change(version): Update version to 5.4.1

Feature/add vendor ble cmd definitions (v5.4)

See merge request espressif/esp-idf!37956

.gitlab/ci/build.yml

@@ -12,7 +12,7 @@
     IDF_CCACHE_ENABLE: "1"
   dependencies: []
 
-.build_cmake_template:
+.build_cmake_clang_template:
   extends:
     - .build_template
     - .before_script:build
@@ -34,29 +34,11 @@
       - "**/build*/size.json"
     expire_in: 1 week
     when: always
-  script:
-    # CI specific options start from "--parallel-count xxx". could ignore when running locally
-    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
-      -t $IDF_TARGET
-      --copy-sdkconfig
-      --parallel-count ${CI_NODE_TOTAL:-1}
-      --parallel-index ${CI_NODE_INDEX:-1}
-      --extra-preserve-dirs
-        examples/bluetooth/esp_ble_mesh/ble_mesh_console
-        examples/bluetooth/hci/controller_hci_uart_esp32
-        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
-    - python tools/ci/artifacts_handler.py upload
-
-.build_cmake_clang_template:
-  extends:
-    - .build_cmake_template
   variables:
     IDF_TOOLCHAIN: clang
     TEST_BUILD_OPTS_EXTRA: ""
     TEST_DIR: tools/test_apps/system/clang_build_test
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
   script:
     # CI specific options start from "--parallel-count xxx". could ignore when running locally
     - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
@@ -126,7 +108,7 @@ gcc_static_analyzer:
     ANALYZING_APP: "examples/get-started/hello_world"
   script:
     - echo "CONFIG_COMPILER_STATIC_ANALYZER=y" >> ${ANALYZING_APP}/sdkconfig.defaults
-    - python -m idf_build_apps build -vv -p ${ANALYZING_APP} -t all
+    - python -m idf_build_apps build -v -p ${ANALYZING_APP} -t all
 
 ########################################
 # Clang Build Apps Without Tests Cases #

.gitlab/ci/common.yml

@@ -40,7 +40,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.4
+  LATEST_GIT_TAG: v5.4.1
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules
@@ -57,7 +57,7 @@ variables:
   # Docker images
   ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:1"
   ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:1-1"
-  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:1"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:2"
   SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
   PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"
 
@@ -141,40 +141,48 @@ variables:
     export IDF_MIRROR_PREFIX_MAP=
   fi
 
-  # install latest python packages
-  # target test jobs
-  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
-  elif [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-docs
-  elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
-    run_cmd bash install.sh --enable-ci
-  else
-    if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+  if [[ "${CI_JOB_STAGE}" != "target_test" ]]; then
+    section_start "running_install_sh" "Running install.sh"
+    if [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
+      run_cmd bash install.sh --enable-ci --enable-docs
+    elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
       run_cmd bash install.sh --enable-ci
     else
-      run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+        run_cmd bash install.sh --enable-ci
+      else
+        run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      fi
     fi
+    section_end "running_install_sh"
+  else
+    section_start "install_python_env" "Install Python environment"
+    run_cmd python tools/idf_tools.py install-python-env --features ci,pytest,test-specific
+    section_end "install_python_env"
   fi
 
-  # Install esp-clang if necessary
+  if [[ ! -z "$INSTALL_EXTRA_TOOLS" ]]; then
+    section_start "installing_optional_tools" "Install optional tools ${INSTALL_EXTRA_TOOLS}"
+    $IDF_PATH/tools/idf_tools.py --non-interactive install $INSTALL_EXTRA_TOOLS
+    section_end "installing_optional_tools"
+  fi
+
+  # Install esp-clang if necessary (esp-clang is separately installed)
   if [[ "$IDF_TOOLCHAIN" == "clang" && -z "$CI_CLANG_DISTRO_URL" ]]; then
     $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
   fi
 
-  # Install QEMU if necessary
-  if [[ ! -z "$INSTALL_QEMU" ]]; then
-    $IDF_PATH/tools/idf_tools.py --non-interactive install qemu-xtensa qemu-riscv32
+  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
+    section_start "IDF_SKIP_TOOLS_CHECK" "Skip required tools check"
+    export IDF_SKIP_TOOLS_CHECK=1
+    section_end "IDF_SKIP_TOOLS_CHECK"
   fi
-
-  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
-  # Needed for pytest junit reports.
-  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
-
+  section_start "source_export" "Source export.sh"
   source ./export.sh
+  section_end "source_export"
 
   # Custom clang toolchain
-  if [[ ! -z "$CI_CLANG_DISTRO_URL" ]]; then
+  if [[ "$IDF_TOOLCHAIN" == "clang" && ! -z "$CI_CLANG_DISTRO_URL" ]]; then
     echo "Using custom clang from ${CI_CLANG_DISTRO_URL}"
     wget $CI_CLANG_DISTRO_URL
     ARCH_NAME=$(basename $CI_CLANG_DISTRO_URL)
@@ -198,6 +206,8 @@ variables:
     rm -rf ${CI_PYTHON_TOOL_REPO}
   fi
 
+  info "setup tools and python venv done"
+
 .show_ccache_statistics: &show_ccache_statistics |
   # Show ccache statistics if enabled globally
   test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats -vv || true
@@ -222,10 +232,11 @@ variables:
     - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
     # remove idf-env.json, since it may contains enabled "features"
     - rm -f $IDF_TOOLS_PATH/idf-env.json
-    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
     # This adds tools (compilers) and the version-specific Python environment to PATH
     - *setup_tools_and_idf_python_venv
     - fetch_submodules
+  variables:
+    INSTALL_EXTRA_TOOLS: cmake ninja
 
 .after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
   after_script:

.gitlab/ci/host-test.yml

@@ -195,7 +195,7 @@ test_tools:
       junit: ${IDF_PATH}/XUNIT_*.xml
   variables:
     LC_ALL: C.UTF-8
-    INSTALL_QEMU: 1  # for test_idf_qemu.py
+    INSTALL_EXTRA_TOOLS: "qemu-xtensa qemu-riscv32"  # for test_idf_qemu.py
   script:
     - stat=0
     - cd ${IDF_PATH}/tools/ci/test_autocomplete
@@ -282,9 +282,10 @@ test_pytest_qemu:
       junit: XUNIT_RESULT.xml
   parallel:
     matrix:
-      - IDF_TARGET: [esp32, esp32c3]
-  variables:
-    INSTALL_QEMU: 1
+      - IDF_TARGET: "esp32"
+        INSTALL_EXTRA_TOOLS: "qemu-xtensa"
+      - IDF_TARGET: "esp32c3"
+        INSTALL_EXTRA_TOOLS: "qemu-riscv32"
   script:
     - run_cmd python tools/ci/ci_build_apps.py . -v
       --target $IDF_TARGET
@@ -348,7 +349,7 @@ test_pytest_macos:
   variables:
     PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
   script:
-    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -vv
+    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -v
       --target linux
       --pytest-apps
       -m \"host_test and macos_shell\"
@@ -397,6 +398,17 @@ test_nvs_gen_check:
     - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
     - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml
 
+test_esp_rom:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+    reports:
+      junit: XUNIT_RESULT.xml
+  script:
+    - cd ${IDF_PATH}/components/esp_rom/
+    - pytest --noconftest test_esp_rom.py --junitxml=XUNIT_RESULT.xml
+
 make_sure_soc_caps_compatible_in_idf_build_apps:
     extends:
       - .host_test_template

.pre-commit-config.yaml

@@ -154,7 +154,7 @@ repos:
         require_serial: true
         additional_dependencies:
           - PyYAML == 5.3.1
-          - idf-build-apps~=2.0
+          - idf-build-apps~=2.5
       - id: sort-yaml-files
         name: sort yaml files
         entry: tools/ci/sort_yaml.py
@@ -241,6 +241,6 @@ repos:
         name: Lint rST files in docs folder using Sphinx Lint
         files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
   - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.3.0
+    rev: v2.4.1
     hooks:
       - id: check-kconfig-files

components/bootloader/Kconfig.projbuild

@@ -1134,6 +1134,44 @@ menu "Security features"
 
             If not set, the app does not care if the flash encryption eFuse bit is set or not.
 
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
     config SECURE_ROM_DL_MODE_ENABLED
         bool
         default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT

components/bootloader_support/include/bootloader_memory_utils.h

@@ -28,7 +28,12 @@ extern "C" {
  */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    bool dram_match_iram = (SOC_DRAM_LOW == SOC_IRAM_LOW) &&
+                             (SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+#if SOC_RTC_FAST_MEM_SUPPORTED
+        dram_match_iram &= (SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW);
+#endif
+    return dram_match_iram;
 }
 
 /**
@@ -97,7 +102,7 @@ inline static bool esp_ptr_in_diram_iram(const void *p) {
  */
 __attribute__((always_inline))
 inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
-#if SOC_RTC_FAST_MEM_SUPPORTED
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
     return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
     return false;
@@ -151,6 +156,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }
 
+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM
 
    - Address must be word aligned

components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c

@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"
 
 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
 
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
 
+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
     // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
     // otherwise the Flash Encryption key cannot be read protected

components/bootloader_support/src/flash_encrypt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"
 
 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@@ -207,6 +210,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32
 
+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
     esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -468,6 +478,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
     }
     result &= secure;
 
+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
     return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32

components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c

@@ -154,13 +154,12 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
     ets_secure_boot_key_digests_t trusted_key_digests = {0};
     bool valid_sig_blk = false;
     for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
         if (sig_block->block[i].version != ESP_SECURE_BOOT_SCHEME) {
             ESP_LOGD(TAG, "%s signing scheme selected but signature block %d generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), i, esp_secure_boot_get_scheme_name(sig_block->block[i].version));
-            continue;
         } else {
             valid_sig_blk = true;
         }
-        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
     }
     if (valid_sig_blk != true) {
         ESP_LOGE(TAG, "No signature block generated for valid scheme");

components/bt/CMakeLists.txt

@@ -24,6 +24,7 @@ set(common_include_dirs
     common/btc/profile/esp/blufi/include
     common/btc/profile/esp/include
     common/hci_log/include
+    common/ble_log/include
 )
 
 set(ble_mesh_include_dirs
@@ -85,11 +86,13 @@ if(CONFIG_BT_ENABLED)
         elseif(CONFIG_IDF_TARGET_ESP32S3)
             list(APPEND ldscripts "linker_rw_bt_controller.lf")
         elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/ble.c")
             if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
                 list(APPEND srcs "controller/esp32c2/dummy.c")
             endif()
             set(ldscripts "linker_esp32c2.lf")
         else()
+            list(APPEND srcs "controller/${target_name}/ble.c")
             list(APPEND ldscripts "linker_esp_ble_controller.lf")
         endif()
 
@@ -130,6 +133,7 @@ if(CONFIG_BT_ENABLED)
          "common/osi/osi.c"
          "common/osi/semaphore.c"
          "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
          )
 
     # Host Bluedroid
@@ -737,6 +741,7 @@ if(CONFIG_BT_ENABLED)
                     "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
                     "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                 )
 
             if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
@@ -856,6 +861,7 @@ idf_component_register(SRCS "${srcs}"
                        PRIV_INCLUDE_DIRS "${priv_include_dirs}"
                        REQUIRES esp_timer esp_wifi
                        PRIV_REQUIRES nvs_flash soc esp_pm esp_phy esp_coex mbedtls esp_driver_uart vfs esp_ringbuf
+                                     esp_driver_spi esp_driver_gpio
                        LDFRAGMENTS "${ldscripts}")
 
 if(CONFIG_BT_ENABLED)
@@ -882,6 +888,9 @@ if(CONFIG_BT_ENABLED)
             target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
         endif()
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
+        endif()
         if(CONFIG_IDF_TARGET_ESP32C6)
             add_prebuilt_library(libble_app
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c6/libble_app.a")
@@ -889,7 +898,7 @@ if(CONFIG_BT_ENABLED)
             add_prebuilt_library(libble_app
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c61/libble_app.a")
         else()
-            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
                 add_prebuilt_library(libble_app
                     "controller/lib_${target_name}/${target_name}-bt-lib/libble_app_flash.a")
             else()

components/bt/common/Kconfig.in

@@ -4,3 +4,58 @@ config BT_ALARM_MAX_NUM
     help
         This option decides the maximum number of alarms which
         could be used by Bluetooth host.
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    int "Number of ble log async SPI output queues"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 4
+    help
+            The number of ble log async SPI output queues
+
+config BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE
+    int "Size of ble log async SPI output transaction buffer size"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2048
+    help
+            The size of ble log async SPI output transaction buffer size
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+            GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+            GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+            GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+            Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+            GPIO number of SYNC IO

components/bt/common/ble_log/ble_log_spi_out.c

@@ -0,0 +1,401 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_spi_out.h"
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+// Private defines
+#define SPI_OUT_BUS SPI2_HOST
+#define SPI_OUT_TAIL 0xAA
+#define SPI_OUT_FLUSHOUT_TIMEOUT (1000 * 1000)
+#define SPI_OUT_TS_SYNC_TIMEOUT (1000 * 1000)
+
+// Private typedefs
+typedef struct spi_out_trans {
+    spi_transaction_t trans;
+    struct spi_out_trans *next;
+} spi_out_trans_t;
+
+// Private variables
+static spi_device_handle_t spi_handle = NULL;
+static spi_out_trans_t *trans_head = NULL;
+static SemaphoreHandle_t mutex_handle = NULL;
+static bool spi_out_inited = false;
+static esp_timer_handle_t flushout_timer_handle = NULL;
+static uint32_t loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+static bool sync_io_level = false;
+static esp_timer_handle_t ts_sync_timer_handle = NULL;
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private function declarations
+static void spi_out_init_trans(void);
+static void spi_out_deinit_trans(void);
+static void spi_out_recycle_trans(uint32_t ms_to_wait);
+static void spi_out_append_trans(void);
+static int spi_out_write(const uint8_t *addr, uint16_t len);
+static void esp_timer_cb_flushout(void);
+static void esp_timer_cb_ts_sync(void);
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+extern uint32_t r_ble_lll_timer_current_tick_get(void);
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+extern uint32_t r_os_cputime_get32(void);
+#endif // CONFIG_IDF_TARGET_ESP32C2
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Private functions
+static void spi_out_init_trans(void)
+{
+    for (int i = 0; i < CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE; i++) {
+        // Allocate memory for SPI transaction
+        uint8_t *buf = (uint8_t *)spi_bus_dma_memory_alloc(SPI_OUT_BUS, CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE, 0);
+        assert(buf);
+
+        // Initialize new trans
+        spi_out_trans_t *new_trans = (spi_out_trans_t *)malloc(sizeof(spi_out_trans_t));
+        assert(new_trans);
+        memset(new_trans, 0, sizeof(spi_out_trans_t));
+        new_trans->trans.tx_buffer = buf;
+        new_trans->trans.length = 0;
+
+        // Append new trans to free trans list
+        new_trans->next = trans_head;
+        trans_head = new_trans;
+    }
+    return;
+}
+
+static void spi_out_deinit_trans(void)
+{
+    // Wait up to QUEUE_SIZE * 100 ms for all transactions to complete and be recycled
+    spi_out_recycle_trans(100);
+
+    // Release memory
+    spi_out_trans_t *next;
+    while (trans_head != NULL) {
+        next = trans_head->next;
+        free((uint8_t *)trans_head->trans.tx_buffer);
+        free(trans_head);
+        trans_head = next;
+    }
+    trans_head = NULL;
+    return;
+}
+
+// CRITICAL: Do not recycle trans when trans_head is not empty!
+IRAM_ATTR static void spi_out_recycle_trans(uint32_t ms_to_wait)
+{
+    // Try to recycle transaction
+    spi_transaction_t *ret_trans;
+    spi_out_trans_t *recycled_trans;
+    while (ESP_OK == spi_device_get_trans_result(spi_handle, &ret_trans, pdMS_TO_TICKS(ms_to_wait))) {
+        recycled_trans = __containerof(ret_trans, spi_out_trans_t, trans);
+        recycled_trans->next = trans_head;
+        trans_head = recycled_trans;
+        trans_head->trans.length = 0;
+        trans_head->trans.rxlength = 0;
+    }
+}
+
+IRAM_ATTR static void spi_out_append_trans(void)
+{
+    // Stop flushout timer
+    esp_timer_stop(flushout_timer_handle);
+
+    // Transaction head shall not be NULL for appending
+    if (trans_head) {
+        // Detach transaction head
+        spi_out_trans_t *trans_to_append = trans_head;
+        trans_head = trans_head->next;
+        trans_to_append->next = NULL;
+
+        // CRITICAL: Length unit conversion from bytes to bits
+        trans_to_append->trans.length *= 8;
+        ESP_ERROR_CHECK(spi_device_queue_trans(spi_handle, &trans_to_append->trans, 0));
+    }
+
+    // Try to recycle trans
+    spi_out_recycle_trans(0);
+
+    // Restart flushout timer
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+}
+
+IRAM_ATTR static int spi_out_write(const uint8_t *addr, uint16_t len)
+{
+    // Recycle trans if free buffer list is empty
+    if (!trans_head) {
+        spi_out_recycle_trans(0);
+    }
+
+    // Copy user data to buffer
+    uint16_t copy_buf_len;
+    uint16_t data_left_len = len;
+    uint16_t empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE - trans_head->trans.length;
+    while (data_left_len) {
+        // There shall always be available buffer in free buffer list during write operation
+        if (!trans_head) {
+            return -1;
+        }
+
+        // Copy data to buffer and update length
+        copy_buf_len = (data_left_len > empty_buf_len) ? empty_buf_len : data_left_len;
+        memcpy((uint8_t *)trans_head->trans.tx_buffer + trans_head->trans.length, addr + (len - data_left_len), copy_buf_len);
+        trans_head->trans.length += copy_buf_len;
+        data_left_len -= copy_buf_len;
+
+        // If buffer is full, append transaction and reset buffer length
+        if (trans_head->trans.length == CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE) {
+            spi_out_append_trans();
+            empty_buf_len = CONFIG_BT_BLE_LOG_SPI_OUT_TRANS_BUF_SIZE;
+        }
+    }
+    return 0;
+}
+
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_flushout(void)
+{
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Flushout
+    if (trans_head) {
+        // Make sure there's enough space for loss frame counter
+        if (trans_head->next && loss_frame_cnt) {
+            ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_LOSS, (uint8_t *)&loss_frame_cnt, sizeof(loss_frame_cnt));
+            loss_frame_cnt = 0;
+        }
+        if (trans_head->trans.length) {
+            spi_out_append_trans();
+        }
+    }
+    else {
+        // Restart flushout timer
+        esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    }
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+// CRITICAL: This function is called in ESP Timer task
+IRAM_ATTR static void esp_timer_cb_ts_sync(void)
+{
+    // Initialize variables
+    uint32_t lc_ts = 0;
+    uint32_t esp_ts = 0;
+
+    // Enter critical
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+    // Get LC timestamp
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6)
+    lc_ts = r_ble_lll_timer_current_tick_get();
+#endif // CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C6
+#if defined(CONFIG_IDF_TARGET_ESP32C2)
+    lc_ts = r_os_cputime_get32();
+#endif // CONFIG_IDF_TARGET_ESP32C2
+
+    // Toggle Sync IO
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, (uint32_t)sync_io_level);
+
+    // Get ESP timestamp
+    esp_ts = esp_timer_get_time();
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    // Exit critical
+
+    // Write timestamp sync log
+    uint8_t sync_frame[9];
+    sync_frame[0] = ((uint8_t)sync_io_level & 0xFF);
+    memcpy(sync_frame + 1, &lc_ts, sizeof(lc_ts));
+    memcpy(sync_frame + 5, &esp_ts, sizeof(esp_ts));
+    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_SYNC, sync_frame, 9);
+
+    // Update IO level
+    sync_io_level = !sync_io_level;
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+// Public functions
+void ble_log_spi_out_init(void)
+{
+    // Avoid double init
+    if (spi_out_inited) {
+        return;
+    }
+
+    // Initialize mutex
+    mutex_handle = xSemaphoreCreateRecursiveMutex();
+
+    // Initialize SPI
+    spi_bus_config_t bus_config = {
+        .miso_io_num = -1,
+        .mosi_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM,
+        .sclk_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM,
+        .quadwp_io_num = -1,
+        .quadhd_io_num = -1,
+        .max_transfer_sz = 10240
+    };
+    spi_device_interface_config_t dev_config = {
+        .clock_speed_hz = SPI_MASTER_FREQ_20M,
+        .mode = 0,
+        .spics_io_num = CONFIG_BT_BLE_LOG_SPI_OUT_CS_IO_NUM,
+        .queue_size = CONFIG_BT_BLE_LOG_SPI_OUT_QUEUE_SIZE
+    };
+    ESP_ERROR_CHECK(spi_bus_initialize(SPI_OUT_BUS, &bus_config, SPI_DMA_CH_AUTO));
+    ESP_ERROR_CHECK(spi_bus_add_device(SPI_OUT_BUS, &dev_config, &spi_handle));
+
+    // Initialize transaction link nodes
+    spi_out_init_trans();
+
+    // Initialize flushout timer
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_flushout,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&timer_args, &flushout_timer_handle));
+    esp_timer_start_once(flushout_timer_handle, SPI_OUT_FLUSHOUT_TIMEOUT);
+    loss_frame_cnt = 0;
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Initialize timestamp synchronizer
+    gpio_config_t io_conf = {
+        .intr_type = GPIO_INTR_DISABLE,
+        .mode = GPIO_MODE_OUTPUT,
+        .pin_bit_mask = (1UL << CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM),
+        .pull_down_en = 0,
+        .pull_up_en = 0
+    };
+    ESP_ERROR_CHECK(gpio_config(&io_conf));
+    sync_io_level = false;
+    gpio_set_level(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM, sync_io_level);
+    esp_timer_create_args_t ts_sync_timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_ts_sync,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    ESP_ERROR_CHECK(esp_timer_create(&ts_sync_timer_args, &ts_sync_timer_handle));
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Set init flag
+    spi_out_inited = true;
+}
+
+void ble_log_spi_out_deinit(void)
+{
+    // Avoid double deinit
+    if (!spi_out_inited) {
+        return;
+    }
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    // Deinitialize timestamp synchronizer
+    esp_timer_stop(ts_sync_timer_handle);
+    esp_timer_delete(ts_sync_timer_handle);
+    gpio_reset_pin(CONFIG_BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM);
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+    // Deinitialize flushout timer
+    esp_timer_stop(flushout_timer_handle);
+    esp_timer_delete(flushout_timer_handle);
+
+    // Deinitialize transaction link nodes
+    spi_out_deinit_trans();
+
+    // Deinitialize SPI
+    ESP_ERROR_CHECK(spi_bus_remove_device(spi_handle));
+    ESP_ERROR_CHECK(spi_bus_free(SPI_OUT_BUS));
+    spi_handle = NULL;
+
+    // Deinitialize mutex
+    vSemaphoreDelete(mutex_handle);
+    mutex_handle = NULL;
+
+    // Reset init flag
+    spi_out_inited = false;
+}
+
+#if CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+void ble_log_spi_out_ts_sync_start(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Start timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (!esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_start_periodic(ts_sync_timer_handle, SPI_OUT_TS_SYNC_TIMEOUT);
+        }
+    }
+}
+
+void ble_log_spi_out_ts_sync_stop(void)
+{
+    // Check if SPI out is initialized
+    if (!spi_out_inited) {
+        return;
+    }
+
+    // Stop timestamp sync timer
+    if (ts_sync_timer_handle) {
+        if (esp_timer_is_active(ts_sync_timer_handle)) {
+            esp_timer_stop(ts_sync_timer_handle);
+        }
+    }
+}
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+
+IRAM_ATTR void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end)
+{
+    return ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP, addr, len);
+}
+
+IRAM_ATTR void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
+{
+    // Initialize frame sequence number
+    static uint8_t frame_sn = 0;
+
+    // Take semaphore
+    assert(xSemaphoreTakeRecursive(mutex_handle, portMAX_DELAY) == pdTRUE);
+
+    // Prepare frame head and frame tail
+    const uint8_t head[4] = {len & 0xFF, (len >> 8) & 0xFF, (uint8_t)source, frame_sn};
+    const uint8_t tail = SPI_OUT_TAIL;
+
+    // Write frame head first, then payload, finally frame tail
+    do
+    {
+        if (spi_out_write(head, 4) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(addr, len) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+        if (spi_out_write(&tail, 1) != 0) {
+            loss_frame_cnt++;
+            break;
+        }
+    } while (0);
+
+    // Update frame sequence number
+    frame_sn++;
+
+    // Release semaphore
+    xSemaphoreGiveRecursive(mutex_handle);
+    return;
+}
+
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h

@@ -0,0 +1,33 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+
+// Public typedefs
+#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
+#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
+#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
+#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
+#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
+#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
+#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+
+// Public functions
+void ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_write_esp(uint32_t len, const uint8_t *addr, bool end);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+
+#endif // __BT_SPI_OUT_H__

components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
         if (p_data->req_data.p_data->write_req.is_prep) {
             tBTA_GATT_STATUS status = GATT_SUCCESS;
 
-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                 if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                 }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);
 
             memset(&rsp, 0, sizeof(tGATTS_RSP));
             rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;

components/bt/common/btc/profile/esp/blufi/blufi_prf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
 
 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
     uint16_t checksum, checksum_pkt;
     int ret;
 

components/bt/common/btc/profile/esp/blufi/include/blufi_int.h

@@ -36,7 +36,9 @@ typedef struct {
     UINT32                  trans_id;
     UINT8                   congest;
     UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
     uint8_t                 *prepare_buf;
     int                     prepare_len;
     /* Control reference */

components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h

@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a
 
 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -240,6 +240,32 @@ static void init_gatt_values(void)
 
 }
 
+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
     int rc;
@@ -260,6 +286,18 @@ int esp_blufi_gatt_svr_init(void)
     return 0;
 }
 
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
 static int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {

components/bt/common/osi/include/osi/fixed_pkt_queue.h

@@ -76,4 +76,8 @@ void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
 
 void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif

components/bt/common/osi/pkt_queue.c

@@ -25,6 +25,7 @@ struct pkt_queue *pkt_queue_create(void)
     }
     if (osi_mutex_new(&queue->lock) != 0) {
         osi_free(queue);
+        return NULL;
     }
     struct pkt_queue_header *p = &queue->header;
     STAILQ_INIT(p);

components/bt/controller/esp32/Kconfig.in

@@ -23,6 +23,14 @@ config BTDM_CTRL_BLE_MAX_CONN
         BLE maximum connections of bluetooth controller.
         Each connection uses 1KB static DRAM whenever the BT controller is enabled.
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT
+    int "BR/EDR default minimum size of encryption key"
+    depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 7
+    range 7 16
+    help
+        BR/EDR default minimum size of encryption key when start encryption.
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN
     int "BR/EDR ACL Max Connections"
     depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -177,6 +185,11 @@ config BTDM_CTRL_BLE_MAX_CONN_EFF
     default BTDM_CTRL_BLE_MAX_CONN if BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM
     default 0
 
+config BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT_EFF
+    int
+    default BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+    default 0
+
 config BTDM_CTRL_BR_EDR_MAX_ACL_CONN_EFF
     int
     default BTDM_CTRL_BR_EDR_MAX_ACL_CONN if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
@@ -320,7 +333,7 @@ choice BTDM_BLE_SLEEP_CLOCK_ACCURACY
         needs a larger RX window to synchronize with master in each anchor point, thus resulting in an
         increase of power consumption but a higher level of robustness in keeping connected. According
         to the requirements of Bluetooth Core specification 4.2, the worst-case accuracy of Classic
-        Bluetooth low power oscialltor(LPO) is +/-250ppm in STANDBY and in low power modes such as
+        Bluetooth Low Power Oscillator (LPO) is +/-250ppm in STANDBY and in low power modes such as
         sniff. For BLE the worst-case SCA is +/-500ppm.
 
         - "151ppm to 250ppm" option is the default value for Bluetooth Dual mode
@@ -487,14 +500,14 @@ config BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD
         If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
         may cause adv packets lost more.
 
-menu "BLE disconnect when instant passed"
+menu "BLE disconnects when Instant Passed (0x28) occurs"
     config BTDM_BLE_LLCP_CONN_UPDATE
         bool "BLE ACL connection update procedure"
         depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed during connection update procedure.
+            when Instant Passed (0x28) error occurs during connection update procedure.
 
     config BTDM_BLE_LLCP_CHAN_MAP_UPDATE
         bool "BLE ACL channel map update procedure"
@@ -502,9 +515,35 @@ menu "BLE disconnect when instant passed"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in channel map update procedure.
+            when Instant Passed (0x28) error occurs in channel map update procedure.
 endmenu
 
+config BTDM_BLE_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BTDM_BLE_PING_EN
+    bool "Enable LE Ping procedure"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+config BTDM_CTRL_CONTROLLER_DEBUG_MODE_1
+    visible if 0
+    bool "Enable Bluetooth controller debugging mode 1 (for internal use only)"
+    default n
+    depends on BT_ENABLED
+    help
+        Enables specific debugging features for the Bluetooth controller.
+        This option is strictly for internal debugging purposes and should not be enabled in production environments,
+        as it may impact performance and stability.
+
 config BTDM_RESERVE_DRAM
     hex
     default 0xdb5c if BT_ENABLED

components/bt/controller/esp32/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -48,6 +48,10 @@
 #include "esp_rom_sys.h"
 #include "hli_api.h"
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -249,6 +253,16 @@ extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+extern void bt_stack_enableSecCtrlVsCmd(bool en);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+extern void bt_stack_enableCoexVsCmd(bool en);
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
 /* Local Function Declare
  *********************************************************************
  */
@@ -449,7 +463,11 @@ static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit f
 
 #if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
 // used low power clock
-static DRAM_ATTR uint8_t btdm_lpclk_sel;
+#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL;
+#else
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL;
+#endif /* CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL */
 #endif /* #ifdef CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG */
 
 static DRAM_ATTR QueueHandle_t s_wakeup_req_sem = NULL;
@@ -1345,7 +1363,8 @@ static esp_err_t esp_bt_controller_rom_mem_release(esp_bt_mode_t mode)
 
     //already released
     if (!(mode & btdm_dram_available_region[0].mode)) {
-        return ESP_ERR_INVALID_STATE;
+        ESP_LOGW(BTDM_LOG_TAG, "%s already released, mode %d",__func__, mode);
+        return ESP_OK;
     }
 
     for (int i = 0; i < sizeof(btdm_dram_available_region)/sizeof(btdm_dram_available_region_t); i++) {
@@ -1490,6 +1509,117 @@ static void hli_queue_setup_pinned_to_core(int core_id)
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
+// init low-power control resources
+static esp_err_t btdm_low_power_mode_init(void)
+{
+    esp_err_t err = ESP_OK;
+
+#ifdef CONFIG_PM_ENABLE
+    s_btdm_allow_light_sleep = false;
+#endif
+
+    // set default sleep clock cycle and its fractional bits
+    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        // check whether or not EXT_CRYS is working
+        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
+#ifdef CONFIG_PM_ENABLE
+            s_btdm_allow_light_sleep = true;
+#endif
+        } else {
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
+                    "light sleep mode will not be able to apply when bluetooth is enabled");
+            btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL; // set default value
+        }
+    } else if (btdm_lpclk_sel != ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        assert(0);
+    }
+
+    bool select_src_ret __attribute__((unused));
+    bool set_div_ret __attribute__((unused));
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
+        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
+        set_div_ret = btdm_lpclk_set_div(0);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
+            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
+        assert(btdm_lpcycle_us != 0);
+    }
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
+
+#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
+#else
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+#endif
+
+#ifdef CONFIG_PM_ENABLE
+    if (!s_btdm_allow_light_sleep) {
+        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+            return err;
+        }
+    }
+    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+        return err;
+    }
+    esp_timer_create_args_t create_args = {
+        .callback = btdm_slp_tmr_callback,
+        .arg = NULL,
+        .name = "btSlp"
+    };
+    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
+        return err;
+    }
+
+    s_pm_lock_acquired = true;
+#endif
+
+    return err;
+}
+
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_INITED &&
+            btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return ESP_BT_SLEEP_CLOCK_NONE;
+    }
+    return btdm_lpclk_sel;
+#else
+    return ESP_BT_SLEEP_CLOCK_NONE;
+#endif
+}
+
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (lpclk < ESP_BT_SLEEP_CLOCK_MAIN_XTAL || lpclk > ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (btdm_controller_status == ESP_BT_CONTROLLER_STATUS_INITED ||
+            btdm_controller_status == ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        ESP_LOGW(BTDM_LOG_TAG, "Please set the Bluetooth sleep clock source before Bluetooth initialization");
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    btdm_lpclk_sel = lpclk;
+    return ESP_OK;
+#else
+    return ESP_ERR_NOT_SUPPORTED;
+#endif
+}
+
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 {
     esp_err_t err;
@@ -1552,58 +1682,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     btdm_controller_mem_init();
 
     periph_module_enable(PERIPH_BT_MODULE);
-
-#ifdef CONFIG_PM_ENABLE
-    s_btdm_allow_light_sleep = false;
-#endif
-
-    // set default sleep clock cycle and its fractional bits
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-
-#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
-
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-    // check whether or not EXT_CRYS is working
-    if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32kHz XTAL
-#ifdef CONFIG_PM_ENABLE
-        s_btdm_allow_light_sleep = true;
-#endif
-    } else {
-        ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-    }
-#else
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#endif
-
-    bool select_src_ret __attribute__((unused));
-    bool set_div_ret __attribute__((unused));
-    if (btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
-        set_div_ret = btdm_lpclk_set_div(0);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
-            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
-        assert(btdm_lpcycle_us != 0);
-    }
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
-
-#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
-#else
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-#endif
+    periph_module_reset(PERIPH_BT_MODULE);
 
 #if CONFIG_BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
     sdk_config_set_uart_flow_ctrl_enable(true);
@@ -1611,31 +1690,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     sdk_config_set_uart_flow_ctrl_enable(false);
 #endif
 
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
-            goto error;
-        }
-    }
-    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+    if ((err = btdm_low_power_mode_init()) != ESP_OK) {
+        ESP_LOGE(BTDM_LOG_TAG, "Low power module initialization failed");
         goto error;
     }
-    esp_timer_create_args_t create_args = {
-        .callback = btdm_slp_tmr_callback,
-        .arg = NULL,
-        .name = "btSlp"
-    };
-    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
-        goto error;
-    }
-
-    s_pm_lock_acquired = true;
-#endif
 
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_cfg_mask = btdm_config_mask_load();
 
     err = btdm_controller_init(btdm_cfg_mask, cfg);
@@ -1646,6 +1713,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(true);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(true);
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
@@ -1663,17 +1740,30 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();
 
+#ifdef CONFIG_BT_BLUEDROID_ENABLED
+    bt_stack_enableSecCtrlVsCmd(false);
+#endif // CONFIG_BT_BLUEDROID_ENABLED
+#if defined(CONFIG_BT_NIMBLE_ENABLED) || defined(CONFIG_BT_BLUEDROID_ENABLED)
+    bt_stack_enableCoexVsCmd(false);
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)
+
     return ESP_OK;
 }
 
-static void bt_controller_deinit_internal(void)
+// deinit low power control resources
+static void btdm_low_power_mode_deinit(void)
 {
-    periph_module_disable(PERIPH_BT_MODULE);
-
 #ifdef CONFIG_PM_ENABLE
     if (!s_btdm_allow_light_sleep) {
         esp_pm_lock_delete(s_light_sleep_pm_lock);
@@ -1694,6 +1784,16 @@ static void bt_controller_deinit_internal(void)
     s_pm_lock_acquired = false;
 #endif
 
+    btdm_lpcycle_us = 0;
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+}
+
+static void bt_controller_deinit_internal(void)
+{
+    periph_module_disable(PERIPH_BT_MODULE);
+
+    btdm_low_power_mode_deinit();
+
     if (s_wakeup_req_sem) {
         semphr_delete_wrapper(s_wakeup_req_sem);
         s_wakeup_req_sem = NULL;
@@ -1706,9 +1806,6 @@ static void bt_controller_deinit_internal(void)
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
-    btdm_lpcycle_us = 0;
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-
     esp_bt_power_domain_off();
 
     esp_phy_modem_deinit();

components/bt/controller/esp32c2/Kconfig.in

@@ -308,6 +308,15 @@ config BT_LE_CONTROLLER_LOG_DUMP_ONLY
     help
             Only operate in dump mode
 
+config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    bool "Output ble controller logs to SPI bus (Experimental)"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    select BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Output ble controller logs to SPI bus
+
 config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
     bool "Store ble controller logs to flash(Experimental)"
     depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -347,6 +356,19 @@ config BT_LE_LOG_HCI_BUF_SIZE
     help
             Configure the size of the BLE HCI LOG buffer.
 
+config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+    bool "Enable wrap panic handler"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+    bool "Enable esp_task_wdt_isr_user_handler implementation"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -659,3 +681,11 @@ config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
     bool "Place the connection-related code into IRAM"
     depends on BT_CTRL_RUN_IN_FLASH_ONLY
     default n
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c2/ble.c

@@ -0,0 +1,58 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+#if DEFAULT_BT_LE_ROLE_BROADCASTER
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if DEFAULT_BT_LE_ROLE_OBSERVER
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+#endif // DEFAULT_BT_LE_ROLE_OBSERVER
+
+    chanSel_stack_enableSetCsaVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_enable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+}

components/bt/controller/esp32c2/ble_priv.h

@@ -0,0 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef _BLE_PRIV_H_
+#define _BLE_PRIV_H_
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);
+
+#endif // _BLE_PRIV_H_

components/bt/controller/esp32c2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -64,6 +65,12 @@
 #include "hal/efuse_ll.h"
 #include "soc/rtc.h"
 
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -199,7 +206,7 @@ static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 /* Local variable definition
  ***************************************************************************
  */
-#if CONFIG_ESP32C2_REV_MIN_FULL < 200
+#if (CONFIG_ESP32C2_REV_MIN_FULL < 200) && (!CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
 void *g_ble_lll_rfmgmt_env_p;
 #endif
 /* Static variable declare */
@@ -210,6 +217,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -218,6 +226,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -265,6 +275,13 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
@@ -280,6 +297,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -437,6 +457,21 @@ void esp_ble_controller_log_dump_all(bool output)
         portEXIT_CRITICAL_SAFE(&spinlock);
     }
 }
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -449,6 +484,17 @@ static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_
 
 #define BLE_RTC_DELAY_US                    (1800)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -954,6 +1000,12 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #if CONFIG_SW_COEXIST_ENABLE
     coex_enable();
 #endif
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -963,6 +1015,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -985,7 +1038,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
-
+    ble_stack_disable();
     if (s_ble_active) {
         esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
@@ -1136,12 +1189,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1168,9 +1229,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1193,11 +1258,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1226,9 +1295,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:

components/bt/controller/esp32c2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -220,12 +220,24 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/controller/esp32c3/Kconfig.in

@@ -66,7 +66,7 @@ endchoice
 config BT_CTRL_HCI_TL
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
     help
         HCI mode as VHCI or UART(H4)
@@ -76,7 +76,7 @@ config BT_CTRL_ADV_DUP_FILT_MAX
     range 1 500
     default 30
     help
-        The maximum number of suplicate scan filter
+        The maximum number of 5.0 extend duplicate
 
 choice BT_BLE_CCA_MODE
     prompt "BLE CCA mode"
@@ -445,7 +445,7 @@ config BT_CTRL_SLEEP_CLOCK_EFF
 config BT_CTRL_HCI_TL_EFF
     int
     default 0 if BT_CTRL_HCI_MODE_UART_H4
-    default 1 if BT_CTRL_HCI_M0DE_VHCI
+    default 1 if BT_CTRL_HCI_MODE_VHCI
     default 1
 
 config BT_CTRL_AGC_RECORRECT_EN
@@ -491,27 +491,27 @@ config BT_CTRL_LE_PING_EN
         If this option is disabled, The Controller will not start the LE authenticated payload timer.
         This option is used for some compatibility problems related to LE ping procedure.
 
-menu "BLE disconnect when instant passed"
+menu "BLE disconnects when Instant Passed (0x28) occurs"
     config BT_CTRL_BLE_LLCP_CONN_UPDATE
         bool "BLE ACL connection update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed during connection update procedure.
+            when Instant Passed (0x28) error occurs during connection update procedure.
 
     config BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE
         bool "BLE ACL channel map update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in channel map update procedure.
+            when Instant Passed (0x28) error occurs in channel map update procedure.
 
     config BT_CTRL_BLE_LLCP_PHY_UPDATE
         bool "BLE ACL PHY update procedure"
         default n
         help
             If this option is enabled, Controller will terminate the connection
-            when instant passed in PHY update procedure.
+            when Instant Passed (0x28) error occurs in PHY update procedure.
 endmenu
 config BT_CTRL_RUN_IN_FLASH_ONLY
     bool "Put all BLE Controller code in flash"
@@ -548,3 +548,11 @@ config BT_CTRL_BLE_SECURITY_ENABLE
     depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_CONTROLLER_ONLY
     bool "Enable BLE security feature"
     default y
+
+config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.

components/bt/controller/esp32c3/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -49,6 +49,9 @@
 #else //CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/rom_layout.h"
 #endif
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #if CONFIG_BT_ENABLED
 
 /* Macro definition
@@ -275,6 +278,14 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
 #endif
 
 extern void btdm_cca_feature_enable(void);
+extern void btdm_aa_check_enhance_enable(void);
+
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+extern void chanSel_stack_enableSetCsaVsCmd(bool en);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
 
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
@@ -964,6 +975,9 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BT_BLE_CCA_MODE == 2
     btdm_cca_feature_enable();
 #endif
+#if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 bool bt_async_wakeup_request(void)
@@ -1442,6 +1456,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     coex_init();
 #endif
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_init();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
@@ -1453,6 +1471,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto error;
     }
 
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(true);
+    adv_stack_enableClearLegacyAdvVsCmd(true);
+    advFilter_stack_enableDupExcListVsCmd(true);
+    chanSel_stack_enableSetCsaVsCmd(true);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
 
     return ESP_OK;
@@ -1470,6 +1495,17 @@ esp_err_t esp_bt_controller_deinit(void)
         return ESP_ERR_INVALID_STATE;
     }
 
+#if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+
+#if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+    scan_stack_enableAdvFlowCtrlVsCmd(false);
+    adv_stack_enableClearLegacyAdvVsCmd(false);
+    advFilter_stack_enableDupExcListVsCmd(false);
+    chanSel_stack_enableSetCsaVsCmd(false);
+#endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
+
     btdm_controller_deinit();
 
     bt_controller_deinit_internal();

components/bt/controller/esp32c5/Kconfig.in

@@ -283,54 +283,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Store ble controller logs to flash memory.
+
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -477,6 +544,7 @@ config BT_LE_USE_ESP_TIMER
     help
         Set this option to use Esp Timer which has higher priority timer
         instead of FreeRTOS timer
+
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
     default y
@@ -575,3 +643,134 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
 config BT_LE_MSYS_INIT_IN_CONTROLLER
     bool "Msys Mbuf Init in Controller"
     default y
+
+config BT_LE_TX_CCA_ENABLED
+    bool "Enable TX CCA feature"
+    default n
+    help
+        Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
+
+config BT_LE_CCA_RSSI_THRESH
+    int "CCA RSSI threshold value"
+    depends on BT_LE_TX_CCA_ENABLED
+    range 20 100
+    default 20
+    help
+        Power threshold of CCA in unit of -1 dBm.
+
+choice BT_LE_DFT_TX_POWER_LEVEL_DBM
+    prompt "BLE default Tx power level(dBm)"
+    default BT_LE_DFT_TX_POWER_LEVEL_P9
+    help
+        Specify default Tx power level(dBm).
+    config BT_LE_DFT_TX_POWER_LEVEL_N24
+        bool "-24dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N21
+        bool "-21dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N18
+        bool "-18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N15
+        bool "-15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N12
+        bool "-12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N9
+        bool "-9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N6
+        bool "-6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N3
+        bool "-3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N0
+        bool "0dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P3
+        bool "+3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P6
+        bool "+6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P9
+        bool "+9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P12
+        bool "+12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P15
+        bool "+15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P18
+        bool "+18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
+endchoice
+
+config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
+    int
+    default -15 if BT_LE_DFT_TX_POWER_LEVEL_N15
+    default -12 if BT_LE_DFT_TX_POWER_LEVEL_N12
+    default -9 if BT_LE_DFT_TX_POWER_LEVEL_N9
+    default -6 if BT_LE_DFT_TX_POWER_LEVEL_N6
+    default -3 if BT_LE_DFT_TX_POWER_LEVEL_N3
+    default 0 if BT_LE_DFT_TX_POWER_LEVEL_N0
+    default 3 if BT_LE_DFT_TX_POWER_LEVEL_P3
+    default 6 if BT_LE_DFT_TX_POWER_LEVEL_P6
+    default 9 if BT_LE_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_LE_DFT_TX_POWER_LEVEL_P12
+    default 15 if BT_LE_DFT_TX_POWER_LEVEL_P15
+    default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
+    default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
+    default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32c5/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32c5/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32c5/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -34,6 +34,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -104,12 +105,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -127,6 +131,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -170,6 +178,9 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
                               const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end);
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
+#endif // #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* Local variable definition
  ***************************************************************************
@@ -178,6 +189,224 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
+enum log_out_mode {
+    LOG_DUMP_MEMORY,
+    LOG_ASYNC_OUT,
+    LOG_STORAGE_TO_FLASH,
+};
+
+bool log_is_inited = false;
+#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+uint8_t log_output_mode = LOG_DUMP_MEMORY;
+#else
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#else
+uint8_t log_output_mode = LOG_ASYNC_OUT;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
+
+void esp_bt_log_output_mode_set(uint8_t output_mode)
+{
+    log_output_mode = output_mode;
+}
+
+uint8_t esp_bt_log_output_mode_get(void)
+{
+    return log_output_mode;
+}
+
+esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
+{
+    esp_err_t ret = ESP_OK;
+    interface_func_t bt_controller_log_interface;
+    bt_controller_log_interface = esp_bt_controller_log_interface;
+    bool task_create;
+    uint8_t buffers = 0;
+
+    if (log_is_inited) {
+        return ret;
+    }
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+    buffers |= ESP_BLE_LOG_BUF_HCI;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+
+    switch (log_output_mode) {
+        case LOG_DUMP_MEMORY:
+            task_create = false;
+            break;
+        case LOG_ASYNC_OUT:
+        case LOG_STORAGE_TO_FLASH:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+            if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+                esp_bt_ctrl_log_partition_get_and_erase_first_block();
+            }
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+            break;
+        default:
+            assert(0);
+    }
+
+    ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
+    if (ret == ESP_OK) {
+        log_is_inited = true;
+    }
+    return ret;
+}
+
+void esp_bt_ontroller_log_deinit(void)
+{
+    r_ble_log_deinit_async();
+    log_is_inited = false;
+}
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+#include "esp_partition.h"
+#include "hal/wdt_hal.h"
+
+#define MAX_STORAGE_SIZE          (CONFIG_BT_LE_CONTROLLER_LOG_PARTITION_SIZE)
+#define BLOCK_SIZE                (4096)
+#define THRESHOLD                 (3072)
+#define PARTITION_NAME            "bt_ctrl_log"
+
+static const esp_partition_t *log_partition;
+static uint32_t write_index = 0;
+static uint32_t next_erase_index = BLOCK_SIZE;
+static bool block_erased = false;
+static bool stop_write = false;
+static bool is_filled = false;
+
+static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void)
+{
+    log_partition = NULL;
+    assert(MAX_STORAGE_SIZE % BLOCK_SIZE == 0);
+    // Find the partition map in the partition table
+    log_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, PARTITION_NAME);
+    assert(log_partition != NULL);
+    // Prepare data to be read later using the mapped address
+    ESP_ERROR_CHECK(esp_partition_erase_range(log_partition, 0, BLOCK_SIZE));
+    write_index = 0;
+    next_erase_index = BLOCK_SIZE;
+    block_erased = false;
+    is_filled = false;
+    stop_write = false;
+}
+
+static int esp_bt_controller_log_storage(uint32_t len, const uint8_t *addr, bool end)
+{
+    if (len > MAX_STORAGE_SIZE) {
+        return -1;
+    }
+
+    if (stop_write) {
+        return 0;
+    }
+
+    if (((write_index) % BLOCK_SIZE) >= THRESHOLD && !block_erased) {
+        // esp_rom_printf("Ers nxt: %d,%d\n", next_erase_index, write_index);
+        esp_partition_erase_range(log_partition, next_erase_index, BLOCK_SIZE);
+        next_erase_index = (next_erase_index + BLOCK_SIZE) % MAX_STORAGE_SIZE;
+        block_erased = true;
+    }
+
+    if (((write_index + len) / BLOCK_SIZE) >  (write_index / BLOCK_SIZE)) {
+        block_erased = false;
+    }
+
+    if (write_index + len <= MAX_STORAGE_SIZE) {
+        esp_partition_write(log_partition, write_index, addr, len);
+        write_index = (write_index + len) % MAX_STORAGE_SIZE;
+    } else {
+        uint32_t first_part_len = MAX_STORAGE_SIZE - write_index;
+        esp_partition_write(log_partition, write_index, addr, first_part_len);
+        esp_partition_write(log_partition, 0, addr + first_part_len, len - first_part_len);
+        write_index = len - first_part_len;
+        is_filled = true;
+        // esp_rom_printf("old idx: %d,%d\n",next_erase_index, write_index);
+    }
+
+    return 0;
+}
+
+void esp_bt_read_ctrl_log_from_flash(bool output)
+{
+    esp_partition_mmap_handle_t mmap_handle;
+    uint32_t read_index;
+    const void *mapped_ptr;
+    const uint8_t *buffer;
+    uint32_t print_len;
+    uint32_t max_print_len;
+    esp_err_t err;
+
+    print_len = 0;
+    max_print_len = 4096;
+    err = esp_partition_mmap(log_partition, 0, MAX_STORAGE_SIZE, ESP_PARTITION_MMAP_DATA, &mapped_ptr, &mmap_handle);
+    if (err != ESP_OK) {
+        ESP_LOGE("FLASH", "Mmap failed: %s", esp_err_to_name(err));
+        return;
+    }
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
+    r_ble_log_async_output_dump_all(true);
+    esp_bt_ontroller_log_deinit();
+    stop_write = true;
+
+    buffer = (const uint8_t *)mapped_ptr;
+    esp_panic_handler_reconfigure_wdts(5000);
+    if (is_filled) {
+        read_index = next_erase_index;
+    } else {
+        read_index = 0;
+    }
+
+    esp_rom_printf("\r\nREAD_CHECK:%ld,%ld,%d\r\n",read_index, write_index, is_filled);
+    esp_rom_printf("\r\n[DUMP_START:");
+    while (read_index != write_index) {
+        esp_rom_printf("%02x ", buffer[read_index]);
+        if (print_len > max_print_len) {
+            esp_panic_handler_reconfigure_wdts(5000);
+            print_len = 0;
+        }
+
+        print_len++;
+        read_index = (read_index + 1) % MAX_STORAGE_SIZE;
+    }
+
+    esp_rom_printf(":DUMP_END]\r\n");
+    portEXIT_CRITICAL_SAFE(&spinlock);
+    esp_partition_munmap(mmap_handle);
+    err = esp_bt_controller_log_init(log_output_mode);
+    assert(err == ESP_OK);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -186,10 +415,20 @@ static bool s_ble_active = false;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -283,8 +522,11 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
                                   void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -377,7 +619,6 @@ static esp_err_t sleep_modem_ble_mac_retention_init(void *arg)
         ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Modem BLE MAC retention initialization");
     }
     return err;
-    return ESP_OK;
 }
 
 static esp_err_t sleep_modem_ble_mac_modem_state_init(uint8_t extra)
@@ -409,6 +650,7 @@ void IRAM_ATTR sleep_modem_light_sleep_overhead_set(uint32_t overhead)
 }
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
 
+
 esp_err_t controller_sleep_init(void)
 {
     esp_err_t rc = 0;
@@ -423,13 +665,13 @@ esp_err_t controller_sleep_init(void)
                                 BLE_RTC_DELAY_US_MODEM_SLEEP);
 #endif /* FREERTOS_USE_TICKLESS_IDLE */
 #endif // CONFIG_BT_LE_SLEEP_ENABLE
+
 #ifdef CONFIG_PM_ENABLE
     rc = esp_pm_lock_create(ESP_PM_CPU_FREQ_MAX, 0, "bt", &s_pm_lock);
     if (rc != ESP_OK) {
         goto error;
     }
 #endif // CONFIG_PM_ENABLE
-
 #if CONFIG_BT_LE_SLEEP_ENABLE && CONFIG_FREERTOS_USE_TICKLESS_IDLE
     /* Create a new regdma link for BLE related register restoration */
     rc = sleep_modem_ble_mac_modem_state_init(0);
@@ -611,7 +853,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     uint8_t hci_transport_mode;
 
     memset(&npl_info, 0, sizeof(ble_npl_count_info_t));
-
     if (ble_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "invalid controller state");
         return ESP_ERR_INVALID_STATE;
@@ -674,20 +915,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_SW_COEXIST_ENABLE
 
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    interface_func_t bt_controller_log_interface;
-    bt_controller_log_interface = esp_bt_controller_log_interface;
-    uint8_t buffers = 0;
-#if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    buffers |= ESP_BLE_LOG_BUF_HCI;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
-#if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    ret = r_ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
-#else
-    ret = r_ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
-#endif // CONFIG_BT_CONTROLLER_LOG_DUMP
+    ret = esp_bt_controller_log_init(log_output_mode);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
         goto modem_deint;
@@ -699,13 +927,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -720,6 +954,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
         goto free_controller;
     }
+
     ESP_ERROR_CHECK(esp_read_mac((uint8_t *)mac, ESP_MAC_BT));
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
              mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
@@ -744,11 +979,12 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_ontroller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     esp_phy_modem_deinit();
     // modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
@@ -781,10 +1017,11 @@ esp_err_t esp_bt_controller_deinit(void)
     // modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    r_ble_log_deinit_async();
+    esp_bt_ontroller_log_deinit();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 #if CONFIG_BT_NIMBLE_ENABLED
@@ -830,6 +1067,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -838,6 +1085,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -861,6 +1109,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -990,12 +1239,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1023,9 +1280,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1048,11 +1309,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1082,9 +1347,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1104,24 +1371,40 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }
-    if (end) {
-        esp_rom_printf("\n");
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        esp_bt_controller_log_storage(len, addr, end);
+#endif //CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_reconfigure_wdts(1000);
+        for (int i = 0; i < len; i++) {
+            esp_rom_printf("%02x ", addr[i]);
+        }
+
+        if (end) {
+            esp_rom_printf("\n");
+        }
+        portEXIT_CRITICAL_SAFE(&spinlock);
     }
 }
 
 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
-
-    portENTER_CRITICAL_SAFE(&spinlock);
-    esp_panic_handler_reconfigure_wdts(5000);
-    BT_ASSERT_PRINT("\r\n[DUMP_START:");
-    r_ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT(":DUMP_END]\r\n");
-    portEXIT_CRITICAL_SAFE(&spinlock);
+    if (log_output_mode == LOG_STORAGE_TO_FLASH) {
+#if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        esp_bt_read_ctrl_log_from_flash(output);
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    } else {
+        portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+        portENTER_CRITICAL_SAFE(&spinlock);
+        esp_panic_handler_reconfigure_wdts(5000);
+        BT_ASSERT_PRINT("\r\n[DUMP_START:");
+        r_ble_log_async_output_dump_all(output);
+        BT_ASSERT_PRINT(":DUMP_END]\r\n");
+        portEXIT_CRITICAL_SAFE(&spinlock);
+    }
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
@@ -1336,3 +1619,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32c5/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -148,12 +148,62 @@ extern "C" {
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
 
+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
@@ -216,8 +266,7 @@ extern "C" {
 
 #define RTC_FREQ_N                          (32768) /* in Hz */
 
-#define BLE_LL_TX_PWR_DBM_N                 (9)
-
+#define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)
 
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)

components/bt/controller/esp32c6/Kconfig.in

@@ -315,72 +315,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
             Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
             The size of ble controller log partition shall be a multiples of 4K.
             The name of log partition shall be "bt_ctrl_log".
             The partition type shall be ESP_PARTITION_TYPE_DATA.
             The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -697,3 +746,56 @@ config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32c6/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32c6/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32c6/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,7 @@
 
 #include "esp_bt.h"
 #include "esp_intr_alloc.h"
+#include "ble_priv.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
 #ifdef CONFIG_ESP_PHY_ENABLED
@@ -56,6 +57,13 @@
 
 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -107,12 +115,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -130,6 +141,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -188,6 +203,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -196,6 +212,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -243,21 +261,35 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
-
     return ret;
 }
 
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -382,6 +414,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -390,10 +438,20 @@ static bool s_ble_active = false;
 static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
-
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP        (2500)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP        (500)
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 static const struct osi_coex_funcs_t s_osi_coex_funcs_ro = {
     ._magic = OSI_COEX_MAGIC_VALUE,
     ._version = OSI_COEX_VERSION,
@@ -484,11 +542,13 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
     return rc;
 }
 
-static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
-                                  void *arg, void **ret_handle_in)
+static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler, void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -506,12 +566,16 @@ void esp_bt_rtc_slow_clk_select(uint8_t slow_clk_src)
     switch (slow_clk_src) {
         case MODEM_CLOCK_LPCLK_SRC_MAIN_XTAL:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using main XTAL as clock source");
+#if SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             uint32_t chip_version = efuse_hal_chip_revision();
             if (chip_version == 0) {
                 modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (400 - 1));
             } else{
                 modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (5 - 1));
             }
+#else
+            modem_clock_select_lp_clock_source(PERIPH_BT_MODULE, slow_clk_src, (400 - 1));
+#endif // SOC_BLE_USE_WIFI_PWR_CLK_WORKAROUND
             break;
         case MODEM_CLOCK_LPCLK_SRC_RC_SLOW:
             ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Using 136 kHz RC as clock source, can only run legacy ADV or SCAN due to low clock accuracy!");
@@ -901,13 +965,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -950,6 +1020,7 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
@@ -987,6 +1058,7 @@ esp_err_t esp_bt_controller_deinit(void)
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -1036,6 +1108,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1044,6 +1126,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1067,6 +1150,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1196,12 +1280,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1229,9 +1321,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1254,11 +1350,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1288,9 +1388,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1558,3 +1660,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32c6/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -154,12 +154,56 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/controller/esp32h2/Kconfig.in

@@ -306,72 +306,121 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
     help
         This configures stack size of NimBLE controller task
 
-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log
 
-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable controller log module
 
-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Enable hci log module
 
-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
             Only operate in dump mode
 
-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus
+
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
             Store ble controller logs to flash memory.
 
-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
             The size of ble controller log partition shall be a multiples of 4K.
             The name of log partition shall be "bt_ctrl_log".
             The partition type shall be ESP_PARTITION_TYPE_DATA.
             The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
 
-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the first BLE controller LOG buffer.
 
-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
             Configure the size of the second BLE controller LOG buffer.
 
-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
             Configure the size of the BLE HCI LOG buffer.
 
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL
+        int "The output level of controller log"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 5
+        default 1
+        help
+            The output level of controller log.
+
+    config BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH
+        hex "The switch of module log output"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        range 0 0xFFFFFFFF
+        default 0xFFFFFFFF
+        help
+            The switch of module log output, this is an unsigned 32-bit hexadecimal value.
+
+    config BT_LE_ERROR_SIM_ENABLED
+        bool "Enable controller features for internal testing"
+        default n
+
+    config BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        bool "When ACL disconnects abnormally, assertion processing is performed(Experimental)"
+        default n
+endmenu
+
 config BT_LE_LL_RESOLV_LIST_SIZE
     int "BLE LL Resolving list size"
     range 1 5
@@ -615,7 +664,7 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
         again.
 
 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
     default y
 
 config BT_LE_TX_CCA_ENABLED
@@ -698,3 +747,56 @@ config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+menu "BLE disconnects when Instant Passed (0x28) occurs"
+    config BT_LE_CTRL_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs during connection update procedure.
+
+    config BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in channel map update procedure.
+
+    config BT_LE_CTRL_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when Instant Passed (0x28) error occurs in PHY update procedure.
+endmenu
+
+config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    int "The value of upperlimitmax during scan backoff procedure"
+    range 1 256
+    default 32
+    help
+        The value of upperlimitmax needs to be a power of 2.
+
+config BT_LE_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment(Experimental)"
+    default n
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero(Experimental)"
+    default y
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.

components/bt/controller/esp32h2/ble.c

@@ -0,0 +1,151 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdlib.h>
+
+#include "sdkconfig.h"
+#include "esp_bt_cfg.h"
+#include "esp_bit_defs.h"
+
+/* External functions or variables
+ ************************************************************************
+ */
+int base_stack_initEnv(void);
+void base_stack_deinitEnv(void);
+int base_stack_enable(void);
+void base_stack_disable(void);
+
+int conn_stack_initEnv(void);
+void conn_stack_deinitEnv(void);
+int conn_stack_enable(void);
+void conn_stack_disable(void);
+
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+int conn_errorSim_initEnv(void);
+void conn_errorSim_deinitEnv(void);
+int conn_errorSim_enable(void);
+void conn_errorSim_disable(void);
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void adv_stack_enableClearLegacyAdvVsCmd(bool en);
+void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void advFilter_stack_enableDupExcListVsCmd(bool en);
+void arr_stack_enableMultiConnVsCmd(bool en);
+void pcl_stack_enableSetRssiThreshVsCmd(bool en);
+void chanSel_stack_enableSetCsaVsCmd(bool en);
+void log_stack_enableLogsRelatedVsCmd(bool en);
+void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+
+void adv_stack_enableScanReqRxdVsEvent(bool en);
+void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+/* Local functions definition
+ ***************************************************************************
+ */
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+void ble_stack_enableVsCmds(bool en)
+{
+    adv_stack_enableClearLegacyAdvVsCmd(en);
+    advFilter_stack_enableDupExcListVsCmd(en);
+    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    arr_stack_enableMultiConnVsCmd(en);
+    pcl_stack_enableSetRssiThreshVsCmd(en);
+    chanSel_stack_enableSetCsaVsCmd(en);
+    log_stack_enableLogsRelatedVsCmd(en);
+    hci_stack_enableSetVsEvtMaskVsCmd(en);
+}
+
+void ble_stack_enableVsEvents(bool en)
+{
+    adv_stack_enableScanReqRxdVsEvent(en);
+    conn_stack_enableChanMapUpdCompVsEvent(en);
+}
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+int ble_stack_initEnv(void)
+{
+    int rc;
+
+    rc = base_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    return 0;
+}
+
+void ble_stack_deinitEnv(void)
+{
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_deinitEnv();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_deinitEnv();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_deinitEnv();
+}
+
+int ble_stack_enable(void)
+{
+    int rc;
+
+    rc = base_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+    rc = conn_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    rc = conn_errorSim_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsCmds(true);
+    ble_stack_enableVsEvents(true);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+    return 0;
+}
+
+void ble_stack_disable(void)
+{
+#if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+    ble_stack_enableVsEvents(false);
+    ble_stack_enableVsCmds(false);
+#endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+
+#if DEFAULT_BT_LE_MAX_CONNECTIONS
+#if CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_errorSim_disable();
+#endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
+    conn_stack_disable();
+#endif // DEFAULT_BT_LE_MAX_CONNECTIONS
+
+    base_stack_disable();
+}

components/bt/controller/esp32h2/ble_priv.h

@@ -0,0 +1,12 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+int ble_stack_initEnv(void);
+
+void ble_stack_deinitEnv(void);
+
+int ble_stack_enable(void);
+
+void ble_stack_disable(void);

components/bt/controller/esp32h2/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -34,6 +34,7 @@
 #include "os/endian.h"
 
 #include "esp_bt.h"
+#include "ble_priv.h"
 #include "esp_intr_alloc.h"
 #include "esp_sleep.h"
 #include "esp_pm.h"
@@ -52,6 +53,13 @@
 #include "esp_private/periph_ctrl.h"
 #include "esp_sleep.h"
 #include "soc/rtc.h"
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#include "ble_log/ble_log_spi_out.h"
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+
 /* Macro definition
  ************************************************************************
  */
@@ -102,12 +110,15 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
  */
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
+extern void esp_ble_controller_info_capture(uint32_t cycle_times);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int r_ble_log_deinit_async(void);
 extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
 extern void r_ble_log_async_output_dump_all(bool output);
 extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
+extern int r_ble_log_ctrl_level_and_mod(uint8_t log_level, uint32_t mod_switch);
+extern int r_ble_ctrl_mod_type(uint16_t mod, uint32_t mod_type_switch);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int r_ble_controller_deinit(void);
 extern int r_ble_controller_enable(uint8_t mode);
@@ -125,6 +136,10 @@ extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
+extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
 extern void r_esp_ble_set_wakeup_overhead(uint32_t overhead);
@@ -186,6 +201,7 @@ enum log_out_mode {
     LOG_DUMP_MEMORY,
     LOG_ASYNC_OUT,
     LOG_STORAGE_TO_FLASH,
+    LOG_SPI_OUT,
 };
 
 bool log_is_inited = false;
@@ -194,6 +210,8 @@ uint8_t log_output_mode = LOG_DUMP_MEMORY;
 #else
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 uint8_t log_output_mode = LOG_STORAGE_TO_FLASH;
+#elif CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+uint8_t log_output_mode = LOG_SPI_OUT;
 #else
 uint8_t log_output_mode = LOG_ASYNC_OUT;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -241,11 +259,23 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
             }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
             break;
+        case LOG_SPI_OUT:
+            task_create = true;
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            ble_log_spi_out_init();
+            bt_controller_log_interface = ble_log_spi_out_write_esp;
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+            break;
         default:
             assert(0);
     }
 
     ret = r_ble_log_init_async(bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size);
+        if (ret != ESP_OK) {
+        return ret;
+    }
+
+    ret = r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH);
     if (ret == ESP_OK) {
         log_is_inited = true;
     }
@@ -255,6 +285,9 @@ esp_err_t esp_bt_controller_log_init(uint8_t log_output_mode)
 void esp_bt_ontroller_log_deinit(void)
 {
     r_ble_log_deinit_async();
+#if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    ble_log_spi_out_deinit();
+#endif
     log_is_inited = false;
 }
 
@@ -379,6 +412,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
     assert(err == ESP_OK);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+void esp_task_wdt_isr_user_handler(void)
+{
+    esp_ble_controller_log_dump_all(true);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+
+#if CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+void __real_esp_panic_handler(void *info);
+void __wrap_esp_panic_handler (void *info)
+{
+    esp_ble_controller_log_dump_all(true);
+    __real_esp_panic_handler(info);
+}
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 
 /* This variable tells if BLE is running */
@@ -388,6 +437,17 @@ static DRAM_ATTR esp_pm_lock_handle_t s_pm_lock = NULL;
 #endif // CONFIG_PM_ENABLE
 static DRAM_ATTR modem_clock_lpclk_src_t s_bt_lpclk_src = MODEM_CLOCK_LPCLK_SRC_INVALID;
 
+#define BLE_CONTROLLER_MALLOC_CAPS          (MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT|MALLOC_CAP_DMA)
+void *malloc_ble_controller_mem(size_t size)
+{
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
+}
+
 #define BLE_RTC_DELAY_US_LIGHT_SLEEP                    (5100)
 #define BLE_RTC_DELAY_US_MODEM_SLEEP                    (1500)
 
@@ -484,8 +544,11 @@ static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer
 static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
                                   void *arg, void **ret_handle_in)
 {
-    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler,
-                            arg, (intr_handle_t *)ret_handle_in);
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    int rc = esp_intr_alloc(source, flags, handler, arg, (intr_handle_t *)ret_handle_in);
+#else
+    int rc = esp_intr_alloc(source, flags | ESP_INTR_FLAG_IRAM, handler, arg, (intr_handle_t *)ret_handle_in);
+#endif
     return rc;
 }
 
@@ -878,13 +941,19 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         goto modem_deint;
     }
 
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+
     ret = r_ble_controller_init(cfg);
     if (ret != ESP_OK) {
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "r_ble_controller_init failed %d", ret);
         goto modem_deint;
     }
 
-    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
+    ret = ble_stack_initEnv();
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_stack_initEnv failed %d", ret);
+        goto free_controller;
+    }
 
     ble_controller_scan_duplicate_config();
 
@@ -899,6 +968,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
         ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
         goto free_controller;
     }
+
     ESP_ERROR_CHECK(esp_read_mac((uint8_t *)mac, ESP_MAC_BT));
     ESP_LOGI(NIMBLE_PORT_LOG_TAG, "Bluetooth MAC: %02x:%02x:%02x:%02x:%02x:%02x",
              mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
@@ -926,6 +996,7 @@ free_controller:
     hci_transport_deinit();
     controller_sleep_deinit();
     os_msys_deinit();
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
 modem_deint:
     esp_ble_unregister_bb_funcs();
@@ -961,6 +1032,7 @@ esp_err_t esp_bt_controller_deinit(void)
     modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
     modem_clock_module_disable(PERIPH_BT_MODULE);
 
+    ble_stack_deinitEnv();
     r_ble_controller_deinit();
     esp_ble_unregister_bb_funcs();
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
@@ -1010,6 +1082,16 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
 
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    r_ble_ll_scan_start_time_init_compensation(500);
+    r_priv_sdk_config_insert_proc_time_set(500);
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+
+    if (ble_stack_enable() != 0) {
+        ret = ESP_FAIL;
+        goto error;
+    }
+
     if (r_ble_controller_enable(mode) != 0) {
         ret = ESP_FAIL;
         goto error;
@@ -1018,6 +1100,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
     return ESP_OK;
 
 error:
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1041,6 +1124,7 @@ esp_err_t esp_bt_controller_disable(void)
     if (r_ble_controller_disable() != 0) {
         return ESP_FAIL;
     }
+    ble_stack_disable();
 #if CONFIG_SW_COEXIST_ENABLE
     coex_disable();
 #endif
@@ -1170,12 +1254,20 @@ esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_
 
     switch (power_type) {
     case ESP_BLE_PWR_TYPE_DEFAULT:
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
         if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0xFF, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1203,9 +1295,13 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
     esp_err_t stat = ESP_FAIL;
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+            stat = ESP_OK;
+        }
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0, power_level) == 0) {
+        if (r_ble_txpwr_set(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0, power_level) == 0) {
             stat = ESP_OK;
         }
         break;
@@ -1228,11 +1324,15 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type)
     int tx_level = 0;
 
     switch (power_type) {
-    case ESP_BLE_PWR_TYPE_ADV:
-    case ESP_BLE_PWR_TYPE_SCAN:
     case ESP_BLE_PWR_TYPE_DEFAULT:
         tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
         break;
+    case ESP_BLE_PWR_TYPE_ADV:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_ADV, 0);
+        break;
+    case ESP_BLE_PWR_TYPE_SCAN:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
+        break;
     case ESP_BLE_PWR_TYPE_CONN_HDL0:
     case ESP_BLE_PWR_TYPE_CONN_HDL1:
     case ESP_BLE_PWR_TYPE_CONN_HDL2:
@@ -1262,9 +1362,11 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 
     switch (power_type) {
     case ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT:
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        break;
     case ESP_BLE_ENHANCED_PWR_TYPE_SCAN:
     case ESP_BLE_ENHANCED_PWR_TYPE_INIT:
-        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT, 0);
+        tx_level = r_ble_txpwr_get(ESP_BLE_ENHANCED_PWR_TYPE_SCAN, 0);
         break;
     case ESP_BLE_ENHANCED_PWR_TYPE_ADV:
     case ESP_BLE_ENHANCED_PWR_TYPE_CONN:
@@ -1531,3 +1633,28 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 
 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+int IRAM_ATTR
+ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+{
+    int i;
+
+    switch(type) {
+        case 0:
+            for (i = 0; i < 2; i++) {
+                esp_ble_controller_info_capture(0x010101);
+            }
+
+            break;
+#if CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        case 1:
+            if ((reason == 0x08) || (reason == 0x3d) || (reason == 0x28)) {
+                osi_assert_wrapper(__LINE__,__func__, type, reason);
+            }
+            break;
+#endif // CONFIG_BT_LE_ASSERT_WHEN_ABNORMAL_DISCONN_ENABLED
+        default:
+            break;
+    }
+    return 0;
+}

components/bt/controller/esp32h2/esp_bt_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -154,12 +154,56 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
 #endif
 
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CONN_UPDATE
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BT_CTRL_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_CHAN_MAP_UPDATE
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#ifdef CONFIG_BT_LE_CTRL_LLCP_PHY_UPDATE
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (1<<2)
+#else
+#define BT_CTRL_BLE_LLCP_PHY_UPDATE (0<<2)
+#endif
+
+#define BT_LE_CTRL_LLCP_DISC_FLAG (BT_CTRL_BLE_LLCP_CONN_UPDATE | BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE | BT_CTRL_BLE_LLCP_PHY_UPDATE)
+
+#ifdef CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (CONFIG_BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX)
+#else
+#define BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX          (256)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (CONFIG_BT_LE_CTRL_CHAN_ASS_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (CONFIG_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX)
+#else
+#define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
 #define HCI_UART_EN 0 // hci ram mode
 #endif
 
+#ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_RAM
+#define DEFAULT_BT_LE_VHCI_ENABLED      (CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+#else
+#define DEFAULT_BT_LE_VHCI_ENABLED      (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else

components/bt/esp_ble_mesh/Kconfig.in

@@ -15,6 +15,7 @@ if BLE_MESH
     config BLE_MESH_RANDOM_ADV_INTERVAL
         bool "Support using random adv interval for mesh packets"
         select BT_BLE_HIGH_DUTY_ADV_INTERVAL if BT_BLUEDROID_ENABLED
+        select BT_NIMBLE_HIGH_DUTY_ADV_ITVL if BT_NIMBLE_ENABLED
         default n
         help
             Enable this option to allow using random advertising interval

components/bt/esp_ble_mesh/core/beacon.c

@@ -35,7 +35,11 @@
 #define UNPROV_BEACON_INTERVAL     K_SECONDS(5)
 #endif
 
+#if CONFIG_BLE_MESH_BQB_TEST
+#define SECURE_BEACON_INTERVAL     K_SECONDS(3)
+#else
 #define SECURE_BEACON_INTERVAL     K_SECONDS(10)
+#endif
 
 /* 3 transmissions, 20ms interval */
 #define UNPROV_XMIT                BLE_MESH_TRANSMIT(2, 20)

components/bt/esp_ble_mesh/core/cfg_srv.c

@@ -1287,7 +1287,7 @@ static struct label *va_find(const uint8_t *label_uuid,
     return match;
 }
 
-static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL, *free_slot = NULL;
 
@@ -1295,6 +1295,9 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     if (update) {
         update->ref++;
         va_store(update);
+        if (addr) {
+            *addr = update->addr;
+        }
         return STATUS_SUCCESS;
     }
 
@@ -1314,7 +1317,7 @@ static uint8_t va_add(uint8_t *label_uuid, uint16_t *addr)
     return STATUS_SUCCESS;
 }
 
-static uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
+uint8_t va_del(uint8_t *label_uuid, uint16_t *addr)
 {
     struct label *update = NULL;
 

components/bt/esp_ble_mesh/core/prov_common.c

@@ -143,7 +143,7 @@ bool bt_mesh_prov_pdu_check(uint8_t type, uint16_t length, uint8_t *reason)
 
 static uint8_t bt_mesh_prov_buf_type_get(struct net_buf_simple *buf)
 {
-    return buf->data[PROV_BUF_HEADROOM];
+    return buf->__buf[PROV_BUF_HEADROOM];
 }
 
 uint8_t node_next_xact_id(struct bt_mesh_prov_link *link)

components/bt/host/bluedroid/Kconfig.in

@@ -43,7 +43,8 @@ config BT_BLUEDROID_MEM_DEBUG
 config BT_BLUEDROID_ESP_COEX_VSC
     bool "Enable Espressif Vendor-specific HCI commands for coexist status configuration"
     depends on BT_BLUEDROID_ENABLED
-    default y
+    default y if (ESP_COEX_SW_COEXIST_ENABLE || BT_CONTROLLER_DISABLED)
+    default n
     help
         Enable Espressif Vendor-specific HCI commands for coexist status configuration
 
@@ -358,6 +359,13 @@ config BT_BLE_SMP_ID_RESET_ENABLE
         of a previously paired peer to be used to determine whether a device
         with which it previously shared an IRK is within range.
 
+config BT_BLE_SMP_BOND_NVS_FLASH
+    bool "Save SMP bonding keys to nvs flash"
+    depends on BT_BLE_SMP_ENABLE
+    default y
+    help
+        This select can save SMP bonding keys to nvs flash
+
 config BT_STACK_NO_LOG
     bool "Disable BT debug logs (minimize bin size)"
     depends on BT_BLUEDROID_ENABLED
@@ -1228,7 +1236,7 @@ config BT_BLE_50_FEATURES_SUPPORTED
 
 config BT_BLE_42_FEATURES_SUPPORTED
     bool "Enable BLE 4.2 features(please disable BLE 5.0 if enable BLE 4.2)"
-    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_SUPPORTED) || BT_CONTROLLER_DISABLED))
+    depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))
     default n
     help
         This enables BLE 4.2 features.

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -21,6 +21,10 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
     bool ret = true;
 
     if (record != NULL) {
+        if (record->hdr.type < ESP_SDP_TYPE_RAW || record->hdr.type > ESP_SDP_TYPE_DIP_SERVER) {
+            LOG_ERROR("Invalid type!\n");
+            return false;
+        }
         switch (record->hdr.type) {
         case ESP_SDP_TYPE_DIP_SERVER:
             if (record->dip.vendor_id_source != ESP_SDP_VENDOR_ID_SRC_BT &&
@@ -29,14 +33,28 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
                 ret = false;
             }
             break;
+        case ESP_SDP_TYPE_MAP_MAS:
+            if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) {
+                LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n");
+               ret = false;
+            }
+            break;
+        case ESP_SDP_TYPE_PBAP_PSE:
+            if (record->pse.supported_repositories >> 8) {
+                LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n");
+               ret = false;
+            }
+            break;
 
         default:
+            break;
+        }
+        if (record->hdr.type != ESP_SDP_TYPE_DIP_SERVER) {
             if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
                 strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
                 LOG_ERROR("Invalid server name!\n");
                 ret = false;
             }
-            break;
         }
     } else {
         LOG_ERROR("record is NULL!\n");

components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h

@@ -1593,6 +1593,8 @@ typedef void (* esp_gap_ble_cb_t)(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p
  *
  * @param[in]       callback: callback function
  *
+ * @note            Avoid performing time-consuming operations within the callback functions.
+ *
  * @return
  *                  - ESP_OK : success
  *                  - other  : failed

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,580 +17,606 @@ extern "C" {
 
 /// GATT Server callback function events
 typedef enum {
-    ESP_GATTS_REG_EVT                 = 0,       /*!< When register application id, the event comes */
-    ESP_GATTS_READ_EVT                = 1,       /*!< When gatt client request read operation, the event comes */
-    ESP_GATTS_WRITE_EVT               = 2,       /*!< When gatt client request write operation, the event comes */
-    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< When gatt client request execute write, the event comes */
-    ESP_GATTS_MTU_EVT                 = 4,       /*!< When set mtu complete, the event comes */
-    ESP_GATTS_CONF_EVT                = 5,       /*!< When receive confirm, the event comes */
-    ESP_GATTS_UNREG_EVT               = 6,       /*!< When unregister application id, the event comes */
-    ESP_GATTS_CREATE_EVT              = 7,       /*!< When create service complete, the event comes */
-    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< When add included service complete, the event comes */
-    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< When add characteristic complete, the event comes */
-    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< When add descriptor complete, the event comes */
-    ESP_GATTS_DELETE_EVT              = 11,      /*!< When delete service complete, the event comes */
-    ESP_GATTS_START_EVT               = 12,      /*!< When start service complete, the event comes */
-    ESP_GATTS_STOP_EVT                = 13,      /*!< When stop service complete, the event comes */
-    ESP_GATTS_CONNECT_EVT             = 14,      /*!< When gatt client connect, the event comes */
-    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< When gatt client disconnect, the event comes */
-    ESP_GATTS_OPEN_EVT                = 16,      /*!< When connect to peer, the event comes */
-    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< When disconnect from peer, the event comes */
-    ESP_GATTS_CLOSE_EVT               = 18,      /*!< When gatt server close, the event comes */
-    ESP_GATTS_LISTEN_EVT              = 19,      /*!< When gatt listen to be connected the event comes */
-    ESP_GATTS_CONGEST_EVT             = 20,      /*!< When congest happen, the event comes */
+    ESP_GATTS_REG_EVT                 = 0,       /*!< This event is triggered when a GATT Server application is registered using `esp_ble_gatts_app_register`. */
+    ESP_GATTS_READ_EVT                = 1,       /*!< This event is triggered when the read request from the Client is received. */
+    ESP_GATTS_WRITE_EVT               = 2,       /*!< This event is triggered when the write request from the Client is received. */
+    ESP_GATTS_EXEC_WRITE_EVT          = 3,       /*!< This event is triggered when the write execution request from the Client is received. */
+    ESP_GATTS_MTU_EVT                 = 4,       /*!< This event is triggered when the MTU configuration request from the Client is received. */
+    ESP_GATTS_CONF_EVT                = 5,       /*!< This event is triggered when the confirmation from the Client is received. */
+    ESP_GATTS_UNREG_EVT               = 6,       /*!< This event is triggered when a GATT Server application is unregistered using `esp_ble_gatts_app_unregister`. */
+    ESP_GATTS_CREATE_EVT              = 7,       /*!< This event is triggered when a GATT Server service is created using `esp_ble_gatts_create_service`. */
+    ESP_GATTS_ADD_INCL_SRVC_EVT       = 8,       /*!< This event is triggered when an included service is added using `esp_ble_gatts_add_included_service`. */
+    ESP_GATTS_ADD_CHAR_EVT            = 9,       /*!< This event is triggered when a characteristic is added to the service using `esp_ble_gatts_add_char`. */
+    ESP_GATTS_ADD_CHAR_DESCR_EVT      = 10,      /*!< This event is triggered when a characteristic descriptor is added to the service using `esp_ble_gatts_add_char_descr`. */
+    ESP_GATTS_DELETE_EVT              = 11,      /*!< This event is triggered when the service is deleted using `esp_ble_gatts_delete_service`. */
+    ESP_GATTS_START_EVT               = 12,      /*!< This event is triggered when the service is started using `esp_ble_gatts_start_service`. */
+    ESP_GATTS_STOP_EVT                = 13,      /*!< This event is triggered when the service is stopped using `esp_ble_gatts_stop_service`.  */
+    ESP_GATTS_CONNECT_EVT             = 14,      /*!< This event is triggered when a physical connection is set up. */
+    ESP_GATTS_DISCONNECT_EVT          = 15,      /*!< This event is triggered when a physical connection is terminated. */
+    ESP_GATTS_OPEN_EVT                = 16,      /*!< This event is triggered when a virtual connection is created using `esp_ble_gatts_open`. */
+    ESP_GATTS_CANCEL_OPEN_EVT         = 17,      /*!< Deprecated. */
+    ESP_GATTS_CLOSE_EVT               = 18,      /*!< This event is triggered when a virtual connection is closed using `esp_ble_gatts_close`. */
+    ESP_GATTS_LISTEN_EVT              = 19,      /*!< Deprecated. */
+    ESP_GATTS_CONGEST_EVT             = 20,      /*!< This event is triggered when the GATT connection is congested. */
     /* following is extra event */
-    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< When gatt send response complete, the event comes */
-    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< When gatt create table complete, the event comes */
-    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< When gatt set attr value complete, the event comes */
-    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< When gatt send service change indication complete, the event comes */
+    ESP_GATTS_RESPONSE_EVT            = 21,      /*!< This event is triggered when a response is sent to the request using `esp_ble_gatts_send_response`. */
+    ESP_GATTS_CREAT_ATTR_TAB_EVT      = 22,      /*!< This event is triggered when a service attribute table is created using `esp_ble_gatts_create_attr_tab`. */
+    ESP_GATTS_SET_ATTR_VAL_EVT        = 23,      /*!< This event is triggered when an attribute value is set using `esp_ble_gatts_set_attr_value`. */
+    ESP_GATTS_SEND_SERVICE_CHANGE_EVT = 24,      /*!< This event is triggered when a service change indication is sent using `esp_ble_gatts_send_service_change_indication`. */
 } esp_gatts_cb_event_t;
 
 /**
- * @brief Gatt server callback parameters union
+ * @brief GATT Server callback parameters
  */
 typedef union {
     /**
-     * @brief ESP_GATTS_REG_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_REG_EVT`
      */
     struct gatts_reg_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t app_id;                /*!< Application id which input in register API */
-    } reg;                              /*!< Gatt server callback param of ESP_GATTS_REG_EVT */
+        uint16_t app_id;                /*!< Application ID */
+    } reg;                              /*!< Callback parameter for the event `ESP_GATTS_REG_EVT` */
 
     /**
-     * @brief ESP_GATTS_READ_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_READ_EVT`
      */
     struct gatts_read_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been read */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to read */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool is_long;                   /*!< The value is too long or not */
-        bool need_rsp;                  /*!< The read operation need to do response */
-    } read;                             /*!< Gatt server callback param of ESP_GATTS_READ_EVT */
+        uint16_t offset;                /*!< The position offset to read. If the length of value is less than or equal to the MTU size, this value is 0. */
+        bool is_long;                   /*!< True indicates that the length of value is greater than the MTU size; false otherwise. */
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+    } read;                             /*!< Callback parameter for the event `ESP_GATTS_READ_EVT` */
 
 
     /**
-     * @brief ESP_GATTS_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_WRITE_EVT`
      */
     struct gatts_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The device address to write */
         uint16_t handle;                /*!< The attribute handle */
-        uint16_t offset;                /*!< Offset of the value, if the value is too long */
-        bool need_rsp;                  /*!< The write operation need to do response */
-        bool is_prep;                   /*!< This write operation is prepare write */
-        uint16_t len;                   /*!< The write attribute value length */
+        uint16_t offset;                /*!< The position offset to write. If the length of value is less than or equal to the MTU size, this value is 0.*/
+        bool need_rsp;                  /*!< True indicates that the `esp_ble_gatts_send_response` is required in the following step; false otherwise. */
+        bool is_prep;                   /*!< True indicates the write operation is a prepared write operation */
+        uint16_t len;                   /*!< The length of the write attribute value in bytes */
         uint8_t *value;                 /*!< The write attribute value */
-    } write;                            /*!< Gatt server callback param of ESP_GATTS_WRITE_EVT */
+    } write;                            /*!< Callback parameter for the event `ESP_GATTS_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_EXEC_WRITE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT`
      */
     struct gatts_exec_write_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint32_t trans_id;              /*!< Transfer id */
-        esp_bd_addr_t bda;              /*!< The bluetooth device address which been written */
-#define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Prepare write flag to indicate cancel prepare write */
-#define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Prepare write flag to indicate execute prepare write */
-        uint8_t exec_write_flag;        /*!< Execute write flag */
-    } exec_write;                       /*!< Gatt server callback param of ESP_GATTS_EXEC_WRITE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint32_t trans_id;              /*!< Transfer ID */
+        esp_bd_addr_t bda;              /*!< The bluetooth device address to write */
+        #define ESP_GATT_PREP_WRITE_CANCEL 0x00 /*!< Flag to indicate the cancellation of a prepare write operation */
+        #define ESP_GATT_PREP_WRITE_EXEC   0x01 /*!< Flag to indicate the execution of a prepare write operation */
+        uint8_t exec_write_flag;        /*!< Execute write flag: `ESP_GATT_PREP_WRITE_CANCEL` or `ESP_GATT_PREP_WRITE_EXEC` */
+    } exec_write;                       /*!< Callback parameter for the event `ESP_GATTS_EXEC_WRITE_EVT` */
 
     /**
-     * @brief ESP_GATTS_MTU_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_MTU_EVT`
      */
     struct gatts_mtu_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
+        uint16_t conn_id;               /*!< Connection ID */
         uint16_t mtu;                   /*!< MTU size */
-    } mtu;                              /*!< Gatt server callback param of ESP_GATTS_MTU_EVT */
+    } mtu;                              /*!< Callback parameter for the event `ESP_GATTS_MTU_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONF_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONF_EVT`
      */
     struct gatts_conf_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< attribute handle */
-        uint16_t len;                   /*!< The indication or notification value length, len is valid when send notification or indication failed */
-        uint8_t *value;                 /*!< The indication or notification value , value is valid when send notification or indication failed */
-    } conf;                             /*!< Gatt server callback param of ESP_GATTS_CONF_EVT (confirm) */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle */
+        uint16_t len;                   /*!< The length of indication or notification value in bytes. The length is invalid if the notification or indication failed. */
+        uint8_t *value;                 /*!< The indication or notification value. The value is invalid if the notification or indication failed. */
+    } conf;                             /*!< Callback parameter for the event `ESP_GATTS_CONF_EVT` */
 
     /**
-     * @brief ESP_GATTS_UNREG_EVT
-     */
-
-    /**
-     * @brief ESP_GATTS_CREATE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREATE_EVT`
      */
     struct gatts_create_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_gatt_srvc_id_t service_id;  /*!< Service id, include service uuid and other information */
-    } create;                           /*!< Gatt server callback param of ESP_GATTS_CREATE_EVT */
+        esp_gatt_srvc_id_t service_id;  /*!< Service ID, including service UUID and other information */
+    } create;                           /*!< Callback parameter for the event `ESP_GATTS_CREATE_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_INCL_SRVC_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT`
      */
     struct gatts_add_incl_srvc_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Included service attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } add_incl_srvc;                    /*!< Gatt server callback param of ESP_GATTS_ADD_INCL_SRVC_EVT */
+    } add_incl_srvc;                    /*!< Callback parameter for the event `ESP_GATTS_ADD_INCL_SRVC_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT`
      */
     struct gatts_add_char_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Characteristic attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t char_uuid;        /*!< Characteristic uuid */
-    } add_char;                         /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_EVT */
+        esp_bt_uuid_t char_uuid;        /*!< Characteristic UUID */
+    } add_char;                         /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_EVT` */
 
     /**
-     * @brief ESP_GATTS_ADD_CHAR_DESCR_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT`
      */
     struct gatts_add_char_descr_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t attr_handle;           /*!< Descriptor attribute handle */
         uint16_t service_handle;        /*!< Service attribute handle */
-        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor uuid */
-    } add_char_descr;                   /*!< Gatt server callback param of ESP_GATTS_ADD_CHAR_DESCR_EVT */
+        esp_bt_uuid_t descr_uuid;       /*!< Characteristic descriptor UUID */
+    } add_char_descr;                   /*!< Callback parameter for the event `ESP_GATTS_ADD_CHAR_DESCR_EVT` */
 
     /**
-     * @brief ESP_GATTS_DELETE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DELETE_EVT`
      */
     struct gatts_delete_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } del;                              /*!< Gatt server callback param of ESP_GATTS_DELETE_EVT */
+    } del;                              /*!< Callback parameter for the event `ESP_GATTS_DELETE_EVT` */
 
     /**
-     * @brief ESP_GATTS_START_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_START_EVT`
      */
     struct gatts_start_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } start;                            /*!< Gatt server callback param of ESP_GATTS_START_EVT */
+    } start;                            /*!< Callback parameter for the event `ESP_GATTS_START_EVT` */
 
     /**
-     * @brief ESP_GATTS_STOP_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_STOP_EVT`
      */
     struct gatts_stop_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
         uint16_t service_handle;        /*!< Service attribute handle */
-    } stop;                             /*!< Gatt server callback param of ESP_GATTS_STOP_EVT */
+    } stop;                             /*!< Callback parameter for the event `ESP_GATTS_STOP_EVT` */
 
     /**
-     * @brief ESP_GATTS_CONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONNECT_EVT`
      */
     struct gatts_connect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        uint8_t link_role;              /*!< Link role : master role = 0  ; slave role = 1*/
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_params_t conn_params; /*!< current Connection parameters */
-        esp_ble_addr_type_t ble_addr_type;  /*!< Remote BLE device address type */
-        uint16_t conn_handle;           /*!< HCI connection handle */
-    } connect;                          /*!< Gatt server callback param of ESP_GATTS_CONNECT_EVT */
+        uint16_t conn_id;                   /*!< Connection ID */
+        uint8_t link_role;                  /*!< Link role: master role = 0; slave role = 1 */
+        esp_bd_addr_t remote_bda;           /*!< Remote device address */
+        esp_gatt_conn_params_t conn_params; /*!< Current connection parameters */
+        esp_ble_addr_type_t ble_addr_type;  /*!< Remote device address type */
+        uint16_t conn_handle;               /*!< HCI connection handle */
+    } connect;                              /*!< Callback parameter for the event `ESP_GATTS_CONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_DISCONNECT_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT`
      */
     struct gatts_disconnect_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        esp_bd_addr_t remote_bda;       /*!< Remote bluetooth device address */
-        esp_gatt_conn_reason_t reason;  /*!< Indicate the reason of disconnection */
-    } disconnect;                       /*!< Gatt server callback param of ESP_GATTS_DISCONNECT_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        esp_bd_addr_t remote_bda;       /*!< Remote device address */
+        esp_gatt_conn_reason_t reason;  /*!< The reason of disconnection */
+    } disconnect;                       /*!< Callback parameter for the event `ESP_GATTS_DISCONNECT_EVT` */
 
     /**
-     * @brief ESP_GATTS_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_OPEN_EVT`
      */
     struct gatts_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } open;                             /*!< Gatt server callback param of ESP_GATTS_OPEN_EVT */
+    } open;                             /*!< Callback parameter for the event `ESP_GATTS_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CANCEL_OPEN_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT`
      */
     struct gatts_cancel_open_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-    } cancel_open;                      /*!< Gatt server callback param of ESP_GATTS_CANCEL_OPEN_EVT */
+    } cancel_open;                      /*!< Callback parameter for the event `ESP_GATTS_CANCEL_OPEN_EVT` */
 
     /**
-     * @brief ESP_GATTS_CLOSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CLOSE_EVT`
      */
     struct gatts_close_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-    } close;                            /*!< Gatt server callback param of ESP_GATTS_CLOSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+    } close;                            /*!< Callback parameter for the event `ESP_GATTS_CLOSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_LISTEN_EVT
-     */
-    /**
-     * @brief ESP_GATTS_CONGEST_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CONGEST_EVT`
      */
     struct gatts_congest_evt_param {
-        uint16_t conn_id;               /*!< Connection id */
-        bool congested;                 /*!< Congested or not */
-    } congest;                          /*!< Gatt server callback param of ESP_GATTS_CONGEST_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        bool congested;                 /*!< True indicates the connection is congested; false otherwise. */
+    } congest;                          /*!< Callback parameter for the event `ESP_GATTS_CONGEST_EVT` */
 
     /**
-     * @brief ESP_GATTS_RESPONSE_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_RESPONSE_EVT`
      */
     struct gatts_rsp_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
-        uint16_t conn_id;               /*!< Connection id */
-        uint16_t handle;                /*!< Attribute handle which send response */
-    } rsp;                              /*!< Gatt server callback param of ESP_GATTS_RESPONSE_EVT */
+        uint16_t conn_id;               /*!< Connection ID */
+        uint16_t handle;                /*!< Attribute handle which sends the response */
+    } rsp;                              /*!< Callback parameter for the event `ESP_GATTS_RESPONSE_EVT` */
 
     /**
-     * @brief ESP_GATTS_CREAT_ATTR_TAB_EVT
+     * @brief Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT`
      */
     struct gatts_add_attr_tab_evt_param{
         esp_gatt_status_t status;       /*!< Operation status */
-        esp_bt_uuid_t svc_uuid;         /*!< Service uuid type */
-        uint8_t svc_inst_id;            /*!< Service id */
-        uint16_t num_handle;            /*!< The number of the attribute handle to be added to the gatts database */
-        uint16_t *handles;              /*!< The number to the handles */
-    } add_attr_tab;                     /*!< Gatt server callback param of ESP_GATTS_CREAT_ATTR_TAB_EVT */
+        esp_bt_uuid_t svc_uuid;         /*!< Service UUID type */
+        uint8_t svc_inst_id;            /*!< Service ID */
+        uint16_t num_handle;            /*!< The number of the attribute handles which have been added to the GATT Service table */
+        uint16_t *handles;              /*!< The handles which have been added to the table */
+    } add_attr_tab;                     /*!< Callback parameter for the event `ESP_GATTS_CREAT_ATTR_TAB_EVT` */
 
 
    /**
-    * @brief ESP_GATTS_SET_ATTR_VAL_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT`
     */
     struct gatts_set_attr_val_evt_param{
         uint16_t srvc_handle;           /*!< The service handle */
-        uint16_t attr_handle;           /*!< The attribute  handle */
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } set_attr_val;                     /*!< Gatt server callback param of ESP_GATTS_SET_ATTR_VAL_EVT */
+        uint16_t attr_handle;           /*!< The attribute handle */
+        esp_gatt_status_t status;       /*!< Operation status */
+    } set_attr_val;                     /*!< Callback parameter for the event `ESP_GATTS_SET_ATTR_VAL_EVT` */
 
     /**
-    * @brief ESP_GATTS_SEND_SERVICE_CHANGE_EVT
+    * @brief Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`
     */
     struct gatts_send_service_change_evt_param{
-        esp_gatt_status_t status;       /*!< Operation status*/
-    } service_change;                    /*!< Gatt server callback param of ESP_GATTS_SEND_SERVICE_CHANGE_EVT */
+        esp_gatt_status_t status;        /*!< Operation status */
+    } service_change;                    /*!< Callback parameter for the event `ESP_GATTS_SEND_SERVICE_CHANGE_EVT` */
 
 } esp_ble_gatts_cb_param_t;
 
 /**
  * @brief GATT Server callback function type
- * @param event : Event type
- * @param gatts_if : GATT server access interface, normally
- *                   different gatts_if correspond to different profile
- * @param param : Point to callback parameter, currently is union type
+ *
+ * @param[in] event    Event type
+ * @param[in] gatts_if GATT Server access interface. Typically, different `gatts_if` values correspond to different profiles.
+ * @param[in] param    The pointer to the callback parameter, which is of a union type.
  */
 typedef void (* esp_gatts_cb_t)(esp_gatts_cb_event_t event, esp_gatt_if_t gatts_if, esp_ble_gatts_cb_param_t *param);
 
 /**
- * @brief           This function is called to register application callbacks
- *                  with BTA GATTS module.
+ * @brief  Register GATT Server application callbacks
+ *
+ * @param[in] callback The pointer to the application callback function
+ *
+ * @note            Avoid performing time-consuming operations within the callback functions.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_register_callback(esp_gatts_cb_t callback);
 
 /**
- * @brief           This function is called to get the current application callbacks
- *                  with BTA GATTS module.
+ * @brief  Get the current GATT Server application callback
  *
  * @return
- *                  - esp_gatts_cb_t : current callback
- *
+ *        - esp_gatts_cb_t: Current callback
  */
 esp_gatts_cb_t esp_ble_gatts_get_callback(void);
 
 /**
- * @brief           This function is called to register application identifier
+ * @brief  Register GATT Server application
+ *
+ * @param[in] app_id: The UUID for different application
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_REG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: The input `app_id` exceeds `ESP_APP_ID_MAX` (0x7fff) defined in esp_bt_defs.h.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_app_register(uint16_t app_id);
 
-
-
 /**
- * @brief           unregister with GATT Server.
+ * @brief  Unregister an GATT Server application
+ *
+ * @param[in]  gatts_if GATT Server access interface.
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_UNREG_EVT`.
+ *      2. The maximum number of applications is limited to 6.
  *
- * @param[in]       gatts_if: GATT server access interface
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_app_unregister(esp_gatt_if_t gatts_if);
 
-
 /**
- * @brief           Create a service. When service creation is done, a callback
- *                  event ESP_GATTS_CREATE_EVT is called to report status
- *                  and service ID to the profile. The service ID obtained in
- *                  the callback function needs to be used when adding included
- *                  service and characteristics/descriptors into the service.
+ * @brief  Create a GATT Server service
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       service_id: service ID.
- * @param[in]       num_handle: number of handle requested for this service.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       service_id The pointer to the Service ID
+ * @param[in]       num_handle The number of handles requested for this service.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CREATE_EVT`.
+ *       2. `num_handle` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_service(esp_gatt_if_t gatts_if,
                                        esp_gatt_srvc_id_t *service_id, uint16_t num_handle);
 
 
 /**
- * @brief               Create a service attribute tab.
- * @param[in]       gatts_attr_db: the pointer to the service attr tab
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       max_nb_attr: the number of attribute to be added to the service database.
- * @param[in]       srvc_inst_id: the instance id of the service
+ * @brief  Create a service attribute table
+ *
+ * @param[in]       gatts_attr_db The pointer to the service attribute table
+ * @param[in]       gatts_if      GATT Server access interface
+ * @param[in]       max_nb_attr   The number of attributes to be added to the service database
+ * @param[in]       srvc_inst_id  The instance ID of the service
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CREAT_ATTR_TAB_EVT`.
+ *      2. `max_nb_attr` should not be greater than CONFIG_BT_GATT_MAX_SR_ATTRIBUTES.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid `max_nb_attr`
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_create_attr_tab(const esp_gatts_attr_db_t *gatts_attr_db,
                                             esp_gatt_if_t gatts_if,
                                             uint16_t max_nb_attr,
                                             uint8_t srvc_inst_id);
 /**
- * @brief           This function is called to add an included service. This function have to be called between
- *                  'esp_ble_gatts_create_service' and 'esp_ble_gatts_add_char'.  After included
- *                  service is included, a callback event ESP_GATTS_ADD_INCL_SRVC_EVT
- *                  is reported the included service ID.
+ * @brief  Add an included service
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       included_service_handle: the service ID to be included.
+ * @param[in]       service_handle  Target service handle to add
+ * @param[in]       included_service_handle The handle of included service to be added
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_ADD_INCL_SRVC_EVT`.
+ *       2. This function has to be called between `esp_ble_gatts_create_service` and `esp_ble_gatts_add_char`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_add_included_service(uint16_t service_handle, uint16_t included_service_handle);
 
-
-
 /**
- * @brief           This function is called to add a characteristic into a service.
+ * @brief  Add a characteristic into a service.
  *
- * @param[in]       service_handle: service handle to which this included service is to
- *                  be added.
- * @param[in]       char_uuid : Characteristic UUID.
- * @param[in]       perm      : Characteristic value declaration attribute permission.
- * @param[in]       property  : Characteristic Properties
- * @param[in]       char_val    : Characteristic value
- * @param[in]       control : attribute response control byte
+ * @param[in]       service_handle  Target service handle to add the characteristic
+ * @param[in]       char_uuid       The pointer to the characteristic UUID
+ * @param[in]       perm            Characteristic value declaration attribute permission
+ * @param[in]       property        Characteristic Properties
+ * @param[in]       char_val        The pointer to the characteristic value
+ * @param[in]       control         The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char(uint16_t service_handle,  esp_bt_uuid_t  *char_uuid,
                                  esp_gatt_perm_t perm, esp_gatt_char_prop_t property, esp_attr_value_t *char_val,
                                  esp_attr_control_t *control);
 
-
 /**
- * @brief           This function is called to add characteristic descriptor. When
- *                  it's done, a callback event ESP_GATTS_ADD_DESCR_EVT is called
- *                  to report the status and an ID number for this descriptor.
+ * @brief  Add a characteristic descriptor
+ *
+ * @param[in]       service_handle Target service handle to add the characteristic descriptor
+ * @param[in]       descr_uuid     The pointer to the descriptor UUID
+ * @param[in]       perm           Descriptor access permission
+ * @param[in]       char_descr_val The pointer to the characteristic descriptor value
+ * @param[in]       control        The pointer to the attribute response control byte
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_ADD_CHAR_DESCR_EVT`.
+ *      2. `control->auto_rsp` should be set to `ESP_GATT_AUTO_RSP` or `ESP_GATT_RSP_BY_APP`.
+ *      3. For stack respond attribute (`ESP_GATT_AUTO_RSP`), `char_val` should not be NULL and `char_val->attr_max_len` must be greater than 0.
  *
- * @param[in]       service_handle: service handle to which this characteristic descriptor is to
- *                              be added.
- * @param[in]       perm: descriptor access permission.
- * @param[in]       descr_uuid: descriptor UUID.
- * @param[in]       char_descr_val  : Characteristic descriptor value
- * @param[in]       control : attribute response control byte
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid arguments
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_add_char_descr (uint16_t service_handle,
                                         esp_bt_uuid_t   *descr_uuid,
                                         esp_gatt_perm_t perm, esp_attr_value_t *char_descr_val,
                                         esp_attr_control_t *control);
 
-
-
 /**
- * @brief           This function is called to delete a service. When this is done,
- *                  a callback event ESP_GATTS_DELETE_EVT is report with the status.
+ * @brief  Delete a service
  *
- * @param[in]       service_handle: service_handle to be deleted.
+ * @param[in]       service_handle Target service handle to delete
+ *
+ * @note    This function triggers `ESP_GATTS_DELETE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_delete_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to start a service.
+ * @brief  Start a service
  *
- * @param[in]       service_handle: the service handle to be started.
+ * @param[in]       service_handle Target service handle to start
+ *
+ * @note      This function triggers `ESP_GATTS_START_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *         - ESP_OK: Success
+ *         - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_start_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           This function is called to stop a service.
+ * @brief  Stop a service.
  *
- * @param[in]       service_handle - service to be topped.
+ * @param[in]       service_handle Target service handle to stop
+ *
+ * @note            This function triggers `ESP_GATTS_STOP_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_stop_service(uint16_t service_handle);
 
-
-
 /**
- * @brief           Send indicate or notify to GATT client.
- *                  Set param need_confirm as false will send notification, otherwise indication.
- *                  Note: the size of indicate or notify data need less than MTU size,see "esp_ble_gattc_send_mtu_req".
+ * @brief  Send indication or notification to a GATT Client
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection id to indicate.
- * @param[in]       attr_handle - attribute handle to indicate.
- * @param[in]       value_len - indicate value length.
- * @param[in]       value: value to indicate.
- * @param[in]       need_confirm - Whether a confirmation is required.
- *                  false sends a GATT notification, true sends a GATT indication.
+ * @param[in]       gatts_if    GATT Server access interface
+ * @param[in]       conn_id     Connection ID
+ * @param[in]       attr_handle Attribute handle to indicate
+ * @param[in]       value_len   Indication value length in bytes
+ * @param[in]       value       Value to indicate
+ * @param[in]       need_confirm True if a confirmation is required, which is a GATT indication; false if the confirmation is not required, which is a GATT notification.
+ *
+ * @note
+ *       1. This function triggers `ESP_GATTS_CONF_EVT`.
+ *       2. The size of indication or notification data must be less than or equal to MTU size, see `esp_ble_gattc_send_mtu_req`.
+ *       3. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *       - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_indicate(esp_gatt_if_t gatts_if, uint16_t conn_id, uint16_t attr_handle,
                                       uint16_t value_len, uint8_t *value, bool need_confirm);
 
-
 /**
- * @brief           This function is called to send a response to a request.
+ * @brief  Send a response to a request
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id - connection identifier.
- * @param[in]       trans_id - transfer id
- * @param[in]       status - response status
- * @param[in]       rsp - response data.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID
+ * @param[in]       trans_id Transfer ID
+ * @param[in]       status   Response status
+ * @param[in]       rsp      The pointer to the response data
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_RESPONSE_EVT`.
+ *      2. This function should be called only after the connection has been established.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_ERR_INVALID_STATE: The connection has not been established.
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_err_t esp_ble_gatts_send_response(esp_gatt_if_t gatts_if, uint16_t conn_id, uint32_t trans_id,
                                       esp_gatt_status_t status, esp_gatt_rsp_t *rsp);
 
-
 /**
- * @brief           This function is called to set the attribute value by the application
+ * @brief  Set the attribute value
  *
- * @param[in]       attr_handle: the attribute handle which to be set
- * @param[in]       length: the value length
- * @param[in]       value: the pointer to the attribute value
+ * @param[in]       attr_handle Target attribute handle to set the value
+ * @param[in]       length      The value length in bytes
+ * @param[in]       value       The pointer to the attribute value
+ *
+ * @note    This function triggers `ESP_GATTS_SET_ATTR_VAL_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *          - ESP_OK: Success
+ *          - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_set_attr_value(uint16_t attr_handle, uint16_t length, const uint8_t *value);
 
 /**
- * @brief       Retrieve attribute value
+ * @brief  Retrieve attribute value
  *
- * @param[in]   attr_handle: Attribute handle.
- * @param[out]  length: pointer to the attribute value length
- * @param[out]  value:  Pointer to attribute value payload, the value cannot be modified by user
+ * @param[in]   attr_handle Attribute handle
+ * @param[out]  length      The pointer to the attribute value length in bytes
+ * @param[out]  value       The pointer to attribute value payload. This value cannot be modified by user.
+ *
+ * @note
+ *      1. This function does not trigger any event.
+ *      2. `attr_handle` must be greater than 0.
  *
  * @return
- *                  - ESP_GATT_OK : success
- *                  - other  : failed
- *
+ *        - ESP_OK: Success
+ *        - ESP_GATT_INVALID_HANDLE: Invalid `attr_handle`
+ *        - ESP_FAIL: Failure due to other reasons
  */
 esp_gatt_status_t esp_ble_gatts_get_attr_value(uint16_t attr_handle, uint16_t *length, const uint8_t **value);
 
-
 /**
- * @brief           Open a direct open connection or add a background auto connection
+ * @brief  Create an ACL connection when `BT_BLE_42_FEATURES_SUPPORTED` is enabled in the menuconfig
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
- * @param[in]       is_direct: direct connection or background auto connection
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote  device address
+ * @param[in]       is_direct `True` indicates a direct connection, while `False` indicates a background auto connection. Currently, background auto connection is not supported, so please always set this parameter to True.
+ *
+ * @note
+ *      1. The function always triggers `ESP_GATTS_CONNECT_EVT` and `ESP_GATTS_OPEN_EVT`.
+ *      2. When the device acts as GATT Server, besides the above two events, this function triggers `ESP_GATTS_CONNECT_EVT` as well.
+ *      3. This function will establish an ACL connection as a Central and a virtual connection as a GATT Server. If the ACL connection already exists, it will create a virtual connection only.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_open(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda, bool is_direct);
 
 /**
- * @brief           Close a connection  a remote device.
+ * @brief  Close a connection with a remote device
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       conn_id: connection ID to be closed.
+ * @param[in]       gatts_if GATT Server access interface
+ * @param[in]       conn_id  Connection ID to be closed
+ *
+ * @note
+ *      1. This function triggers `ESP_GATTS_CLOSE_EVT`.
+ *      2. There may be multiple virtual GATT server connections when multiple `app_id` got registered.
+ *      3. This API closes one virtual GATT server connection only, if there exist other virtual GATT server connections. It does not close the physical connection.
+ *      4. The API `esp_ble_gap_disconnect` can be used to disconnect the physical connection directly.
+ *      5. If there is only one virtual GATT connection left, this API will terminate the ACL connection in addition, and trigger `ESP_GATTS_DISCONNECT_EVT`. Then there is no need to call `esp_ble_gap_disconnect` anymore.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_close(esp_gatt_if_t gatts_if, uint16_t conn_id);
 
 /**
- * @brief           Send service change indication
+ * @brief  Send service change indication
  *
- * @param[in]       gatts_if: GATT server access interface
- * @param[in]       remote_bda: remote device bluetooth device address.
+ * @param[in]       gatts_if   GATT Server access interface
+ * @param[in]       remote_bda Remote device address.
  *                  If remote_bda is NULL then it will send service change
  *                  indication to all the connected devices and if not then
- *                  to a specific device
+ *                  to a specific device.
+ *
+ * @note This function triggers `ESP_GATTS_SEND_SERVICE_CHANGE_EVT`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_send_service_change_indication(esp_gatt_if_t gatts_if, esp_bd_addr_t remote_bda);
 
 /**
- * @brief           Print local database (GATT service table)
+ * @brief   Display the Server's local attribute database.
+ *
+ * This API prints the local attribute database of the BLE server, including details
+ * of all services, characteristics, and descriptors.
+ *
+ * @note
+ *    1. This function does not trigger any event.
+ *    2. It is primarily intended for debugging purposes to verify the server's current configuration.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
- *
+ *       - ESP_OK: Success
+ *       - ESP_FAIL: Failure
  */
 esp_err_t esp_ble_gatts_show_local_database(void);
 

components/bt/host/bluedroid/bta/av/bta_av_ca_act.c

@@ -278,6 +278,7 @@ void bta_av_ca_api_get(tBTA_AV_RCB *p_rcb, tBTA_AV_DATA *p_data)
     GOEPC_RequestAddHeader(p_rcb->cover_art_goep_hdl, COVER_ART_HEADER_ID_IMG_HANDLE, (UINT8 *)image_handle_utf16, BTA_AV_CA_IMG_HDL_UTF16_LEN);
     if (p_data->api_ca_get.type == BTA_AV_CA_GET_IMAGE) {
         GOEPC_RequestAddHeader(p_rcb->cover_art_goep_hdl, COVER_ART_HEADER_ID_IMG_DESCRIPTOR, (UINT8 *)p_data->api_ca_get.image_descriptor, p_data->api_ca_get.image_descriptor_len);
+        osi_free(p_data->api_ca_get.image_descriptor);
     }
     /* always request to enable srm */
     GOEPC_RequestSetSRM(p_rcb->cover_art_goep_hdl, TRUE, FALSE);

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -4972,7 +4972,9 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
         if (p_data->complt.reason != 0) {
             sec_event.auth_cmpl.fail_reason = BTA_DM_AUTH_CONVERT_SMP_CODE(((UINT8)p_data->complt.reason));
             /* delete this device entry from Sec Dev DB */
-            bta_dm_remove_sec_dev_entry (bda);
+            APPL_TRACE_WARNING("%s remove bond,rsn %d, BDA:0x%02X%02X%02X%02X%02X%02X", __func__, sec_event.auth_cmpl.fail_reason,
+                            bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+            bta_dm_remove_sec_dev_entry(bda);
         } else {
             sec_event.auth_cmpl.success = TRUE;
             if (!p_data->complt.smp_over_br) {

components/bt/host/bluedroid/bta/gatt/bta_gatts_act.c

@@ -723,8 +723,6 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
                 } else {
                     APPL_TRACE_ERROR("%s, malloc failed", __func__);
                 }
-            } else {
-                APPL_TRACE_ERROR("%s, incorrect length", __func__);
             }
             (*p_rcb->p_cback)(BTA_GATTS_CONF_EVT, &cb_data);
             if (cb_data.req_data.value != NULL) {
@@ -733,7 +731,7 @@ void bta_gatts_indicate_handle (tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
             }
         }
     } else {
-        APPL_TRACE_ERROR("Not an registered servce attribute ID: 0x%04x",
+        APPL_TRACE_ERROR("Not a registered service attribute ID: 0x%04x",
                          p_msg->api_indicate.attr_id);
     }
 }
@@ -923,7 +921,7 @@ void bta_gatts_listen(tBTA_GATTS_CB *p_cb, tBTA_GATTS_DATA *p_msg)
 **
 ** Function         bta_gatts_show_local_database
 **
-** Description      print loacl service database
+** Description      print local service database
 **
 ** Returns          none.
 **

components/bt/host/bluedroid/bta/include/bta/bta_ar_api.h

@@ -18,7 +18,7 @@
 
 /******************************************************************************
  *
- *  This is the public interface file for the simulatenous advanced
+ *  This is the public interface file for the simultaneous advanced
  *  audio/video streaming (AV) source and sink of BTA, Broadcom's Bluetooth
  *  application layer for mobile phones.
  *
@@ -35,6 +35,10 @@
 
 #if (BTA_AR_INCLUDED == TRUE)
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /*****************************************************************************
 **  Constants and data types
 *****************************************************************************/

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -40,31 +40,6 @@
 
 #if (SDP_INCLUDED == TRUE)
 
-/*****************************************************************************
-**  Constants
-*****************************************************************************/
-
-static const uint8_t  UUID_OBEX_OBJECT_PUSH[] = {0x00, 0x00, 0x11, 0x05, 0x00, 0x00, 0x10, 0x00,
-                                                 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                                };
-static const uint8_t  UUID_PBAP_PSE[] = {0x00, 0x00, 0x11, 0x2F, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_PBAP_PCE[] = {0x00, 0x00, 0x11, 0x2E, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_MAP_MAS[] = {0x00, 0x00, 0x11, 0x32, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_MAP_MNS[] = {0x00, 0x00, 0x11, 0x33, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_SPP[] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
-static const uint8_t  UUID_SAP[] = {0x00, 0x00, 0x11, 0x2D, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
 // TODO:
 // Both the fact that the UUIDs are declared in multiple places, plus the fact
 // that there is a mess of UUID comparison and shortening methods will have to
@@ -369,7 +344,7 @@ static void bta_create_sap_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     tSDP_PROTOCOL_ELEM pe;
     UINT16 pversion = -1;
 
-    record->sap.hdr.type = SDP_TYPE_MAP_MAS;
+    record->sap.hdr.type = SDP_TYPE_SAP_SERVER;
     record->sap.hdr.service_name_length = 0;
     record->sap.hdr.service_name = NULL;
     record->sap.hdr.rfcomm_channel_number = 0;
@@ -420,6 +395,15 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     record->raw.hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
+static bool check_if_uuid16_match(UINT16 uuid16, tBT_UUID *uuid)
+{
+    // Because it is converted to a short UUID, only uuid16 needs to be checked.
+    if (uuid->len == 2 && uuid->uu.uuid16 == uuid16) {
+        return TRUE;
+    } else {
+        return FALSE;
+    }
+}
 
 /*******************************************************************************
 **
@@ -456,25 +440,25 @@ static void bta_sdp_search_cback(UINT16 result, void *user_data)
             /* generate the matching record data pointer */
             if (p_rec != NULL) {
                 status = BTA_SDP_SUCCESS;
-                if (uuid->uu.uuid16 == UUID_SERVCLASS_PNP_INFORMATION) {
+                if (check_if_uuid16_match(UUID_SERVCLASS_PNP_INFORMATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found DIP uuid\n", __func__);
                     bta_create_dip_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MAS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_ACCESS, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MAS) uuid\n", __func__);
                     bta_create_mas_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MNS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_NOTIFICATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MNS) uuid\n", __func__);
                     bta_create_mns_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PSE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PSE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PSE) uuid\n", __func__);
                     bta_create_pse_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PCE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PCE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PCE) uuid\n", __func__);
                     bta_create_pce_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_OBEX_OBJECT_PUSH, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_OBEX_OBJECT_PUSH, &su)) {
                     APPL_TRACE_DEBUG("%s() - found Object Push Server (OPS) uuid\n", __func__);
                     bta_create_ops_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_SAP, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_SAP, &su)) {
                     APPL_TRACE_DEBUG("%s() - found SAP uuid\n", __func__);
                     bta_create_sap_sdp_record(&evt_data.records[count], p_rec);
                 } else {

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -182,11 +182,12 @@ static void btc_dm_remove_ble_bonding_keys(void)
     btc_storage_remove_ble_bonding_keys(&bd_addr);
 }
 
+#if BLE_SMP_BOND_NVS_FLASH
 static void btc_dm_save_ble_bonding_keys(void)
 {
     if (!(btc_dm_cb.pairing_cb.ble.is_penc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_pid_key_rcvd || btc_dm_cb.pairing_cb.ble.is_pcsrk_key_rcvd ||
-         btc_dm_cb.pairing_cb.ble.is_lenc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lcsrk_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd)) {
-        return ;
+        btc_dm_cb.pairing_cb.ble.is_lenc_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lcsrk_key_rcvd || btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd)) {
+        return;
     }
     bt_bdaddr_t bd_addr;
 
@@ -244,13 +245,13 @@ static void btc_dm_save_ble_bonding_keys(void)
         btc_dm_cb.pairing_cb.ble.is_lidk_key_rcvd = false;
     }
 }
+#endif
 
 static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
 {
     /* Save link key, if not temporary */
     BTC_TRACE_DEBUG("%s, status = %d", __func__, p_auth_cmpl->success);
     bt_status_t status = BT_STATUS_FAIL;
-    int addr_type;
     bt_bdaddr_t bdaddr;
     bdcpy(bdaddr.address, p_auth_cmpl->bd_addr);
     bdcpy(btc_dm_cb.pairing_cb.bd_addr, p_auth_cmpl->bd_addr);
@@ -266,6 +267,9 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             return;
         }
 
+#if BLE_SMP_BOND_NVS_FLASH
+        int addr_type;
+
         if (btc_dm_cb.pairing_cb.ble.is_pid_key_rcvd) {
             // delete unused section in NVS
             btc_storage_remove_unused_sections(p_auth_cmpl->bd_addr, &btc_dm_cb.pairing_cb.ble.pid_key);
@@ -276,6 +280,7 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
         }
         btc_storage_set_ble_dev_auth_mode(&bdaddr, p_auth_cmpl->auth_mode, true);
         btc_dm_save_ble_bonding_keys();
+#endif
     } else {
         /*Map the HCI fail reason  to  bt status  */
         switch (p_auth_cmpl->fail_reason) {
@@ -288,6 +293,9 @@ static void btc_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
             status = BT_STATUS_AUTH_REJECTED;
             break;
         default:
+            BTC_TRACE_WARNING ("%s, remove bond in flash bd_addr: %08x%04x", __func__,
+                                (p_auth_cmpl->bd_addr[0] << 24) + (p_auth_cmpl->bd_addr[1] << 16) + (p_auth_cmpl->bd_addr[2] << 8) + p_auth_cmpl->bd_addr[3],
+                                (p_auth_cmpl->bd_addr[4] << 8) + p_auth_cmpl->bd_addr[5]);
             btc_dm_remove_ble_bonding_keys();
             status =  BT_STATUS_FAIL;
             break;

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -122,6 +122,11 @@ uint32_t btc_get_ble_status(void)
 {
     uint32_t status = BTC_BLE_STATUS_IDLE;
 
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        BTC_TRACE_ERROR("%s Bluedroid not enabled", __func__);
+        return status;
+    }
+
     #if (BLE_INCLUDED == TRUE)
     // Number of active advertising
     extern uint8_t btm_ble_adv_active_count(void);

components/bt/host/bluedroid/btc/core/btc_util.c

@@ -349,7 +349,7 @@ esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status)
     return esp_status;
 }
 
-esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
+esp_bt_status_t btc_btm_status_to_esp_status(uint8_t btm_status)
 {
     esp_bt_status_t esp_status = ESP_BT_STATUS_FAIL;
     switch(btm_status) {
@@ -392,7 +392,7 @@ esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status)
     return esp_status;
 }
 
-esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status)
+esp_bt_status_t btc_bta_status_to_esp_status(uint8_t bta_status)
 {
     esp_bt_status_t esp_status = ESP_BT_STATUS_FAIL;
     switch(bta_status){
@@ -424,3 +424,36 @@ esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status)
 
     return esp_status;
 }
+
+void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src)
+{
+    p_dest->len = p_src->len;
+    if (p_src->len == LEN_UUID_16) {
+        p_dest->uuid.uuid16 = p_src->uu.uuid16;
+    } else if (p_src->len == LEN_UUID_32) {
+        p_dest->uuid.uuid32 = p_src->uu.uuid32;
+    } else if (p_src->len == LEN_UUID_128) {
+        memcpy(&p_dest->uuid.uuid128, p_src->uu.uuid128, p_dest->len);
+    } else if (p_src->len == 0) {
+        /* do nothing for now, there's some scenario will input 0
+           such as, receive notify, the descriptor may be 0 */
+    } else {
+        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
+    }
+}
+
+void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src)
+{
+    p_dest->len = p_src->len;
+    if (p_src->len == LEN_UUID_16) {
+        p_dest->uu.uuid16 = p_src->uuid.uuid16;
+    } else if (p_src->len == LEN_UUID_32) {
+        p_dest->uu.uuid32 = p_src->uuid.uuid32;
+    } else if (p_src->len == LEN_UUID_128) {
+        memcpy(&p_dest->uu.uuid128, p_src->uuid.uuid128, p_dest->len);
+    } else if (p_src->len == 0) {
+        /* do nothing for now, there's some scenario will input 0 */
+    } else {
+        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
+    }
+}

components/bt/host/bluedroid/btc/include/btc/btc_util.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -57,8 +57,11 @@ void uuid128_be_to_esp_uuid(esp_bt_uuid_t *u, uint8_t* uuid128);
 void uuid_to_string_legacy(bt_uuid_t *p_uuid, char *str);
 
 esp_bt_status_t btc_hci_to_esp_status(uint8_t hci_status);
-esp_bt_status_t btc_btm_status_to_esp_status (uint8_t btm_status);
-esp_bt_status_t btc_bta_status_to_esp_status (uint8_t bta_status);
+esp_bt_status_t btc_btm_status_to_esp_status(uint8_t btm_status);
+esp_bt_status_t btc_bta_status_to_esp_status(uint8_t bta_status);
+
+void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src);
+void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src);
 
 #ifdef __cplusplus
 }

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatt_util.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -82,23 +82,6 @@ void btc128_to_bta_uuid(tBT_UUID *p_dest, uint8_t *p_src)
 /*******************************************************************************
  * BTC -> BTA conversion functions
  *******************************************************************************/
-
-void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src)
-{
-    p_dest->len = p_src->len;
-    if (p_src->len == LEN_UUID_16) {
-        p_dest->uu.uuid16 = p_src->uuid.uuid16;
-    } else if (p_src->len == LEN_UUID_32) {
-        p_dest->uu.uuid32 = p_src->uuid.uuid32;
-    } else if (p_src->len == LEN_UUID_128) {
-        memcpy(&p_dest->uu.uuid128, p_src->uuid.uuid128, p_dest->len);
-    } else if (p_src->len == 0) {
-        /* do nothing for now, there's some scenario will input 0 */
-    } else {
-        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
-    }
-}
-
 void btc_to_bta_gatt_id(tBTA_GATT_ID *p_dest, esp_gatt_id_t *p_src)
 {
     p_dest->inst_id = p_src->inst_id;
@@ -115,23 +98,6 @@ void btc_to_bta_srvc_id(tBTA_GATT_SRVC_ID *p_dest, esp_gatt_srvc_id_t *p_src)
 /*******************************************************************************
  * BTA -> BTC conversion functions
  *******************************************************************************/
-void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src)
-{
-    p_dest->len = p_src->len;
-    if (p_src->len == LEN_UUID_16) {
-        p_dest->uuid.uuid16 = p_src->uu.uuid16;
-    } else if (p_src->len == LEN_UUID_32) {
-        p_dest->uuid.uuid32 = p_src->uu.uuid32;
-    } else if (p_src->len == LEN_UUID_128) {
-        memcpy(&p_dest->uuid.uuid128, p_src->uu.uuid128, p_dest->len);
-    } else if (p_src->len == 0) {
-        /* do nothing for now, there's some scenario will input 0
-           such as, receive notify, the descriptor may be 0 */
-    } else {
-        BTC_TRACE_ERROR("%s UUID len is invalid %d\n", __func__, p_src->len);
-    }
-}
-
 void bta_to_btc_gatt_id(esp_gatt_id_t *p_dest, tBTA_GATT_ID *p_src)
 {
     p_dest->inst_id = p_src->inst_id;

components/bt/host/bluedroid/btc/profile/std/include/btc_av_api.h

@@ -23,6 +23,9 @@
 #include "stack/a2d_sbc.h"
 
 #if (BTC_AV_INCLUDED == TRUE)
+#ifdef __cplusplus
+extern "C" {
+#endif
 /*****************************************************************************
  **  Constants and data types
  *****************************************************************************/

components/bt/host/bluedroid/btc/profile/std/include/btc_gatt_util.h

@@ -9,6 +9,7 @@
 
 #include "stack/bt_types.h"
 #include "bta/bta_gatt_api.h"
+#include "btc/btc_util.h"
 #include "esp_bt_defs.h"
 #include "esp_gatt_defs.h"
 #include "esp_gattc_api.h"
@@ -18,12 +19,10 @@
 #define BTC_GATT_GET_GATT_IF(conn_id)  ((uint8_t)(conn_id))
 
 void btc128_to_bta_uuid(tBT_UUID *p_dest, uint8_t *p_src);
-void btc_to_bta_uuid(tBT_UUID *p_dest, esp_bt_uuid_t *p_src);
 void btc_to_bta_gatt_id(tBTA_GATT_ID *p_dest, esp_gatt_id_t *p_src);
 void btc_to_bta_srvc_id(tBTA_GATT_SRVC_ID *p_dest, esp_gatt_srvc_id_t *p_src);
 void btc_to_bta_response(tBTA_GATTS_RSP *rsp_struct, esp_gatt_rsp_t *p_rsp);
 
-void bta_to_btc_uuid(esp_bt_uuid_t *p_dest, tBT_UUID *p_src);
 void bta_to_btc_gatt_id(esp_gatt_id_t *p_dest, tBTA_GATT_ID *p_src);
 void bta_to_btc_srvc_id(esp_gatt_srvc_id_t *p_dest, tBTA_GATT_SRVC_ID *p_src);
 

components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c

@@ -9,6 +9,7 @@
 #include "btc_sdp.h"
 #include "btc/btc_manage.h"
 #include "btc/btc_task.h"
+#include "btc/btc_util.h"
 #include "bta/bta_sdp_api.h"
 #include "bta/bta_sys.h"
 #include "bta/utl.h"
@@ -1399,7 +1400,7 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
 
         param.search.status = p_data->sdp_search_comp.status;
         memcpy(param.search.remote_addr, p_data->sdp_search_comp.remote_addr, sizeof(BD_ADDR));
-        memcpy(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid, sizeof(tSDP_UUID));
+        bta_to_btc_uuid(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid);
         param.search.record_count = p_data->sdp_search_comp.record_count;
         param.search.records = (esp_bluetooth_sdp_record_t *)p_data->sdp_search_comp.records;
         btc_sdp_cb_to_app(ESP_SDP_SEARCH_COMP_EVT, &param);

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -251,6 +251,12 @@
 #define UC_BT_BLE_SMP_ID_RESET_ENABLE FALSE
 #endif
 
+#ifdef CONFIG_BT_BLE_SMP_BOND_NVS_FLASH
+#define UC_BT_BLE_SMP_BOND_NVS_FLASH CONFIG_BT_BLE_SMP_BOND_NVS_FLASH
+#else
+#define UC_BT_BLE_SMP_BOND_NVS_FLASH FALSE
+#endif
+
 //Device Name Maximum Length
 #ifdef CONFIG_BT_MAX_DEVICE_NAME_LEN
 #define UC_MAX_LOC_BD_NAME_LEN  CONFIG_BT_MAX_DEVICE_NAME_LEN

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -316,6 +316,12 @@
 #define BLE_SMP_ID_RESET_ENABLE          FALSE
 #endif
 
+#if (UC_BT_BLE_SMP_BOND_NVS_FLASH)
+#define BLE_SMP_BOND_NVS_FLASH      TRUE
+#else
+#define BLE_SMP_BOND_NVS_FLASH      FALSE
+#endif
+
 #ifdef UC_BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
 #define BLE_ADV_REPORT_FLOW_CONTROL         (UC_BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP && BLE_INCLUDED)
 #endif /* UC_BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP */

components/bt/host/bluedroid/stack/btm/btm_acl.c

@@ -335,7 +335,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
 #if (CLASSIC_BT_INCLUDED == TRUE)
                         const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
-                        /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+                        /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
 #if (SMP_INCLUDED == TRUE)
                         btm_sec_set_peer_sec_caps(p, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
@@ -350,7 +350,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
                         return;
                     }
                 } else {
-                    /* If remote features indicated secure connection (SC) mode, check the remote feautres again*/
+                    /* If remote features indicated secure connection (SC) mode, check the remote features again*/
                     /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
                     btm_read_remote_features (p->hci_handle);
                 }
@@ -474,7 +474,7 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
                     BTM_TRACE_DEBUG("Bonded\n");
                 }
             } else {
-                BTM_TRACE_DEBUG("Bletooth link down\n");
+                BTM_TRACE_DEBUG("Bluetooth link down\n");
                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
                                           | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
             }
@@ -1016,7 +1016,7 @@ void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
 
     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #if (SMP_INCLUDED == TRUE)
-    /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+    /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
     btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
     BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
@@ -1455,7 +1455,7 @@ void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
 **
 ** Function         btm_acl_role_changed
 **
-** Description      This function is called whan a link's master/slave role change
+** Description      This function is called when a link's master/slave role change
 **                  event or command status event (with error) is received.
 **                  It updates the link control block, and calls
 **                  the registered callback with status and role (if registered).
@@ -2705,7 +2705,7 @@ void btm_acl_connected(BD_ADDR bda, UINT16 handle, UINT8 link_type, UINT8 enc_mo
         l2c_link_hci_conn_comp(status, handle, bda);
     }
 #if BTM_SCO_INCLUDED == TRUE
-    else {
+    else if (link_type == HCI_LINK_TYPE_SCO) {
         memset(&esco_data, 0, sizeof(tBTM_ESCO_DATA));
         esco_data.link_type = HCI_LINK_TYPE_SCO;
         memcpy (esco_data.bd_addr, bda, BD_ADDR_LEN);

components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c

@@ -1086,18 +1086,23 @@ end:
 void BTM_BleSetPreferExtenedConnParams (BD_ADDR bd_addr, tBTM_EXT_CONN_PARAMS *params)
 {
     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_or_alloc_dev (bd_addr);
+    tBTM_STATUS status = BTM_SUCCESS;
+    tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0};
 
     if (p_dev_rec) {
         if (params) {
             memcpy(&p_dev_rec->ext_conn_params, params, sizeof(tBTM_EXT_CONN_PARAMS));
         } else {
-            BTM_TRACE_ERROR("Invalid Extand connection parameters");
+            BTM_TRACE_ERROR("Invalid Extended connection parameters");
+            status = BTM_ILLEGAL_VALUE;
         }
     } else {
-            BTM_TRACE_ERROR("Unknown Device, setting rejected");
+        BTM_TRACE_ERROR("Unknown Device, setting rejected");
+        status = BTM_UNKNOWN_ADDR;
     }
 
-    return;
+    cb_params.status = status;
+    BTM_ExtBleCallbackTrigger(BTM_BLE_5_GAP_PREFER_EXT_CONN_PARAMS_SET_COMPLETE_EVT, &cb_params);
 }
 
 void btm_ble_extended_init(void)

components/bt/host/bluedroid/stack/btm/btm_devctl.c

@@ -871,7 +871,7 @@ void btm_vendor_specific_evt (UINT8 *p, UINT8 evt_len)
 
     STREAM_TO_UINT8(sub_event, p_evt);
     /* Check in subevent if authentication is through Legacy Authentication. */
-    if (sub_event == ESP_VS_REM_LEGACY_AUTH_CMP) {
+    if (sub_event == HCI_VENDOR_LEGACY_REM_AUTH_EVT_SUBCODE) {
         UINT16 hci_handle;
         STREAM_TO_UINT16(hci_handle, p_evt);
         btm_sec_handle_remote_legacy_auth_cmp(hci_handle);

components/bt/host/bluedroid/stack/btm/btm_sco.c

@@ -117,8 +117,6 @@ void btm_sco_init (void)
     }
 #endif
     /* Initialize nonzero defaults */
-    btm_cb.sco_cb.sco_disc_reason  = BTM_INVALID_SCO_DISC_REASON;
-
     btm_cb.sco_cb.def_esco_parms = btm_esco_defaults; /* Initialize with defaults */
     btm_cb.sco_cb.desired_sco_mode = BTM_DEFAULT_SCO_MODE;
 }
@@ -1048,7 +1046,6 @@ void btm_sco_connected (UINT8 hci_status, BD_ADDR bda, UINT16 hci_handle,
     tBTM_CHG_ESCO_PARAMS parms;
 #endif
 
-    btm_cb.sco_cb.sco_disc_reason = hci_status;
     BTM_TRACE_API("%s, handle %x", __FUNCTION__, hci_handle);
 #if (BTM_MAX_SCO_LINKS>0)
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
@@ -1224,16 +1221,11 @@ void btm_sco_removed (UINT16 hci_handle, UINT8 reason)
 #if (BTM_MAX_SCO_LINKS>0)
     tSCO_CONN   *p = &btm_cb.sco_cb.sco_db[0];
     UINT16      xx;
-#endif
 
-    btm_cb.sco_cb.sco_disc_reason = reason;
-
-#if (BTM_MAX_SCO_LINKS>0)
     p = &btm_cb.sco_cb.sco_db[0];
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
         if ((p->state != SCO_ST_UNUSED) && (p->state != SCO_ST_LISTENING) && (p->hci_handle == hci_handle)) {
             btm_sco_flush_sco_data(xx);
-
             p->state = SCO_ST_UNUSED;
 #if BTM_SCO_HCI_INCLUDED == TRUE
             btm_cb.sco_cb.xmit_window_size += p->sent_not_acked;
@@ -1375,24 +1367,6 @@ UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx)
 #endif
 }
 
-/*******************************************************************************
-**
-** Function         BTM_ReadScoDiscReason
-**
-** Description      This function is returns the reason why an (e)SCO connection
-**                  has been removed. It contains the value until read, or until
-**                  another (e)SCO connection has disconnected.
-**
-** Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
-**
-*******************************************************************************/
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    UINT16 res = btm_cb.sco_cb.sco_disc_reason;
-    btm_cb.sco_cb.sco_disc_reason = BTM_INVALID_SCO_DISC_REASON;
-    return (res);
-}
-
 /*******************************************************************************
 **
 ** Function         BTM_ReadDeviceScoPacketTypes
@@ -1894,10 +1868,6 @@ UINT8 *BTM_ReadScoBdAddr(UINT16 sco_inx)
 {
     return ((UINT8 *) NULL);
 }
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    return (BTM_INVALID_SCO_DISC_REASON);
-}
 tBTM_STATUS BTM_SetEScoMode (tBTM_SCO_TYPE sco_mode, tBTM_ESCO_PARAMS *p_parms)
 {
     return (BTM_MODE_UNSUPPORTED);

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -43,8 +43,6 @@ typedef struct tBTM_SEC_DEV_REC tBTM_SEC_DEV_REC;
 #include "stack/smp_api.h"
 #endif
 
-#define ESP_VS_REM_LEGACY_AUTH_CMP 0x03
-
 #if BTM_MAX_LOC_BD_NAME_LEN > 0
 typedef char tBTM_LOC_BD_NAME[BTM_MAX_LOC_BD_NAME_LEN + 1];
 #endif
@@ -470,7 +468,6 @@ typedef struct {
     tSCO_CONN            sco_db[BTM_MAX_SCO_LINKS];
     tBTM_ESCO_PARAMS     def_esco_parms;
     BD_ADDR              xfer_addr;
-    UINT16               sco_disc_reason;
     BOOLEAN              esco_supported;    /* TRUE if 1.2 cntlr AND supports eSCO links */
     tBTM_SCO_TYPE        desired_sco_mode;
     tBTM_SCO_TYPE        xfer_sco_type;

components/bt/host/bluedroid/stack/btu/btu_hcif.c

@@ -143,6 +143,7 @@ static void btu_ble_periodic_adv_sync_lost_evt(UINT8 *p);
 static void btu_ble_scan_timeout_evt(UINT8 *p);
 static void btu_ble_adv_set_terminate_evt(UINT8 *p);
 static void btu_ble_scan_req_received_evt(UINT8 *p);
+static void btu_ble_channel_select_alg_evt(UINT8 *p);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 static void btu_ble_periodic_adv_sync_trans_recv(UINT8 *p);
@@ -411,6 +412,7 @@ void btu_hcif_process_event (UNUSED_ATTR UINT8 controller_id, BT_HDR *p_msg)
             btu_ble_scan_req_received_evt(p);
             break;
         case HCI_BLE_CHANNEL_SELECT_ALG:
+            btu_ble_channel_select_alg_evt(p);
             break;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
@@ -2351,6 +2353,21 @@ static void btu_ble_scan_req_received_evt(UINT8 *p)
 
     btm_ble_scan_req_received_evt(&req_received);
 }
+
+static void btu_ble_channel_select_alg_evt(UINT8 *p)
+{
+    tBTM_BLE_CHANNEL_SEL_ALG chan_sel_alg = {0};
+
+    if (!p) {
+        HCI_TRACE_ERROR("%s, Invalid params.", __func__);
+        return;
+    }
+
+    STREAM_TO_UINT16(chan_sel_alg.conn_handle, p);
+    STREAM_TO_UINT8(chan_sel_alg.channel_sel_alg, p);
+
+    btm_ble_channel_select_algorithm_evt(&chan_sel_alg);
+}
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)

components/bt/host/bluedroid/stack/gatt/gatt_sr.c

@@ -200,7 +200,7 @@ static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
             *p++ = GATT_RSP_READ_MULTI;
             p_buf->len = 1;
 
-            /* Now walk through the buffers puting the data into the response in order */
+            /* Now walk through the buffers putting the data into the response in order */
             list_t *list = NULL;
             const list_node_t *node = NULL;
             if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
@@ -321,7 +321,7 @@ static BOOLEAN process_read_multi_var_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS sta
             *p++ = GATT_RSP_READ_MULTI_VAR;
             p_buf->len = 1;
 
-            /* Now walk through the buffers puting the data into the response in order */
+            /* Now walk through the buffers putting the data into the response in order */
             list_t *list = NULL;
             const list_node_t *node = NULL;
             if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
@@ -735,7 +735,7 @@ static tGATT_STATUS gatt_build_primary_service_rsp (BT_HDR *p_msg, tGATT_TCB *p_
                     handle_len = 4 + p_uuid->len;
                 }
 
-                /* get the length byte in the repsonse */
+                /* get the length byte in the response */
                 if (p_msg->offset == 0) {
                     *p ++ = op_code + 1;
                     p_msg->len ++;
@@ -788,7 +788,7 @@ static tGATT_STATUS gatt_build_primary_service_rsp (BT_HDR *p_msg, tGATT_TCB *p_
 **                  buffer.
 **
 ** Returns          TRUE: if data filled successfully.
-**                  FALSE: packet full, or format mismatch.
+**                  FALSE: packet full.
 **
 *******************************************************************************/
 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SR_REG *p_rcb, BT_HDR *p_msg, UINT16 *p_len,
@@ -831,10 +831,9 @@ static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SR_REG *p_rcb, BT_HDR *p_msg,
                     gatt_convert_uuid32_to_uuid128(p, ((tGATT_ATTR32 *) p_attr)->uuid);
                     p += LEN_UUID_128;
                 } else {
-                    GATT_TRACE_ERROR("format mismatch");
-                    status = GATT_NO_RESOURCES;
+                    // UUID format mismatch in sequential attributes
+                    // A new request will be sent with the starting handle of the next attribute
                     break;
-                    /* format mismatch */
                 }
                 p_msg->len += info_pair_len[p_msg->offset - 1];
                 len -= info_pair_len[p_msg->offset - 1];
@@ -889,7 +888,7 @@ static tGATT_STATUS gatts_validate_packet_format(UINT8 op_code, UINT16 *p_len,
                 /* parse uuid now */
                 if (gatt_parse_uuid_from_cmd (p_uuid_filter, uuid_len, &p) == FALSE ||
                         p_uuid_filter->len == 0) {
-                    GATT_TRACE_DEBUG("UUID filter does not exsit");
+                    GATT_TRACE_DEBUG("UUID filter does not exist");
                     reason = GATT_INVALID_PDU;
                 } else {
                     len -= p_uuid_filter->len;
@@ -1042,7 +1041,7 @@ static void gatts_process_find_info(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len,
 **
 ** Function         gatts_process_mtu_req
 **
-** Description      This function is called to process excahnge MTU request.
+** Description      This function is called to process exchange MTU request.
 **                  Only used on LE.
 **
 ** Returns          void
@@ -1055,7 +1054,7 @@ static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
     BT_HDR        *p_buf;
     UINT16   conn_id;
 
-    /* BR/EDR conenction, send error response */
+    /* BR/EDR connection, send error response */
     if (p_tcb->att_lcid != L2CAP_ATT_CID) {
         gatt_send_error_rsp (p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, FALSE);
     } else if (len < GATT_MTU_REQ_MIN_LEN) {
@@ -1081,7 +1080,7 @@ static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
             attp_send_sr_msg (p_tcb, p_buf);
 
             /* Notify all registered application with new MTU size. Us a transaction ID */
-            /* of 0, as no response is allowed from applcations                    */
+            /* of 0, as no response is allowed from applications                        */
 
             for (i = 0; i < GATT_MAX_APPS; i ++) {
                 if (gatt_cb.cl_rcb[i].in_use ) {
@@ -1448,7 +1447,7 @@ void gatt_attr_process_prepare_write (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 hand
     }
 
     if ((prepare_record->error_code_app == GATT_SUCCESS)
-        // update prepare write status for excute write request
+        // update prepare write status for execute write request
         && (status == GATT_INVALID_OFFSET || status == GATT_INVALID_ATTR_LEN || status == GATT_REQ_NOT_SUPPORTED)) {
         prepare_record->error_code_app = status;
     }
@@ -1855,7 +1854,7 @@ void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
             gatts_process_primary_service_req (p_tcb, op_code, len, p_data);
             break;
 
-        case GATT_REQ_FIND_INFO:                /* discover char descrptor */
+        case GATT_REQ_FIND_INFO:                /* discover char descriptor */
             gatts_process_find_info(p_tcb, op_code, len, p_data);
             break;
 

components/bt/host/bluedroid/stack/goep/goepc_api.c

@@ -359,7 +359,7 @@ UINT16 GOEPC_RequestAddHeader(UINT16 handle, UINT8 header_id, const UINT8 *data,
             break;
         }
 
-        if (data == NULL || data_len == 0) {
+        if ((data == NULL && data_len != 0) || (data != NULL && data_len == 0)) {
             ret = GOEP_INVALID_PARAM;
             break;
         }

components/bt/host/bluedroid/stack/include/stack/btm_api.h

@@ -1028,9 +1028,6 @@ typedef void (tBTM_ACL_DB_CHANGE_CB) (BD_ADDR p_bda, DEV_CLASS p_dc,
 #define BTM_INVALID_SCO_INDEX       0xFFFF
 #define BTM_INVALID_HCI_HANDLE      0xFFFF
 
-/* Define an invalid SCO disconnect reason */
-#define BTM_INVALID_SCO_DISC_REASON 0xFFFF
-
 /* Define first active SCO index */
 #define BTM_FIRST_ACTIVE_SCO_INDEX  BTM_MAX_SCO_LINKS
 
@@ -3261,21 +3258,6 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx);
 UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx);
 
 
-/*******************************************************************************
-**
-** Function         BTM_ReadScoDiscReason
-**
-** Description      This function is returns the reason why an (e)SCO connection
-**                  has been removed. It contains the value until read, or until
-**                  another (e)SCO connection has disconnected.
-**
-** Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
-**
-*******************************************************************************/
-//extern
-UINT16 BTM_ReadScoDiscReason (void);
-
-
 /*******************************************************************************
 **
 ** Function         BTM_SetEScoMode

components/bt/host/bluedroid/stack/include/stack/goep_common.h

@@ -8,11 +8,12 @@
 
 #include "common/bt_target.h"
 
-#define GOEP_SUCCESS                0       /* Operation successful */
-#define GOEP_FAILURE                1       /* Operation failed */
-#define GOEP_NO_RESOURCES           3       /* Not enough resources */
-#define GOEP_BAD_HANDLE             4       /* Bad handle */
-#define GOEP_INVALID_PARAM          5       /* Invalid parameter */
-#define GOEP_INVALID_STATE          6       /* Operation not allow in current state */
-#define GOEP_CONGEST                7       /* Congest */
-#define GOEP_TL_ERROR               8       /* Lower transport layer error */
+/* GOEP Client or Server(not supported yet) API return code */
+#define GOEP_SUCCESS                0x00        /* Operation successful */
+#define GOEP_FAILURE                0x01        /* Operation failed */
+#define GOEP_NO_RESOURCES           0x02        /* Not enough resources */
+#define GOEP_BAD_HANDLE             0x04        /* Bad handle */
+#define GOEP_INVALID_PARAM          0x08        /* Invalid parameter */
+#define GOEP_INVALID_STATE          0x10        /* Operation not allow in current state */
+#define GOEP_CONGEST                0x20        /* Congest */
+#define GOEP_TL_ERROR               0x40        /* Lower transport layer error */

components/bt/host/bluedroid/stack/include/stack/hcidefs.h

@@ -427,7 +427,14 @@
 
 //ESP BT subcode define
 #define HCI_SUBCODE_BT_INIT                     0x00
+#define HCI_SUBCODE_BT_WRITE_DM1_ENABLE         0x01
 #define HCI_SUBCODE_BT_SET_MIN_ENC_KEY_SIZE     0x02
+#define HCI_SUBCODE_BT_CLK_UPD                  0x03
+#define HCI_SUBCODE_BT_SET_AFH                  0x07
+#define HCI_SUBCODE_BT_SET_EVT_MASK             0x08
+#define HCI_SUBCODE_BT_SET_AFH_REPORTING_MODE   0x09
+#define HCI_SUBCODE_BT_MASK_RMT_AFH_CH_CLASS    0x0A
+#define HCI_SUBCODE_BT_WR_AUTO_RATE_INIT_ENABLE 0x0B
 #define HCI_SUBCODE_BT_MAX                      0x7F
 
 #define HCI_ESP_VENDOR_OPCODE_BUILD(ogf, group, subcode) ((ogf << 10) | (group <<7) | (subcode << 0))
@@ -472,7 +479,14 @@
 /* BLE set CSA support */
 #define HCI_VENDOR_BLE_SET_CSA_SUPPORT    HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BLE, HCI_SUBCODE_BLE_SET_CSA_SUPPORT)
 //ESP BT HCI CMD
-#define HCI_VENDOR_BT_SET_MIN_ENC_KEY_SIZE         HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_MIN_ENC_KEY_SIZE)
+#define HCI_VENDOR_BT_WRITE_DM1_ENABLE              HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_WRITE_DM1_ENABLE)
+#define HCI_VENDOR_BT_SET_MIN_ENC_KEY_SIZE          HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_MIN_ENC_KEY_SIZE)
+#define HCI_VENDOR_BT_CLK_UPD                       HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_CLK_UPD)
+#define HCI_VENDOR_BT_SET_AFH                       HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_AFH)
+#define HCI_VENDOR_BT_SET_EVT_MASK                  HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_EVT_MASK)
+#define HCI_VENDOR_BT_SET_AFH_REPORTING_MODE        HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_AFH_REPORTING_MODE)
+#define HCI_VENDOR_BT_MASK_RMT_AFH_CH_CLASS         HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_MASK_RMT_AFH_CH_CLASS)
+#define HCI_VENDOR_BT_WR_AUTO_RATE_INIT_ENABLE      HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_WR_AUTO_RATE_INIT_ENABLE)
 
 /* subcode for multi adv feature */
 #define BTM_BLE_MULTI_ADV_SET_PARAM                     0x01
@@ -826,7 +840,12 @@
 /* Definitions for LE Channel Map */
 #define HCI_BLE_CHNL_MAP_SIZE               5
 
-#define HCI_VENDOR_SPECIFIC_EVT         0xFF  /* Vendor specific events */
+#define HCI_VENDOR_SPECIFIC_EVT                                     0xFF  /* Vendor specific events */
+#define HCI_VENDOR_LEGACY_REM_AUTH_EVT_SUBCODE                      0x03
+#define HCI_VENDOR_AFH_CHG_EVT_SUBCODE                              0x05
+#define HCI_VENDOR_CH_CLASSIFICATION_EVT_SUBCODE                    0x06
+#define HCI_VENDOR_CH_CLASSIFICATION_REPORTING_MODE_EVT_SUBCODE     0x07
+
 #define HCI_NAP_TRACE_EVT               0xFF  /* was define 0xFE, 0xFD, change to 0xFF
                                                  because conflict w/ TCI_EVT and per
                                                  specification compliant */

components/bt/host/bluedroid/stack/obex/include/obex_int.h

@@ -24,10 +24,6 @@
 #define OBEX_STATE_OPENING          1       /* Starting to open a connection */
 #define OBEX_STATE_OPENED           2       /* Connection opened */
 
-/* Store 16 bits data in big endian format, not modify the p_buf */
-#define STORE16BE(p_buf, data)          do { *p_buf = ((data)>>8)&0xff; \
-                                             *(p_buf+1) = (data)&0xff;} while(0)
-
 /* OBEX Connection Control block */
 typedef struct {
     tOBEX_MSG_CBACK     *callback;      /* Connection msg callback function */

components/bt/host/bluedroid/stack/obex/obex_api.c

@@ -34,7 +34,7 @@ static inline void obex_server_to_tl_server(tOBEX_SVR_INFO *server, tOBEX_TL_SVR
 static inline void obex_updata_packet_length(BT_HDR *p_buf, UINT16 len)
 {
     UINT8 *p_pkt_len = (UINT8 *)(p_buf + 1) + p_buf->offset + 1;
-    STORE16BE(p_pkt_len, len);
+    UINT16_TO_BE_FIELD(p_pkt_len, len);
 }
 
 /*******************************************************************************
@@ -343,7 +343,7 @@ UINT16 OBEX_BuildRequest(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out_
         /* byte 4: flags */
         *p_data++ = info->flags;
         /* byte 5, 6: maximum OBEX packet length, recommend to set as our mtu*/
-        STORE16BE(p_data, info->max_packet_length);
+        UINT16_TO_BE_FIELD(p_data, info->max_packet_length);
         pkt_len += 4;
         break;
     case OBEX_OPCODE_SETPATH:
@@ -357,7 +357,7 @@ UINT16 OBEX_BuildRequest(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out_
         break;
     }
 
-    STORE16BE(p_pkt_len, pkt_len);
+    UINT16_TO_BE_FIELD(p_pkt_len, pkt_len);
     p_buf->len = pkt_len;
     *out_pkt = p_buf;
     return OBEX_SUCCESS;
@@ -405,14 +405,14 @@ UINT16 OBEX_BuildResponse(tOBEX_PARSE_INFO *info, UINT16 buff_size, BT_HDR **out
         /* byte 4: flags */
         *p_data++ = info->flags;
         /* byte 5, 6: maximum OBEX packet length, recommend to set as our mtu */
-        STORE16BE(p_data, info->max_packet_length);
+        UINT16_TO_BE_FIELD(p_data, info->max_packet_length);
         pkt_len += 4;
         break;
     default:
         break;
     }
 
-    STORE16BE(p_pkt_len, pkt_len);
+    UINT16_TO_BE_FIELD(p_pkt_len, pkt_len);
     p_buf->len = pkt_len;
     *out_pkt = p_buf;
     return OBEX_SUCCESS;
@@ -465,7 +465,7 @@ UINT16 OBEX_AppendHeader(BT_HDR *pkt, const UINT8 *header)
     pkt->len += header_len;
     /* point to packet len */
     p_data++;
-    STORE16BE(p_data, pkt->len);
+    UINT16_TO_BE_FIELD(p_data, pkt->len);
     return OBEX_SUCCESS;
 }
 
@@ -481,7 +481,11 @@ UINT16 OBEX_AppendHeader(BT_HDR *pkt, const UINT8 *header)
 *******************************************************************************/
 UINT16 OBEX_AppendHeaderRaw(BT_HDR *pkt, UINT8 header_id, const UINT8 *data, UINT16 data_len)
 {
-    if (pkt == NULL || data == NULL) {
+    if (pkt == NULL) {
+        return OBEX_INVALID_PARAM;
+    }
+
+    if ((data == NULL && data_len != 0) || (data != NULL && data_len == 0)) {
         return OBEX_INVALID_PARAM;
     }
 
@@ -524,15 +528,17 @@ UINT16 OBEX_AppendHeaderRaw(BT_HDR *pkt, UINT8 header_id, const UINT8 *data, UIN
     *p_start++ = header_id;
     if (store_header_len) {
         /* store header length */
-        STORE16BE(p_start, header_len);
+        UINT16_TO_BE_FIELD(p_start, header_len);
         p_start+= 2;
     }
-    /* store data */
-    memcpy(p_start, data, data_len);
+    if (data != NULL) {
+        /* store data */
+        memcpy(p_start, data, data_len);
+    }
     pkt->len += header_len;
     /* point to packet len */
     p_data++;
-    STORE16BE(p_data, pkt->len);
+    UINT16_TO_BE_FIELD(p_data, pkt->len);
     return OBEX_SUCCESS;
 }
 

components/bt/host/bluedroid/stack/obex/obex_tl_l2cap.c

@@ -484,6 +484,10 @@ void obex_tl_l2cap_disconnect_ind(UINT16 lcid, BOOLEAN is_conf_needed)
         return;
     }
 
+    if (p_ccb->initiator && find_scb_by_psm(p_ccb->vpsm) == NULL) {
+        L2CA_Deregister(p_ccb->vpsm);
+    }
+
     tOBEX_TL_MSG msg = {0};
     msg.any.hdl = p_ccb->allocated;
     obex_tl_l2cap_cb.callback(OBEX_TL_DIS_CONN_EVT, &msg);

components/bt/host/nimble/Kconfig.in

@@ -100,6 +100,14 @@ config BT_NIMBLE_L2CAP_COC_MAX_NUM
     help
         Defines maximum number of BLE Connection Oriented Channels. When set to (0), BLE COC is not compiled in
 
+config BT_NIMBLE_L2CAP_ENHANCED_COC
+    bool "L2CAP Enhanced Connection Oriented Channel"
+    depends on BT_NIMBLE_ENABLED && (BT_NIMBLE_L2CAP_COC_MAX_NUM >= 1)
+    default 0
+    help
+        Enable Enhanced Credit Based Flow Control Mode
+
+
 choice BT_NIMBLE_PINNED_TO_CORE_CHOICE
     prompt "The CPU core on which NimBLE host will run"
     depends on BT_NIMBLE_ENABLED && !FREERTOS_UNICORE
@@ -169,7 +177,7 @@ config BT_NIMBLE_SMP_ID_RESET
     default n
     help
         There are tracking risks associated with using a fixed or static IRK.
-        If enabled this option, Bluedroid will assign a new randomly-generated IRK
+        If enabled this option, NimBLE will assign a new randomly-generated IRK
         when all pairing and bonding records are deleted. This would decrease the ability
         of a previously paired peer to be used to determine whether a device
         with which it previously shared an IRK is within range.
@@ -222,6 +230,13 @@ config BT_NIMBLE_SM_LVL
         3. Authenticated pairing with encryption
         4. Authenticated LE Secure Connections pairing with encryption using a 128-bit strength encryption key.
 
+config BT_NIMBLE_SM_SC_ONLY
+    int "Enable Secure Connections Only Mode"
+    depends on BT_NIMBLE_SECURITY_ENABLE
+    default 0
+    help
+        Enable Secure Connections Only Mode
+
 config BT_NIMBLE_DEBUG
     bool "Enable extra runtime asserts and host debugging"
     default n
@@ -618,6 +633,12 @@ if BT_NIMBLE_50_FEATURE_SUPPORT
             default y
             help
                     This enables controller transfer periodic sync events to host
+
+        config BT_NIMBLE_PERIODIC_ADV_WITH_RESPONSES
+            bool "Enable Periodic Advertisement with Response (EXPERIMENTAL)"
+            depends on BT_NIMBLE_ENABLE_PERIODIC_ADV
+            help
+                This enables controller PAwR (Periodic Advertisement with Response).
     endif
 
     config BT_NIMBLE_EXT_SCAN
@@ -702,6 +723,14 @@ if BT_NIMBLE_50_FEATURE_SUPPORT
 endif
 
 
+config BT_NIMBLE_GATT_CACHING_DISABLE_AUTO
+    bool "Do not start discovery procedure automatically upon receiving Out of Sync"
+    depends on BT_NIMBLE_GATT_CACHING
+    default n
+    help
+        When client receives ATT out-of-sync error message, it will not automatically start the discovery procedure
+        to correct the invalid cache.
+
 config BT_NIMBLE_WHITELIST_SIZE
     int "BLE white list size"
     depends on BT_NIMBLE_ENABLED
@@ -898,6 +927,12 @@ menu "GAP Service"
             Peripheral Preferred Connection Parameter: Supervision Timeout
             Timeout = Value * 10 ms
 
+    config BT_NIMBLE_SVC_GAP_GATT_SECURITY_LEVEL
+        bool "LE GATT Security Level Characteristic"
+        default n
+        help
+            Enable the LE GATT Security Level Characteristic
+
 endmenu
 
 menu "BLE Services"
@@ -921,6 +956,71 @@ menu "BLE Services"
         default 3
         help
             Defines maximum number of report characteristics per service instance
+
+    config BT_NIMBLE_SVC_BAS_BATTERY_LEVEL_NOTIFY
+        depends on BT_NIMBLE_ENABLED
+        bool "BAS Battery Level NOTIFY permission"
+        default n
+        help
+            Enable/Disable notifications on BAS Battery Level Characteristic
+
+    menu "Device Information Service"
+        config BT_NIMBLE_SVC_DIS_MANUFACTURER_NAME
+            depends on BT_NIMBLE_ENABLED
+            bool "Manufacturer Name"
+            default n
+            help
+                Enable the DIS characteristic Manufacturer Name String characteristic
+
+        config BT_NIMBLE_SVC_DIS_SERIAL_NUMBER
+            depends on BT_NIMBLE_ENABLED
+            bool "Serial Number"
+            default n
+            help
+                Enable the DIS Serial Number characteristic
+
+        config BT_NIMBLE_SVC_DIS_HARDWARE_REVISION
+            depends on BT_NIMBLE_ENABLED
+            bool "Hardware Revision"
+            default n
+            help
+                Enable the DIS Hardware Revision characteristic
+
+        config BT_NIMBLE_SVC_DIS_FIRMWARE_REVISION
+            depends on BT_NIMBLE_ENABLED
+            bool "Firmware Revision"
+            default n
+            help
+                Enable the DIS Firmware Revision characteristic
+
+        config BT_NIMBLE_SVC_DIS_SOFTWARE_REVISION
+            depends on BT_NIMBLE_ENABLED
+            bool "Software Revision"
+            default n
+            help
+                Enable the DIS Software Revision characteristic
+
+        config BT_NIMBLE_SVC_DIS_SYSTEM_ID
+            depends on BT_NIMBLE_ENABLED
+            bool "System ID"
+            default n
+            help
+                Enable the DIS System ID characteristic
+
+        config BT_NIMBLE_SVC_DIS_PNP_ID
+            depends on BT_NIMBLE_ENABLED
+            bool "PnP ID"
+            default n
+            help
+                Enable the DIS PnP ID characteristic
+
+        config BT_NIMBLE_SVC_DIS_INCLUDED
+            depends on BT_NIMBLE_ENABLED
+            bool "DIS as an Included Service"
+            default n
+            help
+                Use DIS as an included service
+    endmenu
 endmenu
 
 config BT_NIMBLE_VS_SUPPORT
@@ -941,7 +1041,6 @@ config BT_NIMBLE_OPTIMIZE_MULTI_CONN
 
 config BT_NIMBLE_ENC_ADV_DATA
     bool "Encrypted Advertising Data"
-    select BT_NIMBLE_EXT_ADV
     help
         This option is used to enable encrypted advertising data.
 
@@ -973,6 +1072,15 @@ config BT_NIMBLE_HOST_QUEUE_CONG_CHECK
         or application layer handling adv packets is slow, it will cause the controller memory
         to run out. if enabled, adv packets will be lost when host queue is congested.
 
+config BT_NIMBLE_GATTC_PROC_PREEMPTION_PROTECT
+    bool "Gatt-proc preemption protect check"
+    depends on BT_NIMBLE_ENABLED
+    default n
+    help
+        When BLE and Wireless protocol/IEEE 802.15.4 operate in coexistence, BLE preemption
+        can disrupt the GATT context,causing the service discovery callback to not be invoked.
+        A temporary list is maintained to preserve the GATT context and use it in case of preemption.
+
 menu "Host-controller Transport"
     config BT_NIMBLE_TRANSPORT_UART
         bool "Enable Uart Transport"
@@ -1089,3 +1197,17 @@ menu "Host-controller Transport"
         help
             UART HCI CTS pin
 endmenu
+
+config BT_NIMBLE_EATT_CHAN_NUM
+    int "Maximum number of EATT channels"
+    default 0
+    depends on BT_NIMBLE_ENABLED
+    help
+        Defines the number of channels EATT bearers can use
+
+config BT_NIMBLE_SUBRATE
+    bool "Enable Subrate Change"
+    default n
+    depends on BT_NIMBLE_ENABLED
+    help
+        Enable connection subrate change feature

components/bt/host/nimble/port/include/esp_nimble_cfg.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -158,6 +158,16 @@
 #define MYNEWT_VAL_BLE_GATT_CACHING_MAX_DSCS  (0)
 #endif
 
+#ifdef CONFIG_BT_NIMBLE_GATT_CACHING_DISABLE_AUTO
+#define MYNEWT_VAL_BLE_GATT_CACHING_DISABLE_AUTO (CONFIG_BT_NIMBLE_GATT_CACHING_DISABLE_AUTO)
+#else
+#define MYNEWT_VAL_BLE_GATT_CACHING_DISABLE_AUTO (0)
+#endif
+
+#endif
+
+#ifndef MYNEWT_VAL_BLE_GATT_CSFC_SIZE
+#define MYNEWT_VAL_BLE_GATT_CSFC_SIZE (1)
 #endif
 
 #ifndef CONFIG_BT_NIMBLE_MAX_EXT_ADV_INSTANCES
@@ -511,6 +521,12 @@
 #define MYNEWT_VAL_BLE_L2CAP_COC_SDU_BUFF_COUNT CONFIG_BT_NIMBLE_L2CAP_COC_SDU_BUFF_COUNT
 #endif
 
+#if CONFIG_BT_NIMBLE_L2CAP_ENHANCED_COC || CONFIG_BT_NIMBLE_EATT_CHAN_NUM
+#define MYNEWT_VAL_BLE_L2CAP_ENHANCED_COC (1)
+#else
+#define MYNEWT_VAL_BLE_L2CAP_ENHANCED_COC (0)
+#endif
+
 #ifndef MYNEWT_VAL_BLE_DYNAMIC_SERVICE
 #ifdef CONFIG_BT_NIMBLE_DYNAMIC_SERVICE
 #define MYNEWT_VAL_BLE_DYNAMIC_SERVICE CONFIG_BT_NIMBLE_DYNAMIC_SERVICE
@@ -543,6 +559,10 @@
 #define MYNEWT_VAL_BLE_ATT_SVR_NOTIFY (1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_ATT_SVR_NOTIFY_MULTI
+#define MYNEWT_VAL_BLE_ATT_SVR_NOTIFY_MULTI (1)
+#endif
+
 #ifndef MYNEWT_VAL_BLE_ATT_SVR_QUEUED_WRITE
 #define MYNEWT_VAL_BLE_ATT_SVR_QUEUED_WRITE (1)
 #endif
@@ -567,6 +587,10 @@
 #define MYNEWT_VAL_BLE_ATT_SVR_READ_MULT (1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_ATT_SVR_READ_MULT_VAR
+#define MYNEWT_VAL_BLE_ATT_SVR_READ_MULT_VAR (1)
+#endif
+
 #ifndef MYNEWT_VAL_BLE_ATT_SVR_READ_TYPE
 #define MYNEWT_VAL_BLE_ATT_SVR_READ_TYPE (1)
 #endif
@@ -583,6 +607,49 @@
 #define MYNEWT_VAL_BLE_ATT_SVR_WRITE_NO_RSP (1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_EATT_CHAN_NUM
+#define MYNEWT_VAL_BLE_EATT_CHAN_NUM (CONFIG_BT_NIMBLE_EATT_CHAN_NUM)
+#endif
+
+#ifndef MYNEWT_VAL_BLE_EATT_LOG_LVL
+#define MYNEWT_VAL_BLE_EATT_LOG_LVL (1)
+#endif
+
+#ifndef MYNEWT_VAL_BLE_EATT_LOG_MOD
+#define MYNEWT_VAL_BLE_EATT_LOG_MOD (27)
+#endif
+
+#ifndef MYNEWT_VAL_BLE_EATT_MTU
+#define MYNEWT_VAL_BLE_EATT_MTU (128)
+#endif
+
+#ifndef MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES
+
+#if MYNEWT_VAL_BLE_GATT_CACHING
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_ROBUST_CACHING (1)
+#else
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_ROBUST_CACHING (0)
+#endif //MYNEWT_VAL_BLE_GATT_CACHING
+
+#if CONFIG_BT_NIMBLE_EATT_CHAN_NUM
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_EATT (2)
+#else
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_EATT (0)
+#endif //CONFIG_BT_NIMBLE_EATT_CHAN_NUM
+
+#if MYNEWT_VAL_BLE_ATT_SVR_NOTIFY_MULTI
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_NOTIFY_MULTI (4)
+#else
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_NOTIFY_MULTI (0)
+#endif //MYNEWT_VAL_BLE_ATT_SVR_NOTIFY_MULTI
+
+#define MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES (                  \
+        MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_ROBUST_CACHING |   \
+        MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_EATT |             \
+        MYNEWT_VAL_BLE_CLIENT_SUPPORTED_FEATURES_NOTIFY_MULTI       \
+        )
+#endif //MYNEWT_VAL_CLIENT_SUPPORTED_FEATURES
+
 #ifndef MYNEWT_VAL_BLE_GAP_MAX_PENDING_CONN_PARAM_UPDATE
 #define MYNEWT_VAL_BLE_GAP_MAX_PENDING_CONN_PARAM_UPDATE (1)
 #endif
@@ -623,6 +690,10 @@
 #define MYNEWT_VAL_BLE_GATT_NOTIFY (1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_GATT_NOTIFY_MULTIPLE
+#define MYNEWT_VAL_BLE_GATT_NOTIFY_MULTIPLE (1)
+#endif
+
 #ifndef MYNEWT_VAL_BLE_GATT_READ
 #define MYNEWT_VAL_BLE_GATT_READ (MYNEWT_VAL_BLE_ROLE_CENTRAL)
 #endif
@@ -749,11 +820,15 @@
 #define MYNEWT_VAL_BLE_HS_SYSINIT_STAGE (200)
 #endif
 
+#if CONFIG_BT_NIMBLE_EATT_CHAN_NUM > CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
+#define MYNEWT_VAL_BLE_L2CAP_COC_MAX_NUM (CONFIG_BT_NIMBLE_EATT_CHAN_NUM)
+#else
 #ifndef CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
 #define MYNEWT_VAL_BLE_L2CAP_COC_MAX_NUM (2)
 #else
 #define MYNEWT_VAL_BLE_L2CAP_COC_MAX_NUM CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
-#endif
+#endif //CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
+#endif //CONFIG_BT_NIMBLE_EATT_CHAN_NUM
 
 #ifndef MYNEWT_VAL_BLE_L2CAP_COC_MPS
 #define MYNEWT_VAL_BLE_L2CAP_COC_MPS (MYNEWT_VAL_MSYS_1_BLOCK_SIZE-8)
@@ -771,7 +846,11 @@
 #define MYNEWT_VAL_BLE_L2CAP_RX_FRAG_TIMEOUT (30000)
 #endif
 
-#ifndef MYNEWT_VAL_BLE_L2CAP_SIG_MAX_PROCS
+#if CONFIG_BT_NIMBLE_EATT_CHAN_NUM > CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
+#define MYNEWT_VAL_BLE_L2CAP_SIG_MAX_PROCS (CONFIG_BT_NIMBLE_EATT_CHAN_NUM)
+#elif CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM
+#define MYNEWT_VAL_BLE_L2CAP_SIG_MAX_PROCS (CONFIG_BT_NIMBLE_L2CAP_COC_MAX_NUM)
+#else
 #define MYNEWT_VAL_BLE_L2CAP_SIG_MAX_PROCS (1)
 #endif
 
@@ -885,8 +964,12 @@
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SM_SC_ONLY
+#ifdef CONFIG_BT_NIMBLE_SM_SC_ONLY
+#define MYNEWT_VAL_BLE_SM_SC_ONLY (CONFIG_BT_NIMBLE_SM_SC_ONLY)
+#else
 #define MYNEWT_VAL_BLE_SM_SC_ONLY (0)
 #endif
+#endif
 
 #ifndef MYNEWT_VAL_BLE_SM_THEIR_KEY_DIST
 #define MYNEWT_VAL_BLE_SM_THEIR_KEY_DIST (0)
@@ -912,6 +995,10 @@
 #define MYNEWT_VAL_BLE_STORE_MAX_CCCDS CONFIG_BT_NIMBLE_MAX_CCCDS
 #endif
 
+#ifndef MYNEWT_VAL_BLE_STORE_MAX_CSFCS
+#define MYNEWT_VAL_BLE_STORE_MAX_CSFCS CONFIG_BT_NIMBLE_MAX_BONDS
+#endif
+
 #ifdef CONFIG_BT_NIMBLE_MAX_EADS
 #define MYNEWT_VAL_BLE_STORE_MAX_EADS CONFIG_BT_NIMBLE_MAX_EADS
 #endif
@@ -956,7 +1043,7 @@
 
 /*** nimble/host/services/bas */
 #ifndef MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE
-#define MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE (1)
+#define MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE (CONFIG_BT_NIMBLE_SVC_BAS_BATTERY_LEVEL_NOTIFY)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_READ_PERM
@@ -1556,7 +1643,7 @@
 
 /*** @apache-mynewt-nimble/nimble/host/services/bas */
 #ifndef MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE
-#define MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE (1)
+#define MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_NOTIFY_ENABLE (CONFIG_BT_NIMBLE_SVC_BAS_BATTERY_LEVEL_NOTIFY)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_BAS_BATTERY_LEVEL_READ_PERM
@@ -1573,29 +1660,34 @@
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_DEFAULT ("0000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_FIRMWARE_REVISION
+#define MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_FIRMWARE_REVISION_READ_PERM (-1)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_DEFAULT ("0000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_HARDWARE_REVISION
+#define MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_HARDWARE_REVISION_READ_PERM (-1)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_DEFAULT ("espressif")
 #endif
 
-/* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_MANUFACTURER_NAME
+#define MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_MANUFACTURER_NAME_READ_PERM (-1)
 #endif
 
@@ -1608,20 +1700,24 @@
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_DEFAULT ("0000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_SERIAL_NUMBER
+#define MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_SERIAL_NUMBER_READ_PERM (-1)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_DEFAULT ("0000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_SOFTWARE_REVISION
+#define MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_SOFTWARE_REVISION_READ_PERM (-1)
 #endif
 
@@ -1630,23 +1726,31 @@
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_DEFAULT ("00000000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_SYSTEM_ID
+#define MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_SYSTEM_ID_READ_PERM (-1)
 #endif
 
 #ifndef MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_DEFAULT
-#define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_DEFAULT (NULL)
+#define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_DEFAULT ("000000")
 #endif
 
 /* Value copied from BLE_SVC_DIS_DEFAULT_READ_PERM */
-#ifndef MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_READ_PERM
+#if CONFIG_BT_NIMBLE_SVC_DIS_PNP_ID
+#define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_READ_PERM (0)
+#else
 #define MYNEWT_VAL_BLE_SVC_DIS_PNP_ID_READ_PERM (-1)
 #endif
 
+#ifndef MYNEWT_VAL_BLE_SVC_DIS_INCLUDED
+#define MYNEWT_VAL_BLE_SVC_DIS_INCLUDED (CONFIG_BT_NIMBLE_SVC_DIS_INCLUDED)
+#endif
+
 /*** @apache-mynewt-nimble/nimble/host/services/gap */
 #ifndef MYNEWT_VAL_BLE_SVC_GAP_APPEARANCE
 #define MYNEWT_VAL_BLE_SVC_GAP_APPEARANCE CONFIG_BT_NIMBLE_SVC_GAP_APPEARANCE
@@ -1709,6 +1813,11 @@
         CONFIG_BT_NIMBLE_SVC_GAP_PPCP_SUPERVISION_TMO
 #endif
 
+#ifndef MYNEWT_VAL_BLE_SVC_GAP_GATT_SECURITY_LEVEL
+#define MYNEWT_VAL_BLE_SVC_GAP_GATT_SECURITY_LEVEL \
+        CONFIG_BT_NIMBLE_SVC_GAP_GATT_SECURITY_LEVEL
+#endif
+
 /*** nimble/transport */
 #ifndef MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI
 #define MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI (0)
@@ -1844,6 +1953,14 @@
 #endif
 #endif
 
+#ifndef MYNEWT_VAL_BLE_GATTC_PROC_PREEMPTION_PROTECT
+#ifdef CONFIG_BT_NIMBLE_GATTC_PROC_PREEMPTION_PROTECT
+#define MYNEWT_VAL_BLE_GATTC_PROC_PREEMPTION_PROTECT CONFIG_BT_NIMBLE_GATTC_PROC_PREEMPTION_PROTECT
+#else
+#define MYNEWT_VAL_BLE_GATTC_PROC_PREEMPTION_PROTECT (0)
+#endif
+#endif
+
 #ifndef MYNEWT_VAL_BLE_HOST_ALLOW_CONNECT_WITH_SCAN
 #ifdef CONFIG_BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN
 #define MYNEWT_VAL_BLE_HOST_ALLOW_CONNECT_WITH_SCAN CONFIG_BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN
@@ -1894,5 +2011,12 @@
 #endif
 #endif
 
+#ifndef MYNEWT_VAL_BLE_PERIODIC_ADV_WITH_RESPONSES
+#ifdef CONFIG_BT_NIMBLE_PERIODIC_ADV_WITH_RESPONSES
+#define MYNEWT_VAL_BLE_PERIODIC_ADV_WITH_RESPONSES (CONFIG_BT_NIMBLE_PERIODIC_ADV_WITH_RESPONSES)
+#else
+#define MYNEWT_VAL_BLE_PERIODIC_ADV_WITH_RESPONSES (0)
+#endif
+#endif
 
 #endif

components/bt/include/esp32/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -55,7 +55,7 @@ extern "C" {
 *
 * @note Please do not modify this value
 */
-#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20241015
+#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20250318
 
 /**
  * @brief Bluetooth Controller mode
@@ -199,6 +199,28 @@ the advertising packet will be discarded until the memory is restored. */
 #define BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED 0
 #endif
 
+#if defined(CONFIG_BTDM_BLE_CHAN_ASS_EN)
+#define BTDM_BLE_CHAN_ASS_EN (CONFIG_BTDM_BLE_CHAN_ASS_EN)
+#else
+#define BTDM_BLE_CHAN_ASS_EN (0)
+#endif
+
+#if CONFIG_BTDM_CTRL_CONTROLLER_DEBUG_MODE_1
+#define BTDM_CTRL_CONTROLLER_DEBUG_MODE_1  (1 << 1)
+#else
+#define BTDM_CTRL_CONTROLLER_DEBUG_MODE_1  0
+#endif
+
+#ifndef BTDM_CTRL_CONTROLLER_DEBUG_FLAG
+#define BTDM_CTRL_CONTROLLER_DEBUG_FLAG    (BTDM_CTRL_CONTROLLER_DEBUG_MODE_1 | CONTROLLER_ADV_LOST_DEBUG_BIT)
+#endif
+
+#if defined(CONFIG_BTDM_BLE_PING_EN)
+#define BTDM_BLE_PING_EN (CONFIG_BTDM_BLE_PING_EN)
+#else
+#define BTDM_BLE_PING_EN (0)
+#endif
+
 /**
 * @brief  Default Bluetooth Controller configuration
 */
@@ -212,7 +234,7 @@ the advertising packet will be discarded until the memory is restored. */
     .normal_adv_size = NORMAL_SCAN_DUPLICATE_CACHE_SIZE,                   \
     .mesh_adv_size = MESH_DUPLICATE_SCAN_CACHE_SIZE,                       \
     .send_adv_reserved_size = SCAN_SEND_ADV_RESERVED_SIZE,                 \
-    .controller_debug_flag = CONTROLLER_ADV_LOST_DEBUG_BIT,                \
+    .controller_debug_flag = BTDM_CTRL_CONTROLLER_DEBUG_FLAG,              \
     .mode = BTDM_CONTROLLER_MODE_EFF,                                      \
     .ble_max_conn = CONFIG_BTDM_CTRL_BLE_MAX_CONN_EFF,                     \
     .bt_max_acl_conn = CONFIG_BTDM_CTRL_BR_EDR_MAX_ACL_CONN_EFF,           \
@@ -225,10 +247,13 @@ the advertising packet will be discarded until the memory is restored. */
     .pcm_polar = CONFIG_BTDM_CTRL_PCM_POLAR_EFF,                           \
     .pcm_fsyncshp = CONFIG_BTDM_CTRL_PCM_FSYNCSHP_EFF,                     \
     .hli = BTDM_CTRL_HLI,                                                  \
+    .enc_key_sz_min = CONFIG_BTDM_CTRL_BR_EDR_MIN_ENC_KEY_SZ_DFT_EFF,      \
     .dup_list_refresh_period = SCAN_DUPL_CACHE_REFRESH_PERIOD,             \
     .ble_scan_backoff = BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,              \
     .ble_llcp_disc_flag = BTDM_BLE_LLCP_DISC_FLAG,                         \
     .ble_aa_check = BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED,    \
+    .ble_chan_ass_en = BTDM_BLE_CHAN_ASS_EN,                               \
+    .ble_ping_en = BTDM_BLE_PING_EN,                                       \
     .magic = ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL,                           \
 }
 
@@ -242,47 +267,78 @@ the advertising packet will be discarded until the memory is restored. */
 /**
  * @brief Bluetooth Controller config options
  * @note
- *      1. For parameters configurable in menuconfig, please refer to menuconfig for details on range and default values.
- *      2. It is not recommended to modify the default values of `controller_task_stack_size` and `controller_task_prio`.
+ *      1. For parameters configurable through menuconfig, it is recommended to adjust them via the menuconfig interface. Please refer to menuconfig for details on the range and default values.
+ *      2. It is not recommended to modify the values for parameters which are not configurable through menuconfig.
  */
 typedef struct {
     uint16_t controller_task_stack_size;    /*!< Bluetooth Controller task stack size in bytes */
     uint8_t controller_task_prio;           /*!< Bluetooth Controller task priority */
-    uint8_t hci_uart_no;                    /*!< Indicates UART number if using UART1/2 as HCI I/O interface. Configurable in menuconfig */
-    uint32_t hci_uart_baudrate;             /*!< Indicates UART baudrate if using UART1/2 as HCI I/O interface. Configurable in menuconfig */
-    uint8_t scan_duplicate_mode;            /*!< Scan duplicate filtering mode. Configurable in menuconfig */
-    uint8_t scan_duplicate_type;            /*!< Scan duplicate filtering type. Configurable in menuconfig */
-    uint16_t normal_adv_size;               /*!< Maximum number of devices in scan duplicate filtering list. Configurable in menuconfig */
-    uint16_t mesh_adv_size;                 /*!< Maximum number of Mesh advertising packets in scan duplicate filtering list. Configurable in menuconfig */
+    uint8_t hci_uart_no;                    /*!< UART number as HCI I/O interface. Configurable in menuconfig.
+                                                - 1 - URAT 1 (default)
+                                                - 2 - URAT 2 */
+    uint32_t hci_uart_baudrate;             /*!<  UART baudrate. Configurable in menuconfig.
+                                                - Range: 115200 - 921600
+                                                - Default: 921600 */
+    uint8_t scan_duplicate_mode;            /*!< Scan duplicate filtering mode. Configurable in menuconfig.
+                                                - 0 - Normal scan duplicate filtering mode (default)
+                                                - 1 - Special scan duplicate filtering mode for BLE Mesh */
+    uint8_t scan_duplicate_type;            /*!< Scan duplicate filtering type. If `scan_duplicate_mode` is set to 1, this parameter will be ignored. Configurable in menuconfig.
+                                                - 0 - Filter scan duplicates by device address only (default)
+                                                - 1 - Filter scan duplicates by advertising data only, even if they originate from different devices.
+                                                - 2 - Filter scan duplicated by device address and advertising data. */
+    uint16_t normal_adv_size;               /*!< Maximum number of devices in scan duplicate filtering list. Configurable in menuconfig
+                                                - Range: 10 - 1000
+                                                - Default: 100 */
+    uint16_t mesh_adv_size;                 /*!< Maximum number of Mesh advertising packets in scan duplicate filtering list. Configurable in menuconfig
+                                                - Range: 10 - 1000
+                                                - Default: 100 */
     uint16_t send_adv_reserved_size;        /*!< Controller minimum memory value in bytes. Internal use only */
     uint32_t  controller_debug_flag;        /*!< Controller debug log flag. Internal use only */
-    uint8_t mode;                           /*!< Controller mode:
-
-                                                1: BLE mode
-
-                                                2: Classic Bluetooth mode
-
-                                                3: Dual mode
-
-                                                Others: Invalid
-
-                                                Configurable in menuconfig
-                                                */
-    uint8_t ble_max_conn;                   /*!< Maximum number of BLE connections. Configurable in menuconfig */
-    uint8_t bt_max_acl_conn;                /*!< Maximum number of BR/EDR ACL connections. Configurable in menuconfig */
-    uint8_t bt_sco_datapath;                /*!< SCO data path, i.e. HCI or PCM module. Configurable in menuconfig */
-    bool auto_latency;                      /*!< True if BLE auto latency is enabled, used to enhance Classic Bluetooth performance; false otherwise. Configurable in menuconfig */
-    bool bt_legacy_auth_vs_evt;             /*!< True if BR/EDR Legacy Authentication Vendor Specific Event is enabled, which is required to protect from BIAS attack; false otherwise. Configurable in menuconfig */
-    uint8_t bt_max_sync_conn;               /*!< Maximum number of BR/EDR synchronous connections. Configurable in menuconfig */
-    uint8_t ble_sca;                        /*!< BLE low power crystal accuracy index. Configurable in menuconfig */
-    uint8_t pcm_role;                       /*!< PCM role (master & slave). Configurable in menuconfig */
-    uint8_t pcm_polar;                      /*!< PCM polar trig (falling clk edge & rising clk edge). Configurable in menuconfig */
-    uint8_t pcm_fsyncshp;                   /*!< Physical shape of the PCM Frame Synchronization signal (stereo mode & mono mode). Configurable in menuconfig */
-    bool hli;                               /*!< True if using high level interrupt; false otherwise. Configurable in menuconfig */
-    uint16_t dup_list_refresh_period;       /*!< Scan duplicate filtering list refresh period in seconds. Configurable in menuconfig */
-    bool ble_scan_backoff;                  /*!< True if BLE scan backoff is enabled; false otherwise. Configurable in menuconfig */
-    uint8_t ble_llcp_disc_flag;             /*!< BLE disconnect flag when instant passed. Configurable in menuconfig */
-    bool ble_aa_check;                      /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
+    uint8_t mode;                           /*!< Controller mode.  Configurable in menuconfig
+                                                - 1 - BLE mode
+                                                - 2 - Classic Bluetooth mode
+                                                - 3 - Dual mode
+                                                - 4 - Others: Invalid */
+    uint8_t ble_max_conn;                   /*!< Maximum number of BLE connections. Configurable in menuconfig
+                                                - Range: 1 - 9
+                                                - Default: 3 */
+    uint8_t bt_max_acl_conn;                /*!< Maximum number of BR/EDR ACL connections. Configurable in menuconfig
+                                                - Range: 1 - 7
+                                                - Default: 2 */
+    uint8_t bt_sco_datapath;                /*!< SCO data path. Configurable in menuconfig
+                                                - 0 - HCI module (default)
+                                                - 1 - PCM module */
+    bool auto_latency;                      /*!< True if BLE auto latency is enabled, used to enhance Classic Bluetooth performance in the Dual mode; false otherwise (default). Configurable in menuconfig */
+    bool bt_legacy_auth_vs_evt;             /*!< True if BR/EDR Legacy Authentication Vendor Specific Event is enabled (default in the classic bluetooth or Dual mode), which is required to protect from BIAS attack; false otherwise. Configurable in menuconfig */
+    uint8_t bt_max_sync_conn;               /*!< Maximum number of BR/EDR synchronous connections. Configurable in menuconfig
+                                                - Range: 0 - 3
+                                                - Default: 0 */
+    uint8_t ble_sca;                        /*!< BLE low power crystal accuracy index. Configurable in menuconfig
+                                                - 0 - `BTDM_BLE_DEFAULT_SCA_500PPM`
+                                                - 1 - `BTDM_BLE_DEFAULT_SCA_250PPM` (default) */
+    uint8_t pcm_role;                       /*!< PCM role. Configurable in menuconfig
+                                                - 0 - PCM master (default)
+                                                - 1 - PCM slave (default) */
+    uint8_t pcm_polar;                      /*!< PCM polarity (falling clk edge & rising clk edge). Configurable in menuconfig
+                                                - 0 - Falling Edge (default)
+                                                - 1 - Rising Edge */
+    uint8_t pcm_fsyncshp;                   /*!< Physical shape of the PCM Frame Synchronization signal. Configurable in menuconfig
+                                                - 0 - Stereo Mode (default)
+                                                - 1 - Mono Mode 1
+                                                - 2 - Mono Mode 2 */
+    bool hli;                               /*!< True if using high-level (level 4) interrupt (default); false otherwise. Configurable in menuconfig */
+    uint8_t enc_key_sz_min;                 /*!< Minimum size of the encryption key
+                                                - Range: 7 - 16
+                                                - Default: 7 */
+    uint16_t dup_list_refresh_period;       /*!< Scan duplicate filtering list refresh period in seconds. Configurable in menuconfig
+                                                - Range: 0 - 100 seconds
+                                                - Default: 0 second */
+    bool ble_scan_backoff;                  /*!< True if BLE scan backoff is enabled; false otherwise (default). Configurable in menuconfig */
+    uint8_t ble_llcp_disc_flag;             /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    bool ble_aa_check;                      /*!< True if adds a verification step for the Access Address within the `CONNECT_IND` PDU; false otherwise (default). Configurable in menuconfig */
+    uint8_t ble_chan_ass_en;                /*!< True if BLE channel assessment is enabled (default), false otherwise. Configurable in menuconfig */
+    uint8_t ble_ping_en;                    /*!< True if BLE ping procedure is enabled (default), false otherwise. Configurable in menuconfig */
     uint32_t magic;                         /*!< Magic number */
 } esp_bt_controller_config_t;
 
@@ -352,80 +408,13 @@ typedef enum {
 } esp_sco_data_path_t;
 
 /**
- * @brief  Set BLE TX power
- *
- * @note Connection TX power should only be set after the connection is established.
- *
- * @param[in]  power_type The type of TX power. It could be Advertising, Connection, Default, etc.
- * @param[in]  power_level Power level (index) corresponding to the absolute value (dBm)
- *
- * @return
- *      - ESP_OK:   Success
- *      - ESP_ERR_INVALID_ARG: Invalid argument
+ * @brief Bluetooth sleep clock
  */
-esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
-
-/**
- * @brief  Get BLE TX power
- *
- * @note Connection TX power should only be retrieved after the connection is established.
- *
- * @param[in]  power_type The type of TX power. It could be Advertising/Connection/Default and etc.
- *
- * @return
- *         - Power level
- *
- */
-esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type);
-
-/**
- * @brief  Set BR/EDR TX power
- *
- * BR/EDR power control will use the power within the range of minimum value and maximum value.
- * The power level will affect the global BR/EDR TX power for operations such as inquiry, page, and connection.
- *
- * @note
- *      1. Please call this function after `esp_bt_controller_enable()` and before any functions that cause RF transmission,
- *          such as performing discovery, profile initialization, and so on.
- *      2. For BR/EDR to use the new TX power for inquiry, call this function before starting an inquiry.
- *          If BR/EDR is already inquiring, restart the inquiry after calling this function.
- *
- * @param[in]  min_power_level The minimum power level. The default value is `ESP_PWR_LVL_N0`.
- * @param[in]  max_power_level The maximum power level. The default value is `ESP_PWR_LVL_P3`.
- *
- * @return
- *      - ESP_OK: Success
- *      - ESP_ERR_INVALID_ARG: Invalid argument
- *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
- */
-esp_err_t esp_bredr_tx_power_set(esp_power_level_t min_power_level, esp_power_level_t max_power_level);
-
-/**
- * @brief  Get BR/EDR TX power
- *
- * The corresponding power levels will be stored into the arguments.
- *
- * @param[out]  min_power_level Pointer to store the minimum power level
- * @param[out]  max_power_level  The maximum power level
- *
- * @return
- *      - ESP_OK: Success
- *      - ESP_ERR_INVALID_ARG: Invalid argument
- */
-esp_err_t esp_bredr_tx_power_get(esp_power_level_t *min_power_level, esp_power_level_t *max_power_level);
-
-/**
- * @brief  Set default SCO data path
- *
- * @note   This function should be called after the Controller is enabled, and before (e)SCO link is established.
- *
- * @param[in] data_path SCO data path
- *
- * @return
- *      - ESP_OK: Success
- *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
- */
-esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path);
+typedef enum {
+    ESP_BT_SLEEP_CLOCK_NONE            = 0,   /*!< Sleep clock not configured */
+    ESP_BT_SLEEP_CLOCK_MAIN_XTAL       = 1,   /*!< SoC main crystal */
+    ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL    = 2,   /*!< External 32.768kHz crystal/oscillator */
+} esp_bt_sleep_clock_t;
 
 /**
  * @brief       Initialize the Bluetooth Controller to allocate tasks and other resources
@@ -437,6 +426,8 @@ esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path);
  * @return
  *        - ESP_OK: Success
  *        - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *        - ESP_ERR_INVALID_ARG: Invalid arguments
+ *        - ESP_ERR_NO_MEM: Out of memory
  */
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg);
 
@@ -445,13 +436,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg);
  *
  * @note
  *      1. You should stop advertising and scanning, and disconnect all existing connections before de-initializing Bluetooth Controller.
- *      2. This function should be called only once, after any other Bluetooth functions.
+ *      2. This function should be called after `esp_bt_controller_disable` if the Controller was enabled before.
+ *      3. This function should be called only once, after any other Bluetooth functions.
  *
  * @return
  *      - ESP_OK: Success
- *      - ESP_ERR_INVALID_ARG: Invalid argument
  *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
- *      - ESP_ERR_NO_MEM: Out of memory
  */
 esp_err_t esp_bt_controller_deinit(void);
 
@@ -471,6 +461,7 @@ esp_err_t esp_bt_controller_deinit(void);
  * @return
  *          - ESP_OK: Success
  *          - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *          - ESP_ERR_INVALID_ARG: Invalid arguments
  */
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode);
 
@@ -493,49 +484,6 @@ esp_err_t esp_bt_controller_disable(void);
  */
 esp_bt_controller_status_t esp_bt_controller_get_status(void);
 
-/**
- * @brief Vendor HCI (VHCI) callback functions to notify the Host on the next operation
- */
-typedef struct esp_vhci_host_callback {
-    void (*notify_host_send_available)(void);               /*!< Callback to notify the Host that the Controller is ready to receive the packet */
-    int (*notify_host_recv)(uint8_t *data, uint16_t len);   /*!< Callback to notify the Host that the Controller has a packet to send */
-} esp_vhci_host_callback_t;
-
-/**
- * @brief Check whether the Controller is ready to receive the packet
- *
- * If the return value is True, the Host can send the packet to the Controller.
- *
- * @note This function should be called before each `esp_vhci_host_send_packet()`.
- *
- * @return
- *       True if the Controller is ready to receive packets; false otherwise
- */
-bool esp_vhci_host_check_send_available(void);
-
-/**
- * @brief Send the packet to the Controller
- *
- * @note
- *      1. This function shall not be called within a critical section or when the scheduler is suspended.
- *      2. This function should be called only if `esp_vhci_host_check_send_available()` returns True.
- *
- * @param[in] data Pointer to the packet data
- * @param[in] len The packet length
- */
-void esp_vhci_host_send_packet(uint8_t *data, uint16_t len);
-
-/**
- * @brief Register the VHCI callback funations defined in `esp_vhci_host_callback` structure.
- *
- * @param[in] callback `esp_vhci_host_callback` type variable
- *
- * @return
- *      - ESP_OK: Success
- *      - ESP_FAIL: Failure
- */
-esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callback);
-
 /**
  * @brief Release the Controller memory as per the mode
  *
@@ -543,7 +491,7 @@ esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callba
  *
  * @note
  *    1. This function is optional and should be called only if you want to free up memory for other components.
- *    2. This function should only be called when the controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
+ *    2. This function should only be called when the Controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
  *    3. Once Bluetooth Controller memory is released, the process cannot be reversed. This means you cannot use the Bluetooth Controller mode that you have released using this function.
  *    4. If your firmware will upgrade the Bluetooth Controller mode later (such as switching from BLE to Classic Bluetooth or from disabled to enabled), then do not call this function.
  *
@@ -567,7 +515,7 @@ esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode);
  *
  * @note
  *    1. This function is optional and should be called only if you want to free up memory for other components.
- *    2. This function should only be called when the controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
+ *    2. This function should only be called when the Controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
  *    3. Once Bluetooth Controller memory is released, the process cannot be reversed. This means you cannot use the Bluetooth Controller mode that you have released using this function.
  *    4. If your firmware will upgrade the Bluetooth Controller mode later (such as switching from BLE to Classic Bluetooth or from disabled to enabled), then do not call this function.
  *
@@ -616,7 +564,6 @@ esp_err_t esp_bt_mem_release(esp_bt_mode_t mode);
  */
 esp_err_t esp_bt_sleep_enable(void);
 
-
 /**
  * @brief Disable Bluetooth modem sleep
  *
@@ -629,24 +576,182 @@ esp_err_t esp_bt_sleep_enable(void);
  * @return
  *       - ESP_OK: Success
  *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
- *       - ESP_ERR_NOT_SUPPORTED: Operation or feature not supported
+ *       - ESP_ERR_NOT_SUPPORTED: The modem sleep mode is not supported
  */
 esp_err_t esp_bt_sleep_disable(void);
 
 /**
- * @brief Manually clear the scan duplicate list
+ * @brief  Set BLE TX power
+ *
+ * @note Connection TX power should only be set after the connection is established.
+ *
+ * @param[in]  power_type The type of TX power. It could be Advertising, Connection, Default, etc.
+ * @param[in]  power_level Power level (index) corresponding to the absolute value (dBm)
+ *
+ * @return
+ *      - ESP_OK:   Success
+ *      - ESP_ERR_INVALID_ARG: Invalid argument
+ */
+esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
+
+/**
+ * @brief  Get BLE TX power
+ *
+ * @note Connection TX power should only be retrieved after the connection is established.
+ *
+ * @param[in]  power_type The type of TX power. It could be Advertising/Connection/Default and etc.
+ *
+ * @return
+ *         - Power level
+ *
+ */
+esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type);
+
+
+/**
+ * @brief  Set BLE TX power
+ *
+ * @note Connection TX power should only be set after the connection is established.
+ *
+ * @param[in]  power_type The type of TX power. It could be Advertising, Connection, Default, etc.
+ * @param[in]  power_level Power level (index) corresponding to the absolute value (dBm)
+ *
+ * @return
+ *      - ESP_OK:   Success
+ *      - ESP_ERR_INVALID_ARG: Invalid argument
+ */
+esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
+
+/**
+ * @brief Manually clear the BLE scan duplicate list
  *
  * @note
- *       The scan duplicate list will be automatically cleared when the maximum amount of devices in the filter is reached. The amount of devices in the filter can be configured in menuconfig.
+ *      1. This function name is incorrectly spelled, it will be fixed in release 5.x version.
+ *      2. The scan duplicate list will be automatically cleared when the maximum amount of devices in the filter is reached.
+ *         The amount of devices in the filter can be configured in menuconfig.
  *
  * @return
  *       - ESP_OK: Success
  *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
  */
 esp_err_t esp_ble_scan_duplicate_list_flush(void);
-
 esp_err_t esp_ble_scan_dupilcate_list_flush(void);
 
+/**
+ * @brief  Set BR/EDR TX power
+ *
+ * BR/EDR power control will use the power within the range of minimum value and maximum value.
+ * The power level will affect the global BR/EDR TX power for operations such as inquiry, page, and connection.
+ *
+ * @note
+ *      1. Please call this function after `esp_bt_controller_enable()` and before any functions that cause RF transmission,
+ *          such as performing discovery, profile initialization, and so on.
+ *      2. For BR/EDR to use the new TX power for inquiry, call this function before starting an inquiry.
+ *          If BR/EDR is already inquiring, restart the inquiry after calling this function.
+ *
+ * @param[in]  min_power_level The minimum power level. The default value is `ESP_PWR_LVL_N0`.
+ * @param[in]  max_power_level The maximum power level. The default value is `ESP_PWR_LVL_P3`.
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_ERR_INVALID_ARG: Invalid argument
+ *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ */
+esp_err_t esp_bredr_tx_power_set(esp_power_level_t min_power_level, esp_power_level_t max_power_level);
+
+/**
+ * @brief  Get BR/EDR TX power
+ *
+ * The corresponding power levels will be stored into the arguments.
+ *
+ * @param[out]  min_power_level Pointer to store the minimum power level
+ * @param[out]  max_power_level The maximum power level
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_ERR_INVALID_ARG: Invalid argument
+ */
+esp_err_t esp_bredr_tx_power_get(esp_power_level_t *min_power_level, esp_power_level_t *max_power_level);
+
+/**
+ * @brief  Set BR/EDR default SCO data path
+ *
+ * @note   This function should be called after the Controller is enabled, and before (e)SCO link is established.
+ *
+ * @param[in] data_path SCO data path
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ */
+esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path);
+
+/**
+ * @brief Virtual HCI (VHCI) callback functions to notify the Host on the next operation
+ */
+typedef struct esp_vhci_host_callback {
+    void (*notify_host_send_available)(void);               /*!< Callback to notify the Host that the Controller is ready to receive the packet */
+    int (*notify_host_recv)(uint8_t *data, uint16_t len);   /*!< Callback to notify the Host that the Controller has a packet to send */
+} esp_vhci_host_callback_t;
+
+/**
+ * @brief Check whether the Controller is ready to receive the packet
+ *
+ * If the return value is True, the Host can send the packet to the Controller.
+ *
+ * @note This function should be called before each `esp_vhci_host_send_packet()`.
+ *
+ * @return
+ *       True if the Controller is ready to receive packets; false otherwise
+ */
+bool esp_vhci_host_check_send_available(void);
+
+/**
+ * @brief Send the packet to the Controller
+ *
+ * @note
+ *      1. This function shall not be called within a critical section or when the scheduler is suspended.
+ *      2. This function should be called only if `esp_vhci_host_check_send_available()` returns True.
+ *
+ * @param[in] data Pointer to the packet data
+ * @param[in] len The packet length
+ */
+void esp_vhci_host_send_packet(uint8_t *data, uint16_t len);
+
+/**
+ * @brief Register the VHCI callback funations defined in `esp_vhci_host_callback` structure.
+ *
+ * @param[in] callback `esp_vhci_host_callback` type variable
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
+ */
+esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callback);
+
+/**
+ * @brief Get the Bluetooth module sleep clock source.
+ *
+ * @note This function should be called after `esp_bt_controller_init()`
+ *
+ * @return
+ *      - Clock source used in Bluetooth low power mode
+ */
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void);
+
+/**
+ * @brief Set the Bluetooth module sleep clock source.
+ *
+ * @note This function should be called before `esp_bt_controller_init()`
+ *
+ * @param[in] lpclk Bluetooth sleep clock source
+ *
+ * @return
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid argument
+ */
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/include/esp32/include/esp_bt_vs.h

@@ -0,0 +1,252 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include "sdkconfig.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//
+// @brief HCI VS Commands for Espressif's Bluetooth Host
+//
+// @note The following vendor-specific HCI commands are exclusively for Espressif's Bluetooth Host (Bluedroid Host or NimBLE Host).
+//       If you are using a different host or HCI UART, these commands will not be enabled, unless the init function is called from the application.
+//       Note, these functions as well as these additional vendor-specific HCI commands are intended for Espressif's Bluetooth Host use only.
+//       Application developers should not call the init functions in their applications.
+//
+
+/**
+ * @brief Test vendor HCI feature (OCF: 0x0081)
+ *
+ * The Controller return the value in command
+ *
+ * @note The init function is `bt_stack_enableEchoVsCmd(true)`
+ */
+#define ESP_BT_VS_COMMON_ECHO_OCF                                   (0x0081)
+
+/**
+* @brief echo test cmd parameters
+*/
+struct bt_hci_vs_common_echo {
+    uint8_t echo; /*!< echo data */
+};
+
+/**
+ * @brief Set/Clear coexistence status (OCF: 0x0082)
+ *
+ * @note The init function is `bt_stack_enableCoexVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_COEX_STATUS_OCF                               (0x0082)
+/**
+* @brief Set/Clear coexistence status cmd parameters
+*/
+struct bt_hci_vs_set_coex_status {
+    uint8_t type;  /*!< WIFI, BLE or BT */
+    uint8_t op;    /*!< clear or set status */
+    uint8_t status; /*!< WIFI, BLE or BT status */
+};
+
+/**
+ * @brief Config scanning duplicate exceptional list (OCF: 0x0108)
+ *
+ * @note The init function is `advFilter_stack_enableDupExcListCmd(true)`
+ */
+#define ESP_BT_VS_CONFIG_DUP_EXC_LIST_OCF                           (0x0108)
+/**
+* @brief Update exception list cmd parameters
+*/
+struct bt_hci_vs_update_exc_list {
+    uint8_t subcode;    /*!< Add, remove or clear exception list */
+    uint32_t type;      /*!< device type */
+    uint8_t device_info[6]; /*!< device information */
+};
+
+/**
+ * @brief Enable/disable advertising report flow control (OCF: 0x0109)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_ADV_REPORT_FLOW_CTRL_OCF                      (0x0109)
+
+/**
+* @brief Init ADV flow control cmd parameters
+*/
+struct bt_hci_vs_init_adv_flow_ctrl {
+    uint8_t enable; /*!< Enable ADV flow control */
+    uint16_t num;   /*!< ADV buffer maximum value */
+    uint16_t adv_lost_threshold; /*!< ADV lost event triggered threshold */
+};
+
+/**
+ * @brief Update the number of advertising report flow control (OCF: 0x010A)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_UPD_ADV_REPORT_FLOW_CTRL_NUM_OCF                  (0x010a)
+/**
+* @brief Update ADV flow control cmd parameters
+*/
+struct bt_hci_vs_update_adv_flow_ctrl {
+    uint16_t num; /*!< The number of ADV report processed */
+};
+
+/**
+ * @brief Clear legacy advertising (same as HCI_LE_Clear_Advertising_Sets) (OCF: 0x010C)
+ *
+ * @note The init function is `adv_stack_enableClearLegacyAdvVsCmd(true)`
+ */
+#define ESP_BT_VS_CLR_LEGACY_ADV_OCF                                (0x010c)
+/**
+* @brief Clear legacy ADV cmd parameters
+*/
+struct bt_hci_vs_ble_clr_legacy_adv {
+    // no parameters
+};
+
+/**
+ * @brief Set Classic Bluetooth minimum encryption key size (OCF: 0x0182)
+ *
+ * @note The init function is `bt_stack_enableSecCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_MIN_ENC_KEY_SIZE_OCF                          (0x0182)
+/**
+* @brief Set bt minimum encryption key size cmd parameters
+*/
+struct bt_hci_vs_set_min_enc_key_size {
+    uint8_t size; /*!< the minimum encryption key size */
+};
+
+//
+// @brief HCI VS Events for Espressif's Bluetooth Host
+//
+// @note The following HCI VS events are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these events will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS events are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief BLE advertising report lost event for flow control (EVTCODE: 0x3E, SUBCODE: 0xF0)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_LE_ADV_LOST_EVT_SUBCODE                           (0xF0)
+/**
+* @brief ADV lost event parameters
+*/
+struct bt_hci_vs_le_adv_lost_evt {
+    uint32_t nb_lost; /*!< The number of ADV report discarded */
+};
+
+/**
+ * @brief This event indicates legacy authentication is completed by remote device (EVTCODE: 0xFF, SUBCODE: 0x03)
+ *
+ * @note The init function is `bt_stack_enableSecCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_LEGACY_REM_AUTH_EVT_SUBCODE                       (0x03)
+/**
+* @brief legacy remote auth event parameters
+*/
+struct bt_hci_vs_legacy_rem_auth_evt {
+    uint16_t conhdl; /*!< connection handle */
+};
+
+//
+// @brief HCI VS Commands for Espressif's Internal-Use Debugging
+//
+// @note The following HCI VS debugging commands are implemented in Bluetooth controller pre-compiled libraries.
+//       These commands are not linked into the application binary, unless the specific enabling function is called from the application.
+//       They are intended for Espressif's internal use only. Application developers **should not** call the specific enabling function in their applications.
+//
+
+//
+// @brief OCF for vendor specific BLE internal test command
+//
+// @note The init function is `esp_ble_internalTestFeaturesEnable(true)`
+//
+#define ESP_BT_VS_CFG_TEST_RELATED_OCF                              (0x0113)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_SUBCMD                        (0X00)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_ADV_DELAY_SUBCMD              (0X01)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_FOREVER_SUBCMD              (0X04)
+    #define ESP_BT_VS_CFG_TEST_SET_EXPECTED_PEER_SUBCMD             (0X05)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_TXED_CNT_SUBCMD              (0X06)
+    #define ESP_BT_VS_CFG_TEST_GET_SCAN_RXED_CNT_SUBCMD             (0X07)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_SUBCMD                 (0X08)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_SUBCMD                 (0X09)
+    #define ESP_BT_VS_CFG_TEST_CLEAR_RAND_ADDR_SUBCMD               (0X11)
+    #define ESP_BT_VS_CFG_TEST_GET_MAX_TXPWR_SUBCMD                 (0X12)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_RANGE_SUBCMD               (0X13)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_AA_SUBCMD                   (0X14)
+    #define ESP_BT_VS_CFG_TEST_SET_ADV_AA_SUBCMD                    (0X15)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_CHAN_SUBCMD                 (0X16)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_STATUS_SUBCMD               (0X1a)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_COMPILE_VER_SUBCMD          (0X24)
+    #define ESP_BT_VS_CFG_TEST_RELATED_SUBCMD_MAX                   (0Xff)
+
+/**
+ * @note The init function is `bt_stack_enablePktCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_WR_DM1_ENABLE_OCF                                 (0x0181)
+
+/**
+ * @note The init function is `bt_stack_enableClkCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_CLK_UPDATE_OCF                                    (0x0183)
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_AFH_OCF                                       (0x0187)
+
+/**
+ * @note The init function is `bt_stack_enableBasicVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_EVT_MASK_OCF                                  (0x0188)
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_AFH_REPORTING_MODE_OCF                        (0x0189)
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_MASK_RMT_CHANNEL_CLASSIFICATION_OCF               (0x018a)
+
+/**
+ * @note The init function is `bt_stack_enableRateCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_WR_AUTO_RATE_INIT_OCF                             (0x018b)
+
+//
+// @brief HCI VS Events for Espressif's Internal-Use Debugging
+//
+// @note The following HCI VS debugging events are implemented in Bluetooth controller pre-compiled libraries.
+//       These events are not linked into the application binary, unless the specific enabling function is called from the application.
+//       Application developers **should not** call the specific enabling function in their applications.
+//
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_AFH_CHG_EVT_SUBCODE                               (0x05)
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_CH_CLASSIFICATION_EVT_SUBCODE                     (0x06)
+
+/**
+ * @note The init function is `bt_stack_enableAfhVsCmd(true)`
+ */
+#define ESP_BT_VS_CH_CLASSIFICATION_REPORTING_MODE_EVT_SUBCODE      (0x07)
+
+#ifdef __cplusplus
+}
+#endif

components/bt/include/esp32c2/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -73,26 +73,26 @@ typedef enum {
 } esp_ble_power_type_t;
 
 /**
- * @brief Bluetooth TX power level(index), it's just a index corresponding to power(dbm).
+ * @brief Bluetooth TX power level(index), it's just a index corresponding to power(dBm).
  */
 typedef enum {
-    ESP_PWR_LVL_N24 = 0,              /*!< Corresponding to -24dbm */
-    ESP_PWR_LVL_N21 = 1,              /*!< Corresponding to -21dbm */
-    ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18dbm */
-    ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15dbm */
-    ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12dbm */
-    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to  -9dbm */
-    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to  -6dbm */
-    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to  -3dbm */
-    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to   0dbm */
-    ESP_PWR_LVL_P3  = 9,             /*!< Corresponding to  +3dbm */
-    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to  +6dbm */
-    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to  +9dbm */
-    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to  +12dbm */
-    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to  +15dbm */
-    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to  +18dbm */
-    ESP_PWR_LVL_P20 = 15,              /*!< Corresponding to  +20dbm */
-    ESP_PWR_LVL_P21 = 15,              /*!< Corresponding to  +20dbm, this enum variable has been deprecated */
+    ESP_PWR_LVL_N24 = 0,              /*!< Corresponding to -24 dBm */
+    ESP_PWR_LVL_N21 = 1,              /*!< Corresponding to -21 dBm */
+    ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18 dBm */
+    ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15 dBm */
+    ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12 dBm */
+    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to  -9 dBm */
+    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to  -6 dBm */
+    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to  -3 dBm */
+    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to   0 dBm */
+    ESP_PWR_LVL_P3  = 9,             /*!< Corresponding to  +3 dBm */
+    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to  +6 dBm */
+    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to  +9 dBm */
+    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to  +12 dBm */
+    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to  +15 dBm */
+    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to  +18 dBm */
+    ESP_PWR_LVL_P20 = 15,              /*!< Corresponding to  +20 dBm */
+    ESP_PWR_LVL_P21 = 15,              /*!< Corresponding to  +20 dBm, this enum variable has been deprecated */
     ESP_PWR_LVL_INVALID = 0xFF,         /*!< Indicates an invalid value */
 } esp_power_level_t;
 
@@ -128,7 +128,7 @@ typedef struct {
  * @brief  Set BLE TX power
  *         Connection Tx power should only be set after connection created.
  * @param  power_type : The type of which tx power, could set Advertising/Connection/Default and etc
- * @param  power_level: Power level(index) corresponding to absolute value(dbm)
+ * @param  power_level: Power level(index) corresponding to absolute value(dBm)
  * @return              ESP_OK - success, other - failed
  */
 esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
@@ -146,7 +146,7 @@ esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type);
  *         Connection Tx power should only be set after connection created.
  * @param  power_type : The enhanced type of which tx power, could set Advertising/Connection/Default and etc
  * @param  handle : The handle of Advertising or Connection and the value 0 for other enhanced power types.
- * @param  power_level: Power level(index) corresponding to absolute value(dbm)
+ * @param  power_level: Power level(index) corresponding to absolute value(dBm)
  * @return              ESP_OK - success, other - failed
  */
 esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle, esp_power_level_t power_level);
@@ -167,7 +167,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
  */
 uint8_t esp_ble_get_chip_rev_version(void);
 
-#define CONFIG_VERSION  0x20231124
+#define CONFIG_VERSION  0x20250310
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -227,6 +227,8 @@ typedef struct {
     uint8_t version_num;                        /*!< Version number */
     uint8_t ignore_wl_for_direct_adv;           /*!< Ignore the white list for directed advertising */
     uint8_t csa2_select;                        /*!< Select CSA#2 */
+    uint8_t ble_aa_check;                       /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
+    uint8_t vhci_enabled;                       /*!< VHCI mode is enabled */
     uint32_t config_magic;                      /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
@@ -273,6 +275,8 @@ typedef struct {
     .version_num                = esp_ble_get_chip_rev_version(),                       \
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
+    .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/include/esp32c2/include/esp_bt_vs.h

@@ -0,0 +1,157 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include "sdkconfig.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+// @brief HCI VS Commands for Espressif's Bluetooth Host
+//
+// @note The following vendor-specific HCI commands are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these commands will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS commands are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief Enable/disable advertising report flow control (OCF: 0x0109)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_ADV_REPORT_FLOW_CTRL_OCF                      (0x0109)
+/**
+* @brief Init ADV flow control cmd parameters
+*/
+struct bt_hci_vs_init_adv_flow_ctrl {
+    uint8_t enable; /*!< Enable ADV flow control */
+    uint16_t num;   /*!< ADV buffer maximum value */
+    uint16_t adv_lost_threshold; /*!< ADV lost event triggered threshold */
+};
+
+/**
+ * @brief Update the number of advertising report in ADV flow control (OCF: 0x010A)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_UPD_ADV_REPORT_FLOW_CTRL_NUM_OCF                  (0x010a)
+/**
+* @brief Update ADV flow control cmd parameters
+*/
+struct bt_hci_vs_update_adv_flow_ctrl {
+    uint16_t num; /*!< The number of ADV report processed */
+};
+
+/**
+ * @brief Clear legacy advertising (same as HCI_LE_Clear_Advertising_Sets) (OCF: 0x010C)
+ *
+ * @note The init function is `adv_stack_enableClearLegacyAdvVsCmd(true)`
+ */
+#define ESP_BT_VS_CLR_LEGACY_ADV_OCF                                (0x010c)
+/**
+* @brief Clear legacy ADV cmd parameters
+*/
+struct bt_hci_vs_ble_clr_legacy_adv {
+    // no parameters
+};
+
+/**
+ * @brief Enable/disable channel selection algorithm #2 (OCF: 0x0112)
+ *
+ * @note The init function is `chanSel_stack_enableSetCsaVsCmd(true)`
+ */
+#define ESP_BT_VS_ENABLE_CSA2_OCF                                   (0x0112)
+/**
+* @brief Enable/disable channel selection algorithm #2 cmd parameters
+*/
+struct bt_hci_vs_ble_csa_enable {
+    uint8_t csa2_select;  /*!< Select CSA2 */
+};
+
+// @brief HCI VS Events for Espressif's Bluetooth Host
+//
+// @note The following HCI VS events are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these events will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS events are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief BLE advertising report lost event for flow control (EVTCODE: 0x3E, SUBCODE: 0xF0)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_LE_ADV_LOST_EVT_SUBCODE                           (0xF0)
+/**
+* @brief ADV lost event parameters
+*/
+struct bt_hci_vs_le_adv_lost_evt {
+    uint32_t nb_lost; /*!< The number of ADV report discarded */
+};
+
+//
+// @brief HCI VS Commands for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging commands are implemented in Bluetooth controller pre-compiled libraries.
+//        These commands are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//        They are intended for Espressif's internal use only. Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+#define ESP_BT_VS_CFG_TEST_RELATED_OCF                              (0x0113)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_SUBCMD                        (0X00)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_ADV_DELAY_SUBCMD              (0X01)
+    #define ESP_BT_VS_CFG_TEST_SET_PREF_CODED_SUBCMD                (0X02)
+    #define ESP_BT_VS_CFG_TEST_SET_DEFAULT_PRIV_MODE_SUBCMD         (0X03)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_FOREVER_SUBCMD              (0X04)
+    #define ESP_BT_VS_CFG_TEST_SET_EXPECTED_PEER_SUBCMD             (0X05)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_TXED_CNT_SUBCMD              (0X06)
+    #define ESP_BT_VS_CFG_TEST_GET_SCAN_RXED_CNT_SUBCMD             (0X07)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_SUBCMD                 (0X08)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_SUBCMD                 (0X09)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_ENH_SUBCMD             (0X0a)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_ENH_SUBCMD             (0X0b)
+    #define ESP_BT_VS_CFG_TEST_IGNORE_WL_FOR_DIR_ADV_SUBCMD         (0X0c)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_RXED_RSSI_SUBCMD             (0X0d)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_CCA_SUBCMD                    (0X0e)
+    #define ESP_BT_VS_CFG_TEST_SET_CCA_WIN_SUBCMD                   (0X0f)
+    #define ESP_BT_VS_CFG_TEST_READ_CCA_DATA_SUBCM                  (0X10)
+    #define ESP_BT_VS_CFG_TEST_CLEAR_RAND_ADDR_SUBCMD               (0X11)
+    #define ESP_BT_VS_CFG_TEST_GET_MAX_TXPWR_SUBCMD                 (0X12)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_RANGE_SUBCMD               (0X13)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_AA_SUBCMD                   (0X14)
+    #define ESP_BT_VS_CFG_TEST_SET_ADV_AA_SUBCMD                    (0X15)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_CHAN_SUBCMD                 (0X16)
+    #define ESP_BT_VS_CFG_TEST_SKIP_LIGHT_SLEEP_CHECK_SUBCMD        (0X17)
+    #define ESP_BT_VS_CFG_TEST_SET_WAKEUP_OVERHEAD_SUBCMD           (0X18)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_MIN_ITVL_SUBCMD              (0X19)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_STATUS_SUBCMD               (0X1a)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_RECODE_RX_STATE_SUBCMD        (0X1f)
+    #define ESP_BT_VS_CFG_TEST_GET_RECODE_CNT_SUBCMD                (0X20)
+    #define ESP_BT_VS_CFG_TEST_CLR_RECODE_CNT_SUBCMD                (0X21)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_COMPILE_VER_SUBCMD          (0X24)
+    #define ESP_BT_VS_CFG_TEST_SET_AUX_ADV_OFFSET_SUBCMD            (0X25)
+    #define ESP_BT_VS_CFG_TEST_GET_BACKOFF_UPLIMIT_SUBCMD           (0X2d)
+    #define ESP_BT_VS_CFG_TEST_GET_RXED_ADV_ADI_SUBCMD              (0X2f)
+    #define ESP_BT_VS_CFG_TEST_SET_RX_SENS_THRESH_SUBCMD            (0X31)
+    #define ESP_BT_VS_CFG_TEST_SET_AGC_MAX_GAIN_SUBCMD              (0X39)
+    #define ESP_BT_VS_CFG_TEST_RELATED_SUBCMD_MAX                   (0Xff)
+
+//
+// @brief HCI VS Events for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging events are implemented in Bluetooth controller pre-compiled libraries.
+//    These events are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//    Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+
+#ifdef __cplusplus
+}
+#endif

components/bt/include/esp32c3/include/esp_bt.h

@@ -18,50 +18,76 @@
 extern "C" {
 #endif
 
+/**
+* @brief Internal use only
+*
+* @note Please do not modify this value
+*/
 #define ESP_BT_CTRL_CONFIG_MAGIC_VAL    0x5A5AA5A5
+
+/**
+* @brief Internal use only
+*
+* @note Please do not modify this value
+*/
 #define ESP_BT_CTRL_CONFIG_VERSION      0x02410230
 
+/**
+* @brief Internal use only
+*
+* @note Please do not modify this value
+*/
 #define ESP_BT_HCI_TL_MAGIC_VALUE   0xfadebead
+
+/**
+* @brief Internal use only
+*
+* @note Please do not modify this value
+*/
 #define ESP_BT_HCI_TL_VERSION       0x00010000
 
 /**
- * @brief Bluetooth mode for controller enable/disable
+ * @brief Bluetooth Controller mode
  */
 typedef enum {
-    ESP_BT_MODE_IDLE       = 0x00,   /*!< Bluetooth is not running */
-    ESP_BT_MODE_BLE        = 0x01,   /*!< Run BLE mode */
-    ESP_BT_MODE_CLASSIC_BT = 0x02,   /*!< Run Classic BT mode */
-    ESP_BT_MODE_BTDM       = 0x03,   /*!< Run dual mode */
+    ESP_BT_MODE_IDLE       = 0x00,   /*!< Bluetooth is not operating. */
+    ESP_BT_MODE_BLE        = 0x01,   /*!< Bluetooth is operating in BLE mode. */
+    ESP_BT_MODE_CLASSIC_BT = 0x02,   /*!< Unsupported mode */
+    ESP_BT_MODE_BTDM       = 0x03,   /*!< Unsupported mode */
 } esp_bt_mode_t;
 
 /**
- * @brief Type of controller HCI transport layer
+ * @brief BLE Controller HCI transport layer type
  */
 typedef enum {
     ESP_BT_CTRL_HCI_TL_UART = 0,      /*!< HCI UART h4 transport layer */
-    ESP_BT_CTRL_HCI_TL_VHCI = 1,      /*!< VHCI interface */
+    ESP_BT_CTRL_HCI_TL_VHCI = 1,      /*!< Virtual HCI interface */
 } esp_bt_ctrl_hci_tl_t;
 
 /**
- * @brief type of BLE connection event length computation
+ * @brief BLE connection event length computation type
  */
 typedef enum {
     ESP_BLE_CE_LEN_TYPE_ORIG = 0,      /*!< original */
-    ESP_BLE_CE_LEN_TYPE_CE   = 1,      /*!< use CE_LEN parameter from HCI commands */
+    ESP_BLE_CE_LEN_TYPE_CE   = 1,      /*!< use `CE_LEN` parameter from HCI commands */
     ESP_BLE_CE_LEN_TYPE_SD   = 1,      /*!< Espressif vendor defined */
 } esp_ble_ce_len_t;
 
 /**
- * @brief Bluetooth sleep mode
+ * @brief Bluetooth modem sleep mode
  */
 typedef enum {
-    ESP_BT_SLEEP_MODE_NONE = 0,      /*!< Bluetooth sleep mode disabled */
-    ESP_BT_SLEEP_MODE_1    = 1,      /*!< Bluetooth sleep mode 1 */
+    ESP_BT_SLEEP_MODE_NONE = 0,      /*!< Disable modem sleep */
+    ESP_BT_SLEEP_MODE_1    = 1,      /*!< Enable modem sleep */
 } esp_bt_sleep_mode_t;
 
 /**
- * @brief Bluetooth sleep clock
+ * @brief Bluetooth modem sleep clock source
+ *
+ * @note If the modem sleep mode is enabled, `ESP_BT_SLEEP_CLOCK_MAIN_XTAL` is the default option and
+ *      `ESP_BT_SLEEP_CLOCK_NONE` will become an invalid option.
  */
+
 typedef enum {
     ESP_BT_SLEEP_CLOCK_NONE            = 0,   /*!< Sleep clock not configured */
     ESP_BT_SLEEP_CLOCK_MAIN_XTAL       = 1,   /*!< SoC main crystal */
@@ -71,25 +97,25 @@ typedef enum {
 } esp_bt_sleep_clock_t;
 
 /**
- * @brief antenna index used for bluetooth
+ * @brief Bluetooth antenna index
  */
 enum {
-    ESP_BT_ANT_IDX_0 = 0,               /*!< anntena NO 0 */
-    ESP_BT_ANT_IDX_1 = 1,               /*!< anntena NO 1 */
+    ESP_BT_ANT_IDX_0 = 0,               /*!< Antenna NO 0  */
+    ESP_BT_ANT_IDX_1 = 1,               /*!< Antenna NO 1 */
 };
 
 /**
- * @brief Maximum Tx/Rx time limit on Coded-PHY connection
+ * @brief Enable / disable the maximum TX/RX time limit for Coded-PHY connections in coexistence with Wi-Fi scenarios
  */
 enum {
     ESP_BT_COEX_PHY_CODED_TX_RX_TIME_LIMIT_FORCE_DISABLE = 0,    /*!< Disable the limit */
-    ESP_BT_COEX_PHY_CODED_TX_RX_TIME_LIMIT_FORCE_ENABLE,         /*!< Always Enable the limit */
+    ESP_BT_COEX_PHY_CODED_TX_RX_TIME_LIMIT_FORCE_ENABLE,         /*!< Enable the limit */
 };
 
-#define ESP_BT_HCI_TL_STATUS_OK            (0)   /*!< HCI_TL Tx/Rx operation status OK */
+#define ESP_BT_HCI_TL_STATUS_OK            (0)   /*!< HCI_TL TX/RX operation status OK */
 
 /**
- * @brief callback function for HCI Transport Layer send/receive operations
+ * @brief Callback function for HCI Transport Layer send/receive operations
  */
 typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 
@@ -291,6 +317,12 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 #define BT_CTRL_BLE_SCAN     (1)
 #endif // (BT_CTRL_RUN_IN_FLASH_ONLY == 1)
 
+#ifdef CONFIG_BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED CONFIG_BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#else
+#define BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED 0
+#endif
+
 #define BT_CONTROLLER_INIT_CONFIG_DEFAULT() {                              \
     .magic = ESP_BT_CTRL_CONFIG_MAGIC_VAL,                                 \
     .version = ESP_BT_CTRL_CONFIG_VERSION,                                 \
@@ -336,6 +368,7 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
     .qa_test = BT_CTRL_BLE_TEST,                                           \
     .master_en = BT_CTRL_BLE_MASTER,                                       \
     .scan_en = BT_CTRL_BLE_SCAN,                                           \
+    .ble_aa_check = BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED,     \
 }
 
 #else
@@ -344,7 +377,8 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 
 /**
  * @brief Controller HCI transport layer function structure
- *        This structure shall be registered when HCI transport layer is UART
+ *
+ * @note This structure must be registered when HCI transport layer is UART
  */
 typedef struct {
     uint32_t _magic;                        /*!< Magic number */
@@ -360,379 +394,514 @@ typedef struct {
 } esp_bt_hci_tl_t;
 
 /**
- * @brief Controller config options, depend on config mask.
- *        Config mask indicate which functions enabled, this means
- *        some options or parameters of some functions enabled by config mask.
+ * @brief Bluetooth Controller config options
+ * @note
+ *      1. For parameters configurable through menuconfig, it is recommended to adjust them via the menuconfig interface. Please refer to menuconfig for details on the range and default values.
+ *      2. It is not recommended to modify the values for parameters which are not configurable through menuconfig.
  */
 typedef struct {
-    /*
-     * Following parameters can not be configured runtime when call esp_bt_controller_init()
-     * They will be overwritten by constant values from menuconfig options or from macros.
-     * So, do not modify the value when esp_bt_controller_init()
-     */
     uint32_t magic;                         /*!< Magic number */
     uint32_t version;                       /*!< version number of the defined structure */
-    /*
-     * Following parameters can be configured runtime, when call esp_bt_controller_init()
-     */
-    uint16_t controller_task_stack_size;    /*!< Bluetooth controller task stack size */
-    uint8_t controller_task_prio;           /*!< Bluetooth controller task priority */
-    uint8_t controller_task_run_cpu;        /*!< CPU num that Bluetooth controller task runs on */
-    uint8_t bluetooth_mode;                 /*!< Controller mode: BR/EDR, BLE or Dual Mode */
-    uint8_t ble_max_act;                    /*!< BLE maximum number of air activities */
-    uint8_t sleep_mode;                     /*!< controller sleep mode */
-    uint8_t sleep_clock;                    /*!< controller sleep clock */
-    uint8_t ble_st_acl_tx_buf_nb;           /*!< controller static ACL TX BUFFER number */
-    uint8_t ble_hw_cca_check;               /*!< controller hardware triggered CCA check */
-    uint16_t ble_adv_dup_filt_max;          /*!< maximum number of duplicate scan filter */
-    bool coex_param_en;                     /*!< deprecated */
-    uint8_t ce_len_type;                    /*!< connection event length computation method */
-    bool coex_use_hooks;                    /*!< deprecated */
-    uint8_t hci_tl_type;                    /*!< HCI transport layer, UART, VHCI, etc */
-    esp_bt_hci_tl_t *hci_tl_funcs;          /*!< hci transport functions used, must be set when hci_tl_type is UART */
-    uint8_t txant_dft;                      /*!< default Tx antenna */
-    uint8_t rxant_dft;                      /*!< default Rx antenna */
-    uint8_t txpwr_dft;                      /*!< default Tx power */
+    uint16_t controller_task_stack_size;    /*!< Bluetooth Controller task stack size in bytes */
+    uint8_t controller_task_prio;           /*!< Bluetooth Controller task priority */
+    uint8_t controller_task_run_cpu;        /*!< CPU number that Bluetooth Controller task runs on. Configurable in menuconfig.
+                                                - 0 - CPU 0 (default)
+                                                - 1 - CPU 1 */
+    uint8_t bluetooth_mode;                 /*!< BLE mode */
+    uint8_t ble_max_act;                    /*!< The maximum number of BLE instance. Configurable in menuconfig.
+                                                - Range: 1 - 10
+                                                - Default: 6 */
+    uint8_t sleep_mode;                     /*!< Modem sleep mode. Configurable in menuconfig.
+                                                - 0 - Disable (default)
+                                                - 1 - Enable */
+    uint8_t sleep_clock;                    /*!< Modem sleep clock source. Configurable in menuconfig. */
+    uint8_t ble_st_acl_tx_buf_nb;           /*!< Static ACL TX buffer numbers. Configurable in menuconfig.
+                                                - Range: 0 - 12
+                                                - Default: 0 */
+    uint8_t ble_hw_cca_check;               /*!< Deprecated */
+    uint16_t ble_adv_dup_filt_max;          /*!< The maximum number of extended duplicate scan filter. Configurable in menuconfig.
+                                                - Range: 1 - 500
+                                                - Default: 30 */
+    bool coex_param_en;                     /*!< Deprecated */
+    uint8_t ce_len_type;                    /*!< Connection event length determination method. Configurable in menuconfig.
+                                                - 0 - Original (default)
+                                                - 1 - use `CE_LEN` parameter from HCI commands
+                                                - 2 - Espressif vendor defined method */
+    bool coex_use_hooks;                    /*!< Deprecated */
+    uint8_t hci_tl_type;                    /*!< HCI transport layer type. Configurable in menuconfig.
+                                                - 0 - URAT
+                                                - 1 - Virtual HCI (default) */
+    esp_bt_hci_tl_t *hci_tl_funcs;          /*!< HCI transport functions used. It must be set when `hci_tl_type` is UART. */
+    uint8_t txant_dft;                      /*!< Default TX antenna. Configurable in menuconfig.
+                                                - 0 - Antenna 0 (default)
+                                                - 1 - Antenna 1 */
+    uint8_t rxant_dft;                      /*!< Default RX antenna. Configurable in menuconfig.
+                                                - 0 - Antenna 0 (default)
+                                                - 1 - Antenna 1 */
+    uint8_t txpwr_dft;                      /*!< Default TX power. Please refer to `esp_power_level_t` for supported power level. Configurable in menuconfig.
+                                                - Default : `ESP_PWR_LVL_P9` +9 dBm. */
     uint32_t cfg_mask;                      /*!< Configuration mask to set specific options */
-    uint8_t scan_duplicate_mode;            /*!< scan duplicate mode */
-    uint8_t scan_duplicate_type;            /*!< scan duplicate type */
-    uint16_t normal_adv_size;               /*!< Normal adv size for scan duplicate */
-    uint16_t mesh_adv_size;                 /*!< Mesh adv size for scan duplicate */
-    uint8_t coex_phy_coded_tx_rx_time_limit;  /*!< limit on max tx/rx time in case of connection using CODED-PHY with Wi-Fi coexistence */
-    uint32_t hw_target_code;                /*!< hardware target */
-    uint8_t slave_ce_len_min;               /*!< slave minimum ce length*/
-    uint8_t hw_recorrect_en;                /*!< Hardware re-correction enabled */
-    uint8_t cca_thresh;                     /*!< cca threshold*/
-    uint16_t scan_backoff_upperlimitmax;    /*!< scan backoff upperlimitmax value */
-    uint16_t dup_list_refresh_period;       /*!< duplicate scan list refresh time */
-    bool ble_50_feat_supp;                  /*!< BLE 5.0 feature support */
-    uint8_t ble_cca_mode;                   /*!< BLE CCA mode */
-    uint8_t ble_data_lenth_zero_aux;        /*!< Config ext adv aux option */
-    uint8_t ble_chan_ass_en;                /*!< BLE channel assessment enable */
-    uint8_t ble_ping_en;                    /*!< BLE ping procedure enable */
-    uint8_t ble_llcp_disc_flag;             /*!< BLE disconnect flag when instant passed */
-    bool run_in_flash;                      /*!< Check if controller code is in flash */
-    bool dtm_en;                            /*!< Controller DTM feature is enabled or not */
-    bool enc_en;                            /*!< Controller encryption feature is enabled or not */
-    bool qa_test;                           /*!< Controller QA test feature is enabled or not */
-    bool master_en;                         /*!< Controller master feature is enabled or not */
-    bool scan_en;                           /*!< Controller scan feature is enabled or not */
+    uint8_t scan_duplicate_mode;            /*!< Scan duplicate filtering mode. Configurable in menuconfig.
+                                                - 0 - Normal scan duplicate filtering mode (default)
+                                                - 1 - Special scan duplicate filtering mode for BLE Mesh */
+    uint8_t scan_duplicate_type;            /*!< Scan duplicate filtering type. If `scan_duplicate_mode` is set to 1, this parameter will be ignored. Configurable in menuconfig.
+                                                - 0 - Filter scan duplicates by device address only (default)
+                                                - 1 - Filter scan duplicates by advertising data only, even if they originate from different devices.
+                                                - 2 - Filter scan duplicated by device address and advertising data. */
+    uint16_t normal_adv_size;               /*!< Maximum number of devices in scan duplicate filtering list. Configurable in menuconfig.
+                                                - Range: 10 - 1000
+                                                - Default: 100 */
+    uint16_t mesh_adv_size;                 /*!< Maximum number of Mesh advertising packets in scan duplicate filtering list. Configurable in menuconfig.
+                                                - Range: 10 - 1000
+                                                - Default: 100 */
+    uint8_t coex_phy_coded_tx_rx_time_limit;  /*!< Enable / disable the maximum TX/RX time limit for Coded-PHY connections in coexistence with Wi-Fi scenarios. Configurable in menuconfig.
+                                                - 0 - Disable (default)
+                                                - 1 - Enable */
+    uint32_t hw_target_code;                /*!< Hardware target. Internal use only. Please do not modify this value. */
+    uint8_t slave_ce_len_min;               /*!< Slave minimum connection event length: 5. Please do not modify this value. */
+    uint8_t hw_recorrect_en;                /*!< Enable / disable uncoded phy / coded phy hardware re-correction. Configurable in menuconfig. */
+    uint8_t cca_thresh;                     /*!< Hardware-triggered CCA threshold. Configurable in menuconfig.
+                                                - Range: 20 - 100
+                                                - Default: 20 */
+    uint16_t scan_backoff_upperlimitmax;    /*!< Enable / disable active scan backoff. Configurable in menuconfig.
+                                                - 0 - Disable (default)
+                                                - 1 - Enable */
+    uint16_t dup_list_refresh_period;       /*!< Scan duplicate filtering list refresh period in seconds.  Configurable in menuconfig
+                                                - Range: 0 - 100 seconds
+                                                - Default: 0 second */
+    bool ble_50_feat_supp;                  /*!< True if BLE 5.0 features are enabled; false otherwise. This option depends on whether the Host enable the 5.0 features. */
+    uint8_t ble_cca_mode;                   /*!< BLE CCA mode. Configurable in menuconfig
+                                                - 0 - Disable (default)
+                                                - 1 - Hardware-triggered CCA
+                                                - 2 - Software-based CCA */
+    uint8_t ble_data_lenth_zero_aux;        /*!< Enable / disable AUX packets when the extended ADV data length is zero. Configurable in menuconfig.
+                                                - 0 - Disable (default)
+                                                - 1 - Enable */
+    uint8_t ble_chan_ass_en;                /*!< Enable / disable BLE channel assessment. Configurable in menuconfig.
+                                                - 0 - Disable
+                                                - 1 - Enable (default) */
+    uint8_t ble_ping_en;                    /*!< Enable / disable BLE ping procedure. Configurable in menuconfig.
+                                                - 0 - Disable
+                                                - 1 - Enable (default) */
+    uint8_t ble_llcp_disc_flag;             /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    bool run_in_flash;                      /*!< True if the Controller code is in flash (flash model); false otherwise (default). Configurable in menuconfig. */
+    bool dtm_en;                            /*!< In the flash mode, True if the DTM feature is enabled; false otherwise (default). Configurable in menuconfig. */
+    bool enc_en;                            /*!< In the flash mode, True if the encryption feature is enabled (default); false otherwise. Configurable in menuconfig. */
+    bool qa_test;                           /*!< In the flash mode, True if the QA test feature is enabled; false otherwise (default). Configurable in menuconfig.*/
+    bool master_en;                         /*!< In the flash mode, True if the master feature is enabled (default); false otherwise. Configurable in menuconfig.*/
+    bool scan_en;                           /*!< In the flash mode, True if the scan feature is enabled (default); false otherwise. Configurable in menuconfig.*/
+    bool ble_aa_check;                      /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
 } esp_bt_controller_config_t;
 
 /**
- * @brief Bluetooth controller enable/disable/initialised/de-initialised status
+ * @brief Bluetooth Controller status
  */
 typedef enum {
-    ESP_BT_CONTROLLER_STATUS_IDLE = 0,
-    ESP_BT_CONTROLLER_STATUS_INITED,
-    ESP_BT_CONTROLLER_STATUS_ENABLED,
-    ESP_BT_CONTROLLER_STATUS_NUM,
+    ESP_BT_CONTROLLER_STATUS_IDLE = 0,  /*!< The Controller is not initialized or has been de-initialized. */
+    ESP_BT_CONTROLLER_STATUS_INITED,    /*!< The Controller has been initialized, but not enabled or has been disabled. */
+    ESP_BT_CONTROLLER_STATUS_ENABLED,   /*!< The Controller has been initialized and enabled. */
+    ESP_BT_CONTROLLER_STATUS_NUM,       /*!< Number of Controller statuses */
 } esp_bt_controller_status_t;
 
 /**
- * @brief BLE tx power type
- *        ESP_BLE_PWR_TYPE_CONN_HDL0-8: for each connection, and only be set after connection completed.
- *                                      when disconnect, the correspond TX power is not effected.
- *        ESP_BLE_PWR_TYPE_ADV : for advertising/scan response.
- *        ESP_BLE_PWR_TYPE_SCAN : for scan.
- *        ESP_BLE_PWR_TYPE_DEFAULT : if each connection's TX power is not set, it will use this default value.
- *                                   if neither in scan mode nor in adv mode, it will use this default value.
- *        If none of power type is set, system will use ESP_PWR_LVL_P3 as default for ADV/SCAN/CONN0-9.
+ * @brief BLE TX power type
+ *
+ * This TX power type is used for the API `esp_ble_tx_power_set()` and `esp_ble_tx_power_get()`.
+ *
+ * @note
+ *       1. The connection TX power can only be set after the connection is established.
+ *           After disconnecting, the corresponding TX power will not be affected.
+ *       2. `ESP_BLE_PWR_TYPE_DEFAULT` can be used to set the TX power for power types that have not been set before.
+ *          It will not affect the TX power values which have been set for the ADV/SCAN/CONN0-8 power types.
+ *       3. If none of power type is set, the system will use `ESP_PWR_LVL_P3` as default for all power types.
  */
 typedef enum {
-    ESP_BLE_PWR_TYPE_CONN_HDL0  = 0,            /*!< For connection handle 0 */
-    ESP_BLE_PWR_TYPE_CONN_HDL1  = 1,            /*!< For connection handle 1 */
-    ESP_BLE_PWR_TYPE_CONN_HDL2  = 2,            /*!< For connection handle 2 */
-    ESP_BLE_PWR_TYPE_CONN_HDL3  = 3,            /*!< For connection handle 3 */
-    ESP_BLE_PWR_TYPE_CONN_HDL4  = 4,            /*!< For connection handle 4 */
-    ESP_BLE_PWR_TYPE_CONN_HDL5  = 5,            /*!< For connection handle 5 */
-    ESP_BLE_PWR_TYPE_CONN_HDL6  = 6,            /*!< For connection handle 6 */
-    ESP_BLE_PWR_TYPE_CONN_HDL7  = 7,            /*!< For connection handle 7 */
-    ESP_BLE_PWR_TYPE_CONN_HDL8  = 8,            /*!< For connection handle 8 */
-    ESP_BLE_PWR_TYPE_ADV        = 9,            /*!< For advertising */
-    ESP_BLE_PWR_TYPE_SCAN       = 10,           /*!< For scan */
-    ESP_BLE_PWR_TYPE_DEFAULT    = 11,           /*!< For default, if not set other, it will use default value */
-    ESP_BLE_PWR_TYPE_NUM        = 12,           /*!< TYPE numbers */
+    ESP_BLE_PWR_TYPE_CONN_HDL0  = 0,            /*!< TX power for Connection state handle 0 */
+    ESP_BLE_PWR_TYPE_CONN_HDL1  = 1,            /*!< TX power for Connection state handle 1 */
+    ESP_BLE_PWR_TYPE_CONN_HDL2  = 2,            /*!< TX power for Connection state handle 2 */
+    ESP_BLE_PWR_TYPE_CONN_HDL3  = 3,            /*!< TX power for Connection state handle 3 */
+    ESP_BLE_PWR_TYPE_CONN_HDL4  = 4,            /*!< TX power for Connection state handle 4 */
+    ESP_BLE_PWR_TYPE_CONN_HDL5  = 5,            /*!< TX power for Connection state handle 5 */
+    ESP_BLE_PWR_TYPE_CONN_HDL6  = 6,            /*!< TX power for Connection state handle 6 */
+    ESP_BLE_PWR_TYPE_CONN_HDL7  = 7,            /*!< TX power for Connection state handle 7 */
+    ESP_BLE_PWR_TYPE_CONN_HDL8  = 8,            /*!< TX power for Connection state handle 8 */
+    ESP_BLE_PWR_TYPE_ADV        = 9,            /*!< TX power for Advertising state*/
+    ESP_BLE_PWR_TYPE_SCAN       = 10,           /*!< TX power for Scanning state */
+    ESP_BLE_PWR_TYPE_DEFAULT    = 11,           /*!< TX power for states that have not been set before */
+    ESP_BLE_PWR_TYPE_NUM        = 12,           /*!< Reserved  */
 } esp_ble_power_type_t;
 
 /**
- * @brief Bluetooth TX power level(index), it's just a index corresponding to power(dbm).
+ * @brief The enhanced type of which TX power, could set Advertising/Connection/Default and etc.
+ *
+ * This TX power type is used for the API `esp_ble_tx_power_set_enhanced()` and `esp_ble_tx_power_get_enhanced()`.
+ *
+ * @note
+ *       1. The connection TX power can only be set after the connection is established.
+ *           After disconnecting, the corresponding TX power will not be affected.
+ *       2. `ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT` can be used to set the TX power for power types that have not been set before.
+ *          It will not affect the TX power values which have been set for the ADV/SCAN/INIT/CONN power types.
+ *       3. If none of power type is set, the system will use `ESP_PWR_LVL_P3` as default for all power types.
  */
 typedef enum {
-    ESP_PWR_LVL_N24 = 0,              /*!< Corresponding to -24dbm */
-    ESP_PWR_LVL_N21 = 1,              /*!< Corresponding to -21dbm */
-    ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18dbm */
-    ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15dbm */
-    ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12dbm */
-    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to -9dbm */
-    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to -6dbm */
-    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to -3dbm */
-    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to 0dbm */
-    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to +3dbm */
-    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to +6dbm */
-    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to +9dbm */
-    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to +12dbm */
-    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to +15dbm */
-    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to +18dbm */
-    ESP_PWR_LVL_P20 = 15,             /*!< Corresponding to +20dbm */
-    ESP_PWR_LVL_P21 = 15,             /*!< Corresponding to +20dbm, this enum variable has been deprecated */
-    ESP_PWR_LVL_INVALID = 0xFF,         /*!< Indicates an invalid value */
-} esp_power_level_t;
-
-/**
- * @brief The enhanced type of which tx power, could set Advertising/Connection/Default and etc.
- */
-typedef enum {
-    ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT = 0,
-    ESP_BLE_ENHANCED_PWR_TYPE_ADV,
-    ESP_BLE_ENHANCED_PWR_TYPE_SCAN,
-    ESP_BLE_ENHANCED_PWR_TYPE_INIT,
-    ESP_BLE_ENHANCED_PWR_TYPE_CONN,
-    ESP_BLE_ENHANCED_PWR_TYPE_MAX,
+    ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT = 0,   /*!< TX power for states that have not been set before */
+    ESP_BLE_ENHANCED_PWR_TYPE_ADV,           /*!< TX power for Advertising state */
+    ESP_BLE_ENHANCED_PWR_TYPE_SCAN,          /*!< TX power for Scanning state */
+    ESP_BLE_ENHANCED_PWR_TYPE_INIT,          /*!< TX power for Initiating state */
+    ESP_BLE_ENHANCED_PWR_TYPE_CONN,          /*!< TX power for Connection state */
+    ESP_BLE_ENHANCED_PWR_TYPE_MAX,           /*!< Reserved */
 } esp_ble_enhanced_power_type_t;
 
 /**
- * @brief  Set BLE TX power
- *         Connection Tx power should only be set after connection created.
- * @param  power_type : The type of which tx power, could set Advertising/Connection/Default and etc
- * @param  power_level: Power level(index) corresponding to absolute value(dbm)
- * @return              ESP_OK - success, other - failed
+ * @brief Bluetooth TX power level (index). Each index corresponds to a specific power value in dBm.
  */
-esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
+typedef enum {
+    ESP_PWR_LVL_N24 = 0,              /*!< Corresponding to -24 dBm */
+    ESP_PWR_LVL_N21 = 1,              /*!< Corresponding to -21 dBm */
+    ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18 dBm */
+    ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15 dBm */
+    ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12 dBm */
+    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to -9 dBm */
+    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to -6 dBm */
+    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to -3 dBm */
+    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to 0 dBm */
+    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to +3 dBm */
+    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to +6 dBm */
+    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to +9 dBm */
+    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to +12 dBm */
+    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to +15 dBm */
+    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to +18 dBm */
+    ESP_PWR_LVL_P20 = 15,             /*!< Corresponding to +20 dBm */
+    ESP_PWR_LVL_P21 = 15,             /*!< Deprecated */
+    ESP_PWR_LVL_INVALID = 0xFF,       /*!< Indicates an invalid value */
+} esp_power_level_t;
 
 /**
- * @brief  Get BLE TX power
- *         Connection Tx power should only be get after connection created.
- * @param  power_type : The type of which tx power, could set Advertising/Connection/Default and etc
- * @return             >= 0 - Power level, < 0 - Invalid
- */
-esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type);
-
-/**
- * @brief  ENHANCED API for Setting BLE TX power
- *         Connection Tx power should only be set after connection created.
- * @param  power_type : The enhanced type of which tx power, could set Advertising/Connection/Default and etc.
- * @param  handle : The handle of Advertising or Connection and the value 0 for other enhanced power types.
- * @param  power_level: Power level(index) corresponding to absolute value(dbm)
- * @return              ESP_OK - success, other - failed
- */
-esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle, esp_power_level_t power_level);
-
-/**
- * @brief  ENHANCED API of Getting BLE TX power
- *         Connection Tx power should only be get after connection created.
- * @param  power_type : The enhanced type of which tx power, could set Advertising/Connection/Default and etc
- * @param  handle : The handle of Advertising or Connection and the value 0 for other enhanced power types.
- * @return             >= 0 - Power level, < 0 - Invalid
- */
-esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
-
-/**
- * @brief       Initialize BT controller to allocate task and other resource.
- *              This function should be called only once, before any other BT functions are called.
- * @param  cfg: Initial configuration of BT controller. Different from previous version, there's a mode and some
- *              connection configuration in "cfg" to configure controller work mode and allocate the resource which is needed.
- * @return      ESP_OK - success, other - failed
+ * @brief       Initialize the Bluetooth Controller to allocate tasks and other resources
+ *
+ * @note        This function should be called only once, before any other Bluetooth functions.
+ *
+ * @param[in]  cfg Initial Bluetooth Controller configuration
+ *
+ * @return
+ *        - ESP_OK: Success
+ *        - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *        - ESP_ERR_NOT_SUPPORTED: Invalid Bluetooth Controller mode
+ *        - ESP_ERR_INVALID_ARG: Invalid arguments
+ *        - ESP_ERR_NO_MEM: Out of memory
+ *        - ESP_FAIL: Failure due to other reasons
+ *
  */
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg);
 
 /**
- * @brief  De-initialize BT controller to free resource and delete task.
- *         You should stop advertising and scanning, as well as
- *         disconnect all existing connections before de-initializing BT controller.
+ * @brief  De-initialize Bluetooth Controller to free resources and delete tasks
  *
- * This function should be called only once, after any other BT functions are called.
- * This function is not whole completed, esp_bt_controller_init cannot called after this function.
- * @return  ESP_OK - success, other - failed
+ * @note
+ *      1. You should stop advertising and scanning, and disconnect all existing connections before de-initializing Bluetooth Controller.
+ *      2. This function should be called only once, after any other Bluetooth functions.
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_ERR_INVALID_ARG: Invalid arguments
+ *      - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *      - ESP_ERR_NO_MEM: Out of memory
  */
 esp_err_t esp_bt_controller_deinit(void);
 
 /**
- * @brief Enable BT controller.
- *               Due to a known issue, you cannot call esp_bt_controller_enable() a second time
- *               to change the controller mode dynamically. To change controller mode, call
- *               esp_bt_controller_disable() and then call esp_bt_controller_enable() with the new mode.
- * @param mode : the mode(BLE/BT/BTDM) to enable. For compatible of API, retain this argument. This mode must be
- *               equal as the mode in "cfg" of esp_bt_controller_init().
- * @return       ESP_OK - success, other - failed
+ * @brief Enable Bluetooth Controller
+ *
+ * @note
+ *       1. Bluetooth Controller cannot be enabled in `ESP_BT_CONTROLLER_STATUS_IDLE` status. It has to be initialized first.
+ *       2. Due to a known issue, you cannot call `esp_bt_controller_enable()` for the second time
+ *       to change the Controller mode dynamically. To change the Controller mode, call
+ *       `esp_bt_controller_disable()` and then call `esp_bt_controller_enable()` with the new mode.
+ *
+ * @param[in] mode The Bluetooth Controller mode to enable
+ *
+ * For API compatibility, retain this argument. This mode must match the mode specified in the `cfg` of `esp_bt_controller_init()`.
+ *
+ * @return
+ *          - ESP_OK: Success
+ *          - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *          - ESP_ERR_INVALID_ARG: Invalid arguments
  */
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode);
 
 /**
- * @brief  Disable BT controller
- * @return       ESP_OK - success, other - failed
+ * @brief  Disable Bluetooth Controller
+ *
+ * @return
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
  */
 esp_err_t esp_bt_controller_disable(void);
 
 /**
- * @brief  Get BT controller is initialised/de-initialised/enabled/disabled
- * @return status value
+ * @brief  Get Bluetooth Controller status
+ *
+ * @return
+ *      - ESP_BT_CONTROLLER_STATUS_IDLE:    The Controller is not initialized or has been de-initialized.
+ *      - ESP_BT_CONTROLLER_STATUS_INITED:  The Controller has been initialized, but not enabled or has been disabled.
+ *      - ESP_BT_CONTROLLER_STATUS_ENABLED: The Controller has been initialized and enabled.
  */
 esp_bt_controller_status_t esp_bt_controller_get_status(void);
 
-/** @brief esp_vhci_host_callback
- *  used for vhci call host function to notify what host need to do
- */
-typedef struct esp_vhci_host_callback {
-    void (*notify_host_send_available)(void);               /*!< callback used to notify that the host can send packet to controller */
-    int (*notify_host_recv)(uint8_t *data, uint16_t len);   /*!< callback used to notify that the controller has a packet to send to the host*/
-} esp_vhci_host_callback_t;
-
-/** @brief esp_vhci_host_check_send_available
- *  used for check actively if the host can send packet to controller or not.
- *  @return true for ready to send, false means cannot send packet
- */
-bool esp_vhci_host_check_send_available(void);
-
-/** @brief esp_vhci_host_send_packet
- * host send packet to controller
+/**
+ * @brief Release the Controller memory as per the mode
  *
- * Should not call this function from within a critical section
- * or when the scheduler is suspended.
+ * This function releases the BSS, data and other sections of the Controller to heap. The total size is about 70 KB.
  *
- * @param data the packet point
- * @param len the packet length
- */
-void esp_vhci_host_send_packet(uint8_t *data, uint16_t len);
-
-/** @brief esp_vhci_host_register_callback
- * register the vhci reference callback
- * struct defined by vhci_host_callback structure.
- * @param callback esp_vhci_host_callback type variable
- * @return ESP_OK - success, ESP_FAIL - failed
- */
-esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callback);
-
-/** @brief esp_bt_controller_mem_release
- * release the controller memory as per the mode
+ * @note
+ *    1. This function is optional and should be called only if you want to free up memory for other components.
+ *    2. This function should only be called when the Controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
+ *    3. Once Bluetooth Controller memory is released, the process cannot be reversed. This means you cannot use the Bluetooth Controller mode that you have released using this function.
+ *    4. If your firmware will upgrade the Bluetooth Controller mode later (such as from disabled to enabled), then do not call this function.
  *
- * This function releases the BSS, data and other sections of the controller to heap. The total size is about 70k bytes.
+ * If you never intend to use Bluetooth in a current boot-up cycle, calling `esp_bt_controller_mem_release(ESP_BT_MODE_BLE)` could release the BSS and data consumed by BLE Controller to heap.
  *
- * esp_bt_controller_mem_release(mode) should be called only before esp_bt_controller_init()
- * or after esp_bt_controller_deinit().
  *
- * Note that once BT controller memory is released, the process cannot be reversed. It means you cannot use the bluetooth
- * mode which you have released by this function.
+ * @param[in] mode The Bluetooth Controller mode
  *
- * If your firmware will later upgrade the Bluetooth controller mode (BLE -> BT Classic or disabled -> enabled)
- * then do not call this function.
- *
- * If the app calls esp_bt_controller_enable(ESP_BT_MODE_BLE) to use BLE only then it is safe to call
- * esp_bt_controller_mem_release(ESP_BT_MODE_CLASSIC_BT) at initialization time to free unused BT Classic memory.
- *
- * If the mode is ESP_BT_MODE_BTDM, then it may be useful to call API esp_bt_mem_release(ESP_BT_MODE_BTDM) instead,
- * which internally calls esp_bt_controller_mem_release(ESP_BT_MODE_BTDM) and additionally releases the BSS and data
- * consumed by the BT/BLE host stack to heap. For more details about usage please refer to the documentation of
- * esp_bt_mem_release() function
- *
- * @param mode : the mode want to release memory
- * @return ESP_OK - success, other - failed
+ * @return
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *       - ESP_ERR_NOT_FOUND: Requested resource not found
  */
 esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode);
 
-/** @brief esp_bt_mem_release
- * release controller memory and BSS and data section of the BT/BLE host stack as per the mode
+/** @brief Release the Controller memory, BSS and data section of the BLE Host stack as per the mode
  *
- * This function first releases controller memory by internally calling esp_bt_controller_mem_release().
- * Additionally, if the mode is set to ESP_BT_MODE_BTDM, it also releases the BSS and data consumed by the BT/BLE host stack to heap
+ * @note
+ *    1. This function is optional and should be called only if you want to free up memory for other components.
+ *    2. This function should only be called when the Controller is in `ESP_BT_CONTROLLER_STATUS_IDLE` status.
+ *    3. Once Bluetooth Controller memory is released, the process cannot be reversed. This means you cannot use the Bluetooth Controller mode that you have released using this function.
+ *    4. If your firmware will upgrade the Bluetooth Controller mode later (such as from disabled to enabled), then do not call this function.
  *
- * Note that once BT memory is released, the process cannot be reversed. It means you cannot use the bluetooth
- * mode which you have released by this function.
+ * This function first releases Controller memory by internally calling `esp_bt_controller_mem_release()`, then releases Host memory.
  *
- * If your firmware will later upgrade the Bluetooth controller mode (BLE -> BT Classic or disabled -> enabled)
- * then do not call this function.
+ * If you never intend to use Bluetooth in a current boot-up cycle, calling `esp_bt_mem_release(ESP_BT_MODE_BLE)` could release the BSS and data consumed by BLE stack to heap.
  *
- * If you never intend to use bluetooth in a current boot-up cycle, you can call esp_bt_mem_release(ESP_BT_MODE_BTDM)
- * before esp_bt_controller_init or after esp_bt_controller_deinit.
- *
- * For example, if a user only uses bluetooth for setting the WiFi configuration, and does not use bluetooth in the rest of the product operation".
- * In such cases, after receiving the WiFi configuration, you can disable/deinit bluetooth and release its memory.
+ * For example, if you only use Bluetooth for setting the Wi-Fi configuration, and do not use Bluetooth in the rest of the product operation,
+ *  after receiving the Wi-Fi configuration, you can disable/de-init Bluetooth and release its memory.
  * Below is the sequence of APIs to be called for such scenarios:
  *
- *      esp_bluedroid_disable();
- *      esp_bluedroid_deinit();
- *      esp_bt_controller_disable();
- *      esp_bt_controller_deinit();
- *      esp_bt_mem_release(ESP_BT_MODE_BTDM);
+ *       esp_bluedroid_disable();
+ *       esp_bluedroid_deinit();
+ *       esp_bt_controller_disable();
+ *       esp_bt_controller_deinit();
+ *       esp_bt_mem_release(ESP_BT_MODE_BLE);
  *
- * @param mode : the mode whose memory is to be released
- * @return ESP_OK - success, other - failed
+ * @param[in] mode The Bluetooth Controller mode
+ *
+ * @return
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *       - ESP_ERR_NOT_FOUND: Requested resource not found
  */
 esp_err_t esp_bt_mem_release(esp_bt_mode_t mode);
 
 /**
- * @brief enable bluetooth to enter modem sleep
+ * @brief Enable Bluetooth modem sleep
  *
- * Note that this function shall not be invoked before esp_bt_controller_enable()
+ * There are currently two options for Bluetooth modem sleep: ORIG mode and EVED mode. The latter is intended for BLE only.
+ * The modem sleep mode could be configured in menuconfig.
  *
- * There are currently two options for bluetooth modem sleep, one is ORIG mode, and another is EVED Mode. EVED Mode is intended for BLE only.
+ * In ORIG mode, if there is no event to process, the Bluetooth Controller will periodically switch off some components and pause operation, then wake up according to the scheduled interval and resume work.
+ * It can also wakeup earlier upon external request using function `esp_bt_controller_wakeup_request()`.
  *
- * For ORIG mode:
- * Bluetooth modem sleep is enabled in controller start up by default if CONFIG_BTDM_CONTROLLER_MODEM_SLEEP is set and "ORIG mode" is selected. In ORIG modem sleep mode, bluetooth controller will switch off some components and pause to work every now and then, if there is no event to process; and wakeup according to the scheduled interval and resume the work. It can also wakeup earlier upon external request using function "esp_bt_controller_wakeup_request".
+ * @note  This function shall not be invoked before `esp_bt_controller_enable()`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *       - ESP_ERR_NOT_SUPPORTED: Operation or feature not supported
  */
 esp_err_t esp_bt_sleep_enable(void);
 
-
 /**
- * @brief disable bluetooth modem sleep
+ * @brief Disable Bluetooth modem sleep
  *
- * Note that this function shall not be invoked before esp_bt_controller_enable()
- *
- * If esp_bt_sleep_disable() is called, bluetooth controller will not be allowed to enter modem sleep;
- *
- * If ORIG modem sleep mode is in use, if this function is called, bluetooth controller may not immediately wake up if it is dormant then.
- * In this case, esp_bt_controller_wakeup_request() can be used to shorten the time for wakeup.
+ * @note
+ *      1. Bluetooth Controller will not be allowed to enter modem sleep after calling this function.
+ *      2. In ORIG modem sleep mode, calling this function may not immediately wake up the Controller if it is currently dormant.
+ *         In this case, `esp_bt_controller_wakeup_request()` can be used to shorten the wake-up time.
+ *      3. This function shall not be invoked before `esp_bt_controller_enable()`.
  *
  * @return
- *                  - ESP_OK : success
- *                  - other  : failed
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_STATE: Invalid Bluetooth Controller state
+ *       - ESP_ERR_NOT_SUPPORTED: Operation or feature not supported
  */
 esp_err_t esp_bt_sleep_disable(void);
 
 /**
- * @brief to check whether bluetooth controller is sleeping at the instant, if modem sleep is enabled
+ * @brief Get the Bluetooth sleep clock source.
  *
- * Note that this function shall not be invoked before esp_bt_controller_enable()
- * This function is supposed to be used ORIG mode of modem sleep
- *
- * @return  true if in modem sleep state, false otherwise
- */
-bool esp_bt_controller_is_sleeping(void);
-
-/**
- * @brief request controller to wakeup from sleeping state during sleep mode
- *
- * Note that this function shall not be invoked before esp_bt_controller_enable()
- * Note that this function is supposed to be used ORIG mode of modem sleep
- * Note that after this request, bluetooth controller may again enter sleep as long as the modem sleep is enabled
- *
- * Profiling shows that it takes several milliseconds to wakeup from modem sleep after this request.
- * Generally it takes longer if 32kHz XTAL is used than the main XTAL, due to the lower frequency of the former as the bluetooth low power clock source.
- */
-void esp_bt_controller_wakeup_request(void);
-
-/**
- * @brief notify bluetooth controller task to process the event upon Tx or Rx done
- *
- * Note that this function shall not be invoked before esp_bt_controller_enable()
- * This function can be called in both ISR and non-ISR context
- *
- */
-int esp_bt_h4tl_eif_io_event_notify(int event);
-
-/**
- * @brief Get the Bluetooth module sleep clock source.
- *
- * Note that this function shall not be invoked before esp_bt_controller_init()
+ * @note This function shall not be invoked before `esp_bt_controller_init()`.
  *
  * @return  clock source used in Bluetooth low power mode
  */
 esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void);
 
+/**
+ * @brief Check if the Bluetooth Controller is currently in sleep mode when modem sleep is enabled.
+ *
+ * @note
+ *      1. This function shall not be invoked before `esp_bt_controller_enable()`.
+ *      2. This function is supposed to be used ORIG mode of modem sleep.
+ *
+ * @return
+ *      - True if the Controller is in modem sleep state; false otherwise.
+ */
+bool esp_bt_controller_is_sleeping(void);
+
+/**
+ * @brief Request the Controller to wakeup from sleeping state during sleep mode
+ *
+ * Profiling shows that it takes several milliseconds to wakeup from modem sleep after this request.
+ *
+ * Generally it takes longer if 32kHz XTAL is used than the main XTAL, due to the lower frequency of the former as the bluetooth low power clock source.
+ *
+ * @note
+ *      1. This function shall not be invoked before `esp_bt_controller_enable()`.
+ *      2. This function is supposed to be used ORIG mode of modem sleep.
+ *      3. After this request, the Bluetooth Controller can re-enter sleep as long as modem sleep remains enabled.
+ */
+void esp_bt_controller_wakeup_request(void);
+
+/**
+ * @brief  Set BLE TX power for the specified power type
+ *
+ * It is recommended to use `esp_ble_tx_power_set_enhanced` to set TX power for individual advertising and connection handle.
+ *
+ * @note Connection TX power should only be set after the connection is established.
+ *
+ * @param[in]  power_type The type of TX power. It could be Advertising, Connection, or Default.
+ * @param[in]  power_level Power level (index) corresponding to the absolute value (dBm)
+ *
+ * @return
+ *      - ESP_OK:   Success
+ *      - ESP_ERR_NOT_SUPPORTED: Invalid TX power type
+ *      - ESP_FAIL: Failure due to other reasons
+ */
+esp_err_t esp_ble_tx_power_set(esp_ble_power_type_t power_type, esp_power_level_t power_level);
+
+/**
+ * @brief  Get BLE TX power of the specified power type
+ *
+ * It is recommended to use `esp_ble_tx_power_get_enhanced` to get TX power of individual advertising and connection handle.
+ *
+ * @note
+ *      1. Connection TX power should only be retrieved after the connection is established.
+ *      2. If an invalid power type is provided, this API returns `ESP_PWR_LVL_INVALID`.
+ *
+ * @param[in]  power_type The type of TX power. It could be Advertising/Connection/Default and etc.
+ *
+ * @return
+ *         - Power level
+ *
+ */
+esp_power_level_t esp_ble_tx_power_get(esp_ble_power_type_t power_type);
+
+/**
+ * @brief  Set BLE TX power for the specified Advertising or Connection handle
+ *
+ * For the TX power type: `ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT`, `ESP_BLE_ENHANCED_PWR_TYPE_SCAN`, `ESP_BLE_ENHANCED_PWR_TYPE_INIT`,
+ * this API will ignore the input handle number, and set 0 internally.
+ *
+ * For the TX power type: `ESP_BLE_ENHANCED_PWR_TYPE_ADV` and `ESP_BLE_ENHANCED_PWR_TYPE_CONN`，
+ * this API will set the TX power for the target handle.
+ *
+ * @note
+ *      1. Connection TX power should only be set after connection created.
+ *
+ * @param[in]  power_type  The type of TX power
+ * @param[in]  handle      The handle of Advertising or Connection
+ * @param[in]  power_level Power level (index) corresponding to absolute value (dBm)
+ *
+ * @return
+ *        - ESP_OK: Success
+ *        - ESP_ERR_NOT_SUPPORTED: Invalid TX power type
+ *        - ESP_FAIL: Failure due to other reasons
+ */
+esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle, esp_power_level_t power_level);
+
+/**
+ * @brief  Get BLE TX power of the specified Advertising or Connection handle
+ *
+ * For the TX power type: `ESP_BLE_ENHANCED_PWR_TYPE_DEFAULT`, `ESP_BLE_ENHANCED_PWR_TYPE_SCAN`, `ESP_BLE_ENHANCED_PWR_TYPE_INIT`,
+ * this API will ignore the input handle number.
+ *
+ * For the TX power type: `ESP_BLE_ENHANCED_PWR_TYPE_ADV` and `ESP_BLE_ENHANCED_PWR_TYPE_CONN`，
+ * this API will return the TX power of the target handle.
+ *
+ * @note
+ *      1. Connection Tx power should only be get after connection created.
+ *      2. If an invalid power type is provided, this API returns `ESP_PWR_LVL_INVALID`.
+ *
+ * @param[in]  power_type The type of TX power
+ * @param[in]  handle     The handle of Advertising or Connection and the value 0 for other enhanced power types
+ *
+ * @return             Power level
+ */
+esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
+
+/**
+ * @brief Notify Bluetooth Controller task to process the event upon TX or RX done
+ *
+ * @note
+ *     1. This function shall not be invoked before `esp_bt_controller_enable()`.
+ *     2. This function can be called in both ISR and non-ISR context.
+ *     3. This function ignored the passed `event` value currently
+ */
+int esp_bt_h4tl_eif_io_event_notify(int event);
+
+/**
+ * @brief Virtual HCI (VHCI) callback functions to notify the Host on the next operation
+ */
+typedef struct esp_vhci_host_callback {
+    void (*notify_host_send_available)(void);               /*!< callback used to notify that the Host can send packet to Controller */
+    int (*notify_host_recv)(uint8_t *data, uint16_t len);   /*!< callback used to notify that the Controller has a packet to send to the Host */
+} esp_vhci_host_callback_t;
+
+/**
+ * @brief Check whether the Controller is ready to receive the packet
+ *
+ * If the return value is True, the Host can send the packet to the Controller.
+ *
+ * @note This function should be called before each `esp_vhci_host_send_packet()`.
+ *
+ * @return
+ *       True if the Controller is ready to receive packets; false otherwise.
+ */
+bool esp_vhci_host_check_send_available(void);
+
+/**
+ * @brief Send the packet to the Controller
+ *
+ * @note
+ *      1. This function shall not be called within a critical section or when the scheduler is suspended.
+ *      2. This function should be called only if `esp_vhci_host_check_send_available` returns True.
+ *
+ * @param[in] data Pointer to the packet data
+ * @param[in] len The packet length
+ */
+void esp_vhci_host_send_packet(uint8_t *data, uint16_t len);
+
+/**
+ * @brief Register the VHCI callback functions defined in `esp_vhci_host_callback` structure.
+ *
+ * @param[in] callback `esp_vhci_host_callback` type variable
+ *
+ * @return
+ *      - ESP_OK: Success
+ *      - ESP_FAIL: Failure
+ */
+esp_err_t esp_vhci_host_register_callback(const esp_vhci_host_callback_t *callback);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/include/esp32c3/include/esp_bt_vs.h

@@ -0,0 +1,173 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include "sdkconfig.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+// @brief HCI VS Commands for Espressif's Bluetooth Host
+//
+// @note The following vendor-specific HCI commands are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these commands will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS commands are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief Test vendor HCI feature (OCF: 0x0081)
+ *
+ * The Controller returns the value in command.
+ *
+ * @note The init function is `bt_stack_enableEchoVsCmd(true)`
+ */
+#define ESP_BT_VS_COMMON_ECHO_OCF                                   (0x0081)
+/**
+* @brief echo test cmd parameters
+*/
+struct bt_hci_vs_common_echo {
+    uint8_t echo; /*!< echo data */
+};
+
+/**
+ * @brief Config scanning duplicate exceptional list (OCF: 0x0108)
+ *
+ * @note The init function is `advFilter_stack_eanbleDupExcListCmd(true)`
+ */
+#define ESP_BT_VS_CONFIG_DUP_EXC_LIST_OCF                           (0x0108)
+/**
+* @brief Update exception list cmd parameters
+*/
+struct bt_hci_vs_update_exc_list {
+    uint8_t subcode;    /*!< Add, remove or clear exception list */
+    uint32_t type;      /*!< device type */
+    uint8_t device_info[6]; /*!< device information */
+};
+
+/**
+ * @brief Enable/disable advertising report flow control (OCF: 0x0109)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_ADV_REPORT_FLOW_CTRL_OCF                      (0x0109)
+/**
+* @brief Init ADV flow control cmd parameters
+*/
+struct bt_hci_vs_init_adv_flow_ctrl {
+    uint8_t enable; /*!< Enable ADV flow control */
+    uint16_t num;   /*!< ADV buffer maximum value */
+    uint16_t adv_lost_threshold; /*!< ADV lost event triggered threshold */
+};
+
+/**
+ * @brief Update the number of advertising report in ADV flow control (OCF: 0x010A)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_UPD_ADV_REPORT_FLOW_CTRL_NUM_OCF                  (0x010a)
+/**
+* @brief Update ADV flow control cmd parameters
+*/
+struct bt_hci_vs_update_adv_flow_ctrl {
+    uint16_t num; /*!< The number of ADV report processed */
+};
+
+/**
+ * @brief Clear legacy advertising (same as HCI_LE_Clear_Advertising_Sets) (OCF: 0x010C)
+ *
+ * @note The init function is `adv_stack_enableClearLegacyAdvVsCmd(true)`
+ */
+#define ESP_BT_VS_CLR_LEGACY_ADV_OCF                                (0x010c)
+/**
+* @brief Clear legacy ADV cmd parameters
+*/
+struct bt_hci_vs_ble_clr_legacy_adv {
+    // no parameters
+};
+
+/**
+ * @brief Enable/disable channel selection algorithm #2 (OCF: 0x0112)
+ *
+ * @note The init function is `chanSel_stack_enableSetCsaVsCmd(true)`
+ */
+#define ESP_BT_VS_ENABLE_CSA2_OCF                                   (0x0112)
+/**
+* @brief Enable/disable channel selection algorithm #2 cmd parameters
+*/
+struct bt_hci_vs_ble_csa_enable {
+    uint8_t csa2_select;  /*!< Select CSA2 */
+};
+
+// @brief HCI VS Events for Espressif's Bluetooth Host
+//
+// @note The following HCI VS events are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these events will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS events are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief BLE advertising report lost event for flow control (EVTCODE: 0x3E, SUBCODE: 0xF0)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_LE_ADV_LOST_EVT_SUBCODE                           (0xF0)
+/**
+* @brief ADV lost event parameters
+*/
+struct bt_hci_vs_le_adv_lost_evt {
+    uint32_t nb_lost; /*!< The number of ADV report discarded */
+};
+
+//
+// @brief HCI VS Commands for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging commands are implemented in Bluetooth controller pre-compiled libraries.
+//        These commands are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//        They are intended for Espressif's internal use only. Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+#define ESP_BT_VS_CFG_TEST_RELATED_OCF                              (0x0113)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_SUBCMD                        (0X00)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_ADV_DELAY_SUBCMD              (0X01)
+    #define ESP_BT_VS_CFG_TEST_SET_PREF_CODED_SUBCMD                (0X02)
+    #define ESP_BT_VS_CFG_TEST_SET_DEFAULT_PRIV_MODE_SUBCMD         (0X03)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_FOREVER_SUBCMD              (0X04)
+    #define ESP_BT_VS_CFG_TEST_SET_EXPECTED_PEER_SUBCMD             (0X05)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_TXED_CNT_SUBCMD              (0X06)
+    #define ESP_BT_VS_CFG_TEST_GET_SCAN_RXED_CNT_SUBCMD             (0X07)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_SUBCMD                 (0X08)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_SUBCMD                 (0X09)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_ENH_SUBCMD             (0X0a)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_ENH_SUBCMD             (0X0b)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_CCA_SUBCMD                    (0X0e)
+    #define ESP_BT_VS_CFG_TEST_CLEAR_RAND_ADDR_SUBCMD               (0X11)
+    #define ESP_BT_VS_CFG_TEST_GET_MAX_TXPWR_SUBCMD                 (0X12)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_RANGE_SUBCMD               (0X13)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_AA_SUBCMD                   (0X14)
+    #define ESP_BT_VS_CFG_TEST_SET_ADV_AA_SUBCMD                    (0X15)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_CHAN_SUBCMD                 (0X16)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_STATUS_SUBCMD               (0X1a)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_COMPILE_VER_SUBCMD          (0X24)
+    #define ESP_BT_VS_CFG_TEST_SET_AUX_ADV_OFFSET_SUBCMD            (0X25)
+    #define ESP_BT_VS_CFG_TEST_SET_AUX_OFFSET_THRESHOLD_SUBCMD      (0X2b)
+    #define ESP_BT_VS_CFG_TEST_RELATED_SUBCMD_MAX                   (0Xff)
+
+//
+// @brief HCI VS Events for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging events are implemented in Bluetooth controller pre-compiled libraries.
+//    These events are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//    Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+#ifdef __cplusplus
+}
+#endif

components/bt/include/esp32c5/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -159,7 +159,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20240422
+#define CONFIG_VERSION  0x20250310
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -213,6 +213,18 @@ typedef struct {
     uint8_t ignore_wl_for_direct_adv;                /*!< Ignore the whitelist for direct advertising */
     uint8_t enable_pcl;                              /*!< Enable power control */
     uint8_t csa2_select;                             /*!< Select CSA#2*/
+    uint8_t enable_csr;                              /*!< Enable CSR */
+    uint8_t ble_aa_check;                            /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
+    uint8_t ble_llcp_disc_flag;                      /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                        - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    uint16_t scan_backoff_upperlimitmax;             /*!< The value of upperlimitmax is 2^n, The maximum value is 256 */
+    uint8_t ble_chan_ass_en;                         /*!< Enable / disable BLE channel assessment. Configurable in menuconfig.
+                                                        - 0 - Disable
+                                                        - 1 - Enable (default) */
+    uint8_t ble_data_lenth_zero_aux;                 /*!< Enable / disable auxiliary packets when the extended ADV data length is zero. Configurable in menuconfig.
+                                                        - 0 - Disable (default)
+                                                        - 1 - Enable */
+    uint8_t vhci_enabled;                            /*!< VHCI mode is enabled */
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
@@ -260,6 +272,13 @@ typedef struct {
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .enable_pcl                 = DEFAULT_BT_LE_POWER_CONTROL_ENABLED,                  \
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
+    .enable_csr                 = 0,                                                    \
+    .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
+    .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
+    .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
+    .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
+    .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 

components/bt/include/esp32c5/include/esp_bt_vs.h

@@ -0,0 +1,335 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include "sdkconfig.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+// @brief HCI VS Commands for Espressif's Bluetooth Host
+//
+// @note The following vendor-specific HCI commands are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these commands will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS commands are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief Config scanning duplicate exceptional list (OCF: 0x0108)
+ *
+ * @note The init function is `advFilter_stack_eanbleDupExcListCmd(true)`
+ */
+#define ESP_BT_VS_CONFIG_DUP_EXC_LIST_OCF                           (0x0108)
+/**
+* @brief Update exception list cmd parameters
+*/
+struct bt_hci_vs_update_exc_list {
+    uint8_t subcode;    /*!< Add, remove or clear exception list */
+    uint32_t type;      /*!< device type */
+    uint8_t device_info[6]; /*!< device information */
+};
+
+/**
+ * @brief Enable/disable advertising report flow control (OCF: 0x0109)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_ADV_REPORT_FLOW_CTRL_OCF                      (0x0109)
+/**
+* @brief Init ADV flow control cmd parameters
+*/
+struct bt_hci_vs_init_adv_flow_ctrl {
+    uint8_t enable; /*!< Enable ADV flow control */
+    uint16_t num;   /*!< ADV buffer maximum value */
+    uint16_t adv_lost_threshold; /*!< ADV lost event triggered threshold */
+};
+
+/**
+ * @brief Update the number of advertising report in ADV flow control (OCF: 0x010A)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_UPD_ADV_REPORT_FLOW_CTRL_NUM_OCF                  (0x010a)
+/**
+* @brief Update ADV flow control cmd parameters
+*/
+struct bt_hci_vs_update_adv_flow_ctrl {
+    uint16_t num; /*!< The number of ADV report processed */
+};
+
+/**
+ * @brief Clear legacy advertising (same as HCI_LE_Clear_Advertising_Sets) (OCF: 0x010C)
+ *
+ * @note The init function is `adv_stack_enableClearLegacyAdvVsCmd(true)`
+ */
+#define ESP_BT_VS_CLR_LEGACY_ADV_OCF                                (0x010c)
+/**
+* @brief Clear legacy ADV cmd parameters
+*/
+struct bt_hci_vs_ble_clr_legacy_adv {
+    // no parameters
+};
+
+/**
+ * @brief Set parameters of duplicate list (OCF: 0x010D)
+ *
+ * @note The init function is `advFilter_stack_eanbleDupExcListCmd(true)`
+ */
+#define ESP_BT_VS_SET_DUP_LIST_PARAMS_OCF                           (0x010d)
+/**
+* @brief Set duplicate list cmd parameters
+*/
+struct bt_hci_vs_ble_set_dup_params {
+    uint8_t dup_mode;           /*!< Duplicate mode */
+    uint8_t dup_ad_type;        /*!< Duplicate data type */
+    uint16_t ring_list_max_num; /*!< Duplicate list size */
+};
+
+/**
+ * @brief Enable/disable duplicate and exception list (OCF: 0x010E)
+ *
+ * @note The init function is `advFilter_stack_eanbleDupExcListCmd(true)`
+ */
+#define ESP_BT_VS_ENABLE_DUP_EXC_LIST_OCF                           (0x010e)
+/**
+* @brief Enable duplicate and exception list cmd parameters
+*/
+struct bt_hci_vs_ble_enable_dup_exc {
+    uint8_t enable;             /*!< Enable or disable */
+    uint8_t ring_list_reset;    /*!< Reset list */
+};
+
+/**
+ * @brief Enable optimization of multiple connections (OCF: 0x010F)
+ *
+ * @note The init function is `arr_stack_enableMultiConnVsCmd(true)`
+ */
+#define ESP_BT_VS_ENABLE_ARRANGEMENT_OCF                            (0x010f)
+/**
+* @brief Multiple connections optimization cmd parameters
+*/
+struct bt_hci_vs_ble_enable_arrangement {
+    uint32_t common_factor;     /*!< The greatest common factor of connection interval */
+    uint8_t enable;             /*!< Enable or disable */
+};
+
+/**
+ * @brief Set scheduling length for a certain role (OCF: 0x0110)
+ *
+ * @note The init function is `arr_stack_enableMultiConnVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_SCHED_ROLE_LEN_OCF                            (0x0110)
+/**
+* @brief Scheduling length cmd parameters
+*/
+struct bt_hci_vs_ble_set_sched_role_len {
+    uint8_t role;   /*!< BLE role; 0: central; 1: peripheral */
+    uint32_t len;   /*!< Length is us */
+};
+
+/**
+ * @brief Set RSSI threshold for automatic power control (OCF: 0x0111)
+ *
+ * @note The init function is `pcl_stack_enableSetRssiThreshVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_PCL_RSSI_THRESH_OCF                           (0x0111)
+/**
+* @brief PCL RSSI threshold cmd parameters
+*/
+struct bt_hci_vs_ble_set_pcl_rssi_thresh {
+    uint16_t conn_handle;           /*!< Connection handle */
+    uint8_t rssi_thresh_min_1M;     /*!< Lower limit for 1M */
+    uint8_t rssi_thresh_max_1M;     /*!< Upper limit for 1M */
+    uint8_t rssi_thresh_min_2M;     /*!< Lower limit for 2M */
+    uint8_t rssi_thresh_max_2M;     /*!< Upper limit for 2M */
+    uint8_t rssi_thresh_min_s2coded;    /*!< Lower limit for s2 coded */
+    uint8_t rssi_thresh_max_s2coded;    /*!< Upper limit for s2 coded */
+    uint8_t rssi_thresh_min_s8coded;    /*!< Lower limit for s8 coded */
+    uint8_t rssi_thresh_max_s8coded;    /*!< Upper limit for s8 coded */
+};
+
+/**
+ * @brief Enable/disable channel selection algorithm #2 (OCF: 0x0112)
+ *
+ * @note The init function is `chanSel_stack_enableSetCsaVsCmd(true)`
+ */
+#define ESP_BT_VS_ENABLE_CSA2_OCF                                   (0x0112)
+/**
+* @brief Enable/disable channel selection algorithm #2 cmd parameters
+*/
+struct bt_hci_vs_ble_csa_enable {
+    uint8_t csa2_select;  /*!< Select CSA2 */
+};
+
+/**
+ * @brief Set parameters of controller logs (OCF: 0x0114)
+ *
+ * @note The init function is `log_stack_enableLogsRelatedVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_LOG_PARAMS_OCF                                (0x0114)
+/**
+* @brief Controller logs cmd parameters
+*/
+struct bt_hci_vs_ble_log_params {
+    uint8_t type;           /*!< Operation type */
+    uint32_t output_enable; /*!< Enable/disable output */
+    uint8_t buffer_optoin   /*!< Select log buffers */
+};
+
+/**
+ * @brief Set BLE vendor events mask (OCF: 0x0116)
+ *
+ * @note The init function is `hci_stack_enableSetVsEvtMaskVsCmd(true)`
+ */
+#define ESP_BT_VS_SET_LE_VENDOR_EVTS_MASK_OCF                       (0x0116)
+/**
+* @brief Set BLE vendor events mask cmd parameters
+*/
+struct bt_hci_vs_ble_set_vs_evts_mask {
+    uint32_t evt_masks; /*!< BLE vendor events Mask */
+};
+
+
+// @brief HCI VS Events for Espressif's Bluetooth Host
+//
+// @note The following HCI VS events are exclusively for Espressif's Bluetooth Host (ESP-Bluedroid Host or ESP-NimBLE Host).
+//       If you are using a non-ESP host or HCI UART, these events will remain disabled unless the initialization function is explicitly called from the application.
+//       Note, these init functions as well as these additional HCI VS events are intended for Espressif's Bluetooth Host use only.
+//       Application developers **should not** call the init functions in their applications.
+//
+
+/**
+ * @brief BLE Scan/Connect Request, Aux Connect Response received event (EVTCODE: 0xFF, SUBCODE: 0xC0)
+ *
+ * @note The init function is `adv_stack_enableScanReqRxdVsEvent(true)`
+ */
+#define ESP_BT_VS_LE_CONN_SCAN_REQ_RXED_EVT_SUBCODE                 (0xC0)
+/**
+* @brief BLE Scan/Connect Request, Aux Connect Response received event parameters
+*/
+struct bt_hci_vs_le_conn_scan_req_rxed_evt {
+    uint8_t evt_type;       /*!< Event type; 0: SCAN_REQ; 1: CONN_IND */
+    uint8_t handle;         /*!< Advertisement handle */
+    uint8_t peer_addr_type; /*!< Peer address type */
+    uint8_t peer_addr[6];   /*!< Peer address */
+};
+
+/**
+ * @brief BLE Channel Map Update Completion event (EVTCODE: 0xFF, SUBCODE: 0xC1)
+ *
+ * @note The init function is `conn_stack_enableChanMapUpdCompVsEvent(true)`
+ */
+#define ESP_BT_VS_LE_CHAN_UPDATE_COMP_EVT_SUBCODE                   (0xC1)
+/**
+* @brief BLE Channel Map Update Completion event parameters
+*/
+struct bt_hci_vs_le_chan_update_comp_evt {
+    uint8_t status;     /*!< Controller error code */
+    uint16_t handle;    /*!< Connection handle */
+    uint8_t ch_map[5];  /*!< Updated channel map */
+};
+
+/**
+ * @brief BLE advertising report lost event for flow control (EVTCODE: 0x3E, SUBCODE: 0xF0)
+ *
+ * @note The init function is `scan_stack_enableAdvFlowCtrlVsCmd(true)`
+ */
+#define ESP_BT_VS_LE_ADV_LOST_EVT_SUBCODE                           (0xF0)
+/**
+* @brief ADV lost event parameters
+*/
+struct bt_hci_vs_le_adv_lost_evt {
+    uint32_t nb_lost; /*!< The number of ADV report discarded */
+};
+
+//
+// @brief HCI VS Commands for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging commands are implemented in Bluetooth controller pre-compiled libraries.
+//        These commands are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//        They are intended for Espressif's internal use only. Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+#define ESP_BT_VS_CFG_TEST_RELATED_OCF                              (0x0113)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_SUBCMD                        (0X00)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_ADV_DELAY_SUBCMD              (0X01)
+    #define ESP_BT_VS_CFG_TEST_SET_PREF_CODED_SUBCMD                (0X02)
+    #define ESP_BT_VS_CFG_TEST_SET_DEFAULT_PRIV_MODE_SUBCMD         (0X03)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_FOREVER_SUBCMD              (0X04)
+    #define ESP_BT_VS_CFG_TEST_SET_EXPECTED_PEER_SUBCMD             (0X05)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_TXED_CNT_SUBCMD              (0X06)
+    #define ESP_BT_VS_CFG_TEST_GET_SCAN_RXED_CNT_SUBCMD             (0X07)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_SUBCMD                 (0X08)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_SUBCMD                 (0X09)
+    #define ESP_BT_VS_CFG_TEST_SET_TXPWR_LVL_ENH_SUBCMD             (0X0a)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_LVL_ENH_SUBCMD             (0X0b)
+    #define ESP_BT_VS_CFG_TEST_IGNORE_WL_FOR_DIR_ADV_SUBCMD         (0X0c)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_RXED_RSSI_SUBCMD             (0X0d)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_CCA_SUBCMD                    (0X0e)
+    #define ESP_BT_VS_CFG_TEST_SET_CCA_WIN_SUBCMD                   (0X0f)
+    #define ESP_BT_VS_CFG_TEST_READ_CCA_DATA_SUBCM                  (0X10)
+    #define ESP_BT_VS_CFG_TEST_CLEAR_RAND_ADDR_SUBCMD               (0X11)
+    #define ESP_BT_VS_CFG_TEST_GET_MAX_TXPWR_SUBCMD                 (0X12)
+    #define ESP_BT_VS_CFG_TEST_GET_TXPWR_RANGE_SUBCMD               (0X13)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_AA_SUBCMD                   (0X14)
+    #define ESP_BT_VS_CFG_TEST_SET_ADV_AA_SUBCMD                    (0X15)
+    #define ESP_BT_VS_CFG_TEST_SET_SCAN_CHAN_SUBCMD                 (0X16)
+    #define ESP_BT_VS_CFG_TEST_SKIP_LIGHT_SLEEP_CHECK_SUBCMD        (0X17)
+    #define ESP_BT_VS_CFG_TEST_SET_WAKEUP_OVERHEAD_SUBCMD           (0X18)
+    #define ESP_BT_VS_CFG_TEST_GET_ADV_MIN_ITVL_SUBCMD              (0X19)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_STATUS_SUBCMD               (0X1a)
+    #define ESP_BT_VS_CFG_TEST_SET_CONN_PHY_TXPWR_SUBCMD            (0X1b)
+    #define ESP_BT_VS_CFG_TEST_GET_CONN_PHY_TXPWR_SUBCMD            (0X1c)
+    #define ESP_BT_VS_CFG_TEST_GET_RXBUF_EMPTY_CNT_SUBCMD           (0X1d)
+    #define ESP_BT_VS_CFG_TEST_RESTART_SUBCMD                       (0X1e)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_RECODE_RX_STATE_SUBCMD        (0X1f)
+    #define ESP_BT_VS_CFG_TEST_GET_RECODE_CNT_SUBCMD                (0X20)
+    #define ESP_BT_VS_CFG_TEST_CLR_RECODE_CNT_SUBCMD                (0X21)
+    #define ESP_BT_VS_CFG_TEST_GET_CTRL_COMPILE_VER_SUBCMD          (0X24)
+    #define ESP_BT_VS_CFG_TEST_SET_AUX_ADV_OFFSET_SUBCMD            (0X25)
+    #define ESP_BT_VS_CFG_TEST_INIT_FLEXIBLE_MODE_SUBCMD            (0X26)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_FLEXIBLE_MODE_SUBCMD          (0X27)
+    #define ESP_BT_VS_CFG_TEST_SET_FLEXIBLE_CONN_ERR_SUBCMD         (0X28)
+    #define ESP_BT_VS_CFG_TEST_SET_FLEXIBLE_ADV_ERR_SUBCMD          (0X29)
+    #define ESP_BT_VS_CFG_TEST_SET_FLEXIBLE_SCAN_ERR_SUBCMD         (0X2a)
+    #define ESP_BT_VS_CFG_TEST_GET_TXED_CRCERR_SUBCMD               (0X2c)
+    #define ESP_BT_VS_CFG_TEST_GET_BACKOFF_UPLIMIT_SUBCMD           (0X2d)
+    #define ESP_BT_VS_CFG_TEST_GET_RXED_ADV_ADI_SUBCMD              (0X2f)
+    #define ESP_BT_VS_CFG_TEST_SET_SCH_RAND_MODE_SUBCMD             (0X30)
+    #define ESP_BT_VS_CFG_TEST_SET_RX_SENS_THRESH_SUBCMD            (0X31)
+    #define ESP_BT_VS_CFG_TEST_CHECK_MSYS_BUF_SUBCMD                (0X32)
+    #define ESP_BT_VS_CFG_TEST_UPDATE_BLE_TIMER_SUBCMD              (0X33)
+    #define ESP_BT_VS_CFG_TEST_UPDATE_BLE_RTC_SUBCMD                (0X34)
+    #define ESP_BT_VS_CFG_TEST_SET_LOCKED_MEM_NUM_SUBCMD            (0X35)
+    #define ESP_BT_VS_CFG_TEST_ALLOW_MEM_ALLOC_SUBCMD               (0X36)
+    #define ESP_BT_VS_CFG_TEST_SET_SCH_RAND_INFO_PTR_SUBCMD         (0X37)
+    #define ESP_BT_VS_CFG_TEST_SET_DIAG_IO_SUBCMD                   (0X38)
+    #define ESP_BT_VS_CFG_TEST_SET_AGC_MAX_GAIN_SUBCMD              (0X39)
+    #define ESP_BT_VS_CFG_TEST_ENABLE_CHAN_ASSESS_SUBCMD            (0X40)
+    #define ESP_BT_VS_CFG_TEST_SET_BACKOFF_UPLIMIT_SUBCMD           (0X41)
+    #define ESP_BT_VS_CFG_TEST_SET_CONN_TOP_PRIO_RESV_THRESH_SUBCMD (0X42)
+    #define ESP_BT_VS_CFG_TEST_SET_TEST_EVT_MSK_SUBCMD              (0X43)
+    #define ESP_BT_VS_CFG_TEST_GET_WAKEUP_TIMEOUT_SUBCMD            (0X45)
+    #define ESP_BT_VS_CFG_TEST_RELATED_SUBCMD_MAX                   (0Xff)
+
+//
+// @brief HCI VS Events for Espressif's Internal-Use Debugging
+//
+//  @note The following HCI VS debugging events are implemented in Bluetooth controller pre-compiled libraries.
+//    These events are not linked into the application binary, unless the function `esp_ble_internalTestFeaturesEnable(true)`is called from the application.
+//    Application developers **should not** call `esp_ble_internalTestFeaturesEnable(true)` in their applications.
+//
+
+#define ESP_BT_VS_LE_RUNNING_STATUS_EVT_SUBCODE                     (0xC3)
+
+
+#ifdef __cplusplus
+}
+#endif

components/bt/include/esp32c6/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -156,7 +156,7 @@ esp_err_t esp_ble_tx_power_set_enhanced(esp_ble_enhanced_power_type_t power_type
  */
 esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 
-#define CONFIG_VERSION  0x20241121
+#define CONFIG_VERSION  0x20250310
 #define CONFIG_MAGIC    0x5A5AA5A5
 
 /**
@@ -215,9 +215,20 @@ typedef struct {
     uint8_t csa2_select;                             /*!< Select CSA#2*/
     uint8_t enable_csr;                              /*!< Enable CSR */
     uint8_t ble_aa_check;                            /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig */
+    uint8_t ble_llcp_disc_flag;                      /*!< Flag indicating whether the Controller disconnects after Instant Passed (0x28) error occurs. Configurable in menuconfig.
+                                                        - The Controller does not disconnect after Instant Passed (0x28) by default. */
+    uint16_t scan_backoff_upperlimitmax;             /*!< The value of upperlimitmax is 2^n, The maximum value is 256 */
+    uint8_t ble_chan_ass_en;                         /*!< Enable / disable BLE channel assessment. Configurable in menuconfig.
+                                                        - 0 - Disable
+                                                        - 1 - Enable (default) */
+    uint8_t ble_data_lenth_zero_aux;                 /*!< Enable / disable auxiliary packets when the extended ADV data length is zero. Configurable in menuconfig.
+                                                        - 0 - Disable (default)
+                                                        - 1 - Enable */
+    uint8_t vhci_enabled;                            /*!< VHCI mode is enabled */
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
+
 #if CONFIG_IDF_TARGET_ESP32C6
 #define BT_CONTROLLER_INIT_CONFIG_DEFAULT() {                                           \
     .config_version = CONFIG_VERSION,                                                   \
@@ -266,6 +277,11 @@ typedef struct {
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .enable_csr                 = 0,                                                    \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
+    .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
+    .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
+    .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
+    .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 #elif CONFIG_IDF_TARGET_ESP32C61
@@ -315,6 +331,11 @@ typedef struct {
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
     .enable_csr                 = 0,                                                    \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
+    .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
+    .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
+    .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
+    .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
+    .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 #endif