();
+    if (ble_log_spi_out_init() != 0) {
+        ESP_LOGE(BTDM_LOG_TAG, "BLE Log SPI output init failed");
+        err = ESP_ERR_NO_MEM;
+        goto error;
+    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
     btdm_cfg_mask = btdm_config_mask_load();
@@ -1728,6 +1735,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
 error:
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     bt_controller_deinit_internal();
 
     return err;
@@ -1841,6 +1852,10 @@ static void patch_apply(void)
 #ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
     config_ble_funcs_reset();
 #endif
+
+#if BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)

components/bt/controller/esp32c2/Kconfig.in

@@ -90,7 +90,7 @@ menu "HCI Config"
     config BT_LE_HCI_TRANS_TASK_STACK_SIZE
         int "HCI transport task stack size"
         depends on !BT_LE_HCI_INTERFACE_USE_RAM
-        default 1024
+        default 2048
         help
             This configures stack size of hci transport task
 endmenu
@@ -281,94 +281,103 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable controller log module
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable hci log module
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Only operate in dump mode
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-    bool "Output ble controller logs to SPI bus (Experimental)"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    select BT_BLE_LOG_SPI_OUT_ENABLED
-    default n
-    help
-        Output ble controller logs to SPI bus
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-            Store ble controller logs to flash memory.
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+                Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
-            The size of ble controller log partition shall be a multiples of 4K.
-            The name of log partition shall be "bt_ctrl_log".
-            The partition type shall be ESP_PARTITION_TYPE_DATA.
-            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
+                The size of ble controller log partition shall be a multiples of 4K.
+                The name of log partition shall be "bt_ctrl_log".
+                The partition type shall be ESP_PARTITION_TYPE_DATA.
+                The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the first BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
-            Configure the size of the second BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
+                Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the BLE HCI LOG buffer.
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the BLE HCI LOG buffer.
 
-config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
-    bool "Enable wrap panic handler"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
+endmenu
 
-config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
-    bool "Enable esp_task_wdt_isr_user_handler implementation"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -424,7 +433,7 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
 
 config BT_LE_WHITELIST_SIZE
     int "BLE white list size"
-    range 1 15
+    range 1 31
     default 12
     depends on !BT_NIMBLE_ENABLED
 
@@ -445,6 +454,23 @@ config BT_LE_LL_SCA
     help
         Sleep clock accuracy of our device (in ppm)
 
+config BT_LE_LL_PEER_SCA_SET_ENABLE
+    bool "Enable to set constant peer SCA"
+    default n
+    help
+        Enable setting of constant peer SCA, use this if peer device has SCA larger than 500 PPM.
+        Enable this option, the controller will always use BT_LE_LL_PEER_SCA as the peer SCA value
+        to calculate the window widening instead of the value received from peer device.
+
+
+config BT_LE_LL_PEER_SCA
+    int "Constant peer sleep clock accuracy value"
+    range 0 10000
+    depends on BT_LE_LL_PEER_SCA_SET_ENABLE
+    default 0
+    help
+        Set the sleep clock accuracy of peer device
+
 config BT_LE_MAX_CONNECTIONS
     int "Maximum number of concurrent connections"
     depends on !BT_NIMBLE_ENABLED
@@ -567,7 +593,7 @@ config BT_LE_CCA_RSSI_THRESH
     int "CCA RSSI threshold value"
     depends on BT_LE_TX_CCA_ENABLED
     range 20 100
-    default 20
+    default 65
     help
         Power threshold of CCA in unit of -1 dBm.
 
@@ -682,6 +708,11 @@ config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
     depends on BT_CTRL_RUN_IN_FLASH_ONLY
     default n
 
+config BT_LE_PLACE_SLEEP_RELATED_INTO_IRAM
+    bool
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_LE_SLEEP_ENABLE
+    default y
+
 config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
     default n
@@ -689,3 +720,33 @@ config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.

components/bt/controller/esp32c2/ble.c

@@ -12,9 +12,14 @@
  ************************************************************************
  */
 #if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
-void adv_stack_enableClearLegacyAdvVsCmd(bool en);
 void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
 /* Local functions definition
@@ -32,10 +37,18 @@ void ble_stack_enableVsCmds(bool en)
 #endif // DEFAULT_BT_LE_ROLE_OBSERVER
 
     chanSel_stack_enableSetCsaVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
 }
 
 void ble_stack_enableVsEvents(bool en)
 {
+#if DEFAULT_BT_LE_ROLE_BROADCASTER
+    adv_stack_enableScanReqRxdVsEvent(en);
+#endif // DEFAULT_BT_LE_ROLE_BROADCASTER
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
 }
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 

components/bt/controller/esp32c2/bt.c

@@ -45,6 +45,7 @@
 #include "soc/syscon_reg.h"
 #include "soc/modem_clkrst_reg.h"
 #include "esp_private/periph_ctrl.h"
+#include "esp_private/esp_clk_tree_common.h"
 #include "bt_osi_mem.h"
 
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
@@ -65,11 +66,9 @@
 #include "hal/efuse_ll.h"
 #include "soc/rtc.h"
 
-#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #include "ble_log/ble_log_spi_out.h"
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
 /* Macro definition
  ************************************************************************
@@ -119,7 +118,12 @@ struct ext_funcs_t {
 };
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* External functions or variables
@@ -128,14 +132,16 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int ble_log_init_async(interface_func_t interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int ble_log_deinit_async(void);
+extern int ble_log_init_simple(interface_func_t interface, void *handler);
+extern void ble_log_deinit_simple(void);
 extern void ble_log_async_output_dump_all(bool output);
-extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern void esp_panic_handler_feed_wdts(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
-extern int ble_controller_disable(void);
+extern void ble_controller_disable(void);
 extern int esp_register_ext_funcs (struct ext_funcs_t *);
 extern void esp_unregister_ext_funcs (void);
 extern int esp_ble_ll_set_public_addr(const uint8_t *addr);
@@ -151,6 +157,9 @@ extern void r_ble_rtc_wake_up_state_clr(void);
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern void esp_ble_set_wakeup_overhead(uint32_t overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+extern void r_ble_ll_customize_peer_sca_set(uint16_t peer_sca);
+#endif  // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
 extern int os_msys_init(void);
 extern void os_msys_buf_free(void);
 extern int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x,
@@ -198,10 +207,12 @@ static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
-#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
@@ -211,50 +222,29 @@ void *g_ble_lll_rfmgmt_env_p;
 #endif
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
-enum log_out_mode {
-    LOG_DUMP_MEMORY,
-    LOG_ASYNC_OUT,
-    LOG_STORAGE_TO_FLASH,
-    LOG_SPI_OUT,
-};
+static bool log_is_inited = false;
 
-bool log_is_inited = false;
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-uint8_t log_output_mode = LOG_DUMP_MEMORY;
-#else
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
-#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-uint8_t log_output_mode = LOG_SPI_OUT;
-#else
-uint8_t log_output_mode = LOG_ASYNC_OUT;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-
-void esp_bt_log_output_mode_set(uint8_t output_mode)
+esp_err_t esp_bt_controller_log_init(void)
 {
-    log_output_mode = output_mode;
-}
-
-uint8_t esp_bt_log_output_mode_get(void)
-{
-    return log_output_mode;
-}
-
-esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
-{
-    esp_err_t ret = ESP_OK;
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    bool task_create;
-    uint8_t buffers = 0;
-
     if (log_is_inited) {
-        return ret;
+        return ESP_OK;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        goto spi_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    if (ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
@@ -262,44 +252,41 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
     buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 
-    switch (log_output_mode) {
-        case LOG_DUMP_MEMORY:
-            task_create = false;
-            break;
-        case LOG_ASYNC_OUT:
-        case LOG_STORAGE_TO_FLASH:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-                esp_bt_ctrl_log_partition_get_and_erase_first_block();
-            }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            break;
-        case LOG_SPI_OUT:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            ble_log_spi_out_init();
-            bt_controller_log_interface = ble_log_spi_out_write_esp;
+    bool task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    task_create = false;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_ctrl_log_partition_get_and_erase_first_block();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            break;
-        default:
-            assert(0);
-    }
 
-    ret = ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
-    if (ret == ESP_OK) {
-        log_is_inited = true;
+    if (ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
+        goto log_init_failed;
     }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
-    return ret;
+    log_is_inited = true;
+    return ESP_OK;
+
+log_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+spi_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    return ESP_FAIL;
 }
 
-void esp_bt_ontroller_log_deinit(void)
+void esp_bt_controller_log_deinit(void)
 {
-    ble_log_deinit_async();
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
     ble_log_spi_out_deinit();
-#endif
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
     log_is_inited = false;
 }
 
@@ -392,13 +379,13 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 
     portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     ble_log_async_output_dump_all(true);
+    esp_bt_controller_log_deinit();
     stop_write = true;
-    esp_bt_ontroller_log_deinit();
-    portEXIT_CRITICAL_SAFE(&spinlock);
 
     buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_feed_wdts();
     if (is_filled) {
         read_index = next_erase_index;
     } else {
@@ -410,7 +397,7 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     while (read_index != write_index) {
         esp_rom_printf("%02x ", buffer[read_index]);
         if (print_len > max_print_len) {
-            vTaskDelay(2);
+            esp_panic_handler_feed_wdts();
             print_len = 0;
         }
 
@@ -418,45 +405,57 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
         read_index = (read_index + 1) % MAX_STORAGE_SIZE;
     }
     esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
     esp_partition_munmap(mmap_handle);
-    err = esp_bt_controller_log_init(log_output_mode);
+    err = esp_bt_controller_log_init();
     assert(err == ESP_OK);
 
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
-{
-    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_controller_log_storage(len, addr, end);
-#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        for (int i = 0; i < len; i++) {
-            esp_rom_printf("%02x ", addr[i]);
-        }
 
-        if (end) {
-            esp_rom_printf("\n");
-        }
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
+{
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_controller_log_storage(len, addr, end);
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
     }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-   if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_read_ctrl_log_from_flash(output);
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-        portENTER_CRITICAL_SAFE(&spinlock);
-        esp_panic_handler_reconfigure_wdts(5000);
-        BT_ASSERT_PRINT("\r\n[DUMP_START:");
-        ble_log_async_output_dump_all(output);
-        BT_ASSERT_PRINT(":DUMP_END]\r\n");
-        portEXIT_CRITICAL_SAFE(&spinlock);
-    }
+    esp_bt_read_ctrl_log_from_flash(output);
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    BT_ASSERT_PRINT("\r\n[DUMP_START:");
+    ble_log_async_output_dump_all(output);
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif
 }
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
 void esp_task_wdt_isr_user_handler(void)
 {
@@ -480,6 +479,13 @@ static bool s_ble_active = false;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #define BTDM_MIN_TIMER_UNCERTAINTY_US      (200)
 #endif // CONFIG_PM_ENABLE
+#ifdef CONFIG_XTAL_FREQ_26
+#define MAIN_XTAL_FREQ_HZ                 (26000000)
+static DRAM_ATTR uint32_t s_bt_lpclk_freq = 40000;
+#else
+#define MAIN_XTAL_FREQ_HZ                 (40000000)
+static DRAM_ATTR uint32_t s_bt_lpclk_freq = 32000;
+#endif
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
 
 #define BLE_RTC_DELAY_US                    (1800)
@@ -604,13 +610,6 @@ static int esp_intr_free_wrapper(void **ret_handle)
     return rc;
 }
 
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-void sleep_modem_light_sleep_overhead_set(uint32_t overhead)
-{
-    esp_ble_set_wakeup_overhead(overhead);
-}
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
-
 modem_clock_lpclk_src_t esp_bt_get_lpclk_src(void)
 {
     return s_bt_lpclk_src;
@@ -618,6 +617,10 @@ modem_clock_lpclk_src_t esp_bt_get_lpclk_src(void)
 
 void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
 {
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+
     if (clk_src >= MODEM_CLOCK_LPCLK_SRC_MAX) {
         return;
     }
@@ -625,7 +628,28 @@ void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
     s_bt_lpclk_src = clk_src;
 }
 
-IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
+uint32_t esp_bt_get_lpclk_freq(void)
+{
+    return s_bt_lpclk_freq;
+}
+
+void esp_bt_set_lpclk_freq(uint32_t clk_freq)
+{
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+    if (!clk_freq) {
+        return;
+    }
+
+    if (MAIN_XTAL_FREQ_HZ % clk_freq) {
+        return;
+    }
+
+    s_bt_lpclk_freq = clk_freq;
+}
+
+void controller_sleep_cb(uint32_t enable_tick, void *arg)
 {
     if (!s_ble_active) {
         return;
@@ -638,16 +662,23 @@ IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
     s_ble_active = false;
 }
 
-IRAM_ATTR void controller_wakeup_cb(void *arg)
+void controller_wakeup_cb(void *arg)
 {
     if (s_ble_active) {
         return;
     }
-    esp_phy_enable(PHY_MODEM_BT);
-    // need to check if need to call pm lock here
 #ifdef CONFIG_PM_ENABLE
+    esp_pm_config_t pm_config;
     esp_pm_lock_acquire(s_pm_lock);
+    esp_pm_get_configuration(&pm_config);
+    assert(esp_rom_get_cpu_ticks_per_us() == pm_config.max_freq_mhz);
 #endif //CONFIG_PM_ENABLE
+    esp_phy_enable(PHY_MODEM_BT);
+    if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
+        uint32_t *clk_freq = (uint32_t *)arg;
+        *clk_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+    }
+    // need to check if need to call pm lock here
     s_ble_active = true;
 }
 
@@ -678,7 +709,7 @@ esp_err_t controller_sleep_init(modem_clock_lpclk_src_t slow_clk_src)
     esp_sleep_enable_bt_wakeup();
     ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Enable light sleep, the wake up source is BLE timer");
 
-    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
     if (rc != ESP_OK) {
         goto error;
     }
@@ -688,7 +719,7 @@ esp_err_t controller_sleep_init(modem_clock_lpclk_src_t slow_clk_src)
 error:
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
     esp_sleep_disable_bt_wakeup();
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
     /*lock should release first and then delete*/
     if (s_pm_lock != NULL) {
@@ -705,7 +736,7 @@ void controller_sleep_deinit(void)
     r_ble_rtc_wake_up_state_clr();
     esp_sleep_disable_bt_wakeup();
     esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_AUTO);
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif // CONFIG_FREERTOS_USE_TICKLESS_IDLE
 #ifdef CONFIG_PM_ENABLE
     /*lock should release first and then delete*/
@@ -724,11 +755,7 @@ static void esp_bt_rtc_slow_clk_select(modem_clock_lpclk_src_t slow_clk_src)
             SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 1, MODEM_CLKRST_LP_TIMER_SEL_XTAL_S);
             SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_8M_S);
             SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_RTC_SLOW_S);
-#ifdef CONFIG_XTAL_FREQ_26
-            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 129, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
-#else
-            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 249, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
-#endif // CONFIG_XTAL_FREQ_26
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, (MAIN_XTAL_FREQ_HZ/(5 * s_bt_lpclk_freq) - 1), MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
             break;
         case MODEM_CLOCK_LPCLK_SRC_EXT32K:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using external 32.768 kHz XTAL as clock source");
@@ -738,6 +765,14 @@ static void esp_bt_rtc_slow_clk_select(modem_clock_lpclk_src_t slow_clk_src)
             SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_RTC_SLOW_S);
             SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 0, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
             break;
+        case MODEM_CLOCK_LPCLK_SRC_RC_SLOW:
+            ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, use with caution as it may not maintain ACL or Sync process due to low clock accuracy!");
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_XTAL32K_S);
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_XTAL_S);
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 0, MODEM_CLKRST_LP_TIMER_SEL_8M_S);
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, 1, 1, MODEM_CLKRST_LP_TIMER_SEL_RTC_SLOW_S);
+            SET_PERI_REG_BITS(MODEM_CLKRST_MODEM_LP_TIMER_CONF_REG, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM, 0, MODEM_CLKRST_LP_TIMER_CLK_DIV_NUM_S);
+            break;
         default:
             ESP_LOGE(NIMBLE_PORT_LOG_TAG, "Unsupported slow clock");
             assert(0);
@@ -753,23 +788,26 @@ static modem_clock_lpclk_src_t ble_rtc_clk_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_BT_LE_LP_CLK_SRC_MAIN_XTAL
         s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL;
 #else
+#if CONFIG_RTC_CLK_SRC_INT_RC
+        s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_RC_SLOW;
+#elif CONFIG_RTC_CLK_SRC_EXT_OSC
         if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_OSC_SLOW) {
             s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_EXT32K;
         } else {
             ESP_LOGW(NIMBLE_PORT_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock");
             s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL;
         }
+#endif  // CONFIG_RTC_CLK_SRC_INT_RC
 #endif // CONFIG_BT_LE_LP_CLK_SRC_MAIN_XTAL
     }
 
     if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_EXT32K) {
         cfg->rtc_freq = 32768;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL) {
-#ifdef CONFIG_XTAL_FREQ_26
-        cfg->rtc_freq = 40000;
-#else
-        cfg->rtc_freq = 32000;
-#endif // CONFIG_XTAL_FREQ_26
+        cfg->rtc_freq = s_bt_lpclk_freq;
+    } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
+        cfg->rtc_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+        cfg->ble_ll_sca = 3000;
     }
     esp_bt_rtc_slow_clk_select(s_bt_lpclk_src);
     return s_bt_lpclk_src;
@@ -872,11 +910,15 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+    r_ble_ll_customize_peer_sca_set(CONFIG_BT_LE_LL_PEER_SCA);
+#endif // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble rom commit:[%s]", r_ble_controller_get_rom_compile_version());
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ret = esp_bt_controller_log_init(log_output_mode);
+    ret = esp_bt_controller_log_init();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto controller_init_err;
@@ -917,7 +959,7 @@ free_controller:
     controller_sleep_deinit();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 controller_init_err:
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     ble_controller_deinit();
 modem_deint:
@@ -946,7 +988,7 @@ esp_err_t esp_bt_controller_deinit(void)
     controller_sleep_deinit();
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     ble_controller_deinit();
 
@@ -1035,9 +1077,9 @@ esp_err_t esp_bt_controller_disable(void)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "invalid controller state");
         return ESP_FAIL;
     }
-    if (ble_controller_disable() != 0) {
-        return ESP_FAIL;
-    }
+    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
+
+    ble_controller_disable();
     ble_stack_disable();
     if (s_ble_active) {
         esp_phy_disable(PHY_MODEM_BT);
@@ -1049,7 +1091,6 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
-    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
     return ESP_OK;
 }
 
@@ -1532,3 +1573,10 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -226,6 +226,32 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else

components/bt/controller/esp32c3/Kconfig.in

@@ -83,13 +83,16 @@ choice BT_BLE_CCA_MODE
     default BT_BLE_CCA_MODE_NONE
     help
         Define BT BLE CCA mode
+        Note that if CCA feature is enabled, the hardware may not transmit packets due to channel busy.
+        Therefore, it may potentially lead to an increase in the time taken for scanning advertising packet
+        and establishing connections, or a decrease in the throughput rate of the connection.
 
     config BT_BLE_CCA_MODE_NONE
         bool "NONE"
     config BT_BLE_CCA_MODE_HW
         bool "Hardware"
     config BT_BLE_CCA_MODE_SW
-        bool "Software"
+        bool "Software (experimental)"
 endchoice
 
 config BT_BLE_CCA_MODE
@@ -226,7 +229,7 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
-    depends on (!BT_CTRL_RUN_IN_FLASH_ONLY) || (BT_CTRL_RUN_IN_FLASH_ONLY && BT_CTRL_BLE_SCAN)
+    depends on BT_CTRL_BLE_SCAN
     default y
     help
         The function is mainly used to enable flow control for advertising reports. When it is enabled,
@@ -411,10 +414,10 @@ menu "MODEM SLEEP Options"
                 modem sleep to be used with both DFS and light sleep.
 
         config BT_CTRL_LPCLK_SEL_RTC_SLOW
-            bool "Internal 150kHz RC oscillator"
+            bool "Internal 136kHz RC oscillator"
             depends on RTC_CLK_SRC_INT_RC
             help
-                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
+                Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                 in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
     endchoice
 
@@ -525,30 +528,31 @@ config BT_CTRL_RUN_IN_FLASH_ONLY
         impact on Bluetooth performance.
 
 config BT_CTRL_DTM_ENABLE
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
     bool "Enable direct test mode feature"
-    default n
-
-config BT_CTRL_BLE_MASTER
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
-    bool "Enable BLE master role feature"
     default y
 
+config BT_CTRL_BLE_MASTER
+    bool "Enable BLE connection feature"
+    default y
+    help
+        If this option is disabled, it is not recommended to use connectable ADV.
+
 config BT_CTRL_BLE_TEST
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
-    bool "Enable BLE QA test feature"
+    bool "Enable BLE QA test feature (Not Used)"
     default n
 
 config BT_CTRL_BLE_SCAN
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
     bool "Enable BLE scan feature"
     default y
 
 config BT_CTRL_BLE_SECURITY_ENABLE
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_CONTROLLER_ONLY
     bool "Enable BLE security feature"
     default y
 
+config BT_CTRL_BLE_ADV
+    bool "Enable BLE ADV feature"
+    default y
+
 config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
     default n
@@ -593,6 +597,7 @@ menu "Controller debug log Options (Experimental)"
         depends on BT_CTRL_LE_LOG_EN
         depends on !BT_CTRL_LE_LOG_DUMP_ONLY
         select BT_BLE_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_SPI_OUT_LL_ENABLED
         default n
         help
             Output ble controller logs to SPI bus

components/bt/controller/esp32c3/bt.c

@@ -311,6 +311,17 @@ extern void advFilter_stack_enableDupExcListVsCmd(bool en);
 extern void chanSel_stack_enableSetCsaVsCmd(bool en);
 #endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
 
+extern void ble_dtm_funcs_reset(void);
+extern void ble_scan_funcs_reset(void);
+extern void ble_42_adv_funcs_reset(void);
+extern void ble_init_funcs_reset(void);
+extern void ble_con_funcs_reset(void);
+extern void ble_cca_funcs_reset(void);
+extern void ble_ext_adv_funcs_reset(void);
+extern void ble_ext_scan_funcs_reset(void);
+extern void ble_base_funcs_reset(void);
+extern void ble_enc_funcs_reset(void);
+
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _bt_controller_bss_start;
@@ -539,7 +550,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 #if CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
 static IRAM_ATTR void esp_bt_controller_spi_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
-    return ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY, addr, len);
+    ble_log_spi_out_ll_write(len, addr, 0, NULL, 0);
 }
 #endif // CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
 
@@ -1264,6 +1275,46 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
     btdm_aa_check_enhance_enable();
 #endif
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    // do nothing
+#else
+    ESP_LOGI(BT_LOG_TAG, "Feature Config, ADV:%d, BLE_50:%d, DTM:%d, SCAN:%d, CCA:%d, SMP:%d, CONNECT:%d",
+                        BT_CTRL_BLE_ADV, BT_CTRL_50_FEATURE_SUPPORT, BT_CTRL_DTM_ENABLE, BT_CTRL_BLE_SCAN,
+                        BT_BLE_CCA_MODE, BLE_SECURITY_ENABLE, BT_CTRL_BLE_MASTER);
+
+    ble_base_funcs_reset();
+#if CONFIG_BT_CTRL_BLE_ADV
+    ble_42_adv_funcs_reset();
+#if (BT_CTRL_50_FEATURE_SUPPORT == 1)
+    ble_ext_adv_funcs_reset();
+#endif //
+#endif // CONFIG_BT_CTRL_BLE_ADV
+
+#if CONFIG_BT_CTRL_DTM_ENABLE
+    ble_dtm_funcs_reset();
+#endif // CONFIG_BT_CTRL_DTM_ENABLE
+
+#if CONFIG_BT_CTRL_BLE_SCAN
+    ble_scan_funcs_reset();
+#if (BT_CTRL_50_FEATURE_SUPPORT == 1)
+    ble_ext_scan_funcs_reset();
+#endif // (BT_CTRL_50_FEATURE_SUPPORT == 1)
+#endif // CONFIG_BT_CTRL_BLE_SCAN
+
+#if (BT_BLE_CCA_MODE != 0)
+    ble_cca_funcs_reset();
+#endif // (BT_BLE_CCA_MODE != 0)
+
+#if CONFIG_BT_CTRL_BLE_SECURITY_ENABLE
+    ble_enc_funcs_reset();
+#endif // CONFIG_BT_CTRL_BLE_SECURITY_ENABLE
+
+#if CONFIG_BT_CTRL_BLE_MASTER
+    ble_init_funcs_reset();
+    ble_con_funcs_reset();
+#endif // CONFIG_BT_CTRL_BLE_MASTER
+
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 }
 
 bool bt_async_wakeup_request(void)
@@ -1598,15 +1649,11 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
 #endif
                 }
             } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {  // Internal 136kHz RC oscillator
-                if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
-                    ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is "
-                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
-                } else {
+                if (rtc_clk_slow_src_get() != SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
                     ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator not detected.");
                     assert(0);
                 }
             } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
-                ESP_LOGI(BT_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
 #if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
                 s_lp_cntl.no_light_sleep = 1;
 #endif
@@ -1618,6 +1665,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
         bool select_src_ret __attribute__((unused));
         bool set_div_ret __attribute__((unused));
         if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using main XTAL as clock source");
 #ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
             ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
             s_lp_cntl.main_xtal_pu = 1;
@@ -1628,6 +1676,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
             btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
             btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
         } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
             select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
             set_div_ret = btdm_lpclk_set_div(0);
             assert(select_src_ret && set_div_ret);
@@ -1636,6 +1685,8 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
                 (1000000 >> (15 - RTC_CLK_CAL_FRACT));
             assert(btdm_lpcycle_us != 0);
         } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {
+            ESP_LOGW(BT_LOG_TAG, "Using 136 kHz RC as clock source. The accuracy of this clock is a lot larger than 500ppm which is "
+                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
             select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
             set_div_ret = btdm_lpclk_set_div(0);
             assert(select_src_ret && set_div_ret);
@@ -1755,7 +1806,11 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif
 
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
-    ble_log_spi_out_init();
+    if (ble_log_spi_out_init() != 0) {
+        ESP_LOGE(BT_LOG_TAG, "BLE Log SPI output init failed");
+        err = ESP_ERR_NO_MEM;
+        goto error;
+    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
     periph_module_enable(PERIPH_BT_MODULE);
@@ -1790,6 +1845,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
 error:
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     bt_controller_deinit_internal();
 
     return err;

components/bt/controller/esp32c5/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -57,6 +57,11 @@
 
 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -100,7 +105,12 @@ struct ext_funcs_t {
 };
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* External functions or variables
@@ -109,11 +119,13 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_init_async(interface_func_t interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
+extern int r_ble_log_init_simple(interface_func_t interface, void *handler);
+extern void r_ble_log_deinit_simple(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
-extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern void esp_panic_handler_feed_wdts(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -173,15 +185,232 @@ static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
  */
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
+static bool log_is_inited = false;
+
+esp_err_t esp_bt_controller_log_init(void)
+{
+    if (log_is_inited) {
+        return ESP_OK;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        goto spi_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    uint8_t buffers = 0;
+#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_HCI;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+
+    bool task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    task_create = false;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_ctrl_log_partition_get_and_erase_first_block();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
+    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
+        goto log_init_failed;
+    }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
+    if (r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH) != ESP_OK) {
+        goto ctrl_level_init_failed;
+    }
+    log_is_inited = true;
+    return ESP_OK;
+
+ctrl_level_init_failed:
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+log_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+spi_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    return ESP_FAIL;
+}
+
+void esp_bt_controller_log_deinit(void)
+{
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
+    log_is_inited = false;
+}
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#include "esp_partition.h"
+#include "hal/wdt_hal.h"
+
+#define MAX_STORAGE_SIZE          (CONFIG_BT_LE_CONTROLLER_LOG_PARTITION_SIZE)
+#define BLOCK_SIZE                (4096)
+#define THRESHOLD                 (3072)
+#define PARTITION_NAME            "bt_ctrl_log"
+
+static const esp_partition_t *log_partition;
+static uint32_t write_index = 0;
+static uint32_t next_erase_index = BLOCK_SIZE;
+static bool block_erased = false;
+static bool stop_write = false;
+static bool is_filled = false;
+
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void)
+{
+    log_partition = NULL;
+    assert(MAX_STORAGE_SIZE % BLOCK_SIZE == 0);
+    // Find the partition map in the partition table
+    log_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, PARTITION_NAME);
+    assert(log_partition != NULL);
+    // Prepare data to be read later using the mapped address
+    ESP_ERROR_CHECK(esp_partition_erase_range(log_partition, 0, BLOCK_SIZE));
+    write_index = 0;
+    next_erase_index = BLOCK_SIZE;
+    block_erased = false;
+    is_filled = false;
+    stop_write = false;
+}
+
+static int esp_bt_controller_log_storage(uint32_t len, const uint8_t *addr, bool end)
+{
+    if (len > MAX_STORAGE_SIZE) {
+        return -1;
+    }
+
+    if (stop_write) {
+        return 0;
+    }
+
+    if (((write_index) % BLOCK_SIZE) >= THRESHOLD && !block_erased) {
+        // esp_rom_printf("Ers nxt: %d,%d\n", next_erase_index, write_index);
+        esp_partition_erase_range(log_partition, next_erase_index, BLOCK_SIZE);
+        next_erase_index = (next_erase_index + BLOCK_SIZE) % MAX_STORAGE_SIZE;
+        block_erased = true;
+    }
+
+    if (((write_index + len) / BLOCK_SIZE) >  (write_index / BLOCK_SIZE)) {
+        block_erased = false;
+    }
+
+    if (write_index + len <= MAX_STORAGE_SIZE) {
+        esp_partition_write(log_partition, write_index, addr, len);
+        write_index = (write_index + len) % MAX_STORAGE_SIZE;
+    } else {
+        uint32_t first_part_len = MAX_STORAGE_SIZE - write_index;
+        esp_partition_write(log_partition, write_index, addr, first_part_len);
+        esp_partition_write(log_partition, 0, addr + first_part_len, len - first_part_len);
+        write_index = len - first_part_len;
+        is_filled = true;
+        // esp_rom_printf("old idx: %d,%d\n",next_erase_index, write_index);
+    }
+
+    return 0;
+}
+
+void esp_bt_read_ctrl_log_from_flash(bool output)
+{
+    esp_partition_mmap_handle_t mmap_handle;
+    uint32_t read_index;
+    const void *mapped_ptr;
+    const uint8_t *buffer;
+    uint32_t print_len;
+    uint32_t max_print_len;
+    esp_err_t err;
+
+    print_len = 0;
+    max_print_len = 4096;
+    err = esp_partition_mmap(log_partition, 0, MAX_STORAGE_SIZE, ESP_PARTITION_MMAP_DATA, &mapped_ptr, &mmap_handle);
+    if (err != ESP_OK) {
+        ESP_LOGE("FLASH", "Mmap failed: %s", esp_err_to_name(err));
+        return;
+    }
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    r_ble_log_async_output_dump_all(true);
+    esp_bt_controller_log_deinit();
+    stop_write = true;
+
+    buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_feed_wdts();
+    if (is_filled) {
+        read_index = next_erase_index;
+    } else {
+        read_index = 0;
+    }
+
+    esp_rom_printf("\r\nREAD_CHECK:%ld,%ld,%d\r\n",read_index, write_index, is_filled);
+    esp_rom_printf("\r\n[DUMP_START:");
+    while (read_index != write_index) {
+        esp_rom_printf("%02x ", buffer[read_index]);
+        if (print_len > max_print_len) {
+            esp_panic_handler_feed_wdts();
+            print_len = 0;
+        }
+
+        print_len++;
+        read_index = (read_index + 1) % MAX_STORAGE_SIZE;
+    }
+
+    esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    esp_partition_munmap(mmap_handle);
+    err = esp_bt_controller_log_init();
+    assert(err == ESP_OK);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -664,20 +893,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_SW_COEXIST_ENABLE
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    uint8_t buffers = 0;
-#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_HCI;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    ret = r_ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
-#else
-    ret = r_ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
-#endif // CONFIG_BT_CONTROLLER_LOG_DUMP
+    ret = esp_bt_controller_log_init();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto modem_deint;
@@ -738,7 +954,7 @@ free_controller:
 modem_deint:
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     esp_phy_modem_deinit();
     // modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
@@ -774,7 +990,7 @@ esp_err_t esp_bt_controller_deinit(void)
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 #if CONFIG_BT_NIMBLE_ENABLED
@@ -1092,26 +1308,47 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_controller_log_storage(len, addr, end);
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
     }
-    if (end) {
-        esp_rom_printf("\n");
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
     }
+    if (end) { esp_rom_printf("\n"); }
+
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_read_ctrl_log_from_flash(output);
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     BT_ASSERT_PRINT("\r\n[DUMP_START:");
     r_ble_log_async_output_dump_all(output);
     BT_ASSERT_PRINT(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
+#endif
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 

components/bt/controller/esp32c6/Kconfig.in

@@ -1,6 +1,5 @@
 
 menu "HCI Config"
-
     choice BT_LE_HCI_INTERFACE
         prompt "HCI mode"
         default BT_LE_HCI_INTERFACE_USE_RAM
@@ -108,7 +107,7 @@ menu "HCI Config"
     config BT_LE_HCI_TRANS_TASK_STACK_SIZE
         int "HCI transport task stack size"
         depends on !BT_LE_HCI_INTERFACE_USE_RAM
-        default 1024
+        default 2048
         help
             This configures stack size of hci transport task
 
@@ -228,6 +227,16 @@ config BT_LE_POWER_CONTROL_ENABLED
     help
         Set this option to enable the Power Control feature on controller
 
+config BT_LE_CTE_FEATURE_ENABLED
+    bool "Enable Bluetooth LE Direction Finding (AoA/AoD)"
+    depends on BT_LE_50_FEATURE_SUPPORT && SOC_BLE_CTE_SUPPORTED
+    default n
+    help
+        Enable this option to activate Bluetooth LE Direction Finding (AoA/AoD) feature.
+        Note:
+        This feature allows devices to determine the direction of a Bluetooth CTE signal,
+        enabling Angle of Arrival (AoA) and Angle of Departure (AoD) functionality.
+
 menu "Memory Settings"
     depends on !BT_NIMBLE_ENABLED
 
@@ -434,6 +443,16 @@ menu "Controller debug features"
         default n
         help
             Retain scene with GDB to capture info, requires disabling WDT (CONFIG_ESP_INT_WDT, CONFIG_ESP_TASK_WDT_EN).
+
+    config BT_LE_PTR_CHECK_ENABLED
+        bool "Enable boundary check for internal memory"
+        default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -491,7 +510,7 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
 
 config BT_LE_WHITELIST_SIZE
     int "BLE white list size"
-    range 1 15
+    range 1 31
     default 12
     depends on !BT_NIMBLE_ENABLED
 
@@ -512,6 +531,23 @@ config BT_LE_LL_SCA
     help
         Sleep clock accuracy of our device (in ppm)
 
+config BT_LE_LL_PEER_SCA_SET_ENABLE
+    bool "Enable to set constant peer SCA"
+    default n
+    help
+        Enable setting of constant peer SCA, use this if peer device has SCA larger than 500 PPM.
+        Enable this option, the controller will always use BT_LE_LL_PEER_SCA as the peer SCA value
+        to calculate the window widening instead of the value received from peer device.
+
+
+config BT_LE_LL_PEER_SCA
+    int "Constant peer sleep clock accuracy value"
+    range 0 10000
+    depends on BT_LE_LL_PEER_SCA_SET_ENABLE
+    default 0
+    help
+        Set the sleep clock accuracy of peer device
+
 config BT_LE_MAX_CONNECTIONS
     int "Maximum number of concurrent connections"
     depends on !BT_NIMBLE_ENABLED
@@ -691,7 +727,7 @@ config BT_LE_CCA_RSSI_THRESH
     int "CCA RSSI threshold value"
     depends on BT_LE_TX_CCA_ENABLED
     range 20 100
-    default 20
+    default 65
     help
         Power threshold of CCA in unit of -1 dBm.
 
@@ -805,3 +841,49 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
         When this option is enabled, auxiliary packets will be present in the events of
         'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
         If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_LE_RXBUF_OPT_ENABLED
+    bool "Enable rxbuf optimization feature"
+    default y
+
+config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
+    bool "Enable fast sending of connection data"
+    default y
+    help
+        If this option is enabled, The Controller will continue to
+        Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            connection instances and the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n

components/bt/controller/esp32c6/ble.c

@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);
 
+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -38,10 +60,18 @@ void pcl_stack_enableSetRssiThreshVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
 void log_stack_enableLogsRelatedVsCmd(bool en);
 void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+void winWiden_stack_enableSetConstPeerScaVsCmd(bool en);
+#if CONFIG_IDF_TARGET_ESP32C61_ECO3
+void conn_stack_enableSetPrefTxRxCntVsCmd(bool en);
+#endif // CONFIG_IDF_TARGET_ESP32C61_ECO3
 
 void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+extern void mmgmt_enableRxbufOptFeature(void);
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
 
 /* Local functions definition
  ***************************************************************************
@@ -57,12 +87,20 @@ void ble_stack_enableVsCmds(bool en)
     chanSel_stack_enableSetCsaVsCmd(en);
     log_stack_enableLogsRelatedVsCmd(en);
     hci_stack_enableSetVsEvtMaskVsCmd(en);
+    winWiden_stack_enableSetConstPeerScaVsCmd(en);
+#if CONFIG_IDF_TARGET_ESP32C61_ECO3
+    conn_stack_enableSetPrefTxRxCntVsCmd(en);
+#endif // CONFIG_IDF_TARGET_ESP32C61_ECO3
 }
 
 void ble_stack_enableVsEvents(bool en)
 {
     adv_stack_enableScanReqRxdVsEvent(en);
     conn_stack_enableChanMapUpdCompVsEvent(en);
+
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
 }
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
@@ -88,6 +126,27 @@ int ble_stack_initEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
 
+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
     return 0;
 }
 
@@ -99,7 +158,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
     base_stack_deinitEnv();
 }
 
@@ -112,6 +176,28 @@ int ble_stack_enable(void)
         return rc;
     }
 
+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_enable();
     if (rc) {
@@ -130,6 +216,10 @@ int ble_stack_enable(void)
     ble_stack_enableVsEvents(true);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+    mmgmt_enableRxbufOptFeature();
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
+
     return 0;
 }
 
@@ -146,6 +236,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
     base_stack_disable();
 }

components/bt/controller/esp32c6/bt.c

@@ -42,6 +42,7 @@
 #include "esp_phy_init.h"
 #endif
 #include "esp_private/periph_ctrl.h"
+#include "esp_private/esp_clk_tree_common.h"
 #include "bt_osi_mem.h"
 
 #if SOC_PM_RETENTION_HAS_CLOCK_BUG
@@ -60,12 +61,11 @@
 
 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+#include "modem/modem_syscon_struct.h"
 
-#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #include "ble_log/ble_log_spi_out.h"
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
 /* Macro definition
  ************************************************************************
@@ -74,7 +74,7 @@
 #define OSI_COEX_VERSION              0x00010006
 #define OSI_COEX_MAGIC_VALUE          0xFADEBEAD
 
-#define EXT_FUNC_VERSION             0x20240422
+#define EXT_FUNC_VERSION             0x20250415
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5
 
 #define BT_ASSERT_PRINT              ets_printf
@@ -105,26 +105,40 @@ struct ext_funcs_t {
     int (* _ecc_gen_key_pair)(uint8_t *public, uint8_t *priv);
     int (* _ecc_gen_dh_key)(const uint8_t *remote_pub_key_x, const uint8_t *remote_pub_key_y,
                             const uint8_t *local_priv_key, uint8_t *dhkey);
-    void (* _esp_reset_rpa_moudle)(void);
+#if CONFIG_IDF_TARGET_ESP32C6
+    void (* _esp_reset_modem)(uint8_t mdl_opts, uint8_t start);
+#endif // CONFIG_IDF_TARGET_ESP32C6
     uint32_t magic;
 };
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* External functions or variables
  ************************************************************************
  */
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+extern void coex_hw_timer_set(uint8_t idx,uint8_t src, uint8_t pti,uint32_t latency, uint32_t perioidc);
+extern void coex_hw_timer_enable(uint8_t idx);
+extern void coex_hw_timer_disable(uint8_t idx);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
 extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_init_async(interface_func_t interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
+extern int r_ble_log_init_simple(interface_func_t interface, void *handler);
+extern void r_ble_log_deinit_simple(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
-extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern void esp_panic_handler_feed_wdts(void);
 extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
 extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -152,7 +166,9 @@ extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
-extern void r_esp_ble_change_rtc_freq(uint32_t freq);
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+extern void r_ble_ll_customize_peer_sca_set(uint16_t peer_sca);
+#endif  // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
 extern int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x,
                                 const uint8_t *peer_pub_key_y,
                                 const uint8_t *our_priv_key, uint8_t *out_dhkey);
@@ -185,65 +201,48 @@ static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
 static int esp_intr_free_wrapper(void **ret_handle);
 static void osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2);
 static uint32_t osi_random_wrapper(void);
-static void esp_reset_rpa_moudle(void);
+#if CONFIG_IDF_TARGET_ESP32C6
+static void esp_reset_modem(uint8_t mdl_opts,uint8_t start);
+#endif // CONFIG_IDF_TARGET_ESP32C6
 static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
-#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
  */
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
-enum log_out_mode {
-    LOG_DUMP_MEMORY,
-    LOG_ASYNC_OUT,
-    LOG_STORAGE_TO_FLASH,
-    LOG_SPI_OUT,
-};
+static bool log_is_inited = false;
 
-bool log_is_inited = false;
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-uint8_t log_output_mode = LOG_DUMP_MEMORY;
-#else
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
-#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-uint8_t log_output_mode = LOG_SPI_OUT;
-#else
-uint8_t log_output_mode = LOG_ASYNC_OUT;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-
-void esp_bt_log_output_mode_set(uint8_t output_mode)
+esp_err_t esp_bt_controller_log_init(void)
 {
-    log_output_mode = output_mode;
-}
-
-uint8_t esp_bt_log_output_mode_get(void)
-{
-    return log_output_mode;
-}
-
-esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
-{
-    esp_err_t ret = ESP_OK;
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    bool task_create;
-    uint8_t buffers = 0;
-
     if (log_is_inited) {
-        return ret;
+        return ESP_OK;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        goto spi_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
@@ -251,48 +250,50 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
     buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 
-    switch (log_output_mode) {
-        case LOG_DUMP_MEMORY:
-            task_create = false;
-            break;
-        case LOG_ASYNC_OUT:
-        case LOG_STORAGE_TO_FLASH:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-                esp_bt_ctrl_log_partition_get_and_erase_first_block();
-            }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            break;
-        case LOG_SPI_OUT:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            ble_log_spi_out_init();
-            bt_controller_log_interface = ble_log_spi_out_write_esp;
+    bool task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    task_create = false;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_ctrl_log_partition_get_and_erase_first_block();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            break;
-        default:
-            assert(0);
-    }
 
-    ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
-    if (ret != ESP_OK) {
-        return ret;
+    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
+        goto log_init_failed;
     }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
-    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
-    if (ret == ESP_OK) {
-        log_is_inited = true;
+    if (r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH) != ESP_OK) {
+        goto ctrl_level_init_failed;
     }
-    return ret;
+    log_is_inited = true;
+    return ESP_OK;
+
+ctrl_level_init_failed:
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+log_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+spi_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    return ESP_FAIL;
 }
 
-void esp_bt_ontroller_log_deinit(void)
+void esp_bt_controller_log_deinit(void)
 {
-    r_ble_log_deinit_async();
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
     ble_log_spi_out_deinit();
-#endif
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
     log_is_inited = false;
 }
 
@@ -384,13 +385,13 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 
     portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     r_ble_log_async_output_dump_all(true);
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
     stop_write = true;
 
     buffer = (const uint8_t *)mapped_ptr;
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     if (is_filled) {
         read_index = next_erase_index;
     } else {
@@ -402,7 +403,7 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     while (read_index != write_index) {
         esp_rom_printf("%02x ", buffer[read_index]);
         if (print_len > max_print_len) {
-            esp_panic_handler_reconfigure_wdts(5000);
+            esp_panic_handler_feed_wdts();
             print_len = 0;
         }
 
@@ -440,8 +441,12 @@ static bool s_ble_active = false;
 #ifdef CONFIG_PM_ENABLE
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
+#define MAIN_XTAL_FREQ_HZ                 (40000000)
+#define MAIN_XTAL_FREQ_HZ_WORKROUND       (500000)
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-#define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
+static DRAM_ATTR uint32_t s_bt_lpclk_freq = 100000;
+
+#define BLE_RTC_DELAY_US_LIGHT_SLEEP        (3200)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
 #define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
@@ -476,15 +481,34 @@ struct ext_funcs_t ext_funcs_ro = {
     ._os_random = osi_random_wrapper,
     ._ecc_gen_key_pair = esp_ecc_gen_key_pair,
     ._ecc_gen_dh_key = esp_ecc_gen_dh_key,
-    ._esp_reset_rpa_moudle = esp_reset_rpa_moudle,
+#if CONFIG_IDF_TARGET_ESP32C6
+    ._esp_reset_modem = esp_reset_modem,
+#endif // CONFIG_IDF_TARGET_ESP32C6
     .magic = EXT_FUNC_MAGIC_VALUE,
 };
 
-static void IRAM_ATTR esp_reset_rpa_moudle(void)
+#if CONFIG_IDF_TARGET_ESP32C6
+static void IRAM_ATTR esp_reset_modem(uint8_t mdl_opts,uint8_t start)
 {
+    if (mdl_opts == 0x05) {
+        if (start) {
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            coex_hw_timer_set(0x04, 0x02, 15, 0, 5000);
+            coex_hw_timer_enable(0x04);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            MODEM_SYSCON.modem_rst_conf.val |= (BIT(16) | BIT(18));
+            MODEM_SYSCON.modem_rst_conf.val &= ~(BIT(16) | BIT(18));
+        } else {
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            coex_hw_timer_disable(0x04);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+        }
 
+    }
 }
 
+#endif // CONFIG_IDF_TARGET_ESP32C6
+
 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn,
                                          uint32_t param1, uint32_t param2)
 {
@@ -568,16 +592,21 @@ void esp_bt_rtc_slow_clk_select(uint8_t slow_clk_src)
     /* Select slow clock source for BT momdule */
     switch (slow_clk_src) {
         case MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL:
-            ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source");
+#if SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             uint32_t chip_version = efuse_hal_chip_revision();
+            ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source, chip ver: %d", chip_version);
             if (chip_version == 0) {
-                modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (400 - 1));
+                modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (MAIN_XTAL_FREQ_HZ/s_bt_lpclk_freq - 1));
             } else{
-                modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (5 - 1));
+                modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (MAIN_XTAL_FREQ_HZ_WORKROUND/s_bt_lpclk_freq - 1));
             }
+#else
+            ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source");
+            modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (MAIN_XTAL_FREQ_HZ/s_bt_lpclk_freq - 1));
+#endif // SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             break;
         case MODEM_CLOCK_LPCLK_SRC_RC_SLOW:
-            ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, can only run legacy ADV or SCAN due to low clock accuracy!");
+            ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, use with caution as it may not maintain ACL or Sync process due to low clock accuracy!");
             modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (5 - 1));
             break;
         case MODEM_CLOCK_LPCLK_SRC_XTAL32K:
@@ -603,6 +632,10 @@ modem_clock_lpclk_src_t esp_bt_get_lpclk_src(void)
 
 void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
 {
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+
     if (clk_src >= MODEM_CLOCK_LPCLK_SRC_MAX) {
         return;
     }
@@ -610,6 +643,38 @@ void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
     s_bt_lpclk_src = clk_src;
 }
 
+uint32_t esp_bt_get_lpclk_freq(void)
+{
+    return s_bt_lpclk_freq;
+}
+
+void esp_bt_set_lpclk_freq(uint32_t clk_freq)
+{
+    uint32_t xtal_freq;
+
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+
+    if (!clk_freq) {
+        return;
+    }
+
+    xtal_freq = MAIN_XTAL_FREQ_HZ;
+#if SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
+    uint32_t chip_version = efuse_hal_chip_revision();
+    if (chip_version == 1) {
+        xtal_freq = MAIN_XTAL_FREQ_HZ_WORKROUND;
+    }
+#endif // SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
+
+    if (xtal_freq % clk_freq) {
+        return;
+    }
+
+    s_bt_lpclk_freq = clk_freq;
+}
+
 IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
 {
     if (!s_ble_active) {
@@ -631,10 +696,17 @@ IRAM_ATTR void controller_wakeup_cb(void *arg)
         return;
     }
 #ifdef CONFIG_PM_ENABLE
+    esp_pm_config_t pm_config;
     esp_pm_lock_acquire(s_pm_lock);
+    esp_pm_get_configuration(&pm_config);
+    assert(esp_rom_get_cpu_ticks_per_us() == pm_config.max_freq_mhz);
     r_ble_rtc_wake_up_state_clr();
 #endif //CONFIG_PM_ENABLE
     esp_phy_enable(PHY_MODEM_BT);
+    if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
+        uint32_t *clk_freq = (uint32_t *)arg;
+        *clk_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+    }
     s_ble_active = true;
 }
 
@@ -865,11 +937,12 @@ static void ble_rtc_clk_init(esp_bt_controller_config_t *cfg)
     }
 
     if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL) {
-        cfg->rtc_freq = 100000;
+        cfg->rtc_freq = s_bt_lpclk_freq;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_XTAL32K) {
         cfg->rtc_freq = 32768;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
-        cfg->rtc_freq = 30000;
+        cfg->rtc_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+        cfg->ble_ll_sca = 3000;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC32K) {
         cfg->rtc_freq = 32000;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_EXT32K) {
@@ -948,7 +1021,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_SW_COEXIST_ENABLE
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ret = esp_bt_controller_log_init(log_output_mode);
+    ret = esp_bt_controller_log_init();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto modem_deint;
@@ -968,6 +1041,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+    r_ble_ll_customize_peer_sca_set(CONFIG_BT_LE_LL_PEER_SCA);
+#endif // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+
     ret = ble_stack_initEnv();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
@@ -1020,7 +1097,7 @@ free_controller:
 modem_deint:
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     esp_phy_modem_deinit();
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
@@ -1057,7 +1134,7 @@ esp_err_t esp_bt_controller_deinit(void)
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 #if CONFIG_BT_NIMBLE_ENABLED
@@ -1405,42 +1482,47 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_controller_log_storage(len, addr, end);
-#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-        portENTER_CRITICAL_SAFE(&spinlock);
-        esp_panic_handler_reconfigure_wdts(1000);
-        for (int i = 0; i < len; i++) {
-            esp_rom_printf("%02x ", addr[i]);
-        }
+    esp_bt_controller_log_storage(len, addr, end);
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
 
-        if (end) {
-            esp_rom_printf("\n");
-        }
-        portEXIT_CRITICAL_SAFE(&spinlock);
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
     }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_read_ctrl_log_from_flash(output);
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-        portENTER_CRITICAL_SAFE(&spinlock);
-        esp_panic_handler_reconfigure_wdts(5000);
-        BT_ASSERT_PRINT("\r\n[DUMP_START:");
-        r_ble_log_async_output_dump_all(output);
-        BT_ASSERT_PRINT(":DUMP_END]\r\n");
-        portEXIT_CRITICAL_SAFE(&spinlock);
-    }
+    esp_bt_read_ctrl_log_from_flash(output);
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
+    BT_ASSERT_PRINT("\r\n[DUMP_START:");
+    r_ble_log_async_output_dump_all(output);
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
@@ -1661,7 +1743,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #endif // CONFIG_BT_LE_DEBUG_REMAIN_SCENE_ENABLED
 
 int IRAM_ATTR
-ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, uint32_t param2)
 {
     int i;
 
@@ -1688,3 +1770,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason)
     }
     return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -40,6 +40,7 @@ extern "C" {
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
     #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED MYNEWT_VAL(BLE_CONN_SUBRATING)
     #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
     #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
     #else
@@ -144,6 +145,8 @@ extern "C" {
         #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
         #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
     #endif
+
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED 0
 #endif
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
@@ -192,6 +195,12 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif
 
+#if defined(CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -204,6 +213,12 @@ extern "C" {
 #define DEFAULT_BT_LE_VHCI_ENABLED      (0)
 #endif
 
+#ifdef CONFIG_BT_LE_PTR_CHECK_ENABLED
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (CONFIG_BT_LE_PTR_CHECK_ENABLED)
+#else
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
@@ -268,6 +283,9 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/controller/esp32h2/Kconfig.in

@@ -1,6 +1,5 @@
 
 menu "HCI Config"
-
     choice BT_LE_HCI_INTERFACE
         prompt "HCI mode"
         default BT_LE_HCI_INTERFACE_USE_RAM
@@ -108,7 +107,7 @@ menu "HCI Config"
     config BT_LE_HCI_TRANS_TASK_STACK_SIZE
         int "HCI transport task stack size"
         depends on !BT_LE_HCI_INTERFACE_USE_RAM
-        default 1024
+        default 2048
         help
             This configures stack size of hci transport task
 
@@ -228,6 +227,19 @@ config BT_LE_POWER_CONTROL_ENABLED
     help
         Set this option to enable the Power Control feature on controller
 
+config BT_LE_CTE_FEATURE_ENABLED
+    bool "Enable Bluetooth LE Direction Finding (AoA/AoD)"
+    depends on BT_LE_50_FEATURE_SUPPORT && SOC_BLE_CTE_SUPPORTED && !(BT_LE_SECURITY_ENABLE)
+    default n
+    help
+        Enable this option to activate Bluetooth LE Direction Finding (AoA/AoD) feature.
+        Note:
+        This feature allows devices to determine the direction of a Bluetooth CTE signal,
+        enabling Angle of Arrival (AoA) and Angle of Departure (AoD) functionality.
+        In chip esp32h2, Direction Finding is not supported in encrypted
+        communication scenarios. If you are using chip esp32h2, ensure that encryption is
+        disabled when using this feature.
+
 menu "Memory Settings"
     depends on !BT_NIMBLE_ENABLED
 
@@ -425,6 +437,16 @@ menu "Controller debug features"
         default n
         help
             Retain scene with GDB to capture info, requires disabling WDT (CONFIG_ESP_INT_WDT, CONFIG_ESP_TASK_WDT_EN).
+
+    config BT_LE_PTR_CHECK_ENABLED
+        bool "Enable boundary check for internal memory"
+        default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -482,7 +504,7 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
 
 config BT_LE_WHITELIST_SIZE
     int "BLE white list size"
-    range 1 15
+    range 1 31
     default 12
     depends on !BT_NIMBLE_ENABLED
 
@@ -503,6 +525,23 @@ config BT_LE_LL_SCA
     help
         Sleep clock accuracy of our device (in ppm)
 
+config BT_LE_LL_PEER_SCA_SET_ENABLE
+    bool "Enable to set constant peer SCA"
+    default n
+    help
+        Enable setting of constant peer SCA, use this if peer device has SCA larger than 500 PPM.
+        Enable this option, the controller will always use BT_LE_LL_PEER_SCA as the peer SCA value
+        to calculate the window widening instead of the value received from peer device.
+
+
+config BT_LE_LL_PEER_SCA
+    int "Constant peer sleep clock accuracy value"
+    range 0 10000
+    depends on BT_LE_LL_PEER_SCA_SET_ENABLE
+    default 0
+    help
+        Set the sleep clock accuracy of peer device
+
 config BT_LE_MAX_CONNECTIONS
     int "Maximum number of concurrent connections"
     depends on !BT_NIMBLE_ENABLED
@@ -683,7 +722,7 @@ config BT_LE_CCA_RSSI_THRESH
     int "CCA RSSI threshold value"
     depends on BT_LE_TX_CCA_ENABLED
     range 20 100
-    default 20
+    default 65
     help
         Power threshold of CCA in unit of -1 dBm.
 
@@ -806,3 +845,49 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
         When this option is enabled, auxiliary packets will be present in the events of
         'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
         If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_LE_RXBUF_OPT_ENABLED
+    bool "Enable rxbuf optimization feature"
+    default y
+
+config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
+    bool "Enable fast sending of connection data"
+    default y
+    help
+        If this option is enabled, The Controller will continue to
+        Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum connection instances and
+            the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n

components/bt/controller/esp32h2/ble.c

@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);
 
+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -38,10 +60,15 @@ void pcl_stack_enableSetRssiThreshVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
 void log_stack_enableLogsRelatedVsCmd(bool en);
 void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+void winWiden_stack_enableSetConstPeerScaVsCmd(bool en);
 
 void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+extern void mmgmt_enableRxbufOptFeature(void);
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
 
 /* Local functions definition
  ***************************************************************************
@@ -57,12 +84,17 @@ void ble_stack_enableVsCmds(bool en)
     chanSel_stack_enableSetCsaVsCmd(en);
     log_stack_enableLogsRelatedVsCmd(en);
     hci_stack_enableSetVsEvtMaskVsCmd(en);
+    winWiden_stack_enableSetConstPeerScaVsCmd(en);
 }
 
 void ble_stack_enableVsEvents(bool en)
 {
     adv_stack_enableScanReqRxdVsEvent(en);
     conn_stack_enableChanMapUpdCompVsEvent(en);
+
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
 }
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
@@ -75,6 +107,28 @@ int ble_stack_initEnv(void)
         return rc;
     }
 
+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_initEnv();
     if (rc) {
@@ -99,7 +153,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
     base_stack_deinitEnv();
 }
 
@@ -112,6 +171,28 @@ int ble_stack_enable(void)
         return rc;
     }
 
+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
     rc = conn_stack_enable();
     if (rc) {
@@ -130,6 +211,10 @@ int ble_stack_enable(void)
     ble_stack_enableVsEvents(true);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+    mmgmt_enableRxbufOptFeature();
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
+
     return 0;
 }
 
@@ -146,6 +231,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
     conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
     base_stack_disable();
 }

components/bt/controller/esp32h2/bt.c

@@ -51,14 +51,13 @@
 #include "freertos/task.h"
 
 #include "esp_private/periph_ctrl.h"
+#include "esp_private/esp_clk_tree_common.h"
 #include "esp_sleep.h"
 #include "soc/rtc.h"
 
-#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #include "ble_log/ble_log_spi_out.h"
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 
 /* Macro definition
  ************************************************************************
@@ -67,7 +66,7 @@
 #define OSI_COEX_VERSION              0x00010006
 #define OSI_COEX_MAGIC_VALUE          0xFADEBEAD
 
-#define EXT_FUNC_VERSION             0x20240422
+#define EXT_FUNC_VERSION             0x20250415
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5
 
 #define BT_ASSERT_PRINT              ets_printf
@@ -98,12 +97,16 @@ struct ext_funcs_t {
     int (* _ecc_gen_key_pair)(uint8_t *public, uint8_t *priv);
     int (* _ecc_gen_dh_key)(const uint8_t *remote_pub_key_x, const uint8_t *remote_pub_key_y,
                             const uint8_t *local_priv_key, uint8_t *dhkey);
-    void (* _esp_reset_rpa_moudle)(void);
     uint32_t magic;
 };
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
+typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* External functions or variables
  ************************************************************************
@@ -112,11 +115,13 @@ extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
 extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_init_async(interface_func_t interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
+extern int r_ble_log_init_simple(interface_func_t interface, void *handler);
+extern void r_ble_log_deinit_simple(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
-extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern void esp_panic_handler_feed_wdts(void);
 extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
 extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -147,7 +152,9 @@ extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
 #if CONFIG_PM_ENABLE
 extern void r_esp_ble_stop_wakeup_timing(void);
 #endif // CONFIG_PM_ENABLE
-extern void r_esp_ble_change_rtc_freq(uint32_t freq);
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+extern void r_ble_ll_customize_peer_sca_set(uint16_t peer_sca);
+#endif  // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
 extern int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x,
                                 const uint8_t *peer_pub_key_y,
                                 const uint8_t *our_priv_key, uint8_t *out_dhkey);
@@ -180,65 +187,45 @@ static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
 static int esp_intr_free_wrapper(void **ret_handle);
 static void osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2);
 static uint32_t osi_random_wrapper(void);
-static void esp_reset_rpa_moudle(void);
 static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
-#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
  */
 /* Static variable declare */
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
-enum log_out_mode {
-    LOG_DUMP_MEMORY,
-    LOG_ASYNC_OUT,
-    LOG_STORAGE_TO_FLASH,
-    LOG_SPI_OUT,
-};
+static bool log_is_inited = false;
 
-bool log_is_inited = false;
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-uint8_t log_output_mode = LOG_DUMP_MEMORY;
-#else
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
-#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-uint8_t log_output_mode = LOG_SPI_OUT;
-#else
-uint8_t log_output_mode = LOG_ASYNC_OUT;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-
-void esp_bt_log_output_mode_set(uint8_t output_mode)
+esp_err_t esp_bt_controller_log_init(void)
 {
-    log_output_mode = output_mode;
-}
-
-uint8_t esp_bt_log_output_mode_get(void)
-{
-    return log_output_mode;
-}
-
-esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
-{
-    esp_err_t ret = ESP_OK;
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    bool task_create;
-    uint8_t buffers = 0;
-
     if (log_is_inited) {
-        return ret;
+        return ESP_OK;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    if (ble_log_spi_out_init() != 0) {
+        goto spi_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
     buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
@@ -246,48 +233,50 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
     buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 
-    switch (log_output_mode) {
-        case LOG_DUMP_MEMORY:
-            task_create = false;
-            break;
-        case LOG_ASYNC_OUT:
-        case LOG_STORAGE_TO_FLASH:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
-                esp_bt_ctrl_log_partition_get_and_erase_first_block();
-            }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-            break;
-        case LOG_SPI_OUT:
-            task_create = true;
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            ble_log_spi_out_init();
-            bt_controller_log_interface = ble_log_spi_out_write_esp;
+    bool task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    task_create = false;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    esp_bt_ctrl_log_partition_get_and_erase_first_block();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-            break;
-        default:
-            assert(0);
-    }
 
-    ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
-        if (ret != ESP_OK) {
-        return ret;
+    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
+        goto log_init_failed;
     }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
-    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
-    if (ret == ESP_OK) {
-        log_is_inited = true;
+    if (r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH) != ESP_OK) {
+        goto ctrl_level_init_failed;
     }
-    return ret;
+    log_is_inited = true;
+    return ESP_OK;
+
+ctrl_level_init_failed:
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+log_init_failed:
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+spi_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    return ESP_FAIL;
 }
 
-void esp_bt_ontroller_log_deinit(void)
+void esp_bt_controller_log_deinit(void)
 {
-    r_ble_log_deinit_async();
-#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
     ble_log_spi_out_deinit();
-#endif
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+
     log_is_inited = false;
 }
 
@@ -379,13 +368,13 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 
     portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     r_ble_log_async_output_dump_all(true);
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
     stop_write = true;
 
     buffer = (const uint8_t *)mapped_ptr;
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     if (is_filled) {
         read_index = next_erase_index;
     } else {
@@ -397,7 +386,7 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     while (read_index != write_index) {
         esp_rom_printf("%02x ", buffer[read_index]);
         if (print_len > max_print_len) {
-            esp_panic_handler_reconfigure_wdts(5000);
+            esp_panic_handler_feed_wdts();
             print_len = 0;
         }
 
@@ -408,7 +397,7 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     esp_rom_printf(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
     esp_partition_munmap(mmap_handle);
-    err = esp_bt_controller_log_init(log_output_mode);
+    err = esp_bt_controller_log_init();
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -435,7 +424,9 @@ static bool s_ble_active = false;
 #ifdef CONFIG_PM_ENABLE
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
+#define MAIN_XTAL_FREQ_HZ                 (32000000)
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
+static DRAM_ATTR uint32_t s_bt_lpclk_freq = 100000;
 
 #define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
 void *malloc_ble_controller_mem(size_t size)
@@ -472,15 +463,9 @@ struct ext_funcs_t ext_funcs_ro = {
     ._os_random = osi_random_wrapper,
     ._ecc_gen_key_pair = esp_ecc_gen_key_pair,
     ._ecc_gen_dh_key = esp_ecc_gen_dh_key,
-    ._esp_reset_rpa_moudle = esp_reset_rpa_moudle,
     .magic = EXT_FUNC_MAGIC_VALUE,
 };
 
-static void IRAM_ATTR esp_reset_rpa_moudle(void)
-{
-
-}
-
 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn,
                                          uint32_t param1, uint32_t param2)
 {
@@ -566,10 +551,10 @@ void esp_bt_rtc_slow_clk_select(uint8_t slow_clk_src)
     switch (slow_clk_src) {
         case MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source");
-            modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (320 - 1));
+            modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (MAIN_XTAL_FREQ_HZ/s_bt_lpclk_freq - 1));
             break;
         case MODEM_CLOCK_LPCLK_SRC_RC_SLOW:
-            ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, can only run legacy ADV or SCAN due to low clock accuracy!");
+            ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, use with caution as it may not maintain ACL or Sync process due to low clock accuracy!");
             modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (5 - 1));
             break;
         case MODEM_CLOCK_LPCLK_SRC_XTAL32K:
@@ -595,6 +580,10 @@ modem_clock_lpclk_src_t esp_bt_get_lpclk_src(void)
 
 void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
 {
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+
     if (clk_src >= MODEM_CLOCK_LPCLK_SRC_MAX) {
         return;
     }
@@ -602,6 +591,28 @@ void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
     s_bt_lpclk_src = clk_src;
 }
 
+uint32_t esp_bt_get_lpclk_freq(void)
+{
+    return s_bt_lpclk_freq;
+}
+
+void esp_bt_set_lpclk_freq(uint32_t clk_freq)
+{
+    if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return;
+    }
+
+    if (!clk_freq) {
+        return;
+    }
+
+    if (MAIN_XTAL_FREQ_HZ % clk_freq) {
+        return;
+    }
+
+    s_bt_lpclk_freq = clk_freq;
+}
+
 IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
 {
     if (!s_ble_active) {
@@ -623,10 +634,17 @@ IRAM_ATTR void controller_wakeup_cb(void *arg)
         return;
     }
 #ifdef CONFIG_PM_ENABLE
+    esp_pm_config_t pm_config;
     esp_pm_lock_acquire(s_pm_lock);
+    esp_pm_get_configuration(&pm_config);
+    assert(esp_rom_get_cpu_ticks_per_us() == pm_config.max_freq_mhz);
     r_ble_rtc_wake_up_state_clr();
 #endif //CONFIG_PM_ENABLE
     esp_phy_enable(PHY_MODEM_BT);
+    if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
+        uint32_t *clk_freq = (uint32_t *)arg;
+        *clk_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+    }
     s_ble_active = true;
 }
 
@@ -847,11 +865,12 @@ static void ble_rtc_clk_init(esp_bt_controller_config_t *cfg)
     }
 
     if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL) {
-        cfg->rtc_freq = 100000;
+        cfg->rtc_freq = s_bt_lpclk_freq;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_XTAL32K) {
         cfg->rtc_freq = 32768;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC_SLOW) {
-        cfg->rtc_freq = 30000;
+        cfg->rtc_freq = esp_clk_tree_lp_slow_get_freq_hz(ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED) / 5;
+        cfg->ble_ll_sca = 3000;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_RC32K) {
         cfg->rtc_freq = 32000;
     } else if (s_bt_lpclk_src == MODEM_CLOCK_LPCLK_SRC_EXT32K) {
@@ -929,7 +948,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_SW_COEXIST_ENABLE
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ret = esp_bt_controller_log_init(log_output_mode);
+    ret = esp_bt_controller_log_init();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto modem_deint;
@@ -949,6 +968,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+#if CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+    r_ble_ll_customize_peer_sca_set(CONFIG_BT_LE_LL_PEER_SCA);
+#endif // CONFIG_BT_LE_LL_PEER_SCA_SET_ENABLE
+
     ret = ble_stack_initEnv();
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
@@ -1001,7 +1024,7 @@ free_controller:
 modem_deint:
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
@@ -1036,7 +1059,7 @@ esp_err_t esp_bt_controller_deinit(void)
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    esp_bt_ontroller_log_deinit();
+    esp_bt_controller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 #if CONFIG_BT_NIMBLE_ENABLED
@@ -1242,7 +1265,6 @@ esp_err_t esp_bt_mem_release(esp_bt_mode_t mode)
     return ret;
 }
 
-
 esp_bt_controller_status_t esp_bt_controller_get_status(void)
 {
     return ble_controller_status;
@@ -1384,41 +1406,47 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-        esp_bt_controller_log_storage(len, addr, end);
-#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    } else {
-        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-        portENTER_CRITICAL_SAFE(&spinlock);
-        esp_panic_handler_reconfigure_wdts(1000);
-        for (int i = 0; i < len; i++) {
-            esp_rom_printf("%02x ", addr[i]);
-        }
+    esp_bt_controller_log_storage(len, addr, end);
+#else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_feed_wdts();
 
-        if (end) {
-            esp_rom_printf("\n");
-        }
-        portEXIT_CRITICAL_SAFE(&spinlock);
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
     }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
+    portEXIT_CRITICAL_SAFE(&spinlock);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 
 void esp_ble_controller_log_dump_all(bool output)
 {
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     esp_bt_read_ctrl_log_from_flash(output);
-#else
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
     portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-
     portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
+    esp_panic_handler_feed_wdts();
     BT_ASSERT_PRINT("\r\n[DUMP_START:");
     r_ble_log_async_output_dump_all(output);
     BT_ASSERT_PRINT(":DUMP_END]\r\n");
     portEXIT_CRITICAL_SAFE(&spinlock);
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
@@ -1638,7 +1666,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #endif // CONFIG_BT_LE_DEBUG_REMAIN_SCENE_ENABLED
 
 int IRAM_ATTR
-ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, uint32_t param2)
 {
     int i;
 
@@ -1665,3 +1693,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason)
     }
     return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -192,6 +192,12 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif
 
+#if defined(CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -204,6 +210,12 @@ extern "C" {
 #define DEFAULT_BT_LE_VHCI_ENABLED      (0)
 #endif
 
+#ifdef CONFIG_BT_LE_PTR_CHECK_ENABLED
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (CONFIG_BT_LE_PTR_CHECK_ENABLED)
+#else
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
@@ -268,6 +280,9 @@ extern "C" {
 
 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)

components/bt/esp_ble_mesh/Kconfig.in

@@ -408,7 +408,7 @@ if BLE_MESH
         int "Maximum capacity of solicitation replay protection list"
         depends on BLE_MESH_PROXY_SOLIC_PDU_RX
         default 2
-        range 1 255
+        range 1 65536
         help
             This option specifies the maximum capacity of the solicitation replay
             protection list. The solicitation replay protection list is used to

components/bt/esp_ble_mesh/core/adv.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -190,12 +190,11 @@ static inline int adv_send(struct net_buf *buf)
 #if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
         if (BLE_MESH_ADV(buf)->type == BLE_MESH_ADV_PROXY_SOLIC) {
             bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
-            struct bt_mesh_adv_data solic_ad[3] = {
-                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
+            struct bt_mesh_adv_data solic_ad[2] = {
                 BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
                 BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
             };
-            err = bt_le_adv_start(&param, solic_ad, 3, NULL, 0);
+            err = bt_le_adv_start(&param, solic_ad, ARRAY_SIZE(solic_ad), NULL, 0);
         } else
 #endif
         {

components/bt/esp_ble_mesh/core/adv.h

@@ -44,6 +44,7 @@ enum bt_mesh_adv_type {
     BLE_MESH_ADV_URI,
     BLE_MESH_ADV_BLE,
     BLE_MESH_ADV_PROXY_SOLIC,
+    BLE_MESH_ADV_TYPES_NUM,
 };
 
 struct bt_mesh_adv {

components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c

@@ -1599,8 +1599,10 @@ static void bt_mesh_bta_gattc_cb(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
         for (i = 0; i < ARRAY_SIZE(bt_mesh_gattc_info); i++) {
             if (bt_mesh_gattc_info[i].conn.handle == handle) {
                 if (bt_mesh_gattc_info[i].wr_desc_done == false) {
-                    BT_DBG("Receive notification before finishing to write ccc");
+                    BT_WARN("Receive notification before finishing to write ccc");
+#if !CONFIG_BLE_MESH_BQB_TEST
                     return;
+#endif
                 }
 
                 conn = &bt_mesh_gattc_info[i].conn;

components/bt/esp_ble_mesh/core/main.c

@@ -441,7 +441,9 @@ int bt_mesh_init(const struct bt_mesh_prov *prov,
 
     if ((IS_ENABLED(CONFIG_BLE_MESH_PROVISIONER) &&
         IS_ENABLED(CONFIG_BLE_MESH_PB_GATT)) ||
-        IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_CLIENT)) {
+        IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_CLIENT) ||
+        (IS_ENABLED(CONFIG_BLE_MESH_RPR_SRV) &&
+        IS_ENABLED(CONFIG_BLE_MESH_PB_GATT))) {
         bt_mesh_proxy_client_init();
     }
 
@@ -591,7 +593,9 @@ int bt_mesh_deinit(struct bt_mesh_deinit_param *param)
 
     if ((IS_ENABLED(CONFIG_BLE_MESH_PROVISIONER) &&
          IS_ENABLED(CONFIG_BLE_MESH_PB_GATT)) ||
-        IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_CLIENT)) {
+        IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_CLIENT) ||
+        (IS_ENABLED(CONFIG_BLE_MESH_RPR_SRV) &&
+        IS_ENABLED(CONFIG_BLE_MESH_PB_GATT))) {
         bt_mesh_proxy_client_deinit();
     }
 

components/bt/esp_ble_mesh/core/nimble_host/adapter.c

@@ -147,7 +147,8 @@ void bt_mesh_hci_init(void)
 
 static struct ble_gap_disc_params scan_param;
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+     (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
 static struct gattc_prov_info {
     /* Service to be found depends on the type of adv pkt received */
     struct bt_mesh_conn conn;
@@ -396,13 +397,16 @@ static int svc_disced(uint16_t conn_handle, const struct ble_gatt_error *error,
 
     return rc;
 }
-#endif /* (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || CONFIG_BLE_MESH_GATT_PROXY_CLIENT */
+#endif /* (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
+          CONFIG_BLE_MESH_GATT_PROXY_CLIENT ||
+          (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT) */
 
 static int disc_cb(struct ble_gap_event *event, void *arg)
 {
     struct ble_gap_disc_desc *desc;
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+     (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
     int rc, i;
     uint8_t notif_data[100];
     uint16_t notif_len;
@@ -425,7 +429,8 @@ static int disc_cb(struct ble_gap_event *event, void *arg)
         break;
     }
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+     (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
     case BLE_GAP_EVENT_CONNECT:
         if (event->connect.status == 0) {
             /* Connection successfully established. */
@@ -1357,7 +1362,8 @@ int bt_mesh_gatts_set_local_device_name(const char *name)
 #endif /* CONFIG_BLE_MESH_NODE */
 
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+    (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
 void bt_mesh_gattc_conn_cb_register(struct bt_mesh_prov_conn_cb *cb)
 {
     bt_mesh_gattc_conn_cb = cb;
@@ -1598,7 +1604,10 @@ void bt_mesh_gattc_disconnect(struct bt_mesh_conn *conn)
  *  Mesh Proxy Data In:  0x2ADD
  *  Mesh PROXY Data Out: 0x2ADE
  */
-#endif /* (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || CONFIG_BLE_MESH_GATT_PROXY_CLIENT */
+
+#endif /* (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) ||
+          CONFIG_BLE_MESH_GATT_PROXY_CLIENT ||
+          (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)*/
 
 struct bt_mesh_conn *bt_mesh_conn_ref(struct bt_mesh_conn *conn)
 {
@@ -1743,7 +1752,8 @@ void bt_mesh_gatt_init(void)
 #endif /* CONFIG_BLE_MESH_NODE */
 
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+    (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
     for (int i = 0; i < ARRAY_SIZE(bt_mesh_gattc_info); i++) {
         bt_mesh_gattc_info[i].conn.handle = 0xFFFF;
         bt_mesh_gattc_info[i].mtu = BLE_ATT_MTU_DFLT;
@@ -1761,7 +1771,8 @@ void bt_mesh_gatt_deinit(void)
 #endif
 
 #if (CONFIG_BLE_MESH_PROVISIONER && CONFIG_BLE_MESH_PB_GATT) || \
-     CONFIG_BLE_MESH_GATT_PROXY_CLIENT
+     CONFIG_BLE_MESH_GATT_PROXY_CLIENT || \
+     (CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT)
     for (int i = 0; i < ARRAY_SIZE(bt_mesh_gattc_info); i++) {
         bt_mesh_gattc_info[i].conn.handle = 0xFFFF;
         memset(&bt_mesh_gattc_info[i].addr, 0, sizeof(bt_mesh_addr_t));

components/bt/esp_ble_mesh/core/prov_common.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -135,6 +135,9 @@ bool bt_mesh_prov_pdu_check(uint8_t type, uint16_t length, uint8_t *reason)
 #define CLOSE_XMIT      BLE_MESH_TRANSMIT(2, 20)
 
 #define CLOSE_TIMEOUT   K_MSEC(100)
+#define CLOSE_RETRANS_CNT 3
+#define CLOSE_RETRANS_WITH_REASON(cnt, rsn) (((cnt) << 4) | ((rsn) & 0x0f))
+#define CLOSE_RETRANS_GET(rsn) ((rsn) >> 4)
 
 #define BUF_TIMEOUT     K_MSEC(400)
 
@@ -457,12 +460,19 @@ static void prov_retransmit(struct k_work *work)
             if (link->pb_remote_close) {
                 link->pb_remote_close(link, link->reason);
             }
+            return;
         } else {
-            if (link->reset_adv_link) {
-                link->reset_adv_link(link, link->reason);
+            uint8_t retrans_cnt = CLOSE_RETRANS_GET(link->reason);
+            if (!retrans_cnt) {
+                if (link->reset_adv_link) {
+                    link->reset_adv_link(link, link->reason);
+                }
+                return;
+            } else {
+                retrans_cnt--;
+                link->reason = CLOSE_RETRANS_WITH_REASON(retrans_cnt, link->reason);
             }
         }
-        return;
     }
 
     bt_mesh_mutex_lock(&link->buf_lock);
@@ -547,7 +557,14 @@ int bt_mesh_prov_bearer_ctl_send(struct bt_mesh_prov_link *link, uint8_t op,
     if (op == LINK_CLOSE) {
         bt_mesh_atomic_clear_bit(link->flags, LINK_ACTIVE);
         bt_mesh_atomic_set_bit(link->flags, LINK_CLOSING);
-        link->reason = *((uint8_t *)data);
+        /** We can also use buf->ref and a flag to decide that
+         *  link close has been sent 3 times.
+         *  Here we use another way: use retransmit timer and need
+         *  to make sure the timer is not cancelled during sending
+         *  link close pdu, Therefore, use the higher four bits
+         *  of reason as a retransmit count.
+         */
+        link->reason = CLOSE_RETRANS_WITH_REASON(CLOSE_RETRANS_CNT, (*((uint8_t *)data)));
     }
 
     return 0;

components/bt/esp_ble_mesh/core/prov_node.c

@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -82,12 +82,12 @@ static void reset_state(void)
     }
 #endif /* CONFIG_BLE_MESH_PB_GATT */
 
-#if CONFIG_BLE_MESH_PB_ADV
     /* Clear everything except the retransmit and protocol timer
      * delayed work objects.
      */
     (void)memset(&prov_link, 0, offsetof(struct bt_mesh_prov_link, tx.retransmit));
 
+#if CONFIG_BLE_MESH_PB_ADV
     prov_link.pending_ack = PROV_XACT_NVAL;
 
     prov_link.rx.prev_id = PROV_XACT_NVAL;
@@ -154,7 +154,7 @@ static int prov_send_gatt(struct bt_mesh_prov_link *link, struct net_buf_simple
     /* Changed by Espressif, add provisioning timeout timer operations.
      * When sending a provisioning PDU successfully, restart the 60s timer.
      */
-#if CONFIG_BLE_MESH_GATT_PROXY_CLIENT && CONFIG_BLE_MESH_RPR_SRV
+#if CONFIG_BLE_MESH_RPR_SRV
     if (bt_mesh_atomic_test_bit(link->flags, PB_REMOTE)) {
         err = bt_mesh_proxy_client_send(link->conn, BLE_MESH_PROXY_PROV, msg);
 
@@ -1075,10 +1075,19 @@ static void link_ack(struct prov_rx *rx, struct net_buf_simple *buf)
             bt_mesh_prov_clear_tx(&prov_link, true);
             bt_mesh_rpr_srv_recv_link_ack(prov_link.pb_remote_uuid, true);
         } else {
-            BT_INFO("Link ACK for PB-Remote already received");
+            BT_DBG("Link ACK for PB-Remote already received");
+            return;
         }
     }
 #endif /* CONFIG_BLE_MESH_RPR_SRV */
+
+    if (!k_delayed_work_remaining_get(&prov_link.prot_timer)) {
+        /**
+         * When the link is opened, the provisioner and the unprovisioned device
+         * shall start the link timer with the timeout value set to 60 seconds.
+        */
+        k_delayed_work_submit(&prov_link.prot_timer, PROTOCOL_TIMEOUT);
+    }
 }
 
 static void link_close(struct prov_rx *rx, struct net_buf_simple *buf)
@@ -1434,6 +1443,11 @@ int bt_mesh_pb_gatt_open(struct bt_mesh_conn *conn)
 {
     BT_DBG("conn %p", conn);
 
+    /**
+     * It's necessary to determine if it is PB_REMOTE because when the
+     * node acts as an RPR server, LINK_ACTIVE has already been set upon
+     * receiving the link open from the RPR client.
+    */
     if (!bt_mesh_atomic_test_bit(prov_link.flags, PB_REMOTE) &&
         bt_mesh_atomic_test_and_set_bit(prov_link.flags, LINK_ACTIVE)) {
         BT_ERR("Link is busy");
@@ -1451,6 +1465,14 @@ int bt_mesh_pb_gatt_open(struct bt_mesh_conn *conn)
         prov_link.expect = PROV_INVITE;
     }
 
+    /**
+     * Just like ADV Link, start provision timeout timer after
+     * establishing the link to prevent the RPR server from
+     * being unable to recover to a configurable network state
+     * during remote provisioning.
+     */
+    k_delayed_work_submit(&prov_link.prot_timer, PROTOCOL_TIMEOUT);
+
     if (bt_mesh_prov_get()->link_open) {
         bt_mesh_prov_get()->link_open(BLE_MESH_PROV_GATT);
     }
@@ -1496,7 +1518,7 @@ static void protocol_timeout(struct k_work *work)
 
 #if CONFIG_BLE_MESH_PB_GATT
     if (prov_link.conn) {
-#if CONFIG_BLE_MESH_GATT_PROXY_CLIENT && CONFIG_BLE_MESH_RPR_SRV
+#if CONFIG_BLE_MESH_RPR_SRV
         if (bt_mesh_atomic_test_bit(prov_link.flags, PB_REMOTE)) {
             prov_link.pb_remote_reset = true;
             bt_mesh_gattc_disconnect(prov_link.conn);