versions: Update version to 4.2.5

pm: fix RTC IO and MEM issues under high temperature(v4.2)

See merge request espressif/esp-idf!24252

.github/ISSUE_TEMPLATE/bug_report.md

@@ -38,7 +38,7 @@ If the issue cannot be solved after the steps before, please follow these instru
 - Development Kit:      [ESP32-Wrover-Kit|ESP32-DevKitC|ESP32-PICO-Kit|ESP32-LyraT|ESP32-LyraTD-MSC|none]
 - Kit version (for WroverKit/PicoKit/DevKitC): [v1|v2|v3|v4]
 - Module or chip used:  [ESP32-WROOM-32|ESP32-WROOM-32D|ESP32-WROOM-32U|ESP32-WROVER|ESP32-WROVER-I|ESP32-WROVER-B|ESP32-WROVER-IB|ESP32-SOLO-1|ESP32-PICO-D4|ESP32]
-- IDF version (run ``git describe --tags`` to find it):
+- IDF version (run ``git describe`` to find it):
     // v3.2-dev-1148-g96cd3b75c
 - Build System:         [Make|CMake|idf.py]
 - Compiler version (run ``xtensa-esp32-elf-gcc --version`` to find it):

.github/workflows/docker.yml

@@ -0,0 +1,87 @@
+name: docker
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release/*'
+    tags:
+      - 'v*.*'
+
+env:
+  # Platforms to build the image for
+  BUILD_PLATFORMS: linux/amd64
+  DOCKERHUB_REPO: ${{ github.repository_owner }}/idf
+
+jobs:
+  docker:
+    # Disable the job in forks
+    if: ${{ github.repository_owner == 'espressif' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
+      # as a build arg) and TAG_NAME (used when tagging the image).
+      #
+      # The following 3 steps cover the alternatives (tag, release branch, master branch):
+      - name: Set variables (tags)
+        if: ${{ github.ref_type == 'tag' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
+      - name: Set variables (release branches)
+        if: ${{ github.ref_type == 'branch' && startsWith(github.ref_name, 'release/') }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=release-${GITHUB_REF_NAME##release/}" >> $GITHUB_ENV
+      - name: Set variables (main branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=master" >> $GITHUB_ENV
+          echo "TAG_NAME=latest" >> $GITHUB_ENV
+
+      # Display the variables set above, just in case.
+      - name: Check variables
+        run: |
+          echo "CLONE_BRANCH_OR_TAG: $CLONE_BRANCH_OR_TAG"
+          echo "CHECKOUT_REF: $CHECKOUT_REF"
+          echo "TAG_NAME: $TAG_NAME"
+
+      # The following steps are the standard boilerplate from
+      # https://github.com/marketplace/actions/build-and-push-docker-images
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up QEMU for multiarch builds
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: tools/docker
+          push: true
+          tags: ${{ env.DOCKERHUB_REPO }}:${{ env.TAG_NAME }}
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: |
+            IDF_CLONE_URL=${{ github.server_url }}/${{ github.repository }}.git
+            IDF_CLONE_BRANCH_OR_TAG=${{ env.CLONE_BRANCH_OR_TAG }}
+
+      - name: Update Docker Hub repository description (master branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        uses: peter-evans/dockerhub-description@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          # Token based authentication is not supported here:
+          # https://github.com/peter-evans/dockerhub-description/issues/10
+          # https://github.com/docker/roadmap/issues/115#issuecomment-891694974
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: ${{ env.DOCKERHUB_REPO }}
+          readme-filepath: ./tools/docker/README.md

.github/workflows/release_zips.yml

@@ -0,0 +1,17 @@
+name: Create zip file with recursive source clone for release
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release_zips:
+    name: Create release zip file
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Create a recursive clone source zip
+        uses: espressif/github-actions/release_zips@master
+        env:
+            RELEASE_PROJECT_NAME: ESP-IDF
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -83,3 +83,6 @@ build
 
 # lock files for examples and components
 dependencies.lock
+
+# managed_components for examples
+managed_components

.gitlab-ci.yml

@@ -8,6 +8,18 @@ stages:
   - deploy
   - post_deploy
 
+# pipelines will not be created in such two cases:
+# 1. MR push
+# 2. push not on "master/release" branches, and not tagged
+# This behavior could be changed after the `rules: changes` feature is implemented
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: never
+    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
+      when: never
+    - when: always
+
 variables:
 # System environment
 
@@ -39,13 +51,15 @@ variables:
   APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
   CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
 
-# Docker images
+  # Docker images
   BOT_DOCKER_IMAGE_TAG: ":latest"
-# target test config file, used by assign test job
+  # target test config file, used by assign test job
   CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/tools/ci/config/target-test.yml"
+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
 
   # Versioned esp-idf-doc env image to use for all document building jobs
-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v4"
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v7"
 
 
 # before each job, we need to check if this job is filtered by bot stage/job filter
@@ -64,6 +78,8 @@ variables:
   python $SUBMODULE_FETCH_TOOL -s $SUBMODULES_TO_FETCH
 
 before_script:
+  - source tools/ci/utils.sh
+  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
   - source tools/ci/setup_python.sh
   # apply bot filter in before script
   - *apply_bot_filter
@@ -85,6 +101,8 @@ before_script:
     GIT_SUBMODULE_STRATEGY: none
   before_script:
     - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - source tools/ci/setup_python.sh
     - source tools/ci/configure_ci_environment.sh
 
@@ -94,6 +112,8 @@ before_script:
     GIT_SUBMODULE_STRATEGY: none
   before_script:
     - echo "Not setting up GitLab key, not fetching submodules"
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - source tools/ci/setup_python.sh
     # apply bot filter in before script
     - *apply_bot_filter
@@ -128,7 +148,12 @@ before_script:
     - macos_shell
   dependencies: []
   before_script:
+    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
     - *apply_bot_filter
+    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
+    # Clean up idf-env.json which might not be compatible with one produced by newer ESP-IDF versions
+    - rm -f ${IDF_TOOLS_PATH}/idf-env.json
     - $IDF_PATH/tools/idf_tools.py install-python-env
     # On macOS, these tools need to be installed
     - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@@ -141,6 +166,12 @@ before_script:
     - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
     - *fetch_submodules
 
+default:
+  retry:
+    max: 2
+    # In case of a runner failure we could hop to another one, or a network error could go away.
+    when: runner_system_failure
+
 include:
   - '/tools/ci/config/pre_check.yml'
   - '/tools/ci/config/build.yml'

.gitlab/CODEOWNERS

@@ -0,0 +1,6 @@
+# For the syntax of this file, see:
+#
+#    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
+#
+
+* @esp-idf-codeowners/all-maintainers

CMakeLists.txt

@@ -74,6 +74,10 @@ if(CONFIG_COMPILER_DISABLE_GCC8_WARNINGS)
                                 "-Wno-int-in-bool-context")
 endif()
 
+if(CONFIG_COMPILER_WARN_WRITE_STRINGS)
+    list(APPEND compile_options "-Wwrite-strings")
+endif()
+
 if(CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_DISABLE)
     list(APPEND compile_definitions "-DNDEBUG")
 endif()

Kconfig

@@ -114,7 +114,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
                     mon reset halt
                     # Run to a specific point in ROM code,
                     #  where most of initialization is complete.
-                    thb *0x40007901
+                    thb *0x40007d54
                     c
                     # Load the application into RAM
                     load

README.md

@@ -2,20 +2,15 @@
 
 * [中文版](./README_CN.md)
 
-ESP-IDF is the official development framework for the **ESP32** and **ESP32-S** Series SoCs.
+ESP-IDF is the development framework for Espressif SoCs (released after 2016<sup>[1](#fn1)</sup>) provided for Windows, Linux and macOS.
 
 # Developing With ESP-IDF
 
 ## Setting Up ESP-IDF
 
-See setup guides for detailed instructions to set up the ESP-IDF:
+See https://idf.espressif.com/ for links to detailed instructions on how to set up the ESP-IDF depending on chip you use.
 
-| Chip | Getting Started Guides for ESP-IDF |
-|:----:|:----|
-| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> |  <ul><li>[stable](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/) version</li><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/) version</li></ul> |
-| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[latest (master branch)](https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/get-started/) version</li></ul> |
-
-**Note:** Each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) how to find documentation and how to checkout specific release of ESP-IDF.
+**Note:** Each SoC series and each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) on how to find documentation and how to checkout specific release of ESP-IDF.
 
 ### Non-GitHub forks
 
@@ -39,25 +34,16 @@ See the Getting Started guide links above for a detailed setup guide. This is a
 
 ## Setup Build Environment
 
-(See Getting Started guide for a full list of required steps with details.)
+(See the Getting Started guide listed above for a full list of required steps with more details.)
 
-* Install host build dependencies mentioned in Getting Started guide.
-* Add `tools/` directory to the PATH
-* Run `python -m pip install -r requirements.txt` to install Python dependencies
+* Install host build dependencies mentioned in the Getting Started guide.
+* Run the install script to set up the build environment. The options include `install.bat` or `install.ps1` for Windows, and `install.sh` or `install.fish` for Unix shells.
+* Run the export script on Windows (`export.bat`) or source it on Unix (`source export.sh`) in every shell environment before using ESP-IDF.
 
 ## Configuring the Project
 
-`idf.py menuconfig`
-
-* Opens a text-based configuration menu for the project.
-* Use up & down arrow keys to navigate the menu.
-* Use Enter key to go into a submenu, Escape key to go out or to exit.
-* Type `?` to see a help screen. Enter key exits the help screen.
-* Use Space key, or `Y` and `N` keys to enable (Yes) and disable (No) configuration items with checkboxes "`[*]`"
-* Pressing `?` while highlighting a configuration item displays help about that item.
-* Type `/` to search the configuration items.
-
-Once done configuring, press Escape multiple times to exit and say "Yes" to save the new configuration when prompted.
+* `idf.py set-target <chip_name>` sets the target of the project to `<chip_name>`. Run `idf.py set-target` without any arguments to see a list of supported targets.
+* `idf.py menuconfig` opens a text-based configuration menu where you can configure the project.
 
 ## Compiling the Project
 
@@ -79,7 +65,7 @@ You don't need to run `idf.py build` before running `idf.py flash`, `idf.py flas
 
 ## Viewing Serial Output
 
-The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from ESP32 or ESP32-S Series SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from Espressif SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 Exit the monitor by typing Ctrl-].
 
@@ -115,3 +101,6 @@ This can be combined with other targets, ie `idf.py -p PORT erase_flash flash` w
 * If you're interested in contributing to ESP-IDF, please check the [Contributions Guide](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html).
 
 
+________
+
+<a name="fn1">1</a>: ESP8266 and ESP8285 are not supported in ESP-IDF. See [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK) instead.

README_CN.md

@@ -2,26 +2,22 @@
 
 * [English Version](./README.md)
 
-ESP-IDF 是由乐鑫官方推出的针对 **ESP32** 和 **ESP32-S2** 系列芯片的开发框架。
+ESP-IDF 是由乐鑫官方针对乐鑫各系列芯片产品（发布于 2016 年后<sup>[1](#fn1)</sup>）推出的开发框架，支持 Windows、Linux 和 macOS 操作系统。
 
 # 使用 ESP-IDF 进行开发
 
 ## 搭建 ESP-IDF 开发环境
 
-请参阅如下指南搭建 ESP-IDF 的开发环境：
-
-| 芯片 | ESP-IDF 入门指南 |
-|:----:|:----|
-| <img src="docs/_static/chip-esp32.svg" height="85" alt="ESP32"> | <ul><li>[稳定](https://docs.espressif.com/projects/esp-idf/zh_CN/stable/get-started/) 版</li><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/get-started/) 版本</li></ul> |
-| <img src="docs/_static/chip-esp32-s2.svg" height="100" alt="ESP32-S2"> | <ul><li>[最新（master 分支)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32s2/get-started/) 版本</li></ul> |
-
-**注意：** 每个 ESP-IDF 版本都有其对应的文档。 请参阅 [版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html) 部分，如何查找文档以及如何检出ESP-IDF的特定发行版。
+关于不同芯片如何搭建 ESP-IDF 的开发环境，请参考 https://idf.espressif.com/。
 
+**注意：** 不同系列芯片和不同 ESP-IDF 版本都有其对应的文档。请参阅[版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html)部分，获得关于如何查找文档以及如何检出 ESP-IDF 的特定发行版的详细信息。
 
 ### 非 GitHub 分叉的 ESP-IDF 项目
 
 ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodules)），所以它们会指向 GitHub。
-如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该[脚本](tools/set-submodules-to-github.sh)。它会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
+如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该脚本 [tools/set-submodules-to-github.sh](tools/set-submodules-to-github.sh)。
+
+这个脚本会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
 如果 ESP-IDF 是从 GitHub 上克隆得到，则不需要此步骤。
 
 ## 寻找项目
@@ -38,24 +34,16 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 
 ## 设置构建环境
 
-（请参考入门指南中列出的详细步骤。）
-* 在主机中安装入门指南中提到的构建所依赖的工具。
-* 将 ESP-IDF 中的 `tools/` 目录加入 PATH 环境变量中。
-* 运行 `python -m pip install -r requirements.txt` 安装 Python 依赖库。
+请参考入门指南中列出的详细步骤。
 
+* 在主机中安装入门指南中提到的构建所依赖的工具。
+* 运行安装脚本来设置构建环境。可为 Windows shell 选择 `install.bat` 或 `install.ps1`，为 Unix shell 选择 `install.sh` 和 `install.fish`。
+* 在使用 ESP-IDF 之前，需要在 shell 中运行导出脚本。Windows 下可运行 `export.bat`，Unix 下可运行 `source export.sh`。
+  
 ## 配置项目
 
-`idf.py menuconfig`
-
-* 打开项目的文本配置菜单。
-* 使用上下键浏览菜单。
-* 使用回车键进入子菜单，退出键返回上一级菜单或者退出配置。
-* 输入 `?` 查看帮助界面，按下回车键可以退出帮助界面。
-* 使用空格键或者 `Y` 和 `N` 按键来启用和禁用带复选框“`[*]`”的配置项。
-* 高亮某个配置项的同时按下 `?` 键可以显示该选项的帮助文档。
-* 输入 `/` 可以搜索指定的配置项。
-
-一旦配置完成，请按下退出键多次以退出配置界面，当提示是否保存新的的配置时，选择 “Yes”。
+* `idf.py set-target <chip_name>` 可将项目的目标芯片设置为 `<chip_name>`。运行 `idf.py set-target`，不用带任何参数，可查看所有支持的目标芯片列表。
+* `idf.py menuconfig` 可打开一个基于文本的配置菜单，可以用来对项目进行配置。
 
 ## 编译项目
 
@@ -65,23 +53,23 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 
 ## 烧写项目
 
-当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但是你还可以运行下面这条命令来自动烧写：
+当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但你也可以运行下面这条命令来自动烧写：
 
 `idf.py -p PORT flash`
 
-将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 MacOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。
+将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 macOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。
 
 这会烧写整个项目（包括应用程序，引导程序和分区表）到芯片中，此外还可以使用 `idf.py menuconfig` 来调整串口烧写相关的配置。
 
-你也不必先运行 `idf.py build`，再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。
+不必先运行 `idf.py build` 再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。
 
 ## 观察串口输入
 
-`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示 ESP32 和 ESP32-S2 的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示乐鑫芯片的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
 
 输入 `Ctrl-]` 可退出监视器。
 
-想要一次性执行构建，烧写和监视，可以运行如下命令：
+想要一次性执行构建、烧写和监视，可以运行如下命令：
 
 `idf.py flash monitor`
 
@@ -92,24 +80,27 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 * `idf.py app` - 仅构建应用程序。
 * `idf.py app-flash` - 仅烧写应用程序。
 
-`idf.py app-flash` 会自动判断是否有源文件发生了改变而后重新构建应用程序。
+`idf.py app-flash` 会自动判断是否有源文件发生了改变然后重新构建应用程序。
 
 （在正常的开发中，即使引导程序和分区表没有发生变化，每次都重新烧写它们并不会带来什么危害。）
 
 ## 擦除 Flash
 
-`idf.py flash` 并不会擦除 Flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级。要擦除整块 Flash 请运行 `idf.py erase_flash`。
+`idf.py flash` 并不会擦除 flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级时。要擦除整块 flash 请运行 `idf.py erase_flash`。
 
-这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序，引导程序和分区表。
+这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序、引导程序和分区表。
 
 # 其它参考资源
 
-* 最新版的文档：https://docs.espressif.com/projects/esp-idf/ ，该文档是由本仓库 [docs 目录](docs) 构建得到。
+* 最新版的文档：https://docs.espressif.com/projects/esp-idf/，该文档是由本仓库 [docs 目录](docs) 构建得到。
 
 * 可以前往 [esp32.com 论坛](https://esp32.com/) 提问，挖掘社区资源。
 
-* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题不会被重复提交。
+* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题没有重复提交。
 
 * 如果你有兴趣为 ESP-IDF 作贡献，请先阅读[贡献指南](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html)。
 
 
+__________
+
+<a name="fn1">1</a>: ESP-IDF 不支持 ESP8266 和 ESP8285。如有需要，请参考 [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK)。

components/app_trace/CMakeLists.txt

@@ -30,13 +30,17 @@ endif()
 
 idf_component_register(SRCS "${srcs}"
                        INCLUDE_DIRS "${include_dirs}"
-                       PRIV_REQUIRES soc
+                       PRIV_REQUIRES soc esp_ipc
                        LDFRAGMENTS linker.lf)
 
-# disable --coverage for this component, as it is used as transport
-# for gcov
-target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
 
-# Force app_trace to also appear later than gcov in link line
-idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+if(CONFIG_APPTRACE_GCOV_ENABLE)
+    # disable --coverage for this component, as it is used as transport
+    # for gcov
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
+
+    # Force app_trace to also appear later than gcov in link line
+    idf_component_get_property(app_trace app_trace COMPONENT_LIB)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE
+        "-Wl,--undefined=gcov_rtio_atexit" $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+endif()

components/app_trace/component.mk

@@ -8,11 +8,7 @@ COMPONENT_ADD_INCLUDEDIRS = include
 
 COMPONENT_ADD_LDFLAGS = -lapp_trace
 
-# do not produce gcov info for this module, it is used as transport for gcov
-CFLAGS := $(subst --coverage,,$(CFLAGS))
-
 ifdef CONFIG_SYSVIEW_ENABLE
-
 COMPONENT_ADD_INCLUDEDIRS += \
 	sys_view/Config \
 	sys_view/SEGGER \
@@ -26,7 +22,12 @@ COMPONENT_SRCDIRS += \
 	sys_view/esp32 \
 	sys_view/ext
 else
+ifdef CONFIG_APPTRACE_GCOV_ENABLE
+# do not produce gcov info for this module, it is used as transport for gcov
+CFLAGS := $(subst --coverage,,$(CFLAGS))
+COMPONENT_ADD_LDFLAGS += -Wl,--undefined=gcov_rtio_atexit
 COMPONENT_SRCDIRS += gcov
 endif
+endif
 
 COMPONENT_ADD_LDFRAGMENTS += linker.lf

components/app_trace/gcov/gcov_rtio.c

@@ -22,7 +22,9 @@
 #include "soc/cpu.h"
 #include "soc/timer_periph.h"
 #include "esp_app_trace.h"
+#include "esp_freertos_hooks.h"
 #include "esp_private/dbg_stubs.h"
+#include "esp_ipc.h"
 #include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
@@ -37,128 +39,113 @@
 #define LOG_LOCAL_LEVEL CONFIG_LOG_DEFAULT_LEVEL
 #include "esp_log.h"
 const static char *TAG = "esp_gcov_rtio";
+static volatile bool s_create_gcov_task = false;
+static volatile bool s_gcov_task_running = false;
 
 extern void __gcov_dump(void);
 extern void __gcov_reset(void);
 
-static struct syscall_stub_table s_gcov_stub_table;
-
-
-static int gcov_stub_lock_try_acquire_recursive(_lock_t *lock)
+void gcov_dump_task(void *pvParameter)
 {
-    if (*lock && uxSemaphoreGetCount((xSemaphoreHandle)(*lock)) == 0) {
-        // we can do nothing here, gcov dump is initiated with some resource locked
-        // which is also used by gcov functions
-        ESP_EARLY_LOGE(TAG, "Lock 0x%x is busy during GCOV dump! System state can be inconsistent after dump!", lock);
-    }
-    return pdTRUE;
-}
+    int dump_result = 0;
+    bool *running = (bool *)pvParameter;
 
-static void gcov_stub_lock_acquire_recursive(_lock_t *lock)
-{
-    gcov_stub_lock_try_acquire_recursive(lock);
-}
+    ESP_EARLY_LOGV(TAG, "%s stack use in %d", __FUNCTION__, uxTaskGetStackHighWaterMark(NULL));
 
-static void gcov_stub_lock_release_recursive(_lock_t *lock)
-{
-}
-
-static int esp_dbg_stub_gcov_dump_do(void)
-{
-    int ret = ESP_OK;
-    FILE* old_stderr = stderr;
-    FILE* old_stdout = stdout;
-    static struct syscall_stub_table *old_tables[portNUM_PROCESSORS];
-
-    old_tables[0] = syscall_table_ptr_pro;
-#if portNUM_PROCESSORS > 1
-    old_tables[1] = syscall_table_ptr_app;
-#endif
     ESP_EARLY_LOGV(TAG, "Alloc apptrace down buf %d bytes", ESP_GCOV_DOWN_BUF_SIZE);
     void *down_buf = malloc(ESP_GCOV_DOWN_BUF_SIZE);
     if (down_buf == NULL) {
         ESP_EARLY_LOGE(TAG, "Could not allocate memory for the buffer");
-        return ESP_ERR_NO_MEM;
+        dump_result = ESP_ERR_NO_MEM;
+        goto gcov_exit;
     }
     ESP_EARLY_LOGV(TAG, "Config apptrace down buf");
     esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
+    /* we are directing the std outputs to the fake ones in order to reduce stack usage */
+    FILE *old_stderr = stderr;
+    FILE *old_stdout = stdout;
+    stderr = (FILE *) &__sf_fake_stderr;
+    stdout = (FILE *) &__sf_fake_stdout;
     ESP_EARLY_LOGV(TAG, "Dump data...");
-    // incase of dual-core chip APP and PRO CPUs share the same table, so it is safe to save only PRO's table
-    memcpy(&s_gcov_stub_table, syscall_table_ptr_pro, sizeof(s_gcov_stub_table));
-    s_gcov_stub_table._lock_acquire_recursive = &gcov_stub_lock_acquire_recursive;
-    s_gcov_stub_table._lock_release_recursive = &gcov_stub_lock_release_recursive;
-    s_gcov_stub_table._lock_try_acquire_recursive = &gcov_stub_lock_try_acquire_recursive,
-    syscall_table_ptr_pro = &s_gcov_stub_table;
-#if portNUM_PROCESSORS > 1
-    syscall_table_ptr_app = &s_gcov_stub_table;
-#endif
-    stderr = (FILE*) &__sf_fake_stderr;
-    stdout = (FILE*) &__sf_fake_stdout;
     __gcov_dump();
     // reset dump status to allow incremental data accumulation
     __gcov_reset();
-    stdout = old_stdout;
-    stderr = old_stderr;
-    syscall_table_ptr_pro = old_tables[0];
-#if portNUM_PROCESSORS > 1
-    syscall_table_ptr_app = old_tables[1];
-#endif
-    ESP_EARLY_LOGV(TAG, "Free apptrace down buf");
     free(down_buf);
+    stderr = old_stderr;
+    stdout = old_stdout;
     ESP_EARLY_LOGV(TAG, "Finish file transfer session");
-    ret = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
-    if (ret != ESP_OK) {
-        ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", ret);
+    dump_result = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
+    if (dump_result != ESP_OK) {
+        ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", dump_result);
+    }
+
+gcov_exit:
+    ESP_EARLY_LOGV(TAG, "dump_result %d", dump_result);
+    if (running) {
+        *running = false;
+    }
+
+    ESP_EARLY_LOGV(TAG, "%s stack use out %d", __FUNCTION__, uxTaskGetStackHighWaterMark(NULL));
+
+    vTaskDelete(NULL);
+}
+
+void gcov_create_task(void *arg)
+{
+    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
+    xTaskCreatePinnedToCore(&gcov_dump_task, "gcov_dump_task", 2048, (void *)&s_gcov_task_running, configMAX_PRIORITIES - 1, NULL, 0);
+}
+
+void gcov_create_task_tick_hook(void)
+{
+    extern esp_err_t esp_ipc_start_gcov_from_isr(uint32_t cpu_id, esp_ipc_func_t func, void* arg);
+    if (s_create_gcov_task) {
+        if (esp_ipc_start_gcov_from_isr(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
+            s_create_gcov_task = false;
+        }
     }
-    ESP_EARLY_LOGV(TAG, "exit %d", ret);
-    return ret;
 }
 
 /**
- * @brief Triggers gcov info dump.
+ * @brief Triggers gcov info dump task
  *        This function is to be called by OpenOCD, not by normal user code.
- * TODO: what about interrupted flash access (when cache disabled)???
+ * TODO: what about interrupted flash access (when cache disabled)
  *
  * @return ESP_OK on success, otherwise see esp_err_t
  */
 static int esp_dbg_stub_gcov_entry(void)
 {
-    return esp_dbg_stub_gcov_dump_do();
+    /* we are in isr context here */
+    s_create_gcov_task = true;
+    return ESP_OK;
 }
 
 int gcov_rtio_atexit(void (*function)(void) __attribute__ ((unused)))
 {
+    uint32_t capabilities = 0;
     ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
     esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_GCOV, (uint32_t)&esp_dbg_stub_gcov_entry);
-    return 0;
+    if (esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &capabilities) == ESP_OK) {
+        esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, capabilities | ESP_DBG_STUB_CAP_GCOV_TASK);
+    }
+    esp_register_freertos_tick_hook(gcov_create_task_tick_hook);
+    return ESP_OK;
 }
 
 void esp_gcov_dump(void)
 {
-    // disable IRQs on this CPU, other CPU is halted by OpenOCD
-    unsigned irq_state = portENTER_CRITICAL_NESTED();
-#if !CONFIG_FREERTOS_UNICORE
-    int other_core = xPortGetCoreID() ? 0 : 1;
-    esp_cpu_stall(other_core);
-#endif
+    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
+
     while (!esp_apptrace_host_is_connected(ESP_APPTRACE_DEST_TRAX)) {
-        wdt_hal_context_t twdt = {.inst = WDT_MWDT0, .mwdt_dev = &TIMERG0};
-        wdt_hal_context_t iwdt = {.inst = WDT_MWDT1, .mwdt_dev = &TIMERG1};
-        //Feed the Task Watchdog (TG0) to prevent it from timing out
-        wdt_hal_write_protect_disable(&twdt);
-        wdt_hal_feed(&twdt);
-        wdt_hal_write_protect_enable(&twdt);
-        //Likewise, feed the Interrupt Watchdog (TG1) to prevent a reboot
-        wdt_hal_write_protect_disable(&iwdt);
-        wdt_hal_feed(&iwdt);
-        wdt_hal_write_protect_enable(&iwdt);
+        vTaskDelay(pdMS_TO_TICKS(10));
     }
 
-    esp_dbg_stub_gcov_dump_do();
-#if !CONFIG_FREERTOS_UNICORE
-    esp_cpu_unstall(other_core);
-#endif
-    portEXIT_CRITICAL_NESTED(irq_state);
+    /* We are not in isr context here. Waiting for the completion is safe */
+    s_gcov_task_running = true;
+    s_create_gcov_task = true;
+    while (s_gcov_task_running) {
+        vTaskDelay(pdMS_TO_TICKS(10));
+    }
 }
 
 void *gcov_rtio_fopen(const char *path, const char *mode)
@@ -177,7 +164,7 @@ int gcov_rtio_fclose(void *stream)
 
 size_t gcov_rtio_fread(void *ptr, size_t size, size_t nmemb, void *stream)
 {
-    ESP_EARLY_LOGV(TAG, "%s read %u", __FUNCTION__, size*nmemb);
+    ESP_EARLY_LOGV(TAG, "%s read %u", __FUNCTION__, size * nmemb);
     size_t sz = esp_apptrace_fread(ESP_APPTRACE_DEST_TRAX, ptr, size, nmemb, stream);
     ESP_EARLY_LOGV(TAG, "%s actually read %u", __FUNCTION__, sz);
     return sz;

components/app_trace/linker.lf

@@ -3,12 +3,13 @@ archive: libapp_trace.a
 entries: 
     app_trace (noflash)
     app_trace_util (noflash)
-    SEGGER_SYSVIEW (noflash)
-    SEGGER_RTT_esp32 (noflash)
-    SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
-    SEGGER_SYSVIEW_FreeRTOS (noflash)
+    if SYSVIEW_ENABLE = y:
+      SEGGER_SYSVIEW (noflash)
+      SEGGER_RTT_esp32 (noflash)
+      SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
+      SEGGER_SYSVIEW_FreeRTOS (noflash)
 
-[mapping:driver]
+[mapping:app_trace_driver]
 archive: libdriver.a
 entries:
     if SYSVIEW_TS_SOURCE_TIMER_00 = y || SYSVIEW_TS_SOURCE_TIMER_01 = y

components/app_update/esp_app_desc.c

@@ -89,7 +89,10 @@ int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
     static bool first_call = true;
     if (first_call) {
         first_call = false;
-        const uint8_t* src = esp_app_desc.app_elf_sha256;
+        // At -O2 optimization level, GCC optimizes out the copying of the first byte of the app_elf_sha256,
+        // because it is zero at compile time, and only modified afterwards by esptool.
+        // Casting to volatile disables the optimization.
+        const volatile uint8_t* src = (const volatile uint8_t*)esp_app_desc.app_elf_sha256;
         for (size_t i = 0; i < sizeof(s_app_elf_sha256); ++i) {
             s_app_elf_sha256[i] = src[i];
         }

components/app_update/esp_ota_ops.c

@@ -41,6 +41,12 @@
 #include "esp_system.h"
 #include "esp_efuse.h"
 
+#ifdef CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/crc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/crc.h"
+#include "esp32s2/rom/secure_boot.h"
+#endif
 
 #define SUB_TYPE_ID(i) (i & 0x0F)
 
@@ -858,3 +864,24 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void)
 
     return ESP_OK;
 }
+
+#if CONFIG_IDF_TARGET_ESP32S2 && CONFIG_SECURE_BOOT_V2_ENABLED
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index) {
+
+    if (!esp_secure_boot_enabled()) {
+        ESP_LOGE(TAG, "Secure boot v2 has not been enabled.");
+        return ESP_FAIL;
+    }
+
+    if (index != SECURE_BOOT_PUBLIC_KEY_INDEX_0 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_1 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_2) {
+        ESP_LOGE(TAG, "Invalid Index found for public key revocation %d.", index);
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ets_secure_boot_revoke_public_key_digest(index);
+    ESP_LOGI(TAG, "Revoked signature block %d.", index);
+    return ESP_OK;
+}
+#endif

components/app_update/include/esp_ota_ops.h

@@ -49,7 +49,7 @@ typedef uint32_t esp_ota_handle_t;
 
 /**
  * @brief   Return esp_app_desc structure. This structure includes app version.
- * 
+ *
  * Return description for running app.
  * @return Pointer to esp_app_desc structure.
  */
@@ -224,7 +224,7 @@ const esp_partition_t* esp_ota_get_next_update_partition(const esp_partition_t *
 
 /**
  * @brief Returns esp_app_desc structure for app partition. This structure includes app version.
- * 
+ *
  * Returns a description for the requested app partition.
  * @param[in] partition     Pointer to app partition. (only app partition)
  * @param[out] app_desc     Structure of info about app.
@@ -299,6 +299,34 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void);
  */
 bool esp_ota_check_rollback_is_possible(void);
 
+#if CONFIG_IDF_TARGET_ESP32S2 && (CONFIG_SECURE_BOOT_V2_ENABLED || __DOXYGEN__)
+
+/**
+ * Secure Boot V2 public key indexes.
+ */
+typedef enum {
+    SECURE_BOOT_PUBLIC_KEY_INDEX_0,     /*!< Points to the 0th index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_1,     /*!< Points to the 1st index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_2      /*!< Points to the 2nd index of the Secure Boot v2 public key */
+} esp_ota_secure_boot_public_key_index_t;
+
+/**
+ * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
+ *
+ * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key N-1, Key N, Key N+1).
+ * When key N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key N-1 & Key N.
+ * After successfully booting the OTA app should call this function to revoke Key N-1.
+ *
+ * @param index - The index of the signature block to be revoked
+ *
+ * @return
+ *        - ESP_OK: If revocation is successful.
+ *        - ESP_ERR_INVALID_ARG: If the index of the public key to be revoked is incorrect.
+ *        - ESP_FAIL: If secure boot v2 has not been enabled.
+ */
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index);
+#endif /* CONFIG_IDF_TARGET_ESP32S2 */
+
 #ifdef __cplusplus
 }
 #endif

components/app_update/otatool.py

@@ -87,9 +87,8 @@ class OtatoolTarget():
             seq = bytearray(self.otadata[start:start + 4])
             crc = bytearray(self.otadata[start + 28:start + 32])
 
-            seq = struct.unpack('>I', seq)
-            crc = struct.unpack('>I', crc)
-
+            seq = struct.unpack('I', seq)
+            crc = struct.unpack('I', crc)
             info.append(otadata_info(seq[0], crc[0]))
 
         return info
@@ -103,12 +102,11 @@ class OtatoolTarget():
     def switch_ota_partition(self, ota_id):
         self._check_otadata_partition()
 
-        sys.path.append(PARTTOOL_DIR)
         import gen_esp32part as gen
 
         def is_otadata_info_valid(status):
             seq = status.seq % (1 << 32)
-            crc = hex(binascii.crc32(struct.pack("I", seq), 0xFFFFFFFF) % (1 << 32))
+            crc = binascii.crc32(struct.pack('I', seq), 0xFFFFFFFF) % (1 << 32)
             return seq < (int('0xFFFFFFFF', 16) % (1 << 32)) and status.crc == crc
 
         partition_table = self.target.partition_table
@@ -219,8 +217,8 @@ def _read_otadata(target):
 
     otadata_info = target._get_otadata_info()
 
-    print("             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}".format("OTA_SEQ", "CRC", "OTA_SEQ", "CRC"))
-    print("Firmware:  0x{:8x} \t0x{:8x} | \t0x{:8x} \t 0x{:8x}".format(otadata_info[0].seq, otadata_info[0].crc,
+    print('             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}'.format('OTA_SEQ', 'CRC', 'OTA_SEQ', 'CRC'))
+    print('Firmware:  0x{:08x} \t0x{:08x} | \t0x{:08x} \t 0x{:08x}'.format(otadata_info[0].seq, otadata_info[0].crc,
           otadata_info[1].seq, otadata_info[1].crc))
 
 
@@ -249,6 +247,10 @@ def _erase_ota_partition(target, ota_id):
 
 
 def main():
+    if sys.version_info[0] < 3:
+        print("WARNING: Support for Python 2 is deprecated and will be removed in future versions.", file=sys.stderr)
+    elif sys.version_info[0] == 3 and sys.version_info[1] < 6:
+        print("WARNING: Python 3 versions older than 3.6 are not supported.", file=sys.stderr)
     global quiet
 
     parser = argparse.ArgumentParser("ESP-IDF OTA Partitions Tool")

components/app_update/test/test_switch_ota.c

@@ -23,7 +23,7 @@
 #include "unity.h"
 
 #include "bootloader_common.h"
-#include "../include_bootloader/bootloader_flash.h"
+#include "../include_bootloader/bootloader_flash_priv.h"
 
 #include "esp_log.h"
 #include "esp_ota_ops.h"

components/bootloader/Kconfig.projbuild

@@ -53,20 +53,34 @@ menu "Bootloader config"
         default 4 if BOOTLOADER_LOG_LEVEL_DEBUG
         default 5 if BOOTLOADER_LOG_LEVEL_VERBOSE
 
+    config BOOTLOADER_SPI_CUSTOM_WP_PIN
+        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+        default n
+        help
+            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+
+            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+            for external SPIRAM if it is enabled.
+
+            If this config item is set to N (default), the correct WP pin will be automatically used for any
+            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+            Y and specify the GPIO number connected to the WP.
+
     config BOOTLOADER_SPI_WP_PIN
-        int "SPI Flash WP Pin when customising pins via eFuse (read help)"
+        int "Custom SPI Flash WP Pin"
         range 0 33
         default 7
-        depends on ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
         help
-            This value is ignored unless flash mode is set to QIO or QOUT *and* the SPI flash pins have been
-            overriden by setting the eFuses SPI_PAD_CONFIG_xxx.
+            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
 
-            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka ESP32
-            pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. That pin number is compiled into the
-            bootloader instead.
-
-            The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
+            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+            value to the GPIO number of the SPI flash WP pin.
 
     choice BOOTLOADER_VDDSDIO_BOOST
         bool "VDDSDIO LDO voltage"
@@ -100,7 +114,8 @@ menu "Bootloader config"
     config BOOTLOADER_NUM_PIN_FACTORY_RESET
         int "Number of the GPIO input for factory reset"
         depends on BOOTLOADER_FACTORY_RESET
-        range 0 39
+        range 0 39 if IDF_TARGET_ESP32
+        range 0 44 if IDF_TARGET_ESP32S2
         default 4
         help
             The selected GPIO will be configured as an input with internal pull-up enabled.
@@ -294,6 +309,15 @@ menu "Bootloader config"
             in this area of memory, you can increase it. It must be a multiple of 4 bytes.
             This area (rtc_retain_mem_t) is reserved and has access from the bootloader and an application.
 
+    config BOOTLOADER_FLASH_XMC_SUPPORT
+        bool "Enable the support for flash chips of XMC (READ HELP FIRST)"
+        default y
+        help
+            Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
+            XMC chips will be forbidden to be used, when this option is disabled.
+
+            DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
+
 endmenu  # Bootloader
 
 
@@ -320,6 +344,16 @@ menu "Security features"
         select MBEDTLS_ECDSA_C
         depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE
 
+    config SECURE_BOOT_SUPPORTS_RSA
+        bool
+        default y
+        depends on ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2
+
+    config SECURE_TARGET_HAS_SECURE_ROM_DL_MODE
+        bool
+        default y
+        depends on IDF_TARGET_ESP32S2
+
 
     config SECURE_SIGNED_APPS_NO_SECURE_BOOT
         bool "Require signed app images"
@@ -355,7 +389,7 @@ menu "Security features"
 
         config SECURE_SIGNED_APPS_RSA_SCHEME
             bool "RSA"
-            depends on ESP32_REV_MIN_3 && SECURE_BOOT_V2_ENABLED
+            depends on SECURE_BOOT_SUPPORTS_RSA && SECURE_BOOT_V2_ENABLED
             help
                 Appends the RSA-3072 based Signature block to the application.
                 Refer to <Secure Boot Version 2 documentation link> before enabling.
@@ -419,7 +453,9 @@ menu "Security features"
 
         config SECURE_BOOT_V2_ENABLED
             bool "Enable Secure Boot version 2"
-            depends on ESP32_REV_MIN_3
+            depends on SECURE_BOOT_SUPPORTS_RSA
+            select SECURE_ENABLE_SECURE_ROM_DL_MODE if !IDF_TARGET_ESP32 && !SECURE_INSECURE_ALLOW_DL_MODE && !SECURE_DISABLE_ROM_DL_MODE # NOERROR
+            select SECURE_DISABLE_ROM_DL_MODE if ESP32_REV_MIN_3 && !SECURE_INSECURE_ALLOW_DL_MODE
             help
                 Build a bootloader which enables Secure Boot version 2 on first boot.
                 Refer to Secure Boot V2 section of the ESP-IDF Programmer's Guide for this version before enabling.
@@ -539,6 +575,7 @@ menu "Security features"
     config SECURE_FLASH_ENC_ENABLED
         bool "Enable flash encryption on boot (READ DOCS FIRST)"
         default N
+        select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
         help
             If this option is set, flash contents will be encrypted by the bootloader on first boot.
 
@@ -587,7 +624,8 @@ menu "Security features"
 
         config SECURE_FLASH_ENCRYPTION_MODE_RELEASE
             bool "Release"
-            select SECURE_ENABLE_SECURE_ROM_DL_MODE
+            select SECURE_ENABLE_SECURE_ROM_DL_MODE if SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_DISABLE_ROM_DL_MODE # NOERROR
+            select PARTITION_TABLE_MD5 if !ESP32_COMPATIBLE_PRE_V3_1_BOOTLOADERS
 
     endchoice
 
@@ -649,9 +687,30 @@ menu "Security features"
                 efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
 
                 If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse holding the public
-                key digest, causing an immediate denial of service and possibly allowing an additional fault
-                injection attack to bypass the signature protection.
+                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
+                immediate denial of service and possibly allowing an additional fault injection attack to
+                bypass the signature protection.
+
+                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+                However, efuse can be read/written from the application
+
+        config SECURE_INSECURE_ALLOW_DL_MODE
+            bool "Don't automatically restrict UART download mode"
+            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
+            default N
+            help
+                By default, enabling either flash encryption in release mode or secure boot will automatically
+                disable UART download mode on ESP32 ECO3, or enable secure download mode on newer chips.
+                This is recommended to reduce the attack surface of the chip.
+
+                To allow the full UART download mode to stay enabled, enable this option and ensure
+                the options SECURE_DISABLE_ROM_DL_MODE and SECURE_ENABLE_SECURE_ROM_DL_MODE are disabled as applicable.
+                This is not recommended.
 
         config SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
             bool "Leave UART bootloader encryption enabled"
@@ -719,7 +778,7 @@ menu "Security features"
 
     config SECURE_ENABLE_SECURE_ROM_DL_MODE
         bool "Permanently switch to ROM UART Secure Download mode"
-        depends on IDF_TARGET_ESP32S2 && !SECURE_DISABLE_ROM_DL_MODE
+        depends on SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_DISABLE_ROM_DL_MODE
         help
             If set, during startup the app will burn an eFuse bit to permanently switch the UART ROM
             Download Mode into a separate Secure Download mode. This option can only work if

components/bootloader/Makefile.projbuild

@@ -102,7 +102,7 @@ endif
 bootloader: $(BOOTLOADER_DIGEST_BIN)
 	@echo $(SEPARATOR)
 	@echo "Bootloader built and secure digest generated. First time flash command is:"
-	@echo "$(ESPEFUSEPY) burn_key secure_boot $(SECURE_BOOTLOADER_KEY)"
+	@echo "$(ESPEFUSEPY) burn_key secure_boot_v1 $(SECURE_BOOTLOADER_KEY)"
 	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)"
 	@echo $(SEPARATOR)
 	@echo "To reflash the bootloader after initial flash:"

components/bootloader/subproject/CMakeLists.txt

@@ -92,20 +92,20 @@ endif()
 
 if(CONFIG_SECURE_BOOT_V2_ENABLED)
     if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
-        get_filename_component(secure_boot_signing_key 
+        get_filename_component(secure_boot_signing_key
             "${SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")
 
         if(NOT EXISTS "${secure_boot_signing_key}")
-            message(FATAL_ERROR
-                "Secure Boot Signing Key Not found."
-                "\nGenerate the Secure Boot V2 RSA-PSS 3072 Key."
-                "\nTo generate one, you can use this command:"
-                "\n\t${espsecurepy} generate_signing_key --version 2 ${SECURE_BOOT_SIGNING_KEY}")
+        message(FATAL_ERROR
+            "Secure Boot Signing Key Not found."
+            "\nGenerate the Secure Boot V2 RSA-PSS 3072 Key."
+            "\nTo generate one, you can use this command:"
+            "\n\t${espsecurepy} generate_signing_key --version 2 ${SECURE_BOOT_SIGNING_KEY}")
         endif()
 
         set(bootloader_unsigned_bin "bootloader-unsigned.bin")
         add_custom_command(OUTPUT ".signed_bin_timestamp"
-            COMMAND cp "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
+            COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
             COMMAND ${ESPSECUREPY} sign_data --version 2 --keyfile "${secure_boot_signing_key}"
             -o "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
             COMMAND ${CMAKE_COMMAND} -E echo "Generated signed binary image ${build_dir}/${PROJECT_BIN}"
@@ -117,7 +117,7 @@ if(CONFIG_SECURE_BOOT_V2_ENABLED)
     else()
         add_custom_command(OUTPUT ".signed_bin_timestamp"
         VERBATIM
-        COMMENT "Bootloader generated but not signed")    
+        COMMENT "Bootloader generated but not signed")
     endif()
 
     add_custom_target (gen_signed_bootloader ALL DEPENDS "${build_dir}/.signed_bin_timestamp")
@@ -147,7 +147,7 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
         COMMAND ${CMAKE_COMMAND} -E echo
             "Burn secure boot key to efuse using:"
         COMMAND ${CMAKE_COMMAND} -E echo
-            "\t${espefusepy} burn_key secure_boot ${secure_bootloader_key}"
+            "\t${espefusepy} burn_key secure_boot_v1 ${secure_bootloader_key}"
         COMMAND ${CMAKE_COMMAND} -E echo
             "First time flash command is:"
         COMMAND ${CMAKE_COMMAND} -E echo
@@ -166,6 +166,24 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
             "* Not recommended to re-use the same secure boot keyfile on multiple production devices."
         DEPENDS gen_secure_bootloader_key gen_bootloader_digest_bin
         VERBATIM)
+elseif(CONFIG_SECURE_BOOT_V2_ENABLED AND CONFIG_IDF_TARGET_ESP32S2)
+    add_custom_command(TARGET bootloader.elf POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Bootloader built. Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "To sign the bootloader with additional private keys."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${espsecurepy} sign_data -k secure_boot_signing_key2.pem -v 2 --append_signatures -o signed_bootloader.bin build/bootloader/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${esptoolpy_write_flash} ${BOOTLOADER_OFFSET} ${CMAKE_BINARY_DIR}/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    DEPENDS gen_signed_bootloader
+    VERBATIM)
 elseif(CONFIG_SECURE_BOOT_V2_ENABLED)
     add_custom_command(TARGET bootloader.elf POST_BUILD
     COMMAND ${CMAKE_COMMAND} -E echo

components/bootloader/subproject/Makefile

@@ -32,4 +32,6 @@ CFLAGS += -D BOOTLOADER_BUILD=1
 # include the top-level "project" include directory, for sdkconfig.h
 CFLAGS += -I$(BUILD_DIR_BASE)/../include
 
+COMPONENT_ADD_LDFLAGS += -l$(COMPONENT_NAME) -Wl,--wrap=longjmp \
+
 include $(IDF_PATH)/make/project.mk

components/bootloader/subproject/main/ld/esp32/bootloader.ld

@@ -42,6 +42,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libbootloader_support.a:bootloader_efuse_esp32.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
@@ -163,8 +164,35 @@ SECTIONS
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader/subproject/main/ld/esp32s2/bootloader.ld

@@ -5,9 +5,9 @@
 
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x40050000, len = 0x4000  /* 16KB, SRAM Block_14 */
-  iram_loader_seg (RWX) :           org = 0x40054000, len = 0x4000  /* 16KB, SRAM Block_15 */
-  dram_seg (RW) :                   org = 0x3FFE8000, len = 0x2800  /* 10KB, Top of SRAM Block_16, and before ROM data and stack */
+  iram_seg (RWX) :                  org = 0x4004c000, len = 0x4000  /* SRAM Block 13 */
+  iram_loader_seg (RWX) :           org = 0x40050000, len = 0x6000  /* SRAM Block 14 & part of 15 */
+  dram_seg (RW) :                   org = 0x3FFE6000, len = 0x4B00  /* Part SRAM Blocks 15 & 16, ROM static buffer starts at end of this region (reclaimed after app runs) */
 }
 
 /*  Default entry point:  */
@@ -28,6 +28,7 @@ SECTIONS
     *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
     *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
     *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
@@ -39,6 +40,7 @@ SECTIONS
     *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
     *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
     *libsoc.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libsoc.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
     *libefuse.a:*.*(.literal .text .literal.* .text.*)
     *(.fini.literal)
     *(.fini)
@@ -148,8 +150,35 @@ SECTIONS
     *(.fini.literal)
     *(.fini)
     *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
     _text_end = ABSOLUTE(.);
     _etext = .;
   } > iram_seg
 
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }

components/bootloader_support/CMakeLists.txt

@@ -4,6 +4,7 @@ set(srcs
     "src/bootloader_flash.c"
     "src/bootloader_mem.c"
     "src/bootloader_random.c"
+    "src/bootloader_random_${IDF_TARGET}.c"
     "src/bootloader_utility.c"
     "src/esp_image_format.c"
     "src/flash_encrypt.c"

components/bootloader_support/component.mk

@@ -20,7 +20,8 @@ COMPONENT_OBJEXCLUDE := src/bootloader_init.o
 endif
 
 COMPONENT_OBJEXCLUDE += src/bootloader_flash_config_esp32s2.o \
-			src/bootloader_efuse_esp32s2.o
+			src/bootloader_efuse_esp32s2.o \
+			src/bootloader_random_esp32s2.o
 
 ifndef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
 ifndef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME

components/bootloader_support/include/bootloader_flash.h

@@ -0,0 +1,61 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#pragma once
+
+#include <stdint.h>
+#include <esp_err.h>
+#include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Read flash ID by sending 0x9F command
+ * @return flash raw ID
+ *     mfg_id = (ID >> 16) & 0xFF;
+       flash_id = ID & 0xffff;
+ */
+uint32_t bootloader_read_flash_id(void);
+
+#if SOC_CACHE_SUPPORT_WRAP
+/**
+ * @brief Set the burst mode setting command for specified wrap mode.
+ *
+ * @param mode The specified warp mode.
+ * @return always ESP_OK
+ */
+esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode);
+#endif
+
+/**
+ * @brief Startup flow recommended by XMC. Call at startup before any erase/write operation.
+ *
+ * @return ESP_OK When startup successfully, otherwise ESP_FAIL (indiciating you should reboot before erase/write).
+ */
+esp_err_t bootloader_flash_xmc_startup(void);
+
+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t bootloader_flash_unlock(void);
+
+#ifdef __cplusplus
+}
+#endif

components/bootloader_support/include/bootloader_flash_config.h

@@ -14,6 +14,7 @@
 
 #pragma once
 
+#include "sdkconfig.h"
 #include "esp_image_format.h"
 
 #ifdef __cplusplus
@@ -27,6 +28,14 @@ extern "C" {
  */
 void bootloader_flash_update_id(void);
 
+/**
+ * @brief Update the flash size in g_rom_flashchip (global esp_rom_spiflash_chip_t structure).
+ *
+ * @param size The size to store, in bytes.
+ * @return None
+ */
+void bootloader_flash_update_size(uint32_t size);
+
 /**
  * @brief Set the flash CS setup and hold time.
  *
@@ -66,6 +75,22 @@ void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
  */
 void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);
 
+#ifdef CONFIG_IDF_TARGET_ESP32
+/**
+ * @brief Return the pin number used for custom SPI flash and/or SPIRAM WP pin
+ *
+ * Can be determined by eFuse values in most cases, or overriden in configuration
+ *
+ * This value is only meaningful if the other SPI flash pins are overriden via eFuse.
+ *
+ * This value is only meaningful if flash is set to QIO or QOUT mode, or if
+ * SPIRAM is enabled.
+ *
+ * @return Pin number to use, or -1 if the default should be kept
+ */
+int bootloader_flash_get_wp_pin(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif

components/bootloader_support/include/esp_flash_partitions.h

@@ -42,6 +42,9 @@ extern "C" {
 
 #define PART_FLAG_ENCRYPTED (1<<0)
 
+/* The md5sum value is found this many bytes after the ESP_PARTITION_MAGIC_MD5 offset */
+#define ESP_PARTITION_MD5_OFFSET 16
+
 /* Pre-partition table fixed flash offsets */
 #define ESP_BOOTLOADER_DIGEST_OFFSET 0x0
 #define ESP_BOOTLOADER_OFFSET 0x1000 /* Offset of bootloader image. Has matching value in bootloader KConfig.projbuild file. */

components/bootloader_support/include/esp_image_format.h

@@ -169,6 +169,14 @@ esp_err_t esp_image_verify_bootloader(uint32_t *length);
  */
 esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data);
 
+/**
+ * @brief Get the flash size of the image
+ *
+ * @param app_flash_size The value configured in the image header
+ * @return Actual size, in bytes.
+ */
+int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size);
+
 
 typedef struct {
     uint32_t drom_addr;

components/bootloader_support/include_bootloader/bootloader_flash_priv.h

@@ -19,11 +19,28 @@
 #include <stdint.h>
 #include <esp_err.h>
 #include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "bootloader_flash.h"
 
 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 0x10000
 #define MMAP_ALIGNED_MASK 0x0000FFFF
 
+/* SPI commands (actual on-wire commands not SPI controller bitmasks)
+   Suitable for use with the bootloader_execute_flash_command static function.
+*/
+#define CMD_RDID       0x9F
+#define CMD_WRSR       0x01
+#define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
+#define CMD_WREN       0x06
+#define CMD_WRDI       0x04
+#define CMD_RDSR       0x05
+#define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
+#define CMD_RDSFDP     0x5A /* Read the SFDP of the flash */
+#define CMD_WRAP       0x77 /* Set burst with wrap command */
+
+
 /* Provide a Flash API for bootloader_support code,
    that can be used from bootloader or app code.
 
@@ -136,4 +153,29 @@ static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vad
     return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
 }
 
+/**
+ * @brief Execute a user command on the flash
+ *
+ * @param command The command value to execute.
+ * @param mosi_data MOSI data to send
+ * @param mosi_len Length of MOSI data, in bits
+ * @param miso_len Length of MISO data to receive, in bits
+ * @return Received MISO data
+ */
+uint32_t bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len);
+
+/**
+ * @brief Read the SFDP of the flash
+ *
+ * @param sfdp_addr Address of the parameter to read
+ * @param miso_byte_num Bytes to read
+ * @return The read SFDP, little endian, 4 bytes at most
+ */
+uint32_t bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num);
+
+/**
+ * @brief Enable the flash write protect (WEL bit).
+ */
+void bootloader_enable_wp(void);
+
 #endif

components/bootloader_support/include_bootloader/bootloader_utility.h

@@ -99,9 +99,10 @@ __attribute__((noreturn)) void bootloader_reset(void);
 esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);
 
 /**
- * @brief Debug log contents of a buffer as hexadecimal
+ * @brief Debug log contents of a buffer as hexadecimal.
  *
- * @note Only works if component log level is DEBUG or higher.
+ * @note - Only works if component log level is DEBUG or higher.
+ *       - It will print at most 128 bytes from @c buffer.
  *
  * @param buffer Buffer to log
  * @param length Length of buffer in bytes. Maximum length 128 bytes.

components/bootloader_support/include_bootloader/flash_qio_mode.h

@@ -13,6 +13,8 @@
 // limitations under the License.
 #pragma once
 
+#include <stdint.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif

components/bootloader_support/src/bootloader_common.c

@@ -28,11 +28,13 @@
 #include "esp32s2/rom/gpio.h"
 #endif
 #include "esp_flash_partitions.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_common.h"
+#include "bootloader_utility.h"
 #include "soc/gpio_periph.h"
 #include "soc/rtc.h"
 #include "soc/efuse_reg.h"
+#include "soc/soc_memory_layout.h"
 #include "esp_image_format.h"
 #include "bootloader_sha.h"
 #include "sys/param.h"
@@ -187,22 +189,7 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
         size = data.image_len;
     }
     // If image is type by data then hash is calculated for entire image.
-    const void *partition_bin = bootloader_mmap(address, size);
-    if (partition_bin == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", address, size);
-        return ESP_FAIL;
-    }
-    bootloader_sha256_handle_t sha_handle = bootloader_sha256_start();
-    if (sha_handle == NULL) {
-        bootloader_munmap(partition_bin);
-        return ESP_ERR_NO_MEM;
-    }
-    bootloader_sha256_data(sha_handle, partition_bin, size);
-    bootloader_sha256_finish(sha_handle, out_sha_256);
-
-    bootloader_munmap(partition_bin);
-
-    return ESP_OK;
+    return bootloader_sha256_flash_contents(address, size, out_sha_256);
 }
 
 int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata, bool *valid_two_otadata, bool max)
@@ -248,13 +235,15 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
         return ESP_ERR_INVALID_ARG;
     }
 
-    const uint8_t *image = bootloader_mmap(partition->offset, partition->size);
+    const uint32_t app_desc_offset = sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t);
+    const uint32_t mmap_size = app_desc_offset + sizeof(esp_app_desc_t);
+    const uint8_t *image = bootloader_mmap(partition->offset, mmap_size);
     if (image == NULL) {
-        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, partition->size);
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", partition->offset, mmap_size);
         return ESP_FAIL;
     }
 
-    memcpy(app_desc, image + sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t), sizeof(esp_app_desc_t));
+    memcpy(app_desc, image + app_desc_offset, sizeof(esp_app_desc_t));
     bootloader_munmap(image);
 
     if (app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
@@ -307,7 +296,18 @@ RESET_REASON bootloader_common_get_reset_reason(int cpu_no)
 
 #if defined( CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP ) || defined( CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC )
 
-rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)(SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t));
+#define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+
+rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
+
+#if !IS_BOOTLOADER_BUILD
+/* The app needs to be told this memory is reserved, important if configured to use RTC memory as heap.
+
+   Note that keeping this macro here only works when other symbols in this file are referenced by the app, as
+   this feature is otherwise 100% part of the bootloader. However this seems to happen in all apps.
+ */
+SOC_RESERVE_MEMORY_REGION(RTC_RETAIN_MEM_ADDR, RTC_RETAIN_MEM_ADDR + sizeof(rtc_retain_mem_t), rtc_retain_mem);
+#endif
 
 static bool check_rtc_retain_mem(void)
 {

components/bootloader_support/src/bootloader_efuse_esp32s2.c

@@ -15,9 +15,10 @@
 #include "sdkconfig.h"
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
+#include "soc/efuse_reg.h"
 
 uint8_t bootloader_common_get_chip_revision(void)
 {
-    /* No other revisions for ESP32-S2 */
-    return 0;
+    // should return the same value as esp_efuse_get_chip_ver()
+    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
 }

components/bootloader_support/src/bootloader_flash.c

@@ -13,13 +13,44 @@
 // limitations under the License.
 #include <stddef.h>
 
-#include <bootloader_flash.h>
+#include <bootloader_flash_priv.h>
 #include <esp_log.h>
 #include <esp_flash_encrypt.h>
-#if CONFIG_IDF_TARGET_ESP32S2
-#include "esp32s2/rom/spi_flash.h"
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
+
+#if CONFIG_IDF_TARGET_ESP32
+#   include "soc/spi_struct.h"
+#   include "soc/spi_reg.h"
+    /* SPI flash controller */
+#   define SPIFLASH SPI1
+#else
+#   include "soc/spi_mem_struct.h"
+#   include "soc/spi_mem_reg.h"
+    /* SPI flash controller */
+#   define SPIFLASH SPIMEM1
 #endif
 
+#if CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/spi_flash.h"
+#include "esp32/rom/ets_sys.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"  //For SPI_Encrypt_Write
+#include "esp32s2/rom/ets_sys.h"
+#endif
+
+#define BYTESHIFT(VAR, IDX)    (((VAR) >> ((IDX) * 8)) & 0xFF)
+#define ISSI_ID                0x9D
+#define MXIC_ID                0xC2
+#define GD_Q_ID_HIGH           0xC8
+#define GD_Q_ID_MID            0x40
+#define GD_Q_ID_LOW            0x16
+
+#define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI    (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
+#define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2        BIT1   // QE position when you write 8 bits(for SR2) at one time.
+#define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE     BIT9   // QE position when you write 16 bits at one time.
+
+
 #ifndef BOOTLOADER_BUILD
 /* Normal app version maps to esp_spi_flash.h operations...
  */
@@ -89,7 +120,7 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
     return spi_flash_erase_range(start_addr, size);
 }
 
-#else
+#else //BOOTLOADER_BUILD
 /* Bootloader version, uses ROM functions only */
 #include "soc/dport_reg.h"
 #if CONFIG_IDF_TARGET_ESP32
@@ -318,7 +349,7 @@ esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool
         return ESP_FAIL;
     }
 
-    err = spi_to_esp_err(esp_rom_spiflash_unlock());
+    err = bootloader_flash_unlock();
     if (err != ESP_OK) {
         return err;
     }
@@ -364,4 +395,332 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
     }
     return spi_to_esp_err(rc);
 }
+
+#endif // BOOTLOADER_BUILD
+
+FORCE_INLINE_ATTR bool is_issi_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == ISSI_ID;
+}
+
+// For GD25Q32, GD25Q64, GD25Q127C, GD25Q128, which use single command to read/write different SR.
+FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
+}
+
+FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
+}
+
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
+{
+    // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
+    // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
+    uint16_t status = 0;    // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
+    uint16_t new_status = 0;
+    uint8_t status_sr2 = 0;    // status_sr2 for SR2.
+    uint8_t new_status_sr2 = 0;
+    uint8_t sr1_bit_num = 0;
+    esp_err_t err = ESP_OK;
+
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+    if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
+        // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
+        // If any code here needs to be modified, check both chips.
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+
+        /* Clear all bits in the mask.
+        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
+        */
+        sr1_bit_num = 8;
+        new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
+    } else if (is_gd_q_chip(&g_rom_flashchip)) {
+        /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
+           Use 01H to write SR1 and 31H to write SR2.
+        */
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+        sr1_bit_num = 8;
+        new_status = 0;
+
+        status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
+        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
+    } else {
+        /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
+        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
+
+        /* Clear all bits except QE, if it is set.
+        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
+        */
+        sr1_bit_num = 16;
+        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
+    }
+
+    // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
+    bool status_written = false;
+    // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
+    if (status != new_status) {
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
+        status_written = true;
+    }
+
+    if (status_sr2 != new_status_sr2) {
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
+        status_written = true;
+    }
+
+    if (status_written) {
+        //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
+    }
+
+    return err;
+}
+
+
+/* dummy_len_plus values defined in ROM for SPI flash configuration */
+extern uint8_t g_rom_spiflash_dummy_len_plus[];
+IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
+    uint8_t command,
+    uint32_t addr_len, uint32_t address,
+    uint8_t dummy_len,
+    uint8_t mosi_len, uint32_t mosi_data,
+    uint8_t miso_len)
+{
+    assert(mosi_len <= 32);
+    assert(miso_len <= 32);
+    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
+    uint32_t old_user_reg = SPIFLASH.user.val;
+    uint32_t old_user1_reg = SPIFLASH.user1.val;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
+#else
+    SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
 #endif
+    //command phase
+    SPIFLASH.user.usr_command = 1;
+    SPIFLASH.user2.usr_command_bitlen = 7;
+    SPIFLASH.user2.usr_command_value = command;
+    //addr phase
+    SPIFLASH.user.usr_addr = addr_len > 0;
+    SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
+#else
+    SPIFLASH.addr = address;
+#endif
+    //dummy phase
+    if (miso_len > 0) {
+        uint32_t total_dummy = dummy_len + g_rom_spiflash_dummy_len_plus[1];
+        SPIFLASH.user.usr_dummy = total_dummy > 0;
+        SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
+    } else {
+        SPIFLASH.user.usr_dummy = 0;
+        SPIFLASH.user1.usr_dummy_cyclelen = 0;
+    }
+    //output data
+    SPIFLASH.user.usr_mosi = mosi_len > 0;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
+#else
+    SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
+#endif
+    SPIFLASH.data_buf[0] = mosi_data;
+    //input data
+    SPIFLASH.user.usr_miso = miso_len > 0;
+#if CONFIG_IDF_TARGET_ESP32
+    SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
+#else
+    SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
+#endif
+
+    SPIFLASH.cmd.usr = 1;
+    while (SPIFLASH.cmd.usr != 0) {
+    }
+    SPIFLASH.ctrl.val = old_ctrl_reg;
+    SPIFLASH.user.val = old_user_reg;
+    SPIFLASH.user1.val = old_user1_reg;
+
+    uint32_t ret = SPIFLASH.data_buf[0];
+    if (miso_len < 32) {
+        //set unused bits to 0
+        ret &= ~(UINT32_MAX << miso_len);
+    }
+    return ret;
+}
+
+uint32_t IRAM_ATTR bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
+{
+    const uint8_t addr_len = 0;
+    const uint8_t address = 0;
+    const uint8_t dummy_len = 0;
+
+    return bootloader_flash_execute_command_common(command, addr_len, address,
+            dummy_len, mosi_len, mosi_data, miso_len);
+}
+
+// cmd(0x5A) + 24bit address + 8 cycles dummy
+uint32_t IRAM_ATTR bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num)
+{
+    assert(miso_byte_num <= 4);
+    const uint8_t command = CMD_RDSFDP;
+    const uint8_t addr_len = 24;
+    const uint8_t dummy_len = 8;
+    const uint8_t mosi_len = 0;
+    const uint32_t mosi_data = 0;
+    const uint8_t miso_len = miso_byte_num * 8;
+
+    return bootloader_flash_execute_command_common(command, addr_len, sfdp_addr,
+            dummy_len, mosi_len, mosi_data, miso_len);
+}
+
+void bootloader_enable_wp(void)
+{
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+}
+
+uint32_t IRAM_ATTR bootloader_read_flash_id(void)
+{
+    uint32_t id = bootloader_execute_flash_command(CMD_RDID, 0, 0, 24);
+    id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
+    return id;
+}
+
+#if SOC_CACHE_SUPPORT_WRAP
+esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode)
+{
+    uint32_t reg_bkp_ctrl = SPIFLASH.ctrl.val;
+    uint32_t reg_bkp_usr  = SPIFLASH.user.val;
+    SPIFLASH.user.fwrite_dio = 0;
+    SPIFLASH.user.fwrite_dual = 0;
+    SPIFLASH.user.fwrite_qio = 1;
+    SPIFLASH.user.fwrite_quad = 0;
+    SPIFLASH.ctrl.fcmd_dual = 0;
+    SPIFLASH.ctrl.fcmd_quad = 0;
+    SPIFLASH.user.usr_dummy = 0;
+    SPIFLASH.user.usr_addr = 1;
+    SPIFLASH.user.usr_command = 1;
+    SPIFLASH.user2.usr_command_bitlen = 7;
+    SPIFLASH.user2.usr_command_value = CMD_WRAP;
+    SPIFLASH.user1.usr_addr_bitlen = 23;
+    SPIFLASH.addr = 0;
+    SPIFLASH.user.usr_miso = 0;
+    SPIFLASH.user.usr_mosi = 1;
+    SPIFLASH.mosi_dlen.usr_mosi_bit_len = 7;
+    SPIFLASH.data_buf[0] = (uint32_t) mode << 4;;
+    SPIFLASH.cmd.usr = 1;
+    while(SPIFLASH.cmd.usr != 0)
+    { }
+
+    SPIFLASH.ctrl.val = reg_bkp_ctrl;
+    SPIFLASH.user.val = reg_bkp_usr;
+    return ESP_OK;
+}
+#endif //SOC_CACHE_SUPPORT_WRAP
+
+/*******************************************************************************
+ * XMC startup flow
+ ******************************************************************************/
+
+#define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
+#define XMC_VENDOR_ID 0x20
+
+#if BOOTLOADER_BUILD
+#define BOOTLOADER_FLASH_LOG(level, ...)    ESP_LOG##level(TAG, ##__VA_ARGS__)
+#else
+static DRAM_ATTR char bootloader_flash_tag[] = "bootloader_flash";
+#define BOOTLOADER_FLASH_LOG(level, ...)    ESP_DRAM_LOG##level(bootloader_flash_tag, ##__VA_ARGS__)
+#endif
+
+#if XMC_SUPPORT
+//strictly check the model
+static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
+{
+    uint32_t vendor_id = BYTESHIFT(rdid, 2);
+    uint32_t mfid = BYTESHIFT(rdid, 1);
+    uint32_t cpid = BYTESHIFT(rdid, 0);
+
+    if (vendor_id != XMC_VENDOR_ID) {
+        return false;
+    }
+
+    bool matched = false;
+    if (mfid == 0x40) {
+        if (cpid >= 0x13 && cpid <= 0x20) {
+            matched = true;
+        }
+    } else if (mfid == 0x41) {
+        if (cpid >= 0x17 && cpid <= 0x20) {
+            matched = true;
+        }
+    } else if (mfid == 0x50) {
+        if (cpid >= 0x15 && cpid <= 0x16) {
+            matched =  true;
+        }
+    }
+    return matched;
+}
+
+esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
+{
+    // If the RDID value is a valid XMC one, may skip the flow
+    const bool fast_check = true;
+    if (fast_check && is_xmc_chip_strict(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(D, "XMC chip detected by RDID (%08X), skip.", g_rom_flashchip.device_id);
+        return ESP_OK;
+    }
+
+    // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
+    const int sfdp_mfid_addr = 0x10;
+    uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
+    if (mf_id != XMC_VENDOR_ID) {
+        BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
+        return ESP_OK;
+    }
+
+    BOOTLOADER_FLASH_LOG(I, "XM25QHxxC startup flow");
+    // Enter DPD
+    bootloader_execute_flash_command(0xB9, 0, 0, 0);
+    // Enter UDPD
+    bootloader_execute_flash_command(0x79, 0, 0, 0);
+    // Exit UDPD
+    bootloader_execute_flash_command(0xFF, 0, 0, 0);
+    // Delay tXUDPD
+    ets_delay_us(2000);
+    // Release Power-down
+    bootloader_execute_flash_command(0xAB, 0, 0, 0);
+    ets_delay_us(20);
+    // Read flash ID and check again
+    g_rom_flashchip.device_id = bootloader_read_flash_id();
+    if (!is_xmc_chip_strict(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(E, "XMC flash startup fail");
+        return ESP_FAIL;
+    }
+
+    return ESP_OK;
+}
+
+#else
+//only compare the vendor id
+static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
+{
+    uint32_t vendor_id = (rdid >> 16) & 0xFF;
+    return (vendor_id == XMC_VENDOR_ID);
+}
+
+esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
+{
+    if (is_xmc_chip(g_rom_flashchip.device_id)) {
+        BOOTLOADER_FLASH_LOG(E, "XMC chip detected (%08X) while support disabled.", g_rom_flashchip.device_id);
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+#endif //XMC_SUPPORT

components/bootloader_support/src/bootloader_flash_config_esp32.c

@@ -25,6 +25,7 @@
 #include "soc/spi_reg.h"
 #include "soc/spi_caps.h"
 #include "flash_qio_mode.h"
+#include "bootloader_common.h"
 #include "bootloader_flash_config.h"
 
 void bootloader_flash_update_id(void)
@@ -32,6 +33,11 @@ void bootloader_flash_update_id(void)
     g_rom_flashchip.device_id = bootloader_read_flash_id();
 }
 
+void bootloader_flash_update_size(uint32_t size)
+{
+    g_rom_flashchip.chip_size = size;
+}
+
 void IRAM_ATTR bootloader_flash_cs_timing_config(void)
 {
     SET_PERI_REG_MASK(SPI_USER_REG(0), SPI_CS_HOLD_M | SPI_CS_SETUP_M);
@@ -75,18 +81,11 @@ void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
     uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     uint32_t pkg_ver = chip_ver & 0x7;
 
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302) {
+        // For ESP32D2WD or ESP32-PICO series,the SPI pins are already configured
         // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
@@ -163,4 +162,33 @@ void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t* pfhdr)
 
     SET_PERI_REG_BITS(SPI_USER1_REG(0), SPI_USR_DUMMY_CYCLELEN_V, spi_cache_dummy + g_rom_spiflash_dummy_len_plus[0],
             SPI_USR_DUMMY_CYCLELEN_S);
-}
+}
+
+#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD & ESP32-PICO-D4 has this GPIO wired to WP pin of flash */
+#define ESP32_PICO_V3_GPIO 18 /* ESP32-PICO-V3* use this GPIO for WP pin of flash */
+
+int bootloader_flash_get_wp_pin(void)
+{
+#if CONFIG_BOOTLOADER_SPI_CUSTOM_WP_PIN
+    return CONFIG_BOOTLOADER_SPI_WP_PIN; // can be set for bootloader when QIO or QOUT config in use
+#elif CONFIG_SPIRAM_CUSTOM_SPIWP_SD3_PIN
+    return CONFIG_SPIRAM_SPIWP_SD3_PIN; // can be set for app when DIO or DOUT config used for PSRAM only
+#else
+    // no custom value, find it based on the package eFuse value
+    uint8_t chip_ver;
+    uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
+    switch(pkg_ver) {
+    case EFUSE_RD_CHIP_VER_PKG_ESP32U4WDH:
+    case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
+        return ESP32_D2WD_WP_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
+        /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
+        chip_ver = bootloader_common_get_chip_revision();
+        return (chip_ver < 3) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
+    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
+        return ESP32_PICO_V3_GPIO;
+    default:
+        return SPI_WP_GPIO_NUM;
+    }
+#endif
+}

components/bootloader_support/src/bootloader_flash_config_esp32s2.c

@@ -39,6 +39,11 @@ void bootloader_flash_update_id()
     g_rom_flashchip.device_id = bootloader_read_flash_id();
 }
 
+void bootloader_flash_update_size(uint32_t size)
+{
+    g_rom_flashchip.chip_size = size;
+}
+
 void IRAM_ATTR bootloader_flash_cs_timing_config()
 {
     SET_PERI_REG_MASK(SPI_MEM_USER_REG(0), SPI_MEM_CS_HOLD_M | SPI_MEM_CS_SETUP_M);
@@ -69,6 +74,7 @@ void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t* pfhdr)
             break;
     }
     esp_rom_spiflash_config_clk(spi_clk_div, 0);
+    esp_rom_spiflash_config_clk(spi_clk_div, 1);
 }
 
 void IRAM_ATTR bootloader_flash_set_dummy_out(void)

components/bootloader_support/src/bootloader_init.c

@@ -14,9 +14,10 @@
 #include <string.h>
 #include <stdint.h>
 #include "sdkconfig.h"
+#include "esp_attr.h"
 #include "esp_log.h"
 #include "bootloader_init.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_random.h"
 #include "bootloader_clock.h"
@@ -28,7 +29,7 @@
 
 static const char *TAG = "boot";
 
-esp_image_header_t bootloader_image_hdr;
+esp_image_header_t WORD_ALIGNED_ATTR bootloader_image_hdr;
 
 void bootloader_clear_bss_section(void)
 {

components/bootloader_support/src/bootloader_random.c

@@ -1,4 +1,4 @@
-// Copyright 2010-2016 Espressif Systems (Shanghai) PTE LTD
+// Copyright 2010-2020 Espressif Systems (Shanghai) PTE LTD
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -15,16 +15,6 @@
 #include "bootloader_random.h"
 #include "soc/cpu.h"
 #include "soc/wdev_reg.h"
-#include "soc/rtc_periph.h"
-#include "soc/sens_periph.h"
-#include "soc/syscon_periph.h"
-#include "soc/dport_reg.h"
-#include "soc/i2s_periph.h"
-#include "esp_log.h"
-#include "soc/io_mux_reg.h"
-#if CONFIG_IDF_TARGET_ESP32S2
-#include "soc/apb_saradc_reg.h"
-#endif
 
 #ifndef BOOTLOADER_BUILD
 #include "esp_system.h"
@@ -64,150 +54,3 @@ void bootloader_fill_random(void *buffer, size_t length)
     }
 }
 #endif // BOOTLOADER_BUILD
-
-void bootloader_random_enable(void)
-{
-    /* Ensure the hardware RNG is enabled following a soft reset.  This should always be the case already (this clock is
-       never disabled while the CPU is running), this is a "belts and braces" type check.
-     */
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
-#else
-    periph_module_enable(PERIPH_RNG_MODULE);
-#endif // BOOTLOADER_BUILD
-
-    /* Enable SAR ADC in test mode to feed ADC readings of the 1.1V
-       reference via I2S into the RNG entropy input.
-
-       Note: I2S requires the PLL to be running, so the call to rtc_set_cpu_freq(CPU_80M)
-       in early bootloader startup must have been made.
-    */
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 2, RTC_CNTL_DTEST_RTC_S);
-    SET_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
-    SET_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
-
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-#else
-    periph_module_enable(PERIPH_I2S0_MODULE);
-#endif // BOOTLOADER_BUILD
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_FORCE_START_TOP);
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_START_TOP);
-#elif CONFIG_IDF_TARGET_ESP32S2
-    /* Disable IO1 digital function for random function. */
-    PIN_INPUT_DISABLE(PERIPHS_IO_MUX_GPIO1_U);
-    PIN_PULLDWN_DIS(PERIPHS_IO_MUX_GPIO1_U);
-    PIN_PULLUP_DIS(PERIPHS_IO_MUX_GPIO1_U);
-    WRITE_PERI_REG(APB_SARADC_SAR1_PATT_TAB1_REG, 0xFFFFFFFF);
-
-    SET_PERI_REG_MASK(SENS_SAR_MEAS2_CTRL1_REG, SENS_SAR2_EN_TEST);
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-    CLEAR_PERI_REG_MASK(RTC_CNTL_ULP_CP_CTRL_REG, RTC_CNTL_ULP_CP_FORCE_START_TOP);
-    CLEAR_PERI_REG_MASK(RTC_CNTL_ULP_CP_CTRL_REG, RTC_CNTL_ULP_CP_START_TOP);
-#endif
-
-    // Test pattern configuration byte 0xAD:
-    //--[7:4] channel_sel: 10-->en_test
-    //--[3:2] bit_width  : 3-->12bit
-    //--[1:0] atten      : 1-->3dB attenuation
-#if CONFIG_IDF_TARGET_ESP32
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB1_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB2_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB3_REG, 0xADADADAD);
-    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB4_REG, 0xADADADAD);
-    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
-    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
-    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
-#elif CONFIG_IDF_TARGET_ESP32S2
-    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB1_REG, 0xADADADAD);
-    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB2_REG, 0xADADADAD);
-    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB3_REG, 0xADADADAD);
-    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB4_REG, 0xADADADAD);
-    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
-    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX);
-    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_CLK_DIV, 4, SYSCON_SARADC_SAR_CLK_DIV_S);
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_RSTB_WAIT, 8, SYSCON_SARADC_RSTB_WAIT_S); /* was 1 */
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 10, SYSCON_SARADC_START_WAIT_S);
-    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_WORK_MODE, 0, SYSCON_SARADC_WORK_MODE_S);
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_SEL);
-    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_SAR_SEL);
-    SET_PERI_REG_BITS(I2S_SAMPLE_RATE_CONF_REG(0), I2S_RX_BCK_DIV_NUM, 20, I2S_RX_BCK_DIV_NUM_S);
-    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_TO_I2S);
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SET_PERI_REG_BITS(APB_SARADC_CTRL_REG, APB_SARADC_SAR_CLK_DIV, 4, APB_SARADC_SAR_CLK_DIV_S);
-    SET_PERI_REG_BITS(APB_SARADC_FSM_REG, APB_SARADC_RSTB_WAIT, 8, APB_SARADC_RSTB_WAIT_S); /* was 1 */
-    SET_PERI_REG_BITS(APB_SARADC_CTRL_REG, APB_SARADC_WORK_MODE, 0, APB_SARADC_WORK_MODE_S);
-    SET_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_SAR_SEL);
-    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_DATA_SAR_SEL);
-    SET_PERI_REG_BITS(I2S_SAMPLE_RATE_CONF_REG(0), I2S_RX_BCK_DIV_NUM, 20, I2S_RX_BCK_DIV_NUM_S);
-    SET_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_DATA_TO_I2S);
-#endif
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
-    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
-}
-
-void bootloader_random_disable(void)
-{
-    /* Reset some i2s configuration (possibly redundant as we reset entire
-       I2S peripheral further down). */
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
-    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
-    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
-    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
-
-    /* Disable i2s clock */
-#ifdef BOOTLOADER_BUILD
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
-#else
-    periph_module_disable(PERIPH_I2S0_MODULE);
-#endif // BOOTLOADER_BUILD
-
-    /* Restore SYSCON mode registers */
-#if CONFIG_IDF_TARGET_ESP32
-    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
-    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
-#elif CONFIG_IDF_TARGET_ESP32S2
-    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    /* Restore SAR ADC mode */
-    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
-    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX
-                        | SYSCON_SARADC_SAR_SEL | SYSCON_SARADC_DATA_TO_I2S);
-    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
-#elif CONFIG_IDF_TARGET_ESP32S2
-    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS2_CTRL1_REG, SENS_SAR2_EN_TEST);
-    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_SAR_SEL | APB_SARADC_DATA_TO_I2S);
-    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 8, SYSCON_SARADC_START_WAIT_S);
-#endif
-
-    /* Reset i2s peripheral */
-#ifdef BOOTLOADER_BUILD
-    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
-    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
-#else
-    periph_module_reset(PERIPH_I2S0_MODULE);
-#endif
-
-#if CONFIG_IDF_TARGET_ESP32
-    /* Disable pull supply voltage to SAR ADC */
-    CLEAR_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
-    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 0, RTC_CNTL_DTEST_RTC_S);
-#endif
-}

components/bootloader_support/src/bootloader_random_esp32.c

@@ -0,0 +1,128 @@
+// Copyright 2016-2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "sdkconfig.h"
+#include "bootloader_random.h"
+#include "soc/rtc_periph.h"
+#include "soc/sens_periph.h"
+#include "soc/syscon_periph.h"
+#include "soc/dport_reg.h"
+#include "soc/i2s_periph.h"
+#include "esp_log.h"
+#include "soc/io_mux_reg.h"
+
+#ifndef BOOTLOADER_BUILD
+#include "driver/periph_ctrl.h"
+#endif
+
+void bootloader_random_enable(void)
+{
+    /* Ensure the hardware RNG is enabled following a soft reset.  This should always be the case already (this clock is
+       never disabled while the CPU is running), this is a "belts and braces" type check.
+     */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
+#else
+    periph_module_enable(PERIPH_RNG_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    /* Enable SAR ADC in test mode to feed ADC readings of the 1.1V
+       reference via I2S into the RNG entropy input.
+
+       Note: I2S requires the PLL to be running, so the call to rtc_set_cpu_freq(CPU_80M)
+       in early bootloader startup must have been made.
+    */
+    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 2, RTC_CNTL_DTEST_RTC_S);
+    SET_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
+    SET_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
+
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
+#else
+    periph_module_enable(PERIPH_I2S0_MODULE);
+#endif // BOOTLOADER_BUILD
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_FORCE_START_TOP);
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_ULP_CP_START_TOP);
+
+    // Test pattern configuration byte 0xAD:
+    //--[7:4] channel_sel: 10-->en_test
+    //--[3:2] bit_width  : 3-->12bit
+    //--[1:0] atten      : 1-->3dB attenuation
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB1_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB2_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB3_REG, 0xADADADAD);
+    WRITE_PERI_REG(SYSCON_SARADC_SAR2_PATT_TAB4_REG, 0xADADADAD);
+    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 3, SENS_FORCE_XPD_SAR_S);
+    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
+    SET_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
+
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX);
+    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_CLK_DIV, 4, SYSCON_SARADC_SAR_CLK_DIV_S);
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_RSTB_WAIT, 8, SYSCON_SARADC_RSTB_WAIT_S); /* was 1 */
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 10, SYSCON_SARADC_START_WAIT_S);
+    SET_PERI_REG_BITS(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_WORK_MODE, 0, SYSCON_SARADC_WORK_MODE_S);
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR_SEL);
+    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_SAR_SEL);
+    SET_PERI_REG_BITS(I2S_SAMPLE_RATE_CONF_REG(0), I2S_RX_BCK_DIV_NUM, 20, I2S_RX_BCK_DIV_NUM_S);
+    SET_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_DATA_TO_I2S);
+
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
+    SET_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+}
+
+void bootloader_random_disable(void)
+{
+    /* Reset some i2s configuration (possibly redundant as we reset entire
+       I2S peripheral further down). */
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_START);
+    SET_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF_REG(0), I2S_RX_RESET);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_CAMERA_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_LCD_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE_TEST_EN);
+    CLEAR_PERI_REG_MASK(I2S_CONF2_REG(0), I2S_DATA_ENABLE);
+
+    /* Disable i2s clock */
+#ifdef BOOTLOADER_BUILD
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_CLK_EN_REG, DPORT_I2S0_CLK_EN);
+#else
+    periph_module_disable(PERIPH_I2S0_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    /* Restore SYSCON mode registers */
+    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL_REG, SENS_SAR1_DIG_FORCE);
+    CLEAR_PERI_REG_MASK(SENS_SAR_READ_CTRL2_REG, SENS_SAR2_DIG_FORCE);
+
+    /* Restore SAR ADC mode */
+    CLEAR_PERI_REG_MASK(SENS_SAR_START_FORCE_REG, SENS_SAR2_EN_TEST);
+    CLEAR_PERI_REG_MASK(SYSCON_SARADC_CTRL_REG, SYSCON_SARADC_SAR2_MUX
+                        | SYSCON_SARADC_SAR_SEL | SYSCON_SARADC_DATA_TO_I2S);
+    SET_PERI_REG_BITS(SENS_SAR_MEAS_WAIT2_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
+
+    SET_PERI_REG_BITS(SYSCON_SARADC_FSM_REG, SYSCON_SARADC_START_WAIT, 8, SYSCON_SARADC_START_WAIT_S);
+
+    /* Reset i2s peripheral */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, DPORT_I2S0_RST);
+#else
+    periph_module_reset(PERIPH_I2S0_MODULE);
+#endif
+
+    /* Disable pull supply voltage to SAR ADC */
+    CLEAR_PERI_REG_MASK(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_ENT_RTC);
+    SET_PERI_REG_BITS(RTC_CNTL_TEST_MUX_REG, RTC_CNTL_DTEST_RTC, 0, RTC_CNTL_DTEST_RTC_S);
+}

components/bootloader_support/src/bootloader_random_esp32s2.c

@@ -0,0 +1,106 @@
+// Copyright 2019-2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include "sdkconfig.h"
+#include "bootloader_random.h"
+#include "soc/rtc_periph.h"
+#include "soc/sens_periph.h"
+#include "soc/syscon_periph.h"
+#include "soc/dport_reg.h"
+#include "soc/i2s_periph.h"
+#include "esp_log.h"
+#include "soc/io_mux_reg.h"
+#include "soc/apb_saradc_reg.h"
+#include "regi2c_ctrl.h"
+#include "hal/adc_ll.h"
+
+#ifndef BOOTLOADER_BUILD
+#include "driver/periph_ctrl.h"
+#endif
+
+void bootloader_random_enable(void)
+{
+    /* Ensure the Wifi clock for RNG modiule is enabled following a soft reset.  This should always be the case already
+       (this clock is never disabled while the CPU is running), this is a "belt and braces" type check.
+     */
+#ifdef BOOTLOADER_BUILD
+    DPORT_SET_PERI_REG_MASK(DPORT_WIFI_CLK_EN_REG, DPORT_WIFI_CLK_RNG_EN);
+#else
+    periph_module_enable(PERIPH_RNG_MODULE);
+#endif // BOOTLOADER_BUILD
+
+    // Enable 8M clock source for RNG (this is actually enough to produce strong random results,
+    // but enabling the SAR ADC as well adds some insurance.)
+    REG_SET_BIT(RTC_CNTL_CLK_CONF_REG, RTC_CNTL_DIG_CLK8M_EN);
+
+    // Enable SAR ADC to read a disconnected input for additional entropy
+    SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN0_REG,DPORT_APB_SARADC_CLK_EN);
+
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_SEL, 2);
+
+    CLEAR_PERI_REG_MASK(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_SAR_I2C_FORCE_PD_M);
+    SET_PERI_REG_MASK(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_SAR_I2C_FORCE_PU_M);
+    CLEAR_PERI_REG_MASK(ANA_CONFIG_REG, BIT(18));
+    SET_PERI_REG_MASK(ANA_CONFIG2_REG, BIT(16));
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_DREF_ADDR, 0x4);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_DREF_ADDR, 0x4);
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR1_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR1_PATT_TAB1_REG,0xafffffff);    // set adc1 channel & bitwidth & atten
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR2_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB1_REG,0xafffffff); //set adc2 channel & bitwidth & atten
+
+    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG,SENS_SAR1_DIG_FORCE);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG,APB_SARADC_WORK_MODE, 1);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_MEAS_NUM_LIMIT);
+
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3);
+
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_TIMER_SEL);
+
+    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_TARGET, 100);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG,APB_SARADC_START_FORCE);
+
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG,APB_SARADC_TIMER_EN);
+}
+
+void bootloader_random_disable(void)
+{
+    /* Restore internal I2C bus state */
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_DREF_ADDR, 0x1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_DREF_ADDR, 0x1);
+
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+
+    /* Restore SARADC to default mode */
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+    SET_PERI_REG_MASK(DPORT_PERIP_CLK_EN0_REG, DPORT_APB_SARADC_CLK_EN);
+    SET_PERI_REG_BITS(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0, SENS_FORCE_XPD_SAR_S);
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    /* Note: the 8M CLK entropy source continues running even after this function is called,
+       but as mentioned above it's better to enable Wi-Fi or BT or call bootloader_random_enable()
+       in order to get a secondary entropy source.
+    */
+}

components/bootloader_support/src/bootloader_utility.c

@@ -59,13 +59,14 @@
 #include "esp_secure_boot.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "bootloader_config.h"
 #include "bootloader_common.h"
 #include "bootloader_utility.h"
 #include "bootloader_sha.h"
 #include "esp_efuse.h"
+#include "esp_fault.h"
 
 static const char *TAG = "boot";
 
@@ -257,9 +258,16 @@ static esp_err_t write_otadata(esp_ota_select_entry_t *otadata, uint32_t offset,
 static bool check_anti_rollback(const esp_partition_pos_t *partition)
 {
 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
-    esp_app_desc_t app_desc;
+    esp_app_desc_t app_desc = {};
     esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
-    return err == ESP_OK && esp_efuse_check_secure_version(app_desc.secure_version) == true;
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
+        return false;
+    }
+    bool sec_ver = esp_efuse_check_secure_version(app_desc.secure_version);
+    /* Anti FI check */
+    ESP_FAULT_ASSERT(sec_ver == esp_efuse_check_secure_version(app_desc.secure_version));
+    return sec_ver;
 #else
     return true;
 #endif
@@ -272,6 +280,8 @@ static void update_anti_rollback(const esp_partition_pos_t *partition)
     esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
     if (err == ESP_OK) {
         esp_efuse_update_secure_version(app_desc.secure_version);
+    } else {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
     }
 }
 
@@ -800,27 +810,25 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he
 
 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
 {
-#if BOOT_LOG_LEVEL >= LOG_LEVEL_DEBUG
-    assert(length <= 128); // Avoid unbounded VLA size
+#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
     const uint8_t *bytes = (const uint8_t *)buffer;
-    char hexbuf[length * 2 + 1];
-    hexbuf[length * 2] = 0;
-    for (int i = 0; i < length; i++) {
-        for (int shift = 0; shift < 2; shift++) {
-            uint8_t nibble = (bytes[i] >> (shift ? 0 : 4)) & 0x0F;
-            if (nibble < 10) {
-                hexbuf[i * 2 + shift] = '0' + nibble;
-            } else {
-                hexbuf[i * 2 + shift] = 'a' + nibble - 10;
-            }
-        }
-    }
+    const size_t output_len = MIN(length, 128);
+    char hexbuf[128 * 2 + 1];
+
+    bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
+
+    hexbuf[output_len * 2] = '\0';
     ESP_LOGD(TAG, "%s: %s", label, hexbuf);
+#else
+    (void) buffer;
+    (void) length;
+    (void) label;
 #endif
 }
 
 esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
 {
+
     if (digest == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -837,7 +845,7 @@ esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len,
     while (len > 0) {
         uint32_t mmu_page_offset = ((flash_offset & MMAP_ALIGNED_MASK) != 0) ? 1 : 0; /* Skip 1st MMU Page if it is already populated */
         uint32_t partial_image_len = MIN(len, ((mmu_free_pages_count - mmu_page_offset) * SPI_FLASH_MMU_PAGE_SIZE)); /* Read the image that fits in the free MMU pages */
-        
+
         const void * image = bootloader_mmap(flash_offset, partial_image_len);
         if (image == NULL) {
             bootloader_sha256_finish(sha_handle, NULL);

components/bootloader_support/src/esp32/bootloader_esp32.c

@@ -23,6 +23,7 @@
 #include "bootloader_common.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_mem.h"
+#include "bootloader_flash_priv.h"
 
 #include "soc/cpu.h"
 #include "soc/dport_reg.h"
@@ -55,18 +56,11 @@ void bootloader_configure_spi_pins(int drv)
     uint32_t chip_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
     uint32_t pkg_ver = chip_ver & 0x7;
 
-    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5) {
-        // For ESP32D2WD the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2) {
-        // For ESP32PICOD2 the SPI pins are already configured
-        // flash clock signal should come from IO MUX.
-        PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
-        SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
-    } else if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4) {
-        // For ESP32PICOD4 the SPI pins are already configured
+    if (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4 ||
+        pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302) {
+        // For ESP32D2WD or ESP32-PICO series,the SPI pins are already configured
         // flash clock signal should come from IO MUX.
         PIN_FUNC_SELECT(PERIPHS_IO_MUX_SD_CLK_U, FUNC_SD_CLK_SPICLK);
         SET_PERI_REG_BITS(PERIPHS_IO_MUX_SD_CLK_U, FUN_DRV, drv, FUN_DRV_S);
@@ -266,7 +260,7 @@ static esp_err_t bootloader_init_spi_flash(void)
     }
 #endif
 
-    esp_rom_spiflash_unlock();
+    bootloader_flash_unlock();
 
 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
     bootloader_enable_qio_mode();
@@ -274,6 +268,8 @@ static esp_err_t bootloader_init_spi_flash(void)
 
     print_flash_info(&bootloader_image_hdr);
     update_flash_config(&bootloader_image_hdr);
+    //ensure the flash is write-protected
+    bootloader_enable_wp();
     return ESP_OK;
 }
 
@@ -312,11 +308,13 @@ static void bootloader_init_uart_console(void)
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
 
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
         PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
         gpio_pad_pullup(uart_rx_gpio);
 
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
 
         DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
         DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
@@ -457,6 +455,11 @@ esp_err_t bootloader_init(void)
     bootloader_print_banner();
     // update flash ID
     bootloader_flash_update_id();
+    // Check and run XMC startup flow
+    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
+        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        goto err;
+    }
     // read bootloader header
     if ((ret = bootloader_read_bootloader_header()) != ESP_OK) {
         goto err;

components/bootloader_support/src/esp32/flash_encrypt.c

@@ -14,7 +14,7 @@
 
 #include <strings.h>
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "esp_image_format.h"
 #include "esp_flash_encrypt.h"
 #include "esp_flash_partitions.h"
@@ -252,9 +252,7 @@ static esp_err_t encrypt_bootloader(void)
         ESP_LOGD(TAG, "bootloader is plaintext. Encrypting...");
 
 #if CONFIG_SECURE_BOOT_V2_ENABLED
-        // Account for the signature sector after the bootloader
-        image_length = (image_length + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE - 1);
-        image_length += FLASH_SECTOR_SIZE;
+        /* The image length obtained from esp_image_verify_bootloader includes the sector boundary padding and the signature block lengths */
         if (ESP_BOOTLOADER_OFFSET + image_length > ESP_PARTITION_TABLE_OFFSET) {
             ESP_LOGE(TAG, "Bootloader is too large to fit Secure Boot V2 signature sector and partition table (configured offset 0x%x)", ESP_PARTITION_TABLE_OFFSET);
             return ESP_ERR_INVALID_STATE;

components/bootloader_support/src/esp32/secure_boot.c

@@ -29,7 +29,7 @@
 
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "esp_image_format.h"
 #include "esp_secure_boot.h"
@@ -319,16 +319,26 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
     uint32_t dis_reg = REG_READ(EFUSE_BLK0_RDATA0_REG);
     bool efuse_key_read_protected = dis_reg & EFUSE_RD_DIS_BLK2;
     bool efuse_key_write_protected = dis_reg & EFUSE_WR_DIS_BLK2;
-    if (efuse_key_write_protected == false 
-        && efuse_key_read_protected == false
-        && REG_READ(EFUSE_BLK2_RDATA0_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA1_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA2_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA3_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA4_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA5_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA6_REG) == 0
-        && REG_READ(EFUSE_BLK2_RDATA7_REG) == 0) {
+    uint32_t efuse_blk2_r0, efuse_blk2_r1, efuse_blk2_r2, efuse_blk2_r3, efuse_blk2_r4, efuse_blk2_r5, efuse_blk2_r6, efuse_blk2_r7;
+    efuse_blk2_r0 = REG_READ(EFUSE_BLK2_RDATA0_REG);
+    efuse_blk2_r1 = REG_READ(EFUSE_BLK2_RDATA1_REG);
+    efuse_blk2_r2 = REG_READ(EFUSE_BLK2_RDATA2_REG);
+    efuse_blk2_r3 = REG_READ(EFUSE_BLK2_RDATA3_REG);
+    efuse_blk2_r4 = REG_READ(EFUSE_BLK2_RDATA4_REG);
+    efuse_blk2_r5 = REG_READ(EFUSE_BLK2_RDATA5_REG);
+    efuse_blk2_r6 = REG_READ(EFUSE_BLK2_RDATA6_REG);
+    efuse_blk2_r7 = REG_READ(EFUSE_BLK2_RDATA7_REG);
+
+    if (efuse_key_read_protected == true) {
+        ESP_LOGE(TAG, "Secure Boot v2 digest(BLK2) read protected, aborting....");
+        return ESP_FAIL;
+    }
+
+    if (efuse_key_write_protected == false
+        && efuse_blk2_r0 == 0 && efuse_blk2_r1 == 0
+        && efuse_blk2_r2 == 0 && efuse_blk2_r3 == 0
+        && efuse_blk2_r4 == 0 && efuse_blk2_r5 == 0
+        && efuse_blk2_r6 == 0 && efuse_blk2_r7 == 0) {
         /* Verifies the signature block appended to the image matches with the signature block of the app to be loaded */
         ret = secure_boot_v2_digest_generate(bootloader_data.start_addr, bootloader_data.image_len - SIG_BLOCK_PADDING, boot_pub_key_digest);
         if (ret != ESP_OK) {
@@ -343,14 +353,26 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
             ESP_LOGD(TAG, "EFUSE_BLKx_WDATA%d_REG = 0x%08x", i, boot_public_key_digest_ptr[i]);
         }
 
-        ESP_LOGI(TAG, "Write protecting public key digest...");
-        new_wdata0 |= EFUSE_WR_DIS_BLK2;
-        efuse_key_write_protected = true;
-        efuse_key_read_protected = false;
     } else {
+        uint32_t efuse_blk2_digest[8];
+        efuse_blk2_digest[0] = efuse_blk2_r0;
+        efuse_blk2_digest[1] = efuse_blk2_r1;
+        efuse_blk2_digest[2] = efuse_blk2_r2;
+        efuse_blk2_digest[3] = efuse_blk2_r3;
+        efuse_blk2_digest[4] = efuse_blk2_r4;
+        efuse_blk2_digest[5] = efuse_blk2_r5;
+        efuse_blk2_digest[6] = efuse_blk2_r6;
+        efuse_blk2_digest[7] = efuse_blk2_r7;
+        memcpy(boot_pub_key_digest, efuse_blk2_digest, DIGEST_LEN);
         ESP_LOGW(TAG, "Using pre-loaded secure boot v2 public key digest in EFUSE block 2");
     }
 
+    if (efuse_key_write_protected == false) {
+        ESP_LOGI(TAG, "Write protecting public key digest...");
+        new_wdata0 |= EFUSE_WR_DIS_BLK2; // delay burning until second half of this function
+        efuse_key_write_protected = true;
+    }
+
     uint8_t app_pub_key_digest[DIGEST_LEN];
     ret = secure_boot_v2_digest_generate(image_data->start_addr, image_data->image_len - SIG_BLOCK_PADDING, app_pub_key_digest);
     if (ret != ESP_OK) {

components/bootloader_support/src/esp32/secure_boot_signatures.c

@@ -13,7 +13,7 @@
 // limitations under the License.
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 #include "esp_log.h"

components/bootloader_support/src/esp32s2/bootloader_esp32s2.c

@@ -26,6 +26,7 @@
 #include "bootloader_clock.h"
 #include "bootloader_flash_config.h"
 #include "bootloader_mem.h"
+#include "bootloader_flash_priv.h"
 
 #include "esp32s2/rom/cache.h"
 #include "esp32s2/rom/ets_sys.h"
@@ -205,7 +206,7 @@ static esp_err_t bootloader_init_spi_flash(void)
     }
 #endif
 
-    esp_rom_spiflash_unlock();
+    bootloader_flash_unlock();
 
 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
     bootloader_enable_qio_mode();
@@ -213,6 +214,8 @@ static esp_err_t bootloader_init_spi_flash(void)
 
     print_flash_info(&bootloader_image_hdr);
     update_flash_config(&bootloader_image_hdr);
+    //ensure the flash is write-protected
+    bootloader_enable_wp();
     return ESP_OK;
 }
 
@@ -251,11 +254,13 @@ static void bootloader_init_uart_console(void)
         const uint32_t tx_idx = tx_idx_list[uart_num];
         const uint32_t rx_idx = rx_idx_list[uart_num];
 
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
         PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
         gpio_pad_pullup(uart_rx_gpio);
 
         gpio_matrix_out(uart_tx_gpio, tx_idx, 0, 0);
         gpio_matrix_in(uart_rx_gpio, rx_idx, 0);
+        PIN_FUNC_SELECT(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
 
         DPORT_SET_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
         DPORT_CLEAR_PERI_REG_MASK(DPORT_PERIP_RST_EN_REG, uart_reset[uart_num]);
@@ -372,6 +377,11 @@ esp_err_t bootloader_init(void)
     bootloader_print_banner();
     // update flash ID
     bootloader_flash_update_id();
+    // Check and run XMC startup flow
+    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
+        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        goto err;
+    }
     // read bootloader header
     if ((ret = bootloader_read_bootloader_header()) != ESP_OK) {
         goto err;

components/bootloader_support/src/esp32s2/flash_encrypt.c

@@ -14,7 +14,7 @@
 
 #include <strings.h>
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_random.h"
 #include "bootloader_utility.h"
 #include "esp_image_format.h"
@@ -211,6 +211,12 @@ static esp_err_t initialise_flash_encryption(void)
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
 
+#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
+    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
+    // otherwise the Flash Encryption key cannot be read protected
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+#endif
+
     esp_err_t err = esp_efuse_batch_write_commit();
 
     return err;
@@ -286,9 +292,7 @@ static esp_err_t encrypt_bootloader(void)
         ESP_LOGD(TAG, "bootloader is plaintext. Encrypting...");
 
 #if CONFIG_SECURE_BOOT_V2_ENABLED
-        // Account for the signature sector after the bootloader
-        image_length = (image_length + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE - 1);
-        image_length += FLASH_SECTOR_SIZE;
+        /* The image length obtained from esp_image_verify_bootloader includes the sector boundary padding and the signature block lengths */
         if (ESP_BOOTLOADER_OFFSET + image_length > ESP_PARTITION_TABLE_OFFSET) {
             ESP_LOGE(TAG, "Bootloader is too large to fit Secure Boot V2 signature sector and partition table (configured offset 0x%x)", ESP_PARTITION_TABLE_OFFSET);
             return ESP_ERR_INVALID_SIZE;
@@ -299,8 +303,8 @@ static esp_err_t encrypt_bootloader(void)
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt bootloader in place: 0x%x", err);
             return err;
-        } 
-        
+        }
+
         ESP_LOGI(TAG, "bootloader encrypted successfully");
         return err;
     }

components/bootloader_support/src/esp32s2/secure_boot.c

@@ -11,43 +11,342 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-#include "esp_secure_boot.h"
+#include <string.h>
+
 #include "esp_log.h"
+#include "esp_secure_boot.h"
+#include "soc/efuse_reg.h"
+
+#include "bootloader_flash_priv.h"
+#include "bootloader_sha.h"
+#include "bootloader_utility.h"
+
+#include "esp32s2/rom/crc.h"
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+
+#include "esp32s2/rom/efuse.h"
 #include "esp32s2/rom/secure_boot.h"
 
-static const char *TAG = "secure_boot";
+static const char *TAG = "secure_boot_v2";
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
-esp_err_t esp_secure_boot_permanently_enable(void)
+#define SIG_BLOCK_MAGIC_BYTE 0xe7
+#define CRC_SIGN_BLOCK_LEN 1196
+#define SIG_BLOCK_PADDING 4096
+
+#define DIGEST_LEN 32
+
+/* A signature block is valid when it has correct magic byte, crc and image digest. */
+static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *block, int block_num, const uint8_t *image_digest)
 {
-    uint8_t hash[32];
-
-    if (ets_efuse_secure_boot_enabled())
-    {
-        ESP_LOGI(TAG, "secure boot is already enabled, continuing..");
+    uint32_t crc = crc32_le(0, (uint8_t *)block, CRC_SIGN_BLOCK_LEN);
+    if (block->magic_byte != SIG_BLOCK_MAGIC_BYTE) {
+        // All signature blocks have been parsed, no new signature block present.
+        ESP_LOGD(TAG, "Signature block(%d) invalid/absent.", block_num);
+        return ESP_FAIL;
+    }
+    if (block->block_crc != crc) {
+        ESP_LOGE(TAG, "Magic byte correct but incorrect crc.");
+        return ESP_FAIL;
+    }
+    if (memcmp(image_digest, block->image_digest, DIGEST_LEN)) {
+        ESP_LOGE(TAG, "Magic byte & CRC correct but incorrect image digest.");
+        return ESP_FAIL;
+    } else {
+        ESP_LOGD(TAG, "valid signature block(%d) found", block_num);
         return ESP_OK;
     }
 
-    ESP_LOGI(TAG, "Verifying bootloader signature...\n");
-    int r = ets_secure_boot_verify_bootloader(hash, false);
-    if (r != ESP_OK) {
-        ESP_LOGE(TAG, "Failed to verify bootloader signature");
-        return r;
+    return ESP_FAIL;
+}
+
+/* Structure to hold public key digests calculated from the signature blocks of a single image.
+
+   Each image can have one or more signature blocks (up to SECURE_BOOT_NUM_BLOCKS). Each signature block
+   includes a public key.
+
+   Different to the ROM ets_secure_boot_key_digests_t structure which holds pointers to eFuse data with digests,
+   in this data structure the digest data is included.
+*/
+typedef struct {
+    uint8_t key_digests[SECURE_BOOT_NUM_BLOCKS][DIGEST_LEN];
+    unsigned num_digests; /* Number of valid digests, starting at index 0 */
+} image_sig_public_key_digests_t;
+
+/* Generates the public key digests of the valid public keys in an image's
+   signature block, verifies each signature, and stores the key digests in the
+   public_key_digests structure.
+
+   @param flash_offset Image offset in flash
+   @param flash_size Image size in flash (not including signature block)
+   @param[out] public_key_digests Pointer to structure to hold the key digests for valid sig blocks
+
+
+   Note that this function doesn't read any eFuses, so it doesn't know if the
+   keys are ultimately trusted by the hardware or not
+
+   @return - ESP_OK if no signatures failed to verify, or if no valid signature blocks are found at all.
+           - ESP_FAIL if there's a valid signature block that doesn't verify using the included public key (unexpected!)
+*/
+static esp_err_t s_calculate_image_public_key_digests(uint32_t flash_offset, uint32_t flash_size, image_sig_public_key_digests_t *public_key_digests)
+{
+    esp_err_t ret;
+    uint8_t image_digest[DIGEST_LEN] = {0};
+    uint8_t __attribute__((aligned(4))) key_digest[DIGEST_LEN] = {0};
+    size_t sig_block_addr = flash_offset + ALIGN_UP(flash_size, FLASH_SECTOR_SIZE);
+
+    ESP_LOGD(TAG, "calculating public key digests for sig blocks of image offset 0x%x (sig block offset 0x%x)", flash_offset, sig_block_addr);
+
+    bzero(public_key_digests, sizeof(image_sig_public_key_digests_t));
+
+    ret = bootloader_sha256_flash_contents(flash_offset, sig_block_addr - flash_offset, image_digest);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "error generating image digest, %d", ret);
+        return ret;
     }
 
-    esp_efuse_batch_write_begin(); /* Batch all efuse writes at the end of this function */
+    ESP_LOGD(TAG, "reading signatures");
+    const ets_secure_boot_signature_t *signatures = bootloader_mmap(sig_block_addr, sizeof(ets_secure_boot_signature_t));
+    if (signatures == NULL) {
+        ESP_LOGE(TAG, "bootloader_mmap(0x%x, 0x%x) failed", sig_block_addr, sizeof(ets_secure_boot_signature_t));
+        return ESP_FAIL;
+    }
+
+    for (int i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        const ets_secure_boot_sig_block_t *block = &signatures->block[i];
+
+        ret = validate_signature_block(block, i, image_digest);
+        if (ret != ESP_OK) {
+            ret = ESP_OK;  // past the last valid signature block
+            break;
+        }
+
+        /* Generating the SHA of the public key components in the signature block */
+        bootloader_sha256_handle_t sig_block_sha;
+        sig_block_sha = bootloader_sha256_start();
+        bootloader_sha256_data(sig_block_sha, &block->key, sizeof(block->key));
+        bootloader_sha256_finish(sig_block_sha, key_digest);
+
+        // Check we can verify the image using this signature and this key
+        uint8_t temp_verified_digest[DIGEST_LEN];
+        bool verified = ets_rsa_pss_verify(&block->key, block->signature, image_digest, temp_verified_digest);
+
+        if (!verified) {
+            /* We don't expect this: the signature blocks before we enable secure boot should all be verifiable or invalid,
+               so this is a fatal error
+            */
+            ret = ESP_FAIL;
+            ESP_LOGE(TAG, "Secure boot key (%d) verification failed.", i);
+            break;
+        }
+        ESP_LOGD(TAG, "Signature block (%d) is verified", i);
+        /* Copy the key digest to the buffer provided by the caller */
+        memcpy((void *)public_key_digests->key_digests[i], key_digest, DIGEST_LEN);
+        public_key_digests->num_digests++;
+    }
+
+    if (ret == ESP_OK && public_key_digests->num_digests > 0) {
+        ESP_LOGI(TAG, "Digests successfully calculated, %d valid signatures (image offset 0x%x)",
+                 public_key_digests->num_digests, flash_offset);
+    }
+
+    bootloader_munmap(signatures);
+    return ret;
+}
+
+esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *image_data)
+{
+    ESP_LOGI(TAG, "enabling secure boot v2 - ESP32-S2...");
+
+    if (esp_secure_boot_enabled()) {
+        ESP_LOGI(TAG, "secure boot v2 is already enabled, continuing..");
+        return ESP_OK;
+    }
+
+    esp_err_t ret;
+    /* Verify the bootloader */
+    esp_image_metadata_t bootloader_data = { 0 };
+    ret = esp_image_verify_bootloader_data(&bootloader_data);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "bootloader image appears invalid! error %d", ret);
+        return ret;
+    }
+
+    /* Check if secure boot digests are present */
+    bool has_secure_boot_digest = ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST0, NULL);
+    has_secure_boot_digest |= ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST1, NULL);
+    has_secure_boot_digest |= ets_efuse_find_purpose(ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST2, NULL);
+    ESP_LOGI(TAG, "Secure boot digests %s", has_secure_boot_digest ? "already present":"absent, generating..");
+
+    ets_efuse_clear_program_registers();
+    if (!has_secure_boot_digest) {
+        image_sig_public_key_digests_t boot_key_digests = {0};
+        image_sig_public_key_digests_t app_key_digests = {0};
+
+        /* Generate the bootloader public key digests */
+        ret = s_calculate_image_public_key_digests(bootloader_data.start_addr, bootloader_data.image_len - SIG_BLOCK_PADDING, &boot_key_digests);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "Bootloader signature block is invalid");
+            return ret;
+        }
+
+        if (boot_key_digests.num_digests == 0) {
+            ESP_LOGE(TAG, "No valid bootloader signature blocks found.");
+            return ESP_FAIL;
+        }
+        ESP_LOGI(TAG, "%d signature block(s) found appended to the bootloader.", boot_key_digests.num_digests);
+
+        int unused_key_slots = ets_efuse_count_unused_key_blocks();
+        if (boot_key_digests.num_digests > unused_key_slots) {
+            ESP_LOGE(TAG, "Bootloader signatures(%d) more than available key slots(%d).", boot_key_digests.num_digests, unused_key_slots);
+            return ESP_FAIL;
+        }
+
+        for (int i = 0; i < boot_key_digests.num_digests; i++) {
+            ets_efuse_block_t block;
+            const uint32_t secure_boot_key_purpose[SECURE_BOOT_NUM_BLOCKS] = { ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST0,
+                                ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST1, ETS_EFUSE_KEY_PURPOSE_SECURE_BOOT_DIGEST2 };
+
+            block = ets_efuse_find_unused_key_block();
+            if (block == ETS_EFUSE_BLOCK_MAX) {
+                ESP_LOGE(TAG, "No more unused key blocks available.");
+                return ESP_FAIL;
+            }
+
+            int r = ets_efuse_write_key(block, secure_boot_key_purpose[i], boot_key_digests.key_digests[i], DIGEST_LEN);
+            if (r != 0) {
+                ESP_LOGE(TAG, "Failed to write efuse block %d with purpose %d. Can't continue.", block, secure_boot_key_purpose[i]);
+                return ESP_FAIL;
+            }
+
+            // Note: write key will write protect both the block and the purpose eFuse, always
+        }
+
+        /* Generate the application public key digests */
+        ret = s_calculate_image_public_key_digests(image_data->start_addr, image_data->image_len - SIG_BLOCK_PADDING, &app_key_digests);
+        if (ret != ESP_OK) {
+            ESP_LOGE(TAG, "App signature block is invalid.");
+            return ret;
+        }
+
+        if (app_key_digests.num_digests == 0) {
+            ESP_LOGE(TAG, "No valid applications signature blocks found.");
+            return ESP_FAIL;
+        }
+
+        ESP_LOGI(TAG, "%d signature block(s) found appended to the app.", app_key_digests.num_digests);
+        if (app_key_digests.num_digests > boot_key_digests.num_digests) {
+            ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?");
+        }
+
+        /* Confirm if at least one public key from the application matches a public key in the bootloader
+           (Also, ensure if that public revoke bit is not set for the matched key) */
+        bool match = false;
+        const uint32_t revoke_bits[SECURE_BOOT_NUM_BLOCKS] = { EFUSE_SECURE_BOOT_KEY_REVOKE0,
+                                EFUSE_SECURE_BOOT_KEY_REVOKE1, EFUSE_SECURE_BOOT_KEY_REVOKE2 };
+
+        for (int i = 0; i < boot_key_digests.num_digests; i++) {
+
+            if (REG_GET_BIT(EFUSE_RD_REPEAT_DATA1_REG, revoke_bits[i])) {
+                ESP_LOGI(TAG, "Key block(%d) has been revoked.", i);
+                continue; // skip if the key block is revoked
+            }
+
+            for (int j = 0; j < app_key_digests.num_digests; j++) {
+                if (!memcmp(boot_key_digests.key_digests[i], app_key_digests.key_digests[j], DIGEST_LEN)) {
+                    ESP_LOGI(TAG, "Application key(%d) matches with bootloader key(%d).", j, i);
+                    match = true;
+                }
+            }
+        }
+
+        if (match == false) {
+            ESP_LOGE(TAG, "No application key digest matches the bootloader key digest.");
+            return ESP_FAIL;
+        }
+
+        /* Revoke the empty signature blocks */
+        if (boot_key_digests.num_digests < SECURE_BOOT_NUM_BLOCKS) {
+            /* The revocation index can be 0, 1, 2. Bootloader count can be 1,2,3. */
+            for (uint8_t i = boot_key_digests.num_digests; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+                ESP_LOGI(TAG, "Revoking empty key digest slot (%d)...", i);
+                ets_secure_boot_revoke_public_key_digest(i);
+            }
+        }
+    }
+
+    esp_err_t err = esp_efuse_batch_write_begin();
+    if (err != ESP_OK) {
+        ESP_LOGI(TAG, "Error batch programming security eFuses.");
+        return err;
+    }
+
+    __attribute__((unused)) static const uint8_t enable = 1;
 
-    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_BOOT_REMAP);
     esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
 
-    // TODO: also disable JTAG here, etc
-
-    esp_err_t err = esp_efuse_batch_write_commit();
-
-    if (err == ESP_OK) {
-        assert(ets_efuse_secure_boot_enabled());
-        ESP_LOGI(TAG, "Secure boot permanently enabled");
+    esp_err_t err = ESP_FAIL;
+#ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Enabling Security download mode...");
+    err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
     }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
+#else
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
+    esp_efuse_write_field_bit(ESP_EFUSE_HARD_DIS_JTAG);
+    esp_efuse_write_field_bit(ESP_EFUSE_SOFT_DIS_JTAG);
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
+
+#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+    bool rd_dis_now = true;
+#ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
+    /* If flash encryption is not enabled yet then don't read-disable efuses yet, do it later in the boot
+       when Flash Encryption is being enabled */
+    rd_dis_now = esp_flash_encryption_enabled();
+#endif
+    if (rd_dis_now) {
+        ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+    }
+#else
+    ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
+#endif
+
+    err = esp_efuse_batch_write_commit();
+    if (err != ESP_OK) {
+        ESP_LOGI(TAG, "Error programming security eFuses.");
+        return err;
+    }
+
+#ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+    assert(ets_efuse_secure_boot_aggressive_revoke_enabled());
+#endif
+
+    assert(ets_efuse_secure_boot_enabled());
+    ESP_LOGI(TAG, "Secure boot permanently enabled");
 
     return ESP_OK;
 }

components/bootloader_support/src/esp32s2/secure_boot_signatures.c

@@ -13,29 +13,32 @@
 // limitations under the License.
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include <string.h>
+#include "esp_fault.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
+#include "bootloader_utility.h"
 #include "esp_log.h"
 #include "esp_image_format.h"
+#include "esp_secure_boot.h"
 #include "esp32s2/rom/secure_boot.h"
 
 static const char* TAG = "secure_boot";
 
 #define DIGEST_LEN 32
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
-    ets_secure_boot_key_digests_t trusted_keys = { 0 };
     uint8_t digest[DIGEST_LEN];
     uint8_t verified_digest[DIGEST_LEN] = { 0 }; /* Note: this function doesn't do any anti-FI checks on this buffer */
     const uint8_t *data;
 
     ESP_LOGD(TAG, "verifying signature src_addr 0x%x length 0x%x", src_addr, length);
 
-    if ((src_addr + length) % 4096 != 0) {
-        ESP_LOGE(TAG, "addr 0x%x length 0x%x doesn't end on a sector boundary", src_addr, length);
-        return ESP_ERR_INVALID_ARG;
-    }
+    /* Padding to round off the input to the nearest 4k boundary */
+    int padded_length = ALIGN_UP(length, FLASH_SECTOR_SIZE);
+    ESP_LOGD(TAG, "verifying src_addr 0x%x length", src_addr, padded_length);
 
     data = bootloader_mmap(src_addr, length + sizeof(struct ets_secure_boot_sig_block));
     if (data == NULL) {
@@ -43,23 +46,16 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
         return ESP_FAIL;
     }
 
-    // Calculate digest of main image
-#ifdef BOOTLOADER_BUILD
-    bootloader_sha256_handle_t handle = bootloader_sha256_start();
-    bootloader_sha256_data(handle, data, length);
-    bootloader_sha256_finish(handle, digest);
-#else
-    /* Use thread-safe esp-idf SHA function */
-    esp_sha(SHA2_256, data, length, digest);
-#endif
-
-    int r = ets_secure_boot_read_key_digests(&trusted_keys);
-
-    if (r == ETS_OK) {
-        const ets_secure_boot_signature_t *sig = (const ets_secure_boot_signature_t *)(data + length);
-        // TODO: calling this function in IDF app context is unsafe
-        r = ets_secure_boot_verify_signature(sig, digest, &trusted_keys, verified_digest);
+    /* Calculate digest of main image */
+    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Digest calculation failed 0x%x, 0x%x", src_addr, padded_length);
+        bootloader_munmap(data);
+        return err;
     }
+
+    const ets_secure_boot_signature_t *sig = (const ets_secure_boot_signature_t *)(data + length);
+    int r = esp_secure_boot_verify_rsa_signature_block(sig, digest, verified_digest);
     bootloader_munmap(data);
 
     return (r == ETS_OK) ? ESP_OK : ESP_FAIL;
@@ -68,15 +64,30 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
 {
     ets_secure_boot_key_digests_t trusted_keys;
+    ets_secure_boot_key_digests_t trusted_key_copies[2];
+    ETS_STATUS r;
+    ets_secure_boot_status_t sb_result;
 
-    int r = ets_secure_boot_read_key_digests(&trusted_keys);
-    if (r != 0) {
-        ESP_LOGE(TAG, "No trusted key digests were found in efuse!");
-    } else {
-        ESP_LOGD(TAG, "Verifying with RSA-PSS...");
-        // TODO: calling this function in IDF app context is unsafe
-        r = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_keys, verified_digest);
+    memset(&trusted_keys, 0, sizeof(ets_secure_boot_key_digests_t));
+    memset(trusted_key_copies, 0, 2 * sizeof(ets_secure_boot_key_digests_t));
+
+    if (!esp_secure_boot_enabled()) {
+        return ESP_OK;
     }
 
-    return (r == 0) ? ESP_OK : ESP_ERR_IMAGE_INVALID;
+    r = ets_secure_boot_read_key_digests(&trusted_keys);
+    if (r != ETS_OK) {
+        ESP_LOGI(TAG, "Could not read secure boot digests!");
+        return ESP_FAIL;
+    }
+
+    // Create the copies for FI checks (assuming result is ETS_OK, if it's not then it'll fail the fault check anyhow)
+    ets_secure_boot_read_key_digests(&trusted_key_copies[0]);
+    ets_secure_boot_read_key_digests(&trusted_key_copies[1]);
+    ESP_FAULT_ASSERT(memcmp(&trusted_keys, &trusted_key_copies[0], sizeof(ets_secure_boot_key_digests_t)) == 0);
+    ESP_FAULT_ASSERT(memcmp(&trusted_keys, &trusted_key_copies[1], sizeof(ets_secure_boot_key_digests_t)) == 0);
+
+    ESP_LOGI(TAG, "Verifying with RSA-PSS boot...");
+    sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_keys, verified_digest);
+    return (sb_result == SB_SUCCESS) ? ESP_OK : ESP_FAIL;
 }

components/bootloader_support/src/esp_image_format.c

@@ -20,7 +20,7 @@
 #include <esp_log.h>
 #include <esp_attr.h>
 #include <esp_spi_flash.h>
-#include <bootloader_flash.h>
+#include <bootloader_flash_priv.h>
 #include <bootloader_random.h>
 #include <bootloader_sha.h>
 #include "bootloader_util.h"
@@ -220,8 +220,18 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
 
 #ifdef SECURE_BOOT_CHECK_SIGNATURE
             // secure boot images have a signature appended
-            err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest);
-#else
+#if defined(BOOTLOADER_BUILD) && !defined(CONFIG_SECURE_BOOT)
+            // If secure boot is not enabled in hardware, then
+            // skip the signature check in bootloader when the debugger is attached.
+            // This is done to allow for breakpoints in Flash.
+            if (!esp_cpu_in_ocd_debug_mode()) {
+#else // CONFIG_SECURE_BOOT
+            if (true) {
+#endif // end checking for JTAG
+                err = verify_secure_boot_signature(sha_handle, data, image_digest, verified_digest);
+                sha_handle = NULL; // verify_secure_boot_signature finishes sha_handle
+            }
+#else // SECURE_BOOT_CHECK_SIGNATURE
             // No secure boot, but SHA-256 can be appended for basic corruption detection
             if (sha_handle != NULL && !esp_cpu_in_ocd_debug_mode()) {
                 err = verify_simple_hash(sha_handle, data);
@@ -266,7 +276,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
        "only verify signature in bootloader" into the macro so it's tested multiple times.
      */
 #if CONFIG_SECURE_BOOT_V2_ENABLED
-    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, HASH_LEN) == 0);
+    ESP_FAULT_ASSERT(!esp_secure_boot_enabled() || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
 #else // Secure Boot V1 on ESP32, only verify signatures for apps not bootloaders
     ESP_FAULT_ASSERT(data->start_addr == ESP_BOOTLOADER_OFFSET || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
 #endif
@@ -301,7 +311,7 @@ err:
     // Prevent invalid/incomplete data leaking out
     bzero(data, sizeof(esp_image_metadata_t));
     return err;
-    }
+}
 
 esp_err_t bootloader_load_image(const esp_partition_pos_t *part, esp_image_metadata_t *data)
 {
@@ -841,3 +851,21 @@ static esp_err_t verify_simple_hash(bootloader_sha256_handle_t sha_handle, esp_i
     bootloader_munmap(hash);
     return ESP_OK;
 }
+
+int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size)
+{
+    switch (app_flash_size) {
+    case ESP_IMAGE_FLASH_SIZE_1MB:
+        return 1 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_2MB:
+        return 2 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_4MB:
+        return 4 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_8MB:
+        return 8 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_16MB:
+        return 16 * 1024 * 1024;
+    default:
+        return 0;
+    }
+}

components/bootloader_support/src/flash_encrypt.c

@@ -50,7 +50,7 @@ void esp_flash_encryption_init_checks()
                 // (this distinction is important on ESP32 ECO3 where write-procted FLASH_CRYPT_CNT also write-protects UART_DL_DIS)
                 return;
             }
-            ESP_EARLY_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
+            ESP_LOGE(TAG, "Flash encryption & Secure Boot together requires FLASH_CRYPT_CNT efuse to be write protected. Fixing now...");
             esp_flash_write_protect_crypt_cnt();
         }
     }
@@ -62,13 +62,13 @@ void esp_flash_encryption_init_checks()
     mode = esp_get_flash_encryption_mode();
     if (mode == ESP_FLASH_ENC_MODE_DEVELOPMENT) {
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
-        ESP_EARLY_LOGE(TAG, "Flash encryption settings error: app is configured for RELEASE but efuses are set for DEVELOPMENT");
-        ESP_EARLY_LOGE(TAG, "Mismatch found in security options in bootloader menuconfig and efuse settings. Device is not secure.");
+        ESP_LOGE(TAG, "Flash encryption settings error: app is configured for RELEASE but efuses are set for DEVELOPMENT");
+        ESP_LOGE(TAG, "Mismatch found in security options in bootloader menuconfig and efuse settings. Device is not secure.");
 #else
-        ESP_EARLY_LOGW(TAG, "Flash encryption mode is DEVELOPMENT (not secure)");
+        ESP_LOGW(TAG, "Flash encryption mode is DEVELOPMENT (not secure)");
 #endif
     } else if (mode == ESP_FLASH_ENC_MODE_RELEASE) {
-        ESP_EARLY_LOGI(TAG, "Flash encryption mode is RELEASE");
+        ESP_LOGI(TAG, "Flash encryption mode is RELEASE");
     }
 }
 #endif
@@ -80,7 +80,7 @@ void esp_flash_write_protect_crypt_cnt(void)
 
 esp_flash_enc_mode_t esp_get_flash_encryption_mode(void)
 {
-    uint8_t efuse_flash_crypt_cnt_wr_protected = 0;
+    bool flash_crypt_cnt_wr_dis = false;
 #if CONFIG_IDF_TARGET_ESP32   
     uint8_t dis_dl_enc = 0, dis_dl_dec = 0, dis_dl_cache = 0;
 #elif CONFIG_IDF_TARGET_ESP32S2
@@ -94,9 +94,17 @@ esp_flash_enc_mode_t esp_get_flash_encryption_mode(void)
 
     if (esp_flash_encryption_enabled()) {
         /* Check if FLASH CRYPT CNT is write protected */
-        efuse_flash_crypt_cnt_wr_protected = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
 
-        if (efuse_flash_crypt_cnt_wr_protected) {
+        flash_crypt_cnt_wr_dis = esp_efuse_read_field_bit(WR_DIS_CRYPT_CNT);
+        if (!flash_crypt_cnt_wr_dis) {
+            uint8_t flash_crypt_cnt = 0;
+            esp_efuse_read_field_blob(CRYPT_CNT, &flash_crypt_cnt, CRYPT_CNT[0]->bit_count);
+            if (flash_crypt_cnt == (1 << (CRYPT_CNT[0]->bit_count)) - 1) {
+                flash_crypt_cnt_wr_dis = true;
+            }
+        }
+
+        if (flash_crypt_cnt_wr_dis) {
 
 #if CONFIG_IDF_TARGET_ESP32
             dis_dl_cache = esp_efuse_read_field_bit(ESP_EFUSE_DISABLE_DL_CACHE);

components/bootloader_support/src/flash_partitions.c

@@ -52,7 +52,7 @@ esp_err_t esp_partition_table_verify(const esp_partition_info_t *partition_table
             MD5Update(&context, (unsigned char *) partition_table, num_parts * sizeof(esp_partition_info_t));
             MD5Final(digest, &context);
 
-            unsigned char *md5sum = ((unsigned char *) part) + 16; // skip the 2B magic number and the 14B fillup bytes
+            unsigned char *md5sum = ((unsigned char *) part) + ESP_PARTITION_MD5_OFFSET;
 
             if (memcmp(md5sum, digest, sizeof(digest)) != 0) {
                 if (log_errors) {

components/bootloader_support/src/flash_qio_mode.c

@@ -13,7 +13,9 @@
 // limitations under the License.
 #include <stddef.h>
 #include <stdint.h>
+#include "bootloader_flash_config.h"
 #include "flash_qio_mode.h"
+#include "bootloader_flash_priv.h"
 #include "esp_log.h"
 #include "esp_err.h"
 #if CONFIG_IDF_TARGET_ESP32
@@ -24,30 +26,10 @@
 #include "esp32s2/rom/efuse.h"
 #include "soc/spi_mem_struct.h"
 #endif
-#include "soc/spi_struct.h"
-#include "soc/spi_reg.h"
 #include "soc/efuse_periph.h"
 #include "soc/io_mux_reg.h"
 #include "sdkconfig.h"
 
-/* SPI flash controller */
-#if CONFIG_IDF_TARGET_ESP32
-#define SPIFLASH SPI1
-#elif CONFIG_IDF_TARGET_ESP32S2
-#define SPIFLASH SPIMEM1
-#endif
-
-/* SPI commands (actual on-wire commands not SPI controller bitmasks)
-   Suitable for use with the execute_flash_command static function.
-*/
-#define CMD_RDID       0x9F
-#define CMD_WRSR       0x01
-#define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
-#define CMD_WREN       0x06
-#define CMD_WRDI       0x04
-#define CMD_RDSR       0x05
-#define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
-#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 
 static const char *TAG = "qio_mode";
 
@@ -84,12 +66,6 @@ static unsigned read_status_8b_xmc25qu64a(void);
 /* Write 8 bit status of XM25QU64A */
 static void write_status_8b_xmc25qu64a(unsigned new_status);
 
-#define ESP32_D2WD_WP_GPIO 7 /* ESP32-D2WD has this GPIO wired to WP pin of flash */
-
-#ifndef CONFIG_BOOTLOADER_SPI_WP_PIN // Set in menuconfig if SPI flasher config is set to a quad mode
-#define CONFIG_BOOTLOADER_SPI_WP_PIN ESP32_D2WD_WP_GPIO
-#endif
-
 /* Array of known flash chips and data to enable Quad I/O mode
 
    Manufacturer & flash ID can be tested by running "esptool.py
@@ -109,6 +85,7 @@ const static qio_info_t chip_data[] = {
     { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
     { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
     { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
+    { "TH",          0xcd,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
 
     /* Final entry is default entry, if no other IDs have matched.
 
@@ -130,56 +107,6 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
 
    The command passed here is always the on-the-wire command given to the SPI flash unit.
 */
-static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len);
-
-/* dummy_len_plus values defined in ROM for SPI flash configuration */
-extern uint8_t g_rom_spiflash_dummy_len_plus[];
-uint32_t bootloader_read_flash_id(void)
-{
-    uint32_t id = execute_flash_command(CMD_RDID, 0, 0, 24);
-    id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
-    return id;
-}
-
-#if CONFIG_IDF_TARGET_ESP32S2
-#define FLASH_WRAP_CMD   0x77
-typedef enum {
-    FLASH_WRAP_MODE_8B  = 0,
-    FLASH_WRAP_MODE_16B = 2,
-    FLASH_WRAP_MODE_32B = 4,
-    FLASH_WRAP_MODE_64B = 6,
-    FLASH_WRAP_MODE_DISABLE = 1
-} spi_flash_wrap_mode_t;
-static esp_err_t spi_flash_wrap_set(spi_flash_wrap_mode_t mode)
-{
-    uint32_t reg_bkp_ctrl = SPIFLASH.ctrl.val;
-    uint32_t reg_bkp_usr  = SPIFLASH.user.val;
-    SPIFLASH.user.fwrite_dio = 0;
-    SPIFLASH.user.fwrite_dual = 0;
-    SPIFLASH.user.fwrite_qio = 1;
-    SPIFLASH.user.fwrite_quad = 0;
-    SPIFLASH.ctrl.fcmd_dual = 0;
-    SPIFLASH.ctrl.fcmd_quad = 0;
-    SPIFLASH.user.usr_dummy = 0;
-    SPIFLASH.user.usr_addr = 1;
-    SPIFLASH.user.usr_command = 1;
-    SPIFLASH.user2.usr_command_bitlen = 7;
-    SPIFLASH.user2.usr_command_value = FLASH_WRAP_CMD;
-    SPIFLASH.user1.usr_addr_bitlen = 23;
-    SPIFLASH.addr = 0;
-    SPIFLASH.user.usr_miso = 0;
-    SPIFLASH.user.usr_mosi = 1;
-    SPIFLASH.mosi_dlen.usr_mosi_bit_len = 7;
-    SPIFLASH.data_buf[0] = (uint32_t) mode << 4;;
-    SPIFLASH.cmd.usr = 1;
-    while (SPIFLASH.cmd.usr != 0) {
-    }
-
-    SPIFLASH.ctrl.val = reg_bkp_ctrl;
-    SPIFLASH.user.val = reg_bkp_usr;
-    return ESP_OK;
-}
-#endif
 
 void bootloader_enable_qio_mode(void)
 {
@@ -212,8 +139,8 @@ void bootloader_enable_qio_mode(void)
     enable_qio_mode(chip_data[i].read_status_fn,
                     chip_data[i].write_status_fn,
                     chip_data[i].status_qio_bit);
-#if CONFIG_IDF_TARGET_ESP32S2
-    spi_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
+#if SOC_CACHE_SUPPORT_WRAP
+    bootloader_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
 #endif
 }
 
@@ -224,31 +151,13 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     uint32_t status;
     const uint32_t spiconfig = ets_efuse_get_spiconfig();
 
-#if CONFIG_IDF_TARGET_ESP32
-    if (spiconfig != EFUSE_SPICONFIG_SPI_DEFAULTS && spiconfig != EFUSE_SPICONFIG_HSPI_DEFAULTS) {
-        // spiconfig specifies a custom efuse pin configuration. This config defines all pins -except- WP,
-        // which is compiled into the bootloader instead.
-        //
-        // Most commonly an overriden pin mapping means ESP32-D2WD or ESP32-PICOD4.
-        //Warn if chip is ESP32-D2WD/ESP32-PICOD4 but someone has changed the WP pin
-        //assignment from that chip's WP pin.
-        uint32_t pkg_ver = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-        if (CONFIG_BOOTLOADER_SPI_WP_PIN != ESP32_D2WD_WP_GPIO  &&
-                (pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5 ||
-                 pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD2 ||
-                 pkg_ver == EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4)) {
-            ESP_LOGW(TAG, "Chip is ESP32-D2WD/ESP32-PICOD4 but flash WP pin is different value to internal flash");
-        }
-    }
-#endif
-
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
 
     status = read_status_fn();
     ESP_LOGD(TAG, "Initial flash chip status 0x%x", status);
 
     if ((status & (1 << status_qio_bit)) == 0) {
-        execute_flash_command(CMD_WREN, 0, 0, 0);
+        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
         write_status_fn(status | (1 << status_qio_bit));
 
         esp_rom_spiflash_wait_idle(&g_rom_flashchip);
@@ -276,108 +185,58 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
     esp_rom_spiflash_config_readmode(mode);
 
 #if CONFIG_IDF_TARGET_ESP32
-    esp_rom_spiflash_select_qio_pins(CONFIG_BOOTLOADER_SPI_WP_PIN, spiconfig);
+    int wp_pin = bootloader_flash_get_wp_pin();
+    esp_rom_spiflash_select_qio_pins(wp_pin, spiconfig);
 #elif CONFIG_IDF_TARGET_ESP32S2
-    if (ets_efuse_get_wp_pad() <= MAX_PAD_GPIO_NUM) {
-        esp_rom_spiflash_select_qio_pins(ets_efuse_get_wp_pad(), spiconfig);
-    } else {
-        esp_rom_spiflash_select_qio_pins(CONFIG_BOOTLOADER_SPI_WP_PIN, spiconfig);
-    }
+    esp_rom_spiflash_select_qio_pins(ets_efuse_get_wp_pad(), spiconfig);
 #endif
     return ESP_OK;
 }
 
 static unsigned read_status_8b_rdsr(void)
 {
-    return execute_flash_command(CMD_RDSR, 0, 0, 8);
+    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
 }
 
 static unsigned read_status_8b_rdsr2(void)
 {
-    return execute_flash_command(CMD_RDSR2, 0, 0, 8);
+    return bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
 }
 
 static unsigned read_status_16b_rdsr_rdsr2(void)
 {
-    return execute_flash_command(CMD_RDSR, 0, 0, 8) | (execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
+    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
 }
 
 static void write_status_8b_wrsr(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
 }
 
 static void write_status_8b_wrsr2(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR2, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR2, new_status, 8, 0);
 }
 
 static void write_status_16b_wrsr(unsigned new_status)
 {
-    execute_flash_command(CMD_WRSR, new_status, 16, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }
 
 static unsigned read_status_8b_xmc25qu64a(void)
 {
-    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    uint32_t read_status = execute_flash_command(CMD_RDSR, 0, 0, 8);
-    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
+    uint32_t read_status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
     return read_status;
 }
 
 static void write_status_8b_xmc25qu64a(unsigned new_status)
 {
-    execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
+    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    execute_flash_command(CMD_WRSR, new_status, 8, 0);
+    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
-}
-
-static uint32_t execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
-{
-    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
-#endif
-    SPIFLASH.user.usr_dummy = 0;
-    SPIFLASH.user.usr_addr = 0;
-    SPIFLASH.user.usr_command = 1;
-    SPIFLASH.user2.usr_command_bitlen = 7;
-
-    SPIFLASH.user2.usr_command_value = command;
-    SPIFLASH.user.usr_miso = miso_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
-#endif
-    SPIFLASH.user.usr_mosi = mosi_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
-#elif CONFIG_IDF_TARGET_ESP32S2
-    SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
-#endif
-    SPIFLASH.data_buf[0] = mosi_data;
-
-    if (g_rom_spiflash_dummy_len_plus[1]) {
-        /* When flash pins are mapped via GPIO matrix, need a dummy cycle before reading via MISO */
-        if (miso_len > 0) {
-            SPIFLASH.user.usr_dummy = 1;
-            SPIFLASH.user1.usr_dummy_cyclelen = g_rom_spiflash_dummy_len_plus[1] - 1;
-        } else {
-            SPIFLASH.user.usr_dummy = 0;
-            SPIFLASH.user1.usr_dummy_cyclelen = 0;
-        }
-    }
-
-    SPIFLASH.cmd.usr = 1;
-    while (SPIFLASH.cmd.usr != 0) {
-    }
-
-    SPIFLASH.ctrl.val = old_ctrl_reg;
-    return SPIFLASH.data_buf[0];
+    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
 }

components/bootloader_support/src/idf/bootloader_sha.c

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 #include "bootloader_sha.h"
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include <stdbool.h>
 #include <string.h>
 #include <assert.h>
@@ -51,4 +51,5 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
     }
     mbedtls_sha256_free(ctx);
     free(handle);
+    handle = NULL;
 }

components/bootloader_support/src/idf/secure_boot_signatures.c

@@ -13,7 +13,7 @@
 // limitations under the License.
 #include "sdkconfig.h"
 
-#include "bootloader_flash.h"
+#include "bootloader_flash_priv.h"
 #include "bootloader_sha.h"
 #include "bootloader_utility.h"
 #include "esp_log.h"
@@ -27,6 +27,11 @@
 #include "mbedtls/ctr_drbg.h"
 #include <string.h>
 #include <sys/param.h>
+#include "esp_secure_boot.h"
+
+#ifdef CONFIG_IDF_TARGET_ESP32S2
+#include <esp32s2/rom/secure_boot.h>
+#endif
 
 #define DIGEST_LEN 32
 
@@ -142,6 +147,26 @@ static const char *TAG = "secure_boot_v2";
 #define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
 #define RSA_KEY_SIZE 384 /* RSA 3072 Bits */
 
+#if CONFIG_IDF_TARGET_ESP32S2
+inline static bool digest_matches(const void *trusted, const void *computed)
+{
+    if (trusted == NULL) {
+        return false;
+    }
+
+    // 'trusted' is probably a pointer to read-only efuse registers,
+    // which only support word reads. memcmp() cannot be guaranteed
+    // to do word reads, so we make a local copy here (we know that
+    // memcpy() will do word operations if it can).
+    uint8_t __attribute__((aligned(4))) trusted_local[ETS_DIGEST_LEN];
+    uint8_t __attribute__((aligned(4))) computed_local[ETS_DIGEST_LEN];
+
+    memcpy(trusted_local, trusted, ETS_DIGEST_LEN);
+    memcpy(computed_local, computed, ETS_DIGEST_LEN);
+    return memcmp(trusted_local, computed_local, ETS_DIGEST_LEN) == 0;
+}
+#endif /* CONFIG_IDF_TARGET_ESP32S2 */
+
 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
     uint8_t digest[DIGEST_LEN] = {0};
@@ -173,23 +198,27 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 
 esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest)
 {
-    int i = 0;
-
+    uint8_t i = 0;
 #if CONFIG_SECURE_BOOT_V2_ENABLED /* Verify key against efuse block */
-    uint8_t efuse_trusted_digest[DIGEST_LEN] = {0}, sig_block_trusted_digest[DIGEST_LEN] = {0};
-    memcpy(efuse_trusted_digest, (uint8_t *) EFUSE_BLK2_RDATA0_REG, sizeof(efuse_trusted_digest));
+    uint8_t sig_block_key_digest[SECURE_BOOT_NUM_BLOCKS][DIGEST_LEN] = {0};
 
     /* Note: in IDF verification we don't add any fault injection resistance, as we don't expect this to be called
        during boot-time verification. */
     memset(verified_digest, 0, DIGEST_LEN);
 
     /* Generating the SHA of the public key components in the signature block */
-    bootloader_sha256_handle_t sig_block_sha;
-    sig_block_sha = bootloader_sha256_start();
-    bootloader_sha256_data(sig_block_sha, &sig_block->block[0].key, sizeof(sig_block->block[0].key));
-    bootloader_sha256_finish(sig_block_sha, (unsigned char *)sig_block_trusted_digest);
+    for (i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        bootloader_sha256_handle_t sig_block_sha;
+        sig_block_sha = bootloader_sha256_start();
+        bootloader_sha256_data(sig_block_sha, &sig_block->block[i].key, sizeof(sig_block->block[i].key));
+        bootloader_sha256_finish(sig_block_sha, (unsigned char *)sig_block_key_digest[i]);
+    }
 
-    if (memcmp(efuse_trusted_digest, sig_block_trusted_digest, DIGEST_LEN) != 0) {
+#if CONFIG_IDF_TARGET_ESP32
+    uint8_t efuse_trusted_digest[DIGEST_LEN] = {0};
+    memcpy(efuse_trusted_digest, (uint8_t *) EFUSE_BLK2_RDATA0_REG, sizeof(efuse_trusted_digest));
+
+    if (memcmp(efuse_trusted_digest, sig_block_key_digest[0], DIGEST_LEN) != 0) {
         const uint8_t zeroes[DIGEST_LEN] = {0};
         /* Can't continue if secure boot is enabled, OR if a different digest is already written in efuse BLK2
 
@@ -200,7 +229,17 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
             return ESP_FAIL;
         }
     }
-#endif
+#elif CONFIG_IDF_TARGET_ESP32S2
+    bool match = false;
+    ets_secure_boot_key_digests_t efuse_trusted_digest;
+    ETS_STATUS r;
+    r = ets_secure_boot_read_key_digests(&efuse_trusted_digest);
+    if (r != 0) {
+        ESP_LOGI(TAG, "Could not read secure boot digests!");
+        return ESP_FAIL;
+    }
+#endif /* CONFIG_IDF_TARGET_ESP32 */
+#endif /* CONFIG_SECURE_BOOT_V2_ENABLED */
 
     ESP_LOGI(TAG, "Verifying with RSA-PSS...");
     int ret = 0;
@@ -222,6 +261,19 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
     }
 
     for (i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+#if CONFIG_IDF_TARGET_ESP32S2
+        for (uint8_t j = 0; j < SECURE_BOOT_NUM_BLOCKS; j++) {
+            if (digest_matches(efuse_trusted_digest.key_digests[j], sig_block_key_digest[i])) {
+                ESP_LOGI(TAG, "eFuse key matches(%d) matches the application key(%d).", j, i);
+                match = true;
+                break;
+            }
+        }
+        if (match == false) {
+            continue; // Skip the public keys whose digests don't match.
+        }
+# endif
+
         const mbedtls_mpi N = { .s = 1,
                                 .n = sizeof(sig_block->block[i].key.n)/sizeof(mbedtls_mpi_uint),
                                 .p = (void *)sig_block->block[i].key.n,
@@ -260,8 +312,8 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
             goto exit;
         }
 
-        ret = mbedtls_rsa_rsassa_pss_verify( &pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA256, 32, 
-                                            sig_block->block[i].image_digest, sig_be);
+        ret = mbedtls_rsa_rsassa_pss_verify( &pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA256, DIGEST_LEN,
+                                            image_digest, sig_be);
         if (ret != 0) {
             ESP_LOGE(TAG, "Failed mbedtls_rsa_rsassa_pss_verify, err: %d", ret);
         } else {
@@ -273,9 +325,13 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
                 break;
             }
     }
-    
+
     free(sig_be);
     free(buf);
-    return (!ret) ? ESP_OK : ESP_ERR_IMAGE_INVALID;
+#if CONFIG_IDF_TARGET_ESP32
+    return (ret != 0) ? ESP_ERR_IMAGE_INVALID: ESP_OK;
+#elif CONFIG_IDF_TARGET_ESP32S2
+    return (ret != 0 || match == false) ? ESP_ERR_IMAGE_INVALID: ESP_OK;
+#endif /* CONFIG_IDF_TARGET_ESP32 */
 }
 #endif

components/bt/CMakeLists.txt

@@ -96,6 +96,7 @@ if(CONFIG_BT_ENABLED)
                    "host/bluedroid/bta/dm/bta_dm_main.c"
                    "host/bluedroid/bta/dm/bta_dm_pm.c"
                    "host/bluedroid/bta/dm/bta_dm_sco.c"
+                   "host/bluedroid/bta/dm/bta_dm_qos.c"
                    "host/bluedroid/bta/gatt/bta_gatt_common.c"
                    "host/bluedroid/bta/gatt/bta_gattc_act.c"
                    "host/bluedroid/bta/gatt/bta_gattc_api.c"
@@ -315,6 +316,7 @@ if(CONFIG_BT_ENABLED)
     if(CONFIG_BLE_MESH)
         list(APPEND include_dirs
                     "esp_ble_mesh/mesh_common/include"
+                    "esp_ble_mesh/mesh_common/tinycrypt/include"
                     "esp_ble_mesh/mesh_core"
                     "esp_ble_mesh/mesh_core/include"
                     "esp_ble_mesh/mesh_core/storage"
@@ -339,6 +341,7 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/api/models/esp_ble_mesh_lighting_model_api.c"
                     "esp_ble_mesh/api/models/esp_ble_mesh_sensor_model_api.c"
                     "esp_ble_mesh/api/models/esp_ble_mesh_time_scene_model_api.c"
+                    "esp_ble_mesh/btc/btc_ble_mesh_ble.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_config_model.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_generic_model.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_health_model.c"
@@ -346,7 +349,21 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/btc/btc_ble_mesh_prov.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_sensor_model.c"
                     "esp_ble_mesh/btc/btc_ble_mesh_time_scene_model.c"
-                    "esp_ble_mesh/mesh_common/mesh_aes_encrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_decrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/aes_encrypt.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cbc_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ccm_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/cmac_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_mode.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ctr_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dh.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_dsa.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc_platform_specific.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/ecc.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac_prng.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/hmac.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/sha256.c"
+                    "esp_ble_mesh/mesh_common/tinycrypt/src/utils.c"
                     "esp_ble_mesh/mesh_common/mesh_atomic.c"
                     "esp_ble_mesh/mesh_common/mesh_buf.c"
                     "esp_ble_mesh/mesh_common/mesh_common.c"
@@ -361,9 +378,11 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/mesh_core/cfg_cli.c"
                     "esp_ble_mesh/mesh_core/cfg_srv.c"
                     "esp_ble_mesh/mesh_core/crypto.c"
+                    "esp_ble_mesh/mesh_core/fast_prov.c"
                     "esp_ble_mesh/mesh_core/friend.c"
                     "esp_ble_mesh/mesh_core/health_cli.c"
                     "esp_ble_mesh/mesh_core/health_srv.c"
+                    "esp_ble_mesh/mesh_core/local_operation.c"
                     "esp_ble_mesh/mesh_core/lpn.c"
                     "esp_ble_mesh/mesh_core/main.c"
                     "esp_ble_mesh/mesh_core/net.c"
@@ -372,15 +391,17 @@ if(CONFIG_BT_ENABLED)
                     "esp_ble_mesh/mesh_core/provisioner_prov.c"
                     "esp_ble_mesh/mesh_core/proxy_client.c"
                     "esp_ble_mesh/mesh_core/proxy_server.c"
+                    "esp_ble_mesh/mesh_core/settings_uid.c"
                     "esp_ble_mesh/mesh_core/settings.c"
+                    "esp_ble_mesh/mesh_core/scan.c"
                     "esp_ble_mesh/mesh_core/test.c"
                     "esp_ble_mesh/mesh_core/transport.c"
+                    "esp_ble_mesh/mesh_models/common/device_property.c"
                     "esp_ble_mesh/mesh_models/client/client_common.c"
                     "esp_ble_mesh/mesh_models/client/generic_client.c"
                     "esp_ble_mesh/mesh_models/client/lighting_client.c"
                     "esp_ble_mesh/mesh_models/client/sensor_client.c"
                     "esp_ble_mesh/mesh_models/client/time_scene_client.c"
-                    "esp_ble_mesh/mesh_models/server/device_property.c"
                     "esp_ble_mesh/mesh_models/server/generic_server.c"
                     "esp_ble_mesh/mesh_models/server/lighting_server.c"
                     "esp_ble_mesh/mesh_models/server/sensor_server.c"
@@ -552,6 +573,6 @@ idf_component_register(SRCS "${srcs}"
 if(CONFIG_BT_ENABLED)
     target_compile_options(${COMPONENT_LIB} PRIVATE -Wno-implicit-fallthrough -Wno-unused-const-variable)
 
-    target_link_libraries(${COMPONENT_LIB} INTERFACE "-L${CMAKE_CURRENT_LIST_DIR}/controller/lib")
+    target_link_libraries(${COMPONENT_LIB} INTERFACE "-L${CMAKE_CURRENT_LIST_DIR}/controller/lib/esp32")
     target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
 endif()

components/bt/Kconfig

@@ -79,6 +79,47 @@ menu "Bluetooth"
             default 1 if BTDM_CTRL_BR_EDR_SCO_DATA_PATH_PCM
             default 0
 
+        menuconfig BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            bool "PCM Signal Config (Role and Polar)"
+            depends on BTDM_CTRL_BR_EDR_SCO_DATA_PATH_PCM
+            default y
+
+        choice BTDM_CTRL_PCM_ROLE
+            prompt "PCM Role"
+            depends on BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            help
+                PCM role can be configured as PCM master or PCM slave
+
+            config BTDM_CTRL_PCM_ROLE_MASTER
+                bool "PCM Master"
+            config BTDM_CTRL_PCM_ROLE_SLAVE
+                bool "PCM Slave"
+        endchoice
+
+        choice BTDM_CTRL_PCM_POLAR
+            prompt "PCM Polar"
+            depends on BTDM_CTRL_PCM_ROLE_EDGE_CONFIG
+            help
+                PCM polarity can be configured as Falling Edge or Rising Edge
+
+            config BTDM_CTRL_PCM_POLAR_FALLING_EDGE
+                bool "Falling Edge"
+            config BTDM_CTRL_PCM_POLAR_RISING_EDGE
+                bool "Rising Edge"
+        endchoice
+
+        config BTDM_CTRL_PCM_ROLE_EFF
+            int
+            default 0 if BTDM_CTRL_PCM_ROLE_MASTER
+            default 1 if BTDM_CTRL_PCM_ROLE_SLAVE
+            default 0
+
+        config BTDM_CTRL_PCM_POLAR_EFF
+            int
+            default 0 if BTDM_CTRL_PCM_POLAR_FALLING_EDGE
+            default 1 if BTDM_CTRL_PCM_POLAR_RISING_EDGE
+            default 0
+
         config BTDM_CTRL_AUTO_LATENCY
             bool "Auto latency"
             depends on BTDM_CTRL_MODE_BTDM
@@ -92,6 +133,19 @@ menu "Bluetooth"
             default BTDM_CTRL_AUTO_LATENCY if BTDM_CTRL_MODE_BTDM
             default n
 
+        config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT
+            bool "Legacy Authentication Vendor Specific Event Enable"
+            depends on BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+            default y
+            help
+                To protect from BIAS attack during Legacy authentication,
+                Legacy authentication Vendor specific event should be enabled
+
+        config BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT_EFF
+            bool
+            default BTDM_CTRL_LEGACY_AUTH_VENDOR_EVT if BTDM_CTRL_MODE_BR_EDR_ONLY || BTDM_CTRL_MODE_BTDM
+            default 0
+
 
         config BTDM_CTRL_BLE_MAX_CONN_EFF
             int
@@ -311,11 +365,27 @@ menu "Bluetooth"
             int "Maximum number of devices in scan duplicate filter"
             depends on BTDM_BLE_SCAN_DUPL
             range 10 1000
-            default 200
+            default 100
             help
                 Maximum number of devices which can be recorded in scan duplicate filter.
                 When the maximum amount of device in the filter is reached, the cache will be refreshed.
 
+        config BTDM_SCAN_DUPL_CACHE_REFRESH_PERIOD
+            int "Duplicate scan list refresh period (seconds)"
+            depends on BTDM_BLE_SCAN_DUPL
+            range 0 1000
+            default 0
+            help
+                If the period value is non-zero, the controller will periodically clear the device information
+                stored in the scan duuplicate filter. If it is 0, the scan duuplicate filter will not be cleared
+                until the scanning is disabled. Duplicate advertisements for this period should not be sent to the
+                Host in advertising report events.
+                There are two scenarios where the ADV packet will be repeatedly reported:
+                1. The duplicate scan cache is full, the controller will delete the oldest device information and
+                add new device information.
+                2. When the refresh period is up, the controller will clear all device information and start filtering
+                again.
+
         config BTDM_BLE_MESH_SCAN_DUPL_EN
             bool "Special duplicate scan mechanism for BLE Mesh scan"
             depends on BTDM_BLE_SCAN_DUPL
@@ -327,7 +397,7 @@ menu "Bluetooth"
             int "Maximum number of Mesh adv packets in scan duplicate filter"
             depends on BTDM_BLE_MESH_SCAN_DUPL_EN
             range 10 1000
-            default 200
+            default 100
             help
                 Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
                 When the maximum amount of device in the filter is reached, the cache will be refreshed.
@@ -374,21 +444,6 @@ menu "Bluetooth"
                 If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
                 may cause adv packets lost more.
 
-        menuconfig BTDM_COEX_BT_OPTIONS
-            bool "Coexistence Bluetooth Side Options"
-            depends on ESP32_WIFI_SW_COEXIST_ENABLE
-            default n
-            help
-                Options of Bluetooth Side of WiFi and bluetooth coexistence.
-
-        config BTDM_COEX_BLE_ADV_HIGH_PRIORITY
-            bool "Improve BLE ADV priority for WiFi & BLE coexistence"
-            depends on BTDM_COEX_BT_OPTIONS
-            default n
-            help
-                Improve BLE ADV coexistence priority to make it better performance.
-                For example, BLE mesh need to enable this option to improve BLE adv performance.
-
     endmenu
 
     choice BT_HOST

components/bt/common/btc/core/btc_task.c

@@ -57,6 +57,7 @@
 #endif
 
 #if CONFIG_BLE_MESH
+#include "btc_ble_mesh_ble.h"
 #include "btc_ble_mesh_prov.h"
 #include "btc_ble_mesh_health_model.h"
 #include "btc_ble_mesh_config_model.h"
@@ -68,7 +69,7 @@
 
 #define BTC_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
-#define BTC_TASK_NAME                   "btcT"
+#define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
 
 osi_thread_t *btc_thread;
@@ -93,9 +94,9 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
 #endif  ///BLE_INCLUDED == TRUE
     [BTC_PID_BLE_HID]     = {NULL, NULL},
     [BTC_PID_SPPLIKE]     = {NULL, NULL},
-#if (GATTS_INCLUDED == TRUE)
+#if (BLUFI_INCLUDED == TRUE)
     [BTC_PID_BLUFI]       = {btc_blufi_call_handler,      btc_blufi_cb_handler    },
-#endif  ///GATTS_INCLUDED == TRUE
+#endif  ///BLUFI_INCLUDED == TRUE
     [BTC_PID_DM_SEC]      = {NULL,                        btc_dm_sec_cb_handler   },
 #endif
     [BTC_PID_ALARM]       = {btc_alarm_handler,           NULL                    },
@@ -124,18 +125,43 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
 #if CONFIG_BLE_MESH
     [BTC_PID_PROV]              = {btc_ble_mesh_prov_call_handler,              btc_ble_mesh_prov_cb_handler             },
     [BTC_PID_MODEL]             = {btc_ble_mesh_model_call_handler,             btc_ble_mesh_model_cb_handler            },
+#if CONFIG_BLE_MESH_HEALTH_CLI
     [BTC_PID_HEALTH_CLIENT]     = {btc_ble_mesh_health_client_call_handler,     btc_ble_mesh_health_client_cb_handler    },
+#endif /* CONFIG_BLE_MESH_HEALTH_CLI */
+#if CONFIG_BLE_MESH_HEALTH_SRV
     [BTC_PID_HEALTH_SERVER]     = {btc_ble_mesh_health_server_call_handler,     btc_ble_mesh_health_server_cb_handler    },
+#endif /* CONFIG_BLE_MESH_HEALTH_SRV */
+#if CONFIG_BLE_MESH_CFG_CLI
     [BTC_PID_CONFIG_CLIENT]     = {btc_ble_mesh_config_client_call_handler,     btc_ble_mesh_config_client_cb_handler    },
+#endif /* CONFIG_BLE_MESH_CFG_CLI */
     [BTC_PID_CONFIG_SERVER]     = {NULL,                                        btc_ble_mesh_config_server_cb_handler    },
+#if CONFIG_BLE_MESH_GENERIC_CLIENT
     [BTC_PID_GENERIC_CLIENT]    = {btc_ble_mesh_generic_client_call_handler,    btc_ble_mesh_generic_client_cb_handler   },
+#endif /* CONFIG_BLE_MESH_GENERIC_CLIENT */
+#if CONFIG_BLE_MESH_LIGHTING_CLIENT
     [BTC_PID_LIGHTING_CLIENT]   = {btc_ble_mesh_lighting_client_call_handler,   btc_ble_mesh_lighting_client_cb_handler  },
+#endif /* CONFIG_BLE_MESH_LIGHTING_CLIENT */
+#if CONFIG_BLE_MESH_SENSOR_CLI
     [BTC_PID_SENSOR_CLIENT]     = {btc_ble_mesh_sensor_client_call_handler,     btc_ble_mesh_sensor_client_cb_handler    },
+#endif /* CONFIG_BLE_MESH_SENSOR_CLI */
+#if CONFIG_BLE_MESH_TIME_SCENE_CLIENT
     [BTC_PID_TIME_SCENE_CLIENT] = {btc_ble_mesh_time_scene_client_call_handler, btc_ble_mesh_time_scene_client_cb_handler},
+#endif /* CONFIG_BLE_MESH_TIME_SCENE_CLIENT */
+#if CONFIG_BLE_MESH_GENERIC_SERVER
     [BTC_PID_GENERIC_SERVER]    = {NULL,                                        btc_ble_mesh_generic_server_cb_handler   },
+#endif /* CONFIG_BLE_MESH_GENERIC_SERVER */
+#if CONFIG_BLE_MESH_LIGHTING_SERVER
     [BTC_PID_LIGHTING_SERVER]   = {NULL,                                        btc_ble_mesh_lighting_server_cb_handler  },
+#endif /* CONFIG_BLE_MESH_LIGHTING_SERVER */
+#if CONFIG_BLE_MESH_SENSOR_SERVER
     [BTC_PID_SENSOR_SERVER]     = {NULL,                                        btc_ble_mesh_sensor_server_cb_handler    },
+#endif /* CONFIG_BLE_MESH_SENSOR_SERVER */
+#if CONFIG_BLE_MESH_TIME_SCENE_SERVER
     [BTC_PID_TIME_SCENE_SERVER] = {NULL,                                        btc_ble_mesh_time_scene_server_cb_handler},
+#endif /* CONFIG_BLE_MESH_TIME_SCENE_SERVER */
+#if CONFIG_BLE_MESH_BLE_COEX_SUPPORT
+    [BTC_PID_BLE_MESH_BLE_COEX] = {btc_ble_mesh_ble_call_handler,               btc_ble_mesh_ble_cb_handler              },
+#endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */
 };
 
@@ -161,59 +187,93 @@ static void btc_thread_handler(void *arg)
         break;
     }
 
-    if (msg->arg) {
-        osi_free(msg->arg);
-    }
     osi_free(msg);
 }
 
 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
         return BT_STATUS_BUSY;
     }
 
     return BT_STATUS_SUCCESS;
 }
 
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
+/**
+ * transfer an message to another module in the different task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @param  arg_len   length of paramter
+ * @param  copy_func deep copy function
+ * @param  free_func deep free function
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func)
 {
-    btc_msg_t lmsg;
-
-    if (msg == NULL) {
+    btc_msg_t* lmsg;
+    bt_status_t ret;
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
+        BTC_TRACE_WARNING("%s Invalid parameters\n", __func__);
         return BT_STATUS_PARM_INVALID;
     }
 
     BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);
 
-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t) + arg_len);
+    if (lmsg == NULL) {
+        BTC_TRACE_WARNING("%s No memory\n", __func__);
+        return BT_STATUS_NOMEM;
     }
 
-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    }
 
+    ret = btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);
+    if (ret != BT_STATUS_SUCCESS) {
+        if (copy_func && free_func) {
+            free_func(lmsg);
+        }
+        osi_free(lmsg);
+    }
+
+    return ret;
 }
 
+/**
+ * transfer an message to another module in tha same task.
+ * @param  msg       message
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_inter_profile_call(btc_msg_t *msg)
+{
+    if (msg == NULL) {
+        return BT_STATUS_PARM_INVALID;
+    }
+
+    switch (msg->sig) {
+    case BTC_SIG_API_CALL:
+        profile_tab[msg->pid].btc_call(msg);
+        break;
+    case BTC_SIG_API_CB:
+        profile_tab[msg->pid].btc_cb(msg);
+        break;
+    default:
+        break;
+    }
+    return BT_STATUS_SUCCESS;
+}
+
+
 #if BTC_DYNAMIC_MEMORY
 
 static void btc_deinit_mem(void) {
@@ -244,12 +304,13 @@ static void btc_deinit_mem(void) {
         osi_free(btc_creat_tab_env_ptr);
         btc_creat_tab_env_ptr = NULL;
     }
-
+#if (BLUFI_INCLUDED == TRUE)
     if (blufi_env_ptr) {
         osi_free(blufi_env_ptr);
         blufi_env_ptr = NULL;
     }
 #endif
+#endif
 
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
     if (hf_client_local_param_ptr) {
@@ -298,12 +359,13 @@ static bt_status_t btc_init_mem(void) {
         goto error_exit;
     }
     memset((void *)btc_creat_tab_env_ptr, 0, sizeof(esp_btc_creat_tab_t));
-
+#if (BLUFI_INCLUDED == TRUE)
     if ((blufi_env_ptr = (tBLUFI_ENV *)osi_malloc(sizeof(tBLUFI_ENV))) == NULL) {
         goto error_exit;
     }
     memset((void *)blufi_env_ptr, 0, sizeof(tBLUFI_ENV));
 #endif
+#endif
 
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
     if ((hf_client_local_param_ptr = (hf_client_local_param_t *)osi_malloc(sizeof(hf_client_local_param_t))) == NULL) {
@@ -331,9 +393,9 @@ error_exit:;
 }
 #endif ///BTC_DYNAMIC_MEMORY
 
-int btc_init(void)
+bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create("BTC_TASK", BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
     if (btc_thread == NULL) {
         return BT_STATUS_NOMEM;
     }
@@ -378,3 +440,8 @@ bool btc_check_queue_is_congest(void)
     return false;
 }
 
+int get_btc_work_queue_size(void)
+{
+    return osi_thread_queue_wait_size(btc_thread, 0);
+}
+

components/bt/common/btc/include/btc/btc_task.h

@@ -28,7 +28,7 @@ typedef struct btc_msg {
     uint8_t aid;    //application id
     uint8_t pid;    //profile id
     uint8_t act;    //profile action, defined in seprerate header files
-    void   *arg;    //param for btc function or function param
+    uint8_t arg[0]; //param for btc function or function param
 } btc_msg_t;
 
 typedef struct btc_adv_packet {
@@ -53,7 +53,9 @@ typedef enum {
     BTC_PID_GAP_BLE,
     BTC_PID_BLE_HID,
     BTC_PID_SPPLIKE,
+#if (BLUFI_INCLUDED == TRUE)
     BTC_PID_BLUFI,
+#endif  ///BLUFI_INCLUDED == TRUE
     BTC_PID_DM_SEC,
     BTC_PID_ALARM,
 #if (CLASSIC_BT_INCLUDED == TRUE)
@@ -85,6 +87,7 @@ typedef enum {
     BTC_PID_LIGHTING_SERVER,
     BTC_PID_SENSOR_SERVER,
     BTC_PID_TIME_SCENE_SERVER,
+    BTC_PID_BLE_MESH_BLE_COEX,
 #endif /* CONFIG_BLE_MESH */
     BTC_PID_NUM,
 } btc_pid_t; //btc profile id
@@ -95,11 +98,32 @@ typedef struct {
 } btc_func_t;
 
 typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
+typedef void (* btc_arg_deep_free_t)(btc_msg_t *msg);
 
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func);
+/**
+ * transfer an message to another module in the different task.
+ * @param  msg       message
+ * @param  arg       paramter
+ * @param  arg_len   length of paramter
+ * @param  copy_func deep copy function
+ * @param  free_func deep free function
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func);
 
-int btc_init(void);
+/**
+ * transfer an message to another module in tha same task.
+ * @param  msg       message
+ * @return           BT_STATUS_SUCCESS: success
+ *                   others: fail
+ */
+bt_status_t btc_inter_profile_call(btc_msg_t *msg);
+
+bt_status_t btc_init(void);
 void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
+int get_btc_work_queue_size(void);
 
 #endif /* __BTC_TASK_H__ */

components/bt/common/include/bt_common.h

@@ -42,6 +42,12 @@
 #define BTC_DYNAMIC_MEMORY         FALSE
 #endif
 
+#if UC_BT_BLUEDROID_MEM_DEBUG
+#define HEAP_MEMORY_DEBUG   TRUE
+#else
+#define HEAP_MEMORY_DEBUG   FALSE
+#endif
+
 #ifndef BT_BLE_DYNAMIC_ENV_MEMORY
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif

components/bt/common/include/bt_user_config.h

@@ -80,4 +80,11 @@
 #define UC_BT_LOG_OSI_TRACE_LEVEL           UC_TRACE_LEVEL_WARNING
 #endif
 
+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */

components/bt/common/osi/alarm.c

@@ -143,13 +143,13 @@ static void alarm_cb_handler(struct alarm_t *alarm)
         OSI_TRACE_WARNING("%s, invalid state %d\n", __func__, alarm_state);
         return;
     }
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
     btc_alarm_args_t arg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_ALARM;
     arg.cb = alarm->cb;
     arg.cb_data = alarm->cb_data;
-    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL);
+    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL, NULL);
 }
 
 osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)
@@ -173,7 +173,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
         goto end;
     }
 
-    esp_timer_create_args_t tca;
+    esp_timer_create_args_t tca = {0};
     tca.callback = (esp_timer_cb_t)alarm_cb_handler;
     tca.arg = timer_id;
     tca.dispatch_method = ESP_TIMER_TASK;
@@ -318,3 +318,16 @@ uint32_t osi_time_get_os_boottime_ms(void)
 {
     return (uint32_t)(esp_timer_get_time() / 1000);
 }
+
+bool osi_alarm_is_active(osi_alarm_t *alarm)
+{
+    assert(alarm != NULL);
+    assert(alarm_mutex != NULL);
+    bool is_active = false;
+
+    osi_mutex_lock(&alarm_mutex, OSI_MUTEX_MAX_TIMEOUT);
+    is_active = alarm->deadline_us > 0;
+    osi_mutex_unlock(&alarm_mutex);
+
+    return is_active;
+}

components/bt/common/osi/config.c

@@ -267,6 +267,7 @@ bool config_remove_key(config_t *config, const char *section, const char *key)
     assert(config != NULL);
     assert(section != NULL);
     assert(key != NULL);
+    bool ret;
 
     section_t *sec = section_find(config, section);
     entry_t *entry = entry_find(config, section, key);
@@ -274,7 +275,12 @@ bool config_remove_key(config_t *config, const char *section, const char *key)
         return false;
     }
 
-    return list_remove(sec->entries, entry);
+    ret = list_remove(sec->entries, entry);
+    if (list_length(sec->entries) == 0) {
+        OSI_TRACE_DEBUG("%s remove section name:%s",__func__, section);
+        ret &= config_remove_section(config, section);
+    }
+    return ret;
 }
 
 const config_section_node_t *config_section_begin(const config_t *config)
@@ -544,10 +550,12 @@ static void config_parse(nvs_handle_t fp, config_t *config)
     const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
     char *keyname = osi_calloc(keyname_bufsz);
     int buf_size = get_config_size_from_flash(fp);
-    char *buf = osi_calloc(buf_size);
+    char *buf = NULL;
+
     if(buf_size == 0) { //First use nvs
         goto error;
     }
+    buf = osi_calloc(buf_size);
     if (!line || !section || !buf || !keyname) {
         err_code |= 0x01;
         goto error;

components/bt/common/osi/include/osi/alarm.h

@@ -20,6 +20,7 @@
 #define _ALARM_H_
 
 #include <stdint.h>
+#include <stdbool.h>
 #include "esp_timer.h"
 
 typedef struct alarm_t osi_alarm_t;
@@ -77,4 +78,8 @@ period_ms_t osi_alarm_get_remaining_ms(const osi_alarm_t *alarm);
 
 uint32_t osi_time_get_os_boottime_ms(void);
 
+// This function returns whether the alarm which encapsulated 
+// a one-shot timer is active or not
+bool osi_alarm_is_active(osi_alarm_t *alarm);
+
 #endif /*_ALARM_H_*/

components/bt/common/osi/include/osi/list.h

@@ -22,6 +22,10 @@ list_t *list_new(list_free_cb callback);
 
 
 list_node_t *list_free_node(list_t *list, list_node_t *node);
+
+// similar with list_free_node, this function doesn't free the node data
+list_node_t *list_delete_node(list_t *list, list_node_t *node);
+
 // Frees the list. This function accepts NULL as an argument, in which case it
 // behaves like a no-op.
 void list_free(list_t *list);
@@ -75,6 +79,9 @@ bool list_append(list_t *list, void *data);
 
 bool list_remove(list_t *list, void *data);
 
+// similar with list_remove, but do not free the node data
+bool list_delete(list_t *list, void *data);
+
 // Removes all elements in the list. Calling this function will return the list to the
 // same state it was in after |list_new|. |list| may not be NULL.
 void list_clear(list_t *list);

components/bt/common/osi/list.c

@@ -186,6 +186,36 @@ bool list_remove(list_t *list, void *data)
     return false;
 }
 
+bool list_delete(list_t *list, void *data)
+{
+    assert(list != NULL);
+    assert(data != NULL);
+
+    if (list_is_empty(list)) {
+        return false;
+    }
+
+    if (list->head->data == data) {
+        list_node_t *next = list_delete_node(list, list->head);
+        if (list->tail == list->head) {
+            list->tail = next;
+        }
+        list->head = next;
+        return true;
+    }
+
+    for (list_node_t *prev = list->head, *node = list->head->next; node; prev = node, node = node->next)
+        if (node->data == data) {
+            prev->next = list_delete_node(list, node);
+            if (list->tail == node) {
+                list->tail = prev;
+            }
+            return true;
+        }
+
+    return false;
+}
+
 void list_clear(list_t *list)
 {
     assert(list != NULL);
@@ -251,3 +281,17 @@ list_node_t *list_free_node(list_t *list, list_node_t *node)
 
     return next;
 }
+
+// remove the element from list but do not free the node data
+list_node_t *list_delete_node(list_t *list, list_node_t *node)
+{
+    assert(list != NULL);
+    assert(node != NULL);
+
+    list_node_t *next = node->next;
+
+    osi_free(node);
+    --list->length;
+
+    return next;
+}

components/bt/common/osi/thread.c

@@ -110,7 +110,6 @@ static void osi_thread_stop(osi_thread_t *thread)
 osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
 {
     int ret;
-    osi_thread_t *thread;
     struct osi_thread_start_arg start_arg = {0};
 
     if (stack_size <= 0 ||
@@ -119,17 +118,17 @@ osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priorit
         return NULL;
     }
 
-    thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
+    osi_thread_t *thread = (osi_thread_t *)osi_calloc(sizeof(osi_thread_t));
     if (thread == NULL) {
         goto _err;
     }
 
     thread->stop = false;
-    thread->work_queue_num = work_queue_num;
-    thread->work_queues = (fixed_queue_t **)osi_malloc(sizeof(fixed_queue_t *) * work_queue_num);
+    thread->work_queues = (fixed_queue_t **)osi_calloc(sizeof(fixed_queue_t *) * work_queue_num);
     if (thread->work_queues == NULL) {
         goto _err;
     }
+    thread->work_queue_num = work_queue_num;
 
     for (int i = 0; i < thread->work_queue_num; i++) {
         thread->work_queues[i] = fixed_queue_new(DEFAULT_WORK_QUEUE_CAPACITY);

components/bt/component.mk

@@ -9,11 +9,11 @@ COMPONENT_ADD_INCLUDEDIRS := include
 
 LIBS := btdm_app
 
-COMPONENT_ADD_LDFLAGS     := -lbt -L $(COMPONENT_PATH)/controller/lib \
+COMPONENT_ADD_LDFLAGS     := -lbt -L $(COMPONENT_PATH)/controller/lib/esp32 \
                            $(addprefix -l,$(LIBS))
 
 # re-link program if BT binary libs change
-COMPONENT_ADD_LINKER_DEPS := $(patsubst %,$(COMPONENT_PATH)/controller/lib/lib%.a,$(LIBS))
+COMPONENT_ADD_LINKER_DEPS := $(patsubst %,$(COMPONENT_PATH)/controller/lib/esp32/lib%.a,$(LIBS))
 
 COMPONENT_SUBMODULES += controller/lib
 
@@ -139,6 +139,7 @@ endif
 
 ifdef CONFIG_BLE_MESH
 COMPONENT_ADD_INCLUDEDIRS += esp_ble_mesh/mesh_common/include           \
+                             esp_ble_mesh/mesh_common/tinycrypt/include \
                              esp_ble_mesh/mesh_core                     \
                              esp_ble_mesh/mesh_core/include             \
                              esp_ble_mesh/mesh_core/storage             \
@@ -151,9 +152,11 @@ COMPONENT_ADD_INCLUDEDIRS += esp_ble_mesh/mesh_common/include           \
                              esp_ble_mesh/api
 
 COMPONENT_SRCDIRS += esp_ble_mesh/mesh_common               \
+                     esp_ble_mesh/mesh_common/tinycrypt/src \
                      esp_ble_mesh/mesh_core                 \
                      esp_ble_mesh/mesh_core/storage         \
                      esp_ble_mesh/btc                       \
+                     esp_ble_mesh/mesh_models/common        \
                      esp_ble_mesh/mesh_models/client        \
                      esp_ble_mesh/mesh_models/server        \
                      esp_ble_mesh/api/core                  \

components/bt/esp_ble_mesh/Kconfig.in

@@ -18,12 +18,118 @@ if BLE_MESH
             option in the Bluetooth Controller section in menuconfig, which is
             "Scan Duplicate By Device Address and Advertising Data".
 
-    config BLE_MESH_ALLOC_FROM_PSRAM_FIRST
-        bool "BLE Mesh will first allocate memory from PSRAM"
+    choice BLE_MESH_MEM_ALLOC_MODE
+        prompt "Memory allocation strategy"
+        default BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+        help
+            Allocation strategy for BLE Mesh stack, essentially provides ability to
+            allocate all required dynamic allocations from,
+
+            - Internal DRAM memory only
+            - External SPIRAM memory only
+            - Either internal or external memory based on default malloc()
+              behavior in ESP-IDF
+            - Internal IRAM memory wherever applicable else internal DRAM
+
+            Recommended mode here is always internal, since that is most preferred
+            from security perspective. But if application requirement does not allow
+            sufficient free internal memory then alternate mode can be selected.
+
+        config BLE_MESH_MEM_ALLOC_MODE_INTERNAL
+            bool "Internal DRAM"
+
+        config BLE_MESH_MEM_ALLOC_MODE_EXTERNAL
+            bool "External SPIRAM"
+            depends on ESP32_SPIRAM_SUPPORT
+
+        config BLE_MESH_MEM_ALLOC_MODE_DEFAULT
+            bool "Default alloc mode"
+            depends on ESP32_SPIRAM_SUPPORT
+            help
+                Enable this option to use the default memory allocation strategy when
+                external SPIRAM is enabled. See the SPIRAM options for more details.
+
+        config BLE_MESH_MEM_ALLOC_MODE_IRAM_8BIT
+            bool "Internal IRAM"
+            depends on ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY
+            help
+                Allows to use IRAM memory region as 8bit accessible region. Every
+                unaligned (8bit or 16bit) access will result in an exception and
+                incur penalty of certain clock cycles per unaligned read/write.
+
+    endchoice # BLE_MESH_MEM_ALLOC_MODE
+
+    config BLE_MESH_FREERTOS_STATIC_ALLOC
+        bool "Enable FreeRTOS static allocation"
+        depends on FREERTOS_SUPPORT_STATIC_ALLOCATION && (ESP32_SPIRAM_SUPPORT || ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY)
         default n
         help
-            When this option is enabled, BLE Mesh stack will try to allocate memory
-            from PSRAM firstly. This will save the internal RAM if PSRAM exists.
+            Enable this option to use FreeRTOS static allocation APIs for BLE Mesh,
+            which provides the ability to use different dynamic memory (i.e. SPIRAM
+            or IRAM) for FreeRTOS objects.
+            If this option is disabled, the FreeRTOS static allocation APIs will not
+            be used, and internal DRAM will be allocated for FreeRTOS objects.
+
+    choice BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+        prompt "Memory allocation for FreeRTOS objects"
+        depends on BLE_MESH_FREERTOS_STATIC_ALLOC
+        help
+            Choose the memory to be used for FreeRTOS objects.
+
+        config BLE_MESH_FREERTOS_STATIC_ALLOC_EXTERNAL
+            bool "External SPIRAM"
+            depends on ESP32_SPIRAM_SUPPORT
+            help
+                If enabled, BLE Mesh allocates dynamic memory from external SPIRAM for
+                FreeRTOS objects, i.e. mutex, queue, and task stack. External SPIRAM
+                can only be used for task stack when SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY
+                is enabled. See the SPIRAM options for more details.
+
+        config BLE_MESH_FREERTOS_STATIC_ALLOC_IRAM_8BIT
+            bool "Internal IRAM"
+            depends on ESP32_IRAM_AS_8BIT_ACCESSIBLE_MEMORY
+            help
+                If enabled, BLE Mesh allocates dynamic memory from internal IRAM for
+                FreeRTOS objects, i.e. mutex, queue. Note: IRAM region cannot be used
+                as task stack.
+
+    endchoice # BLE_MESH_FREERTOS_STATIC_ALLOC_MODE
+
+    config BLE_MESH_DEINIT
+        bool "Support de-initialize BLE Mesh stack"
+        default y
+        help
+            If enabled, users can use the function esp_ble_mesh_deinit() to de-initialize
+            the whole BLE Mesh stack.
+
+    menu "BLE Mesh and BLE coexistence support"
+
+        config BLE_MESH_SUPPORT_BLE_ADV
+            bool "Support sending normal BLE advertising packets"
+            default n
+            help
+                When selected, users can send normal BLE advertising packets
+                with specific API.
+
+        if BLE_MESH_SUPPORT_BLE_ADV
+
+            config BLE_MESH_BLE_ADV_BUF_COUNT
+                int "Number of advertising buffers for BLE advertising packets"
+                default 3
+                range 1 255
+                help
+                    Number of advertising buffers for BLE packets available.
+
+        endif # BLE_MESH_SUPPORT_BLE_ADV
+
+        config BLE_MESH_SUPPORT_BLE_SCAN
+            bool "Support scanning normal BLE advertising packets"
+            default n
+            help
+                When selected, users can register a callback and receive normal BLE
+                advertising packets in the application layer.
+
+    endmenu # BLE Mesh and BLE coexistence support
 
     config BLE_MESH_FAST_PROV
         bool "Enable BLE Mesh Fast Provisioning"
@@ -118,6 +224,28 @@ if BLE_MESH
                 This option specifies how many application keys the Provisioner can have.
                 Indeed, this value decides the number of the application keys which can be added by a Provisioner.
 
+        config BLE_MESH_PROVISIONER_RECV_HB
+            bool "Support receiving Heartbeat messages"
+            default n
+            help
+                When this option is enabled, Provisioner can call specific functions to enable
+                or disable receiving Heartbeat messages and notify them to the application layer.
+
+        if BLE_MESH_PROVISIONER_RECV_HB
+
+            config BLE_MESH_PROVISIONER_RECV_HB_FILTER_SIZE
+                int "Maximum number of filter entries for receiving Heartbeat messages"
+                default 3
+                range 1 1000
+                help
+                    This option specifies how many heartbeat filter entries Provisioner supports.
+                    The heartbeat filter (acceptlist or rejectlist) entries are used to store a
+                    list of SRC and DST which can be used to decide if a heartbeat message will
+                    be processed and notified to the application layer by Provisioner.
+                    Note: The filter is an empty rejectlist by default.
+
+        endif # BLE_MESH_PROVISIONER_RECV_HB
+
     endif # BLE_MESH_PROVISIONER
 
     # Virtual option enabled whenever Generic Provisioning layer is needed
@@ -137,6 +265,19 @@ if BLE_MESH
             advertising bearer. This option should be enabled if PB-ADV is
             going to be used during provisioning procedure.
 
+    config BLE_MESH_UNPROVISIONED_BEACON_INTERVAL
+        int "Interval between two consecutive Unprovisioned Device Beacon"
+        depends on BLE_MESH_NODE && BLE_MESH_PB_ADV
+        default 5
+        default 3 if BLE_MESH_FAST_PROV
+        range 1 100
+        help
+            This option specifies the interval of sending two consecutive unprovisioned
+            device beacon, users can use this option to change the frequency of sending
+            unprovisioned device beacon. For example, if the value is 5, it means the
+            unprovisioned device beacon will send every 5 seconds. When the option of
+            BLE_MESH_FAST_PROV is selected, the value is better to be 3 seconds, or less.
+
     config BLE_MESH_PB_GATT
         bool "Provisioning support using GATT (PB-GATT)"
         select BLE_MESH_PROXY
@@ -199,7 +340,7 @@ if BLE_MESH
             advertising bearer.
 
     config BLE_MESH_NET_BUF_POOL_USAGE
-        bool "BLE Mesh net buffer pool usage tracking"
+        bool
         default y
         help
             Enable BLE Mesh net buffer pool tracking. This option is used to introduce another
@@ -221,28 +362,6 @@ if BLE_MESH
 
     if BLE_MESH_SETTINGS
 
-        config BLE_MESH_SPECIFIC_PARTITION
-            bool "Use a specific NVS partition for BLE Mesh"
-            default n
-            help
-                When selected, the mesh stack will use a specified NVS partition instead of
-                default NVS partition. Note that the specified partition must be registered
-                with NVS using nvs_flash_init_partition() API, and the partition must exists
-                in the csv file.
-                When Provisioner needs to store a large amount of nodes' information in the
-                flash (e.g. more than 20), this option is recommended to be enabled.
-
-        if BLE_MESH_SPECIFIC_PARTITION
-
-            config BLE_MESH_PARTITION_NAME
-                string "Name of the NVS partition for BLE Mesh"
-                default "ble_mesh"
-                help
-                    This value defines the name of the specified NVS partition used by the
-                    mesh stack.
-
-        endif # BLE_MESH_SPECIFIC_PARTITION
-
         config BLE_MESH_STORE_TIMEOUT
             int "Delay (in seconds) before storing anything persistently"
             range 0 1000000
@@ -257,7 +376,7 @@ if BLE_MESH
         config BLE_MESH_SEQ_STORE_RATE
             int "How often the sequence number gets updated in storage"
             range 0 1000000
-            default 6
+            default 0
             help
                 This value defines how often the local sequence number gets updated in
                 persistent storage (i.e. flash). e.g. a value of 100 means that the
@@ -272,7 +391,7 @@ if BLE_MESH
         config BLE_MESH_RPL_STORE_TIMEOUT
             int "Minimum frequency that the RPL gets updated in storage"
             range 0 1000000
-            default 5
+            default 0
             help
                 This value defines in seconds how soon the RPL (Replay Protection List)
                 gets written to persistent storage after a change occurs. If the node
@@ -308,6 +427,50 @@ if BLE_MESH
                 in advance before recovering node information and make sure the node
                 information recovering could work as expected.
 
+        config BLE_MESH_SPECIFIC_PARTITION
+            bool "Use a specific NVS partition for BLE Mesh"
+            default n
+            help
+                When selected, the mesh stack will use a specified NVS partition instead of
+                default NVS partition. Note that the specified partition must be registered
+                with NVS using nvs_flash_init_partition() API, and the partition must exists
+                in the csv file.
+                When Provisioner needs to store a large amount of nodes' information in the
+                flash (e.g. more than 20), this option is recommended to be enabled.
+
+        config BLE_MESH_PARTITION_NAME
+            string "Name of the NVS partition for BLE Mesh"
+            depends on BLE_MESH_SPECIFIC_PARTITION
+            default "ble_mesh"
+            help
+                This value defines the name of the specified NVS partition used by the
+                mesh stack.
+
+        config BLE_MESH_USE_MULTIPLE_NAMESPACE
+            bool "Support using multiple NVS namespaces by Provisioner"
+            depends on BLE_MESH_PROVISIONER
+            default n
+            help
+                When selected, Provisioner can use different NVS namespaces to store
+                different instances of mesh information.
+                For example, if in the first room, Provisioner uses NetKey A, AppKey
+                A and provisions three devices, these information will be treated as
+                mesh information instance A. When the Provisioner moves to the second
+                room, it uses NetKey B, AppKey B and provisions two devices, then the
+                information will be treated as mesh information instance B.
+                Here instance A and instance B will be stored in different namespaces.
+                With this option enabled, Provisioner needs to use specific functions
+                to open the corresponding NVS namespace, restore the mesh information,
+                release the mesh information or erase the mesh information.
+
+        config BLE_MESH_MAX_NVS_NAMESPACE
+            int "Maximum number of NVS namespaces"
+            depends on BLE_MESH_USE_MULTIPLE_NAMESPACE
+            default 2
+            range 1 255
+            help
+                This option specifies the maximum NVS namespaces supported by Provisioner.
+
     endif  # if BLE_MESH_SETTINGS
 
     config BLE_MESH_SUBNET_COUNT
@@ -389,24 +552,6 @@ if BLE_MESH
             SDU size is 60 bytes, which leaves 56 bytes for application layer data
             using a 4-byte MIC, or 52 bytes using an 8-byte MIC.
 
-    config BLE_MESH_SUPPORT_BLE_ADV
-        bool "Support sending normal BLE advertising packets"
-        default n
-        help
-            When selected, users can send normal BLE advertising packets
-            with specific API.
-
-    if BLE_MESH_SUPPORT_BLE_ADV
-
-        config BLE_MESH_BLE_ADV_BUF_COUNT
-            int "Number of advertising buffers for BLE advertising packets"
-            default 3
-            range 1 255
-            help
-                Number of advertising buffers for BLE packets available.
-
-    endif # BLE_MESH_SUPPORT_BLE_ADV
-
     config BLE_MESH_IVU_DIVIDER
         int "Divider for IV Update state refresh timer"
         default 4
@@ -433,6 +578,21 @@ if BLE_MESH
             stored to flash. E.g. the default value of 4 means that the
             state is saved every 24 hours (96 / 4).
 
+    config BLE_MESH_IVU_RECOVERY_IVI
+        bool "Recovery the IV index when the latest whole IV update procedure is missed"
+        default n
+        help
+            According to Section 3.10.5 of Mesh Specification v1.0.1.
+            If a node in Normal Operation receives a Secure Network beacon with an IV index
+            equal to the last known IV index+1 and the IV Update Flag set to 0, the node may
+            update its IV without going to the IV Update in Progress state, or it may initiate
+            an IV Index Recovery procedure (Section 3.10.6), or it may ignore the Secure
+            Network beacon. The node makes the choice depending on the time since last IV
+            update and the likelihood that the node has missed the Secure Network beacons
+            with the IV update Flag.
+            When the above situation is encountered, this option can be used to decide whether
+            to perform the IV index recovery procedure.
+
     config BLE_MESH_TX_SEG_MSG_COUNT
         int "Maximum number of simultaneous outgoing segmented messages"
         default 1
@@ -651,6 +811,13 @@ if BLE_MESH
             help
                 Maximum number of groups to which the LPN can subscribe.
 
+        config BLE_MESH_LPN_SUB_ALL_NODES_ADDR
+            bool "Automatically subscribe all nodes address"
+            default n
+            help
+                Automatically subscribe all nodes address when friendship
+                established.
+
     endif # BLE_MESH_LOW_POWER
 
     config BLE_MESH_FRIEND
@@ -801,104 +968,138 @@ if BLE_MESH
             uses 0 as the timeout value when sending acknowledged messages, then
             the default value will be used which is four seconds.
 
-    menu "Support for BLE Mesh Client Models"
+    menu "Support for BLE Mesh Foundation models"
 
         config BLE_MESH_CFG_CLI
-            bool "Configuration Client Model"
+            bool "Configuration Client model"
             help
-                Enable support for Configuration client model.
+                Enable support for Configuration Client model.
 
         config BLE_MESH_HEALTH_CLI
-            bool "Health Client Model"
+            bool "Health Client model"
             help
-                Enable support for Health client model.
+                Enable support for Health Client model.
+
+        config BLE_MESH_HEALTH_SRV
+            bool "Health Server model"
+            default y
+            help
+                Enable support for Health Server model.
+
+    endmenu #Support for BLE Mesh Foundation models
+
+    menu "Support for BLE Mesh Client/Server models"
 
         config BLE_MESH_GENERIC_ONOFF_CLI
-            bool "Generic OnOff Client Model"
+            bool "Generic OnOff Client model"
             help
-                Enable support for Generic OnOff client model.
+                Enable support for Generic OnOff Client model.
 
         config BLE_MESH_GENERIC_LEVEL_CLI
-            bool "Generic Level Client Model"
+            bool "Generic Level Client model"
             help
-                Enable support for Generic Level client model.
+                Enable support for Generic Level Client model.
 
         config BLE_MESH_GENERIC_DEF_TRANS_TIME_CLI
-            bool "Generic Default Transition Time Client Model"
+            bool "Generic Default Transition Time Client model"
             help
-                Enable support for Generic Default Transition Time client model.
+                Enable support for Generic Default Transition Time Client model.
 
         config BLE_MESH_GENERIC_POWER_ONOFF_CLI
-            bool "Generic Power OnOff Client Model"
+            bool "Generic Power OnOff Client model"
             help
-                Enable support for Generic Power OnOff client model.
+                Enable support for Generic Power OnOff Client model.
 
         config BLE_MESH_GENERIC_POWER_LEVEL_CLI
-            bool "Generic Power Level Client Model"
+            bool "Generic Power Level Client model"
             help
-                Enable support for Generic Power Level client model.
+                Enable support for Generic Power Level Client model.
 
         config BLE_MESH_GENERIC_BATTERY_CLI
-            bool "Generic Battery Client Model"
+            bool "Generic Battery Client model"
             help
-                Enable support for Generic Battery client model.
+                Enable support for Generic Battery Client model.
 
         config BLE_MESH_GENERIC_LOCATION_CLI
-            bool "Generic Location Client Model"
+            bool "Generic Location Client model"
             help
-                Enable support for Generic Location client model.
+                Enable support for Generic Location Client model.
 
         config BLE_MESH_GENERIC_PROPERTY_CLI
-            bool "Generic Property Client Model"
+            bool "Generic Property Client model"
             help
-                Enable support for Generic Property client model.
+                Enable support for Generic Property Client model.
 
         config BLE_MESH_SENSOR_CLI
-            bool "Sensor Client Model"
+            bool "Sensor Client model"
             help
-                Enable support for Sensor client model.
+                Enable support for Sensor Client model.
 
         config BLE_MESH_TIME_CLI
-            bool "Time Client Model"
+            bool "Time Client model"
             help
-                Enable support for Time client model.
+                Enable support for Time Client model.
 
         config BLE_MESH_SCENE_CLI
-            bool "Scene Client Model"
+            bool "Scene Client model"
             help
-                Enable support for Scene client model.
+                Enable support for Scene Client model.
 
         config BLE_MESH_SCHEDULER_CLI
-            bool "Scheduler Client Model"
+            bool "Scheduler Client model"
             help
-                Enable support for Scheduler client model.
+                Enable support for Scheduler Client model.
 
         config BLE_MESH_LIGHT_LIGHTNESS_CLI
-            bool "Light Lightness Client Model"
+            bool "Light Lightness Client model"
             help
-                Enable support for Light Lightness client model.
+                Enable support for Light Lightness Client model.
 
         config BLE_MESH_LIGHT_CTL_CLI
-            bool "Light CTL Client Model"
+            bool "Light CTL Client model"
             help
-                Enable support for Light CTL client model.
+                Enable support for Light CTL Client model.
 
         config BLE_MESH_LIGHT_HSL_CLI
-            bool "Light HSL Client Model"
+            bool "Light HSL Client model"
             help
-                Enable support for Light HSL client model.
+                Enable support for Light HSL Client model.
 
         config BLE_MESH_LIGHT_XYL_CLI
-            bool "Light XYL Client Model"
+            bool "Light XYL Client model"
             help
-                Enable support for Light XYL client model.
+                Enable support for Light XYL Client model.
 
         config BLE_MESH_LIGHT_LC_CLI
-            bool "Light LC Client Model"
+            bool "Light LC Client model"
             help
-                Enable support for Light LC client model.
+                Enable support for Light LC Client model.
 
-    endmenu
+        config BLE_MESH_GENERIC_SERVER
+            bool "Generic server models"
+            default y
+            help
+                Enable support for Generic server models.
+
+        config BLE_MESH_SENSOR_SERVER
+            bool "Sensor server models"
+            default y
+            help
+                Enable support for Sensor server models.
+
+        config BLE_MESH_TIME_SCENE_SERVER
+            bool "Time and Scenes server models"
+            default y
+            help
+                Enable support for Time and Scenes server models.
+
+        config BLE_MESH_LIGHTING_SERVER
+            bool "Lighting server models"
+            default y
+            help
+                Enable support for Lighting server models.
+
+    endmenu #Support for BLE Mesh Client/Server models
 
     config BLE_MESH_IV_UPDATE_TEST
         bool "Test the IV Update Procedure"
@@ -908,6 +1109,13 @@ if BLE_MESH
             lets the state to be changed at any time.
             If IV Update test mode is going to be used, this option should be enabled.
 
+    config BLE_MESH_DISCARD_OLD_SEQ_AUTH
+        bool
+        default y
+        help
+            This option is used to decide whether discarding the old SeqAuth when
+            receiving a segmented message.
+
     menu "BLE Mesh specific test option"
 
         config BLE_MESH_SELF_TEST

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c

@@ -1,4 +1,4 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
+// Copyright 2017-2020 Espressif Systems (Shanghai) PTE LTD
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -15,19 +15,25 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "btc/btc_manage.h"
-
 #include "esp_err.h"
 
-#include "btc_ble_mesh_prov.h"
-#include "esp_ble_mesh_defs.h"
+#include "btc_ble_mesh_ble.h"
+#include "esp_ble_mesh_ble_api.h"
+
+#if CONFIG_BLE_MESH_BLE_COEX_SUPPORT
+esp_err_t esp_ble_mesh_register_ble_callback(esp_ble_mesh_ble_cb_t callback)
+{
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    return (btc_profile_cb_set(BTC_PID_BLE_MESH_BLE_COEX, callback) == 0 ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */
 
 #if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
-
 esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t *param,
                                              const esp_ble_mesh_ble_adv_data_t *data)
 {
-    btc_ble_mesh_prov_args_t arg = {0};
+    btc_ble_mesh_ble_args_t arg = {0};
     btc_msg_t msg = {0};
 
     if (param == NULL) {
@@ -37,21 +43,21 @@ esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
-    msg.pid = BTC_PID_PROV;
-    msg.act = BTC_BLE_MESH_ACT_START_BLE_ADVERTISING;
+    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
+    msg.act = BTC_BLE_MESH_ACT_START_BLE_ADV;
 
-    memcpy(&arg.start_ble_advertising.param, param, sizeof(esp_ble_mesh_ble_adv_param_t));
+    memcpy(&arg.start_ble_adv.param, param, sizeof(esp_ble_mesh_ble_adv_param_t));
     if (data) {
-        memcpy(&arg.start_ble_advertising.data, data, sizeof(esp_ble_mesh_ble_adv_data_t));
+        memcpy(&arg.start_ble_adv.data, data, sizeof(esp_ble_mesh_ble_adv_data_t));
     }
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index)
 {
-    btc_ble_mesh_prov_args_t arg = {0};
+    btc_ble_mesh_ble_args_t arg = {0};
     btc_msg_t msg = {0};
 
     if (index >= CONFIG_BLE_MESH_BLE_ADV_BUF_COUNT) {
@@ -61,13 +67,44 @@ esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index)
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
-    msg.pid = BTC_PID_PROV;
-    msg.act = BTC_BLE_MESH_ACT_STOP_BLE_ADVERTISING;
+    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
+    msg.act = BTC_BLE_MESH_ACT_STOP_BLE_ADV;
 
-    arg.stop_ble_advertising.index = index;
+    arg.stop_ble_adv.index = index;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */
+
+#if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN
+esp_err_t esp_ble_mesh_start_ble_scanning(esp_ble_mesh_ble_scan_param_t *param)
+{
+    btc_ble_mesh_ble_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
+    msg.act = BTC_BLE_MESH_ACT_START_BLE_SCAN;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */
+esp_err_t esp_ble_mesh_stop_ble_scanning(void)
+{
+    btc_ble_mesh_ble_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
+    msg.act = BTC_BLE_MESH_ACT_STOP_BLE_SCAN;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_ble_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c

@@ -42,7 +42,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
 
     // Create a semaphore
     if ((semaphore = xSemaphoreCreateCounting(1, 0)) == NULL) {
-        BT_ERR("%s, Failed to allocate memory for the semaphore", __func__);
+        BT_ERR("Failed to create semaphore");
         return ESP_ERR_NO_MEM;
     }
 
@@ -55,9 +55,9 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_MESH_INIT;
 
-    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL) != BT_STATUS_SUCCESS) {
+    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL) != BT_STATUS_SUCCESS) {
         vSemaphoreDelete(semaphore);
-        BT_ERR("%s, BLE Mesh initialise failed", __func__);
+        BT_ERR("Failed to start mesh init");
         return ESP_FAIL;
     }
 
@@ -69,6 +69,7 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
     return ESP_OK;
 }
 
+#if CONFIG_BLE_MESH_DEINIT
 esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
 {
     btc_ble_mesh_prov_args_t arg = {0};
@@ -86,7 +87,7 @@ esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_DEINIT_MESH;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
-
+#endif /* CONFIG_BLE_MESH_DEINIT */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c

@@ -13,6 +13,7 @@
 // limitations under the License.
 
 #include <stdint.h>
+#include <string.h>
 
 #include "esp_err.h"
 
@@ -32,7 +33,8 @@ uint16_t esp_ble_mesh_get_primary_element_address(void)
     return btc_ble_mesh_get_primary_addr();
 }
 
-uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model, uint16_t group_addr)
+uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model,
+                                                    uint16_t group_addr)
 {
     if (model == NULL) {
         return NULL;
@@ -54,7 +56,7 @@ uint8_t esp_ble_mesh_get_element_count(void)
 }
 
 esp_ble_mesh_model_t *esp_ble_mesh_find_vendor_model(const esp_ble_mesh_elem_t *element,
-        uint16_t company_id, uint16_t model_id)
+                                                     uint16_t company_id, uint16_t model_id)
 {
     if (element == NULL) {
         return NULL;
@@ -62,7 +64,8 @@ esp_ble_mesh_model_t *esp_ble_mesh_find_vendor_model(const esp_ble_mesh_elem_t *
     return btc_ble_mesh_model_find_vnd(element, company_id, model_id);
 }
 
-esp_ble_mesh_model_t *esp_ble_mesh_find_sig_model(const esp_ble_mesh_elem_t *element, uint16_t model_id)
+esp_ble_mesh_model_t *esp_ble_mesh_find_sig_model(const esp_ble_mesh_elem_t *element,
+                                                  uint16_t model_id)
 {
     if (element == NULL) {
         return NULL;
@@ -75,3 +78,138 @@ const esp_ble_mesh_comp_t *esp_ble_mesh_get_composition_data(void)
     return btc_ble_mesh_comp_get();
 }
 
+esp_err_t esp_ble_mesh_model_subscribe_group_addr(uint16_t element_addr, uint16_t company_id,
+                                                  uint16_t model_id, uint16_t group_addr)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!ESP_BLE_MESH_ADDR_IS_UNICAST(element_addr) ||
+        !ESP_BLE_MESH_ADDR_IS_GROUP(group_addr)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_MODEL_SUBSCRIBE_GROUP_ADDR;
+
+    arg.model_sub_group_addr.element_addr = element_addr;
+    arg.model_sub_group_addr.company_id = company_id;
+    arg.model_sub_group_addr.model_id = model_id;
+    arg.model_sub_group_addr.group_addr = group_addr;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_model_unsubscribe_group_addr(uint16_t element_addr, uint16_t company_id,
+                                                    uint16_t model_id, uint16_t group_addr)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!ESP_BLE_MESH_ADDR_IS_UNICAST(element_addr) ||
+        !ESP_BLE_MESH_ADDR_IS_GROUP(group_addr)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_MODEL_UNSUBSCRIBE_GROUP_ADDR;
+
+    arg.model_unsub_group_addr.element_addr = element_addr;
+    arg.model_unsub_group_addr.company_id = company_id;
+    arg.model_unsub_group_addr.model_id = model_id;
+    arg.model_unsub_group_addr.group_addr = group_addr;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+#if CONFIG_BLE_MESH_NODE
+
+const uint8_t *esp_ble_mesh_node_get_local_net_key(uint16_t net_idx)
+{
+    return btc_ble_mesh_node_get_local_net_key(net_idx);
+}
+
+const uint8_t *esp_ble_mesh_node_get_local_app_key(uint16_t app_idx)
+{
+    return btc_ble_mesh_node_get_local_app_key(app_idx);
+}
+
+esp_err_t esp_ble_mesh_node_add_local_net_key(const uint8_t net_key[16], uint16_t net_idx)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (net_key == NULL || net_idx > 0xFFF) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_NODE_ADD_LOCAL_NET_KEY;
+
+    arg.node_add_local_net_key.net_idx = net_idx;
+    memcpy(arg.node_add_local_net_key.net_key, net_key, 16);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_node_add_local_app_key(const uint8_t app_key[16], uint16_t net_idx, uint16_t app_idx)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (app_key == NULL || net_idx > 0xFFF || app_idx > 0xFFF) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_NODE_ADD_LOCAL_APP_KEY;
+
+    arg.node_add_local_app_key.net_idx = net_idx;
+    arg.node_add_local_app_key.app_idx = app_idx;
+    memcpy(arg.node_add_local_app_key.app_key, app_key, 16);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_node_bind_app_key_to_local_model(uint16_t element_addr, uint16_t company_id,
+                                                        uint16_t model_id, uint16_t app_idx)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!ESP_BLE_MESH_ADDR_IS_UNICAST(element_addr) || app_idx > 0xFFF) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_NODE_BIND_APP_KEY_TO_MODEL;
+
+    arg.node_local_mod_app_bind.element_addr = element_addr;
+    arg.node_local_mod_app_bind.model_id = model_id;
+    arg.node_local_mod_app_bind.company_id = company_id;
+    arg.node_local_mod_app_bind.app_idx = app_idx;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+#endif /* CONFIG_BLE_MESH_NODE */

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c

@@ -29,7 +29,7 @@ esp_err_t esp_ble_mesh_lpn_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_lpn_disable(bool force)
@@ -45,7 +45,7 @@ esp_err_t esp_ble_mesh_lpn_disable(bool force)
 
     arg.lpn_disable.force = force;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -59,5 +59,5 @@ esp_err_t esp_ble_mesh_lpn_poll(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_LPN_POLL;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c

@@ -23,12 +23,12 @@
 #define ESP_BLE_MESH_TX_SDU_MAX ((CONFIG_BLE_MESH_ADV_BUF_COUNT - 3) * 12)
 
 static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_msg_ctx_t *ctx,
-        uint32_t opcode,
-        btc_ble_mesh_model_act_t act,
-        uint16_t length, uint8_t *data,
-        int32_t msg_timeout, bool need_rsp,
-        esp_ble_mesh_dev_role_t device_role)
+                                         esp_ble_mesh_msg_ctx_t *ctx,
+                                         uint32_t opcode,
+                                         btc_ble_mesh_model_act_t act,
+                                         uint16_t length, uint8_t *data,
+                                         int32_t msg_timeout, bool need_rsp,
+                                         esp_ble_mesh_dev_role_t device_role)
 {
     btc_ble_mesh_model_args_t arg = {0};
     uint8_t op_len = 0, mic_len = 0;
@@ -39,12 +39,12 @@ static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     if (ctx && ctx->addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
-        BT_ERR("%s, Invalid destination address 0x0000", __func__);
+        BT_ERR("Invalid destination address 0x0000");
         return ESP_ERR_INVALID_ARG;
     }
 
     if (device_role > ROLE_FAST_PROV) {
-        BT_ERR("%s, Invalid device role 0x%02x", __func__, device_role);
+        BT_ERR("Invalid device role 0x%02x", device_role);
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -63,7 +63,7 @@ static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
 
     if (act == BTC_BLE_MESH_ACT_MODEL_PUBLISH) {
         if (op_len + length > model->pub->msg->size) {
-            BT_ERR("%s, Model publication msg size %d is too small", __func__, model->pub->msg->size);
+            BT_ERR("Too small publication msg size %d", model->pub->msg->size);
             return ESP_ERR_INVALID_ARG;
         }
     }
@@ -75,7 +75,7 @@ static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
     }
 
     if (op_len + length + mic_len > MIN(ESP_BLE_MESH_SDU_MAX_LEN, ESP_BLE_MESH_TX_SDU_MAX)) {
-        BT_ERR("%s, Data length %d is too large", __func__, length);
+        BT_ERR("Too large data length %d", length);
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -109,8 +109,8 @@ static esp_err_t ble_mesh_model_send_msg(esp_ble_mesh_model_t *model,
         arg.model_send.msg_timeout = msg_timeout;
     }
 
-    status = (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy)
-              == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    status = (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy,
+                btc_ble_mesh_model_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 
     bt_mesh_free(msg_data);
 
@@ -164,6 +164,7 @@ esp_err_t esp_ble_mesh_client_model_init(esp_ble_mesh_model_t *model)
     return btc_ble_mesh_client_model_init(model);
 }
 
+#if CONFIG_BLE_MESH_DEINIT
 esp_err_t esp_ble_mesh_client_model_deinit(esp_ble_mesh_model_t *model)
 {
     if (model == NULL) {
@@ -174,26 +175,36 @@ esp_err_t esp_ble_mesh_client_model_deinit(esp_ble_mesh_model_t *model)
 
     return btc_ble_mesh_client_model_deinit(model);
 }
+#endif /* CONFIG_BLE_MESH_DEINIT */
 
 esp_err_t esp_ble_mesh_server_model_send_msg(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_msg_ctx_t *ctx, uint32_t opcode,
-        uint16_t length, uint8_t *data)
+                                             esp_ble_mesh_msg_ctx_t *ctx,
+                                             uint32_t opcode,
+                                             uint16_t length, uint8_t *data)
 {
-    if (!model || !ctx) {
+    if (model == NULL || ctx == NULL ||
+        ctx->net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        ctx->app_idx == ESP_BLE_MESH_KEY_UNUSED) {
         return ESP_ERR_INVALID_ARG;
     }
+
     return ble_mesh_model_send_msg(model, ctx, opcode, BTC_BLE_MESH_ACT_SERVER_MODEL_SEND,
                                    length, data, 0, false, ROLE_NODE);
 }
 
 esp_err_t esp_ble_mesh_client_model_send_msg(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_msg_ctx_t *ctx, uint32_t opcode,
-        uint16_t length, uint8_t *data, int32_t msg_timeout,
-        bool need_rsp, esp_ble_mesh_dev_role_t device_role)
+                                             esp_ble_mesh_msg_ctx_t *ctx,
+                                             uint32_t opcode,
+                                             uint16_t length, uint8_t *data,
+                                             int32_t msg_timeout, bool need_rsp,
+                                             esp_ble_mesh_dev_role_t device_role)
 {
-    if (!model || !ctx) {
+    if (model == NULL || ctx == NULL ||
+        ctx->net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        ctx->app_idx == ESP_BLE_MESH_KEY_UNUSED) {
         return ESP_ERR_INVALID_ARG;
     }
+
     return ble_mesh_model_send_msg(model, ctx, opcode, BTC_BLE_MESH_ACT_CLIENT_MODEL_SEND,
                                    length, data, msg_timeout, need_rsp, device_role);
 }
@@ -202,16 +213,19 @@ esp_err_t esp_ble_mesh_model_publish(esp_ble_mesh_model_t *model, uint32_t opcod
                                      uint16_t length, uint8_t *data,
                                      esp_ble_mesh_dev_role_t device_role)
 {
-    if (!model || !model->pub || !model->pub->msg) {
+    if (model == NULL || model->pub == NULL || model->pub->msg == NULL ||
+        model->pub->publish_addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
+
     return ble_mesh_model_send_msg(model, NULL, opcode, BTC_BLE_MESH_ACT_MODEL_PUBLISH,
                                    length, data, 0, false, device_role);
 }
 
+#if CONFIG_BLE_MESH_SERVER_MODEL
 esp_err_t esp_ble_mesh_server_model_update_state(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_server_state_type_t type,
-        esp_ble_mesh_server_state_value_t *value)
+                                                 esp_ble_mesh_server_state_type_t type,
+                                                 esp_ble_mesh_server_state_value_t *value)
 {
     btc_ble_mesh_model_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -230,9 +244,10 @@ esp_err_t esp_ble_mesh_server_model_update_state(esp_ble_mesh_model_t *model,
     msg.pid = BTC_PID_MODEL;
     msg.act = BTC_BLE_MESH_ACT_SERVER_MODEL_UPDATE_STATE;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_model_args_t), btc_ble_mesh_model_arg_deep_copy,
+                btc_ble_mesh_model_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_SERVER_MODEL */
 
 esp_err_t esp_ble_mesh_node_local_reset(void)
 {
@@ -244,7 +259,7 @@ esp_err_t esp_ble_mesh_node_local_reset(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_NODE_RESET;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 #if (CONFIG_BLE_MESH_PROVISIONER)
@@ -268,7 +283,7 @@ esp_err_t esp_ble_mesh_provisioner_set_node_name(uint16_t index, const char *nam
     memset(arg.set_node_name.name, 0, sizeof(arg.set_node_name.name));
     strncpy(arg.set_node_name.name, name, ESP_BLE_MESH_NODE_NAME_MAX_LEN);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -286,7 +301,8 @@ uint16_t esp_ble_mesh_provisioner_get_node_index(const char *name)
     return bt_mesh_provisioner_get_node_index(name);
 }
 
-esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr, uint8_t *data, uint16_t length)
+esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr,
+                                                        uint8_t *data, uint16_t length)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -304,8 +320,8 @@ esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr, u
     arg.store_node_comp_data.unicast_addr = unicast_addr;
     arg.store_node_comp_data.length = length;
     arg.store_node_comp_data.data = data;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_uuid(const uint8_t uuid[16])
@@ -326,6 +342,25 @@ esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_addr(uint16_t unicas
     return btc_ble_mesh_provisioner_get_node_with_addr(unicast_addr);
 }
 
+esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_name(const char *name)
+{
+    if (!name || (strlen(name) > ESP_BLE_MESH_NODE_NAME_MAX_LEN)) {
+        return NULL;
+    }
+
+    return btc_ble_mesh_provisioner_get_node_with_name(name);
+}
+
+uint16_t esp_ble_mesh_provisioner_get_prov_node_count(void)
+{
+    return btc_ble_mesh_provisioner_get_prov_node_count();
+}
+
+const esp_ble_mesh_node_t **esp_ble_mesh_provisioner_get_node_table_entry(void)
+{
+    return btc_ble_mesh_provisioner_get_node_table_entry();
+}
+
 esp_err_t esp_ble_mesh_provisioner_delete_node_with_uuid(const uint8_t uuid[16])
 {
     btc_ble_mesh_prov_args_t arg = {0};
@@ -343,7 +378,7 @@ esp_err_t esp_ble_mesh_provisioner_delete_node_with_uuid(const uint8_t uuid[16])
 
     memcpy(arg.delete_node_with_uuid.uuid, uuid, 16);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -364,12 +399,12 @@ esp_err_t esp_ble_mesh_provisioner_delete_node_with_addr(uint16_t unicast_addr)
 
     arg.delete_node_with_addr.unicast_addr = unicast_addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16],
-        uint16_t net_idx, uint16_t app_idx)
+                                                     uint16_t net_idx, uint16_t app_idx)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -387,12 +422,12 @@ esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16],
     } else {
         bzero(arg.add_local_app_key.app_key, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_provisioner_update_local_app_key(const uint8_t app_key[16],
-            uint16_t net_idx, uint16_t app_idx)
+                                                        uint16_t net_idx, uint16_t app_idx)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -410,7 +445,7 @@ esp_err_t esp_ble_mesh_provisioner_update_local_app_key(const uint8_t app_key[16
     memcpy(arg.update_local_app_key.app_key, app_key, 16);
     arg.update_local_app_key.net_idx = net_idx;
     arg.update_local_app_key.app_idx = app_idx;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -420,7 +455,7 @@ const uint8_t *esp_ble_mesh_provisioner_get_local_app_key(uint16_t net_idx, uint
 }
 
 esp_err_t esp_ble_mesh_provisioner_bind_app_key_to_local_model(uint16_t element_addr, uint16_t app_idx,
-        uint16_t model_id, uint16_t company_id)
+                                                               uint16_t model_id, uint16_t company_id)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -439,7 +474,7 @@ esp_err_t esp_ble_mesh_provisioner_bind_app_key_to_local_model(uint16_t element_
     arg.local_mod_app_bind.app_idx = app_idx;
     arg.local_mod_app_bind.model_id = model_id;
     arg.local_mod_app_bind.cid = company_id;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -464,7 +499,7 @@ esp_err_t esp_ble_mesh_provisioner_add_local_net_key(const uint8_t net_key[16],
     } else {
         bzero(arg.add_local_net_key.net_key, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -485,7 +520,7 @@ esp_err_t esp_ble_mesh_provisioner_update_local_net_key(const uint8_t net_key[16
 
     memcpy(arg.update_local_net_key.net_key, net_key, 16);
     arg.update_local_net_key.net_idx = net_idx;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -494,11 +529,245 @@ const uint8_t *esp_ble_mesh_provisioner_get_local_net_key(uint16_t net_idx)
     return bt_mesh_provisioner_local_net_key_get(net_idx);
 }
 
-uint16_t esp_ble_mesh_provisioner_get_prov_node_count(void)
+#if CONFIG_BLE_MESH_PROVISIONER_RECV_HB
+esp_err_t esp_ble_mesh_provisioner_recv_heartbeat(bool enable)
 {
-    return btc_ble_mesh_provisioner_get_prov_node_count();
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_ENABLE_HEARTBEAT_RECV;
+
+    arg.enable_heartbeat_recv.enable = enable;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_type(uint8_t type)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (type > ESP_BLE_MESH_HEARTBEAT_FILTER_REJECTLIST) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_SET_HEARTBEAT_FILTER_TYPE;
+
+    arg.set_heartbeat_filter_type.type = type;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_info(uint8_t op, esp_ble_mesh_heartbeat_filter_info_t *info)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (op > ESP_BLE_MESH_HEARTBEAT_FILTER_REMOVE || info == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (!ESP_BLE_MESH_ADDR_IS_UNICAST(info->hb_src) &&
+        !ESP_BLE_MESH_ADDR_IS_UNICAST(info->hb_dst) &&
+        !ESP_BLE_MESH_ADDR_IS_GROUP(info->hb_dst)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_SET_HEARTBEAT_FILTER_INFO;
+
+    arg.set_heartbeat_filter_info.op = op;
+    arg.set_heartbeat_filter_info.hb_src = info->hb_src;
+    arg.set_heartbeat_filter_info.hb_dst = info->hb_dst;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_PROVISIONER_RECV_HB */
+
+#if CONFIG_BLE_MESH_SETTINGS
+esp_err_t esp_ble_mesh_provisioner_direct_erase_settings(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_DIRECT_ERASE_SETTINGS;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_SETTINGS */
+
+#if CONFIG_BLE_MESH_USE_MULTIPLE_NAMESPACE
+esp_err_t esp_ble_mesh_provisioner_open_settings_with_index(uint8_t index)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (index >= CONFIG_BLE_MESH_MAX_NVS_NAMESPACE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_OPEN_SETTINGS_WITH_INDEX;
+
+    arg.open_settings_with_index.index = index;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_open_settings_with_uid(const char *uid)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!uid || strlen(uid) > ESP_BLE_MESH_SETTINGS_UID_SIZE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_OPEN_SETTINGS_WITH_UID;
+
+    strncpy(arg.open_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_close_settings_with_index(uint8_t index, bool erase)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (index >= CONFIG_BLE_MESH_MAX_NVS_NAMESPACE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_CLOSE_SETTINGS_WITH_INDEX;
+
+    arg.close_settings_with_index.index = index;
+    arg.close_settings_with_index.erase = erase;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_close_settings_with_uid(const char *uid, bool erase)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!uid || strlen(uid) > ESP_BLE_MESH_SETTINGS_UID_SIZE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_CLOSE_SETTINGS_WITH_UID;
+
+    strncpy(arg.close_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
+    arg.close_settings_with_uid.erase = erase;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_delete_settings_with_index(uint8_t index)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (index >= CONFIG_BLE_MESH_MAX_NVS_NAMESPACE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_DELETE_SETTINGS_WITH_INDEX;
+
+    arg.delete_settings_with_index.index = index;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_provisioner_delete_settings_with_uid(const char *uid)
+{
+    btc_ble_mesh_prov_args_t arg = {0};
+    btc_msg_t msg = {0};
+
+    if (!uid || strlen(uid) > ESP_BLE_MESH_SETTINGS_UID_SIZE) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PROVISIONER_DELETE_SETTINGS_WITH_UID;
+
+    strncpy(arg.delete_settings_with_uid.uid, uid, ESP_BLE_MESH_SETTINGS_UID_SIZE);
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
+            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+const char *esp_ble_mesh_provisioner_get_settings_uid(uint8_t index)
+{
+    if (index >= CONFIG_BLE_MESH_MAX_NVS_NAMESPACE) {
+        return NULL;
+    }
+
+    return btc_ble_mesh_provisioner_get_settings_uid(index);
+}
+
+uint8_t esp_ble_mesh_provisioner_get_settings_index(const char *uid)
+{
+    if (!uid || strlen(uid) > ESP_BLE_MESH_SETTINGS_UID_SIZE) {
+        return ESP_BLE_MESH_INVALID_SETTINGS_IDX;
+    }
+
+    return btc_ble_mesh_provisioner_get_settings_index(uid);
+}
+
+uint8_t esp_ble_mesh_provisioner_get_free_settings_count(void)
+{
+    return btc_ble_mesh_provisioner_get_free_settings_count();
+}
+#endif /* CONFIG_BLE_MESH_USE_MULTIPLE_NAMESPACE */
+
 #endif /* CONFIG_BLE_MESH_PROVISIONER */
 
 #if (CONFIG_BLE_MESH_FAST_PROV)

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c

@@ -35,11 +35,29 @@ bool esp_ble_mesh_node_is_provisioned(void)
     return bt_mesh_is_provisioned();
 }
 
+static bool prov_bearers_valid(esp_ble_mesh_prov_bearer_t bearers)
+{
+    if ((!(bearers & (ESP_BLE_MESH_PROV_ADV | ESP_BLE_MESH_PROV_GATT))) ||
+        (IS_ENABLED(CONFIG_BLE_MESH_PB_ADV) &&
+            !IS_ENABLED(CONFIG_BLE_MESH_PB_GATT) &&
+            !(bearers & ESP_BLE_MESH_PROV_ADV)) ||
+        (!IS_ENABLED(CONFIG_BLE_MESH_PB_ADV) &&
+            IS_ENABLED(CONFIG_BLE_MESH_PB_GATT) &&
+            !(bearers & ESP_BLE_MESH_PROV_GATT))) {
+        return false;
+    }
+    return true;
+}
+
 esp_err_t esp_ble_mesh_node_prov_enable(esp_ble_mesh_prov_bearer_t bearers)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
 
+    if (prov_bearers_valid(bearers) == false) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
@@ -47,7 +65,7 @@ esp_err_t esp_ble_mesh_node_prov_enable(esp_ble_mesh_prov_bearer_t bearers)
     msg.act = BTC_BLE_MESH_ACT_PROV_ENABLE;
     arg.node_prov_enable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -56,6 +74,10 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers)
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
 
+    if (prov_bearers_valid(bearers) == false) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
@@ -63,12 +85,12 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers)
     msg.act = BTC_BLE_MESH_ACT_PROV_DISABLE;
     arg.node_prov_disable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_node_set_oob_pub_key(uint8_t pub_key_x[32], uint8_t pub_key_y[32],
-        uint8_t private_key[32])
+                                            uint8_t private_key[32])
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -87,7 +109,7 @@ esp_err_t esp_ble_mesh_node_set_oob_pub_key(uint8_t pub_key_x[32], uint8_t pub_k
     memcpy(arg.set_oob_pub_key.pub_key_y, pub_key_y, 32);
     memcpy(arg.set_oob_pub_key.private_key, private_key, 32);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -107,7 +129,7 @@ esp_err_t esp_ble_mesh_node_input_number(uint32_t number)
     msg.act = BTC_BLE_MESH_ACT_INPUT_NUMBER;
     arg.input_number.number = number;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -129,7 +151,7 @@ esp_err_t esp_ble_mesh_node_input_string(const char *string)
     strncpy(arg.input_string.string, string,
         MIN(strlen(string), sizeof(arg.input_string.string)));
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -151,13 +173,13 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name)
     memset(arg.set_device_name.name, 0, sizeof(arg.set_device_name.name));
     strncpy(arg.set_device_name.name, name, ESP_BLE_MESH_DEVICE_NAME_MAX_LEN);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 #if (CONFIG_BLE_MESH_PROVISIONER)
 esp_err_t esp_ble_mesh_provisioner_read_oob_pub_key(uint8_t link_idx, uint8_t pub_key_x[32],
-        uint8_t pub_key_y[32])
+                                                    uint8_t pub_key_y[32])
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -176,7 +198,7 @@ esp_err_t esp_ble_mesh_provisioner_read_oob_pub_key(uint8_t link_idx, uint8_t pu
     memcpy(arg.provisioner_read_oob_pub_key.pub_key_x, pub_key_x, 32);
     memcpy(arg.provisioner_read_oob_pub_key.pub_key_y, pub_key_y, 32);
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -201,7 +223,7 @@ esp_err_t esp_ble_mesh_provisioner_input_string(const char *string, uint8_t link
         MIN(strlen(string), sizeof(arg.provisioner_input_str.string)));
     arg.provisioner_input_str.link_idx = link_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -223,7 +245,7 @@ esp_err_t esp_ble_mesh_provisioner_input_number(uint32_t number, uint8_t link_id
     arg.provisioner_input_num.number = number;
     arg.provisioner_input_num.link_idx = link_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -232,6 +254,10 @@ esp_err_t esp_ble_mesh_provisioner_prov_enable(esp_ble_mesh_prov_bearer_t bearer
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
 
+    if (prov_bearers_valid(bearers) == false) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
@@ -240,7 +266,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_enable(esp_ble_mesh_prov_bearer_t bearer
 
     arg.provisioner_enable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -249,6 +275,10 @@ esp_err_t esp_ble_mesh_provisioner_prov_disable(esp_ble_mesh_prov_bearer_t beare
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
 
+    if (prov_bearers_valid(bearers) == false) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     msg.sig = BTC_SIG_API_CALL;
@@ -257,12 +287,12 @@ esp_err_t esp_ble_mesh_provisioner_prov_disable(esp_ble_mesh_prov_bearer_t beare
 
     arg.provisioner_disable.bearers = bearers;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_provisioner_add_unprov_dev(esp_ble_mesh_unprov_dev_add_t *add_dev,
-        esp_ble_mesh_dev_add_flag_t flags)
+                                                  esp_ble_mesh_dev_add_flag_t flags)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -283,13 +313,15 @@ esp_err_t esp_ble_mesh_provisioner_add_unprov_dev(esp_ble_mesh_unprov_dev_add_t
     memcpy(arg.provisioner_dev_add.add_dev.addr, add_dev->addr, sizeof(esp_ble_mesh_bd_addr_t));
     memcpy(arg.provisioner_dev_add.add_dev.uuid, add_dev->uuid, 16);
     arg.provisioner_dev_add.flags = flags;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_provisioner_prov_device_with_addr(const uint8_t uuid[16],
-            esp_ble_mesh_bd_addr_t addr, esp_ble_mesh_addr_type_t addr_type,
-            esp_ble_mesh_prov_bearer_t bearer, uint16_t oob_info, uint16_t unicast_addr)
+                                                         esp_ble_mesh_bd_addr_t addr,
+                                                         esp_ble_mesh_addr_type_t addr_type,
+                                                         esp_ble_mesh_prov_bearer_t bearer,
+                                                         uint16_t oob_info, uint16_t unicast_addr)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -315,7 +347,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_device_with_addr(const uint8_t uuid[16],
     arg.provisioner_prov_dev_with_addr.bearer = bearer;
     arg.provisioner_prov_dev_with_addr.oob_info = oob_info;
     arg.provisioner_prov_dev_with_addr.unicast_addr = unicast_addr;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -342,12 +374,12 @@ esp_err_t esp_ble_mesh_provisioner_delete_dev(esp_ble_mesh_device_delete_t *del_
     } else if (del_dev->flag & DEL_DEV_UUID_FLAG) {
         memcpy(arg.provisioner_dev_del.del_dev.uuid, del_dev->uuid, 16);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val, uint8_t match_len,
-        uint8_t offset, bool prov_after_match)
+                                                      uint8_t offset, bool prov_after_match)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -368,7 +400,7 @@ esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val,
     arg.set_dev_uuid_match.match_len = match_len;
     arg.set_dev_uuid_match.offset = offset;
     arg.set_dev_uuid_match.prov_after_match = prov_after_match;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -396,7 +428,7 @@ esp_err_t esp_ble_mesh_provisioner_set_prov_data_info(esp_ble_mesh_prov_data_inf
     } else if (prov_data_info->flag & PROV_DATA_IV_INDEX_FLAG) {
         arg.set_prov_data_info.prov_data.iv_index = prov_data_info->iv_index;
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -417,7 +449,7 @@ esp_err_t esp_ble_mesh_provisioner_set_static_oob_value(const uint8_t *value, ui
 
     arg.set_static_oob_val.length = length;
     memcpy(arg.set_static_oob_val.value, value, length);
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -437,7 +469,7 @@ esp_err_t esp_ble_mesh_provisioner_set_primary_elem_addr(uint16_t addr)
     msg.act = BTC_BLE_MESH_ACT_PROVISIONER_SET_PRIMARY_ELEM_ADDR;
 
     arg.set_primary_elem_addr.addr = addr;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -473,7 +505,7 @@ esp_err_t esp_ble_mesh_set_fast_prov_info(esp_ble_mesh_fast_prov_info_t *fast_pr
     if (fast_prov_info->match_len && fast_prov_info->match_val) {
         memcpy(arg.set_fast_prov_info.match_val, fast_prov_info->match_val, fast_prov_info->match_len);
     }
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -493,7 +525,7 @@ esp_err_t esp_ble_mesh_set_fast_prov_action(esp_ble_mesh_fast_prov_action_t acti
     msg.act = BTC_BLE_MESH_ACT_SET_FAST_PROV_ACTION;
 
     arg.set_fast_prov_action.action = action;
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 

components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c

@@ -30,7 +30,7 @@ esp_err_t esp_ble_mesh_proxy_identity_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_IDENTITY_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_gatt_enable(void)
@@ -43,7 +43,7 @@ esp_err_t esp_ble_mesh_proxy_gatt_enable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_GATT_ENABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
@@ -56,11 +56,12 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
     msg.pid = BTC_PID_PROV;
     msg.act = BTC_BLE_MESH_ACT_PROXY_GATT_DISABLE;
 
-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
-        esp_ble_mesh_addr_type_t addr_type, uint16_t net_idx)
+                                            esp_ble_mesh_addr_type_t addr_type,
+                                            uint16_t net_idx)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -79,7 +80,7 @@ esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
     arg.proxy_client_connect.addr_type = addr_type;
     arg.proxy_client_connect.net_idx = net_idx;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
@@ -96,12 +97,12 @@ esp_err_t esp_ble_mesh_proxy_client_disconnect(uint8_t conn_handle)
 
     arg.proxy_client_disconnect.conn_handle = conn_handle;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle,
-        uint16_t net_idx, esp_ble_mesh_proxy_filter_type_t filter_type)
+esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle, uint16_t net_idx,
+                                                    esp_ble_mesh_proxy_filter_type_t filter_type)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -120,12 +121,12 @@ esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle,
     arg.proxy_client_set_filter_type.net_idx = net_idx;
     arg.proxy_client_set_filter_type.filter_type = filter_type;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle,
-        uint16_t net_idx, uint16_t *addr, uint16_t addr_num)
+esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle, uint16_t net_idx,
+                                                    uint16_t *addr, uint16_t addr_num)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -145,12 +146,12 @@ esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle,
     arg.proxy_client_add_filter_addr.addr_num = addr_num;
     arg.proxy_client_add_filter_addr.addr = addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle,
-        uint16_t net_idx, uint16_t *addr, uint16_t addr_num)
+esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle, uint16_t net_idx,
+                                                       uint16_t *addr, uint16_t addr_num)
 {
     btc_ble_mesh_prov_args_t arg = {0};
     btc_msg_t msg = {0};
@@ -170,6 +171,6 @@ esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle,
     arg.proxy_client_remove_filter_addr.addr_num = addr_num;
     arg.proxy_client_remove_filter_addr.addr = addr;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), btc_ble_mesh_prov_arg_deep_copy,
+                btc_ble_mesh_prov_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_ble_api.h

@@ -1,4 +1,4 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
+// Copyright 2017-2020 Espressif Systems (Shanghai) PTE LTD
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -21,6 +21,106 @@
 extern "C" {
 #endif
 
+/** This enum value is the event of BLE operations */
+typedef enum {
+    ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT, /*!< Start BLE advertising completion event */
+    ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT,  /*!< Stop BLE advertising completion event */
+    ESP_BLE_MESH_START_BLE_SCANNING_COMP_EVT,    /*!< Start BLE scanning completion event */
+    ESP_BLE_MESH_STOP_BLE_SCANNING_COMP_EVT,     /*!< Stop BLE scanning completion event */
+    ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT,   /*!< Scanning BLE advertising packets event */
+    ESP_BLE_MESH_BLE_EVT_MAX,
+} esp_ble_mesh_ble_cb_event_t;
+
+/** BLE operation callback parameters */
+typedef union {
+    /**
+     * @brief ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT
+     */
+    struct {
+        int err_code;             /*!< Indicate the result of starting BLE advertising */
+        uint8_t index;            /*!< Index of the BLE advertising */
+    } start_ble_advertising_comp; /*!< Event parameters of ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT
+     */
+    struct {
+        int err_code;            /*!< Indicate the result of stopping BLE advertising */
+        uint8_t index;           /*!< Index of the BLE advertising */
+    } stop_ble_advertising_comp; /*!< Event parameters of ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_START_BLE_SCANNING_COMP_EVT
+     */
+    struct {
+        int err_code;      /*!< Indicate the result of starting BLE scanning */
+    } start_ble_scan_comp; /*!< Event parameters of ESP_BLE_MESH_START_BLE_SCANNING_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_STOP_BLE_SCANNING_COMP_EVT
+     */
+    struct {
+        int err_code;     /*!< Indicate the result of stopping BLE scanning */
+    } stop_ble_scan_comp; /*!< Event parameters of ESP_BLE_MESH_STOP_BLE_SCANNING_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT
+     */
+    struct {
+        uint8_t  addr[6];   /*!< Device address */
+        uint8_t  addr_type; /*!< Device address type */
+        uint8_t  adv_type;  /*!< Advertising data type */
+        uint8_t *data;      /*!< Advertising data */
+        uint16_t length;    /*!< Advertising data length */
+        int8_t   rssi;      /*!< RSSI of the advertising packet */
+    } scan_ble_adv_pkt;     /*!< Event parameters of ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT */
+} esp_ble_mesh_ble_cb_param_t;
+
+/**
+ * @brief   BLE scanning callback function type
+ *
+ * @param   event: BLE scanning callback event type
+ * @param   param: BLE scanning callback parameter
+ */
+typedef void (* esp_ble_mesh_ble_cb_t)(esp_ble_mesh_ble_cb_event_t event,
+                                       esp_ble_mesh_ble_cb_param_t *param);
+
+/**
+ * @brief       Register BLE scanning callback.
+ *
+ * @param[in]   callback: Pointer to the BLE scaning callback function.
+ *
+ * @return      ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_register_ble_callback(esp_ble_mesh_ble_cb_t callback);
+
+/** Count for sending BLE advertising packet infinitely */
+#define ESP_BLE_MESH_BLE_ADV_INFINITE   0xFFFF
+
+/*!< This enum value is the priority of BLE advertising packet */
+typedef enum {
+    ESP_BLE_MESH_BLE_ADV_PRIO_LOW,
+    ESP_BLE_MESH_BLE_ADV_PRIO_HIGH,
+} esp_ble_mesh_ble_adv_priority_t;
+
+/** Context of BLE advertising parameters. */
+typedef struct {
+    uint16_t interval;               /*!< BLE advertising interval */
+    uint8_t  adv_type;               /*!< BLE advertising type */
+    uint8_t  own_addr_type;          /*!< Own address type */
+    uint8_t  peer_addr_type;         /*!< Peer address type */
+    uint8_t  peer_addr[BD_ADDR_LEN]; /*!< Peer address */
+    uint16_t duration;               /*!< Duration is milliseconds */
+    uint16_t period;                 /*!< Period in milliseconds */
+    uint16_t count;                  /*!< Number of advertising duration */
+    uint8_t  priority:2;             /*!< Priority of BLE advertising packet */
+} esp_ble_mesh_ble_adv_param_t;
+
+/** Context of BLE advertising data. */
+typedef struct {
+    uint8_t adv_data_len;      /*!< Advertising data length */
+    uint8_t adv_data[31];      /*!< Advertising data */
+    uint8_t scan_rsp_data_len; /*!< Scan response data length */
+    uint8_t scan_rsp_data[31]; /*!< Scan response data */
+} esp_ble_mesh_ble_adv_data_t;
+
 /**
  * @brief         This function is called to start BLE advertising with the corresponding data
  *                and parameters while BLE Mesh is working at the same time.
@@ -58,6 +158,31 @@ esp_err_t esp_ble_mesh_start_ble_advertising(const esp_ble_mesh_ble_adv_param_t
  */
 esp_err_t esp_ble_mesh_stop_ble_advertising(uint8_t index);
 
+/** Context of BLE scanning parameters. */
+typedef struct {
+    uint32_t duration; /*!< Duration used to scan normal BLE advertising packets */
+} esp_ble_mesh_ble_scan_param_t;
+
+/**
+ * @brief         This function is called to start scanning normal BLE advertising packets
+ *                and notifying the packets to the application layer.
+ *
+ * @param[in]     param: Pointer to the BLE scanning parameters
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_start_ble_scanning(esp_ble_mesh_ble_scan_param_t *param);
+
+/**
+ * @brief         This function is called to stop notifying normal BLE advertising packets
+ *                to the application layer.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_stop_ble_scanning(void);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_local_data_operation_api.h

@@ -55,7 +55,8 @@ uint16_t esp_ble_mesh_get_primary_element_address(void);
  *                      to 0x0000 in order to unsubscribe the model from the group.
  *
  */
-uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model, uint16_t group_addr);
+uint16_t *esp_ble_mesh_is_model_subscribed_to_group(esp_ble_mesh_model_t *model,
+                                                    uint16_t group_addr);
 
 /**
  * @brief         Find the BLE Mesh element pointer via the element address.
@@ -87,7 +88,7 @@ uint8_t esp_ble_mesh_get_element_count(void);
  *
  */
 esp_ble_mesh_model_t *esp_ble_mesh_find_vendor_model(const esp_ble_mesh_elem_t *element,
-        uint16_t company_id, uint16_t model_id);
+                                                     uint16_t company_id, uint16_t model_id);
 
 /**
  * @brief        Find the SIG model with the given element and Model id.
@@ -98,7 +99,8 @@ esp_ble_mesh_model_t *esp_ble_mesh_find_vendor_model(const esp_ble_mesh_elem_t *
  * @return       Pointer to the SIG Model on success, or NULL on failure which means the SIG Model is not found.
  *
  */
-esp_ble_mesh_model_t *esp_ble_mesh_find_sig_model(const esp_ble_mesh_elem_t *element, uint16_t model_id);
+esp_ble_mesh_model_t *esp_ble_mesh_find_sig_model(const esp_ble_mesh_elem_t *element,
+                                                  uint16_t model_id);
 
 /**
  * @brief        Get the Composition data which has been registered.
@@ -108,6 +110,104 @@ esp_ble_mesh_model_t *esp_ble_mesh_find_sig_model(const esp_ble_mesh_elem_t *ele
  */
 const esp_ble_mesh_comp_t *esp_ble_mesh_get_composition_data(void);
 
+/**
+ * @brief        A local model of node or Provisioner subscribes a group address.
+ *
+ * @note         This function shall not be invoked before node is provisioned or Provisioner is enabled.
+ *
+ * @param[in]    element_addr: Unicast address of the element to which the model belongs.
+ * @param[in]    company_id: A 16-bit company identifier.
+ * @param[in]    model_id: A 16-bit model identifier.
+ * @param[in]    group_addr: The group address to be subscribed.
+ *
+ * @return       ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_model_subscribe_group_addr(uint16_t element_addr, uint16_t company_id,
+                                                  uint16_t model_id, uint16_t group_addr);
+
+/**
+ * @brief        A local model of node or Provisioner unsubscribes a group address.
+ *
+ * @note         This function shall not be invoked before node is provisioned or Provisioner is enabled.
+ *
+ * @param[in]    element_addr: Unicast address of the element to which the model belongs.
+ * @param[in]    company_id: A 16-bit company identifier.
+ * @param[in]    model_id: A 16-bit model identifier.
+ * @param[in]    group_addr: The subscribed group address.
+ *
+ * @return       ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_model_unsubscribe_group_addr(uint16_t element_addr, uint16_t company_id,
+                                                    uint16_t model_id, uint16_t group_addr);
+
+/**
+ * @brief         This function is called by Node to get the local NetKey.
+ *
+ * @param[in]     net_idx: NetKey index.
+ *
+ * @return        NetKey on success, or NULL on failure.
+ *
+ */
+const uint8_t *esp_ble_mesh_node_get_local_net_key(uint16_t net_idx);
+
+/**
+ * @brief         This function is called by Node to get the local AppKey.
+ *
+ * @param[in]     app_idx: AppKey index.
+ *
+ * @return        AppKey on success, or NULL on failure.
+ *
+ */
+const uint8_t *esp_ble_mesh_node_get_local_app_key(uint16_t app_idx);
+
+/**
+ * @brief         This function is called by Node to add a local NetKey.
+ *
+ * @param[in]     net_key: NetKey to be added.
+ * @param[in]     net_idx: NetKey Index.
+ *
+ * @note          This function can only be called after the device is provisioned.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_node_add_local_net_key(const uint8_t net_key[16], uint16_t net_idx);
+
+/**
+ * @brief         This function is called by Node to add a local AppKey.
+ *
+ * @param[in]     app_key: AppKey to be added.
+ * @param[in]     net_idx: NetKey Index.
+ * @param[in]     app_idx: AppKey Index.
+ *
+ * @note          The net_idx must be an existing one.
+ *                This function can only be called after the device is provisioned.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_node_add_local_app_key(const uint8_t app_key[16], uint16_t net_idx, uint16_t app_idx);
+
+/**
+ * @brief         This function is called by Node to bind AppKey to model locally.
+ *
+ * @param[in]     element_addr: Node local element address
+ * @param[in]     company_id: Node local company id
+ * @param[in]     model_id: Node local model id
+ * @param[in]     app_idx: Node local appkey index
+ *
+ * @note          If going to bind app_key with local vendor model, the company_id
+ *                shall be set to 0xFFFF.
+ *                This function can only be called after the device is provisioned.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_node_bind_app_key_to_local_model(uint16_t element_addr, uint16_t company_id,
+                                                        uint16_t model_id, uint16_t app_idx);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_networking_api.h

@@ -23,7 +23,7 @@ extern "C" {
 
 /** @brief: event, event code of user-defined model events; param, parameters of user-defined model events */
 typedef void (* esp_ble_mesh_model_cb_t)(esp_ble_mesh_model_cb_event_t event,
-        esp_ble_mesh_model_cb_param_t *param);
+                                         esp_ble_mesh_model_cb_param_t *param);
 
 /**
  * @brief         Register BLE Mesh callback for user-defined models' operations.
@@ -104,8 +104,9 @@ esp_err_t esp_ble_mesh_client_model_deinit(esp_ble_mesh_model_t *model);
  *
  */
 esp_err_t esp_ble_mesh_server_model_send_msg(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_msg_ctx_t *ctx, uint32_t opcode,
-        uint16_t length, uint8_t *data);
+                                             esp_ble_mesh_msg_ctx_t *ctx,
+                                             uint32_t opcode,
+                                             uint16_t length, uint8_t *data);
 
 /**
  * @brief         Send client model message (such as model get, set, etc).
@@ -123,9 +124,11 @@ esp_err_t esp_ble_mesh_server_model_send_msg(esp_ble_mesh_model_t *model,
  *
  */
 esp_err_t esp_ble_mesh_client_model_send_msg(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_msg_ctx_t *ctx, uint32_t opcode,
-        uint16_t length, uint8_t *data, int32_t msg_timeout,
-        bool need_rsp, esp_ble_mesh_dev_role_t device_role);
+                                             esp_ble_mesh_msg_ctx_t *ctx,
+                                             uint32_t opcode,
+                                             uint16_t length, uint8_t *data,
+                                             int32_t msg_timeout, bool need_rsp,
+                                             esp_ble_mesh_dev_role_t device_role);
 
 /**
  * @brief         Send a model publication message.
@@ -166,8 +169,8 @@ esp_err_t esp_ble_mesh_model_publish(esp_ble_mesh_model_t *model, uint32_t opcod
  *
  */
 esp_err_t esp_ble_mesh_server_model_update_state(esp_ble_mesh_model_t *model,
-        esp_ble_mesh_server_state_type_t type,
-        esp_ble_mesh_server_state_value_t *value);
+                                                 esp_ble_mesh_server_state_type_t type,
+                                                 esp_ble_mesh_server_state_value_t *value);
 
 /**
  * @brief         Reset the provisioning procedure of the local BLE Mesh node.
@@ -226,7 +229,8 @@ uint16_t esp_ble_mesh_provisioner_get_node_index(const char *name);
  * @return       ESP_OK on success or error code otherwise.
  *
  */
-esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr, uint8_t *data, uint16_t length);
+esp_err_t esp_ble_mesh_provisioner_store_node_comp_data(uint16_t unicast_addr,
+                                                        uint8_t *data, uint16_t length);
 
 /**
  * @brief        This function is called to get the provisioned node information
@@ -250,6 +254,48 @@ esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_uuid(const uint8_t u
  */
 esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_addr(uint16_t unicast_addr);
 
+/**
+ * @brief        This function is called to get the provisioned node information
+ *               with the node name.
+ *
+ * @param[in]    name: Name of the node (end by '\0').
+ *
+ * @return       Pointer of the node info struct or NULL on failure.
+ *
+ */
+esp_ble_mesh_node_t *esp_ble_mesh_provisioner_get_node_with_name(const char *name);
+
+/**
+ * @brief         This function is called by Provisioner to get provisioned node count.
+ *
+ * @return        Number of the provisioned nodes.
+ *
+ */
+uint16_t esp_ble_mesh_provisioner_get_prov_node_count(void);
+
+/**
+ * @brief         This function is called by Provisioner to get the entry of the node table.
+ *
+ * @note          After invoking the function to get the entry of nodes, users can use the "for"
+ *                loop combined with the macro CONFIG_BLE_MESH_MAX_PROV_NODES to get each node's
+ *                information. Before trying to read the node's information, users need to check
+ *                if the node exists, i.e. if the *(esp_ble_mesh_node_t **node) is NULL.
+ *                For example:
+ *                ```
+ *                const esp_ble_mesh_node_t **entry = esp_ble_mesh_provisioner_get_node_table_entry();
+ *                for (int i = 0; i < CONFIG_BLE_MESH_MAX_PROV_NODES; i++) {
+ *                    const esp_ble_mesh_node_t *node = entry[i];
+ *                    if (node) {
+ *                        ......
+ *                    }
+ *                }
+ *                ```
+ *
+ * @return        Pointer to the start of the node table.
+ *
+ */
+const esp_ble_mesh_node_t **esp_ble_mesh_provisioner_get_node_table_entry(void);
+
 /**
  * @brief        This function is called to delete the provisioned node information
  *               with the node device uuid.
@@ -287,7 +333,8 @@ esp_err_t esp_ble_mesh_provisioner_delete_node_with_addr(uint16_t unicast_addr);
  * @return        ESP_OK on success or error code otherwise.
  *
  */
-esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16], uint16_t net_idx, uint16_t app_idx);
+esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16],
+                                                     uint16_t net_idx, uint16_t app_idx);
 
 /**
  * @brief         This function is used to update a local AppKey for Provisioner.
@@ -300,7 +347,7 @@ esp_err_t esp_ble_mesh_provisioner_add_local_app_key(const uint8_t app_key[16],
  *
  */
 esp_err_t esp_ble_mesh_provisioner_update_local_app_key(const uint8_t app_key[16],
-                uint16_t net_idx, uint16_t app_idx);
+                                                        uint16_t net_idx, uint16_t app_idx);
 
 /**
  * @brief         This function is called by Provisioner to get the local app key value.
@@ -328,7 +375,7 @@ const uint8_t *esp_ble_mesh_provisioner_get_local_app_key(uint16_t net_idx, uint
  *
  */
 esp_err_t esp_ble_mesh_provisioner_bind_app_key_to_local_model(uint16_t element_addr, uint16_t app_idx,
-        uint16_t model_id, uint16_t company_id);
+                                                               uint16_t model_id, uint16_t company_id);
 
 /**
  * @brief         This function is called by Provisioner to add local network key.
@@ -367,12 +414,229 @@ esp_err_t esp_ble_mesh_provisioner_update_local_net_key(const uint8_t net_key[16
 const uint8_t *esp_ble_mesh_provisioner_get_local_net_key(uint16_t net_idx);
 
 /**
- * @brief         This function is called by Provisioner to get provisioned node count.
+ * @brief         This function is called by Provisioner to enable or disable receiving
+ *                heartbeat messages.
  *
- * @return        Number of the provisioned nodes.
+ * @note          If enabling receiving heartbeat message successfully, the filter will
+ *                be an empty rejectlist by default, which means all heartbeat messages
+ *                received by the Provisioner will be reported to the application layer.
+ *
+ * @param[in]     enable: Enable or disable receiving heartbeat messages.
+ *
+ * @return        ESP_OK on success or error code otherwise.
  *
  */
-uint16_t esp_ble_mesh_provisioner_get_prov_node_count(void);
+esp_err_t esp_ble_mesh_provisioner_recv_heartbeat(bool enable);
+
+/**
+ * @brief         This function is called by Provisioner to set the heartbeat filter type.
+ *
+ * @note          1. If the filter type is not the same with the current value, then all the
+ *                   filter entries will be cleaned.
+ *                2. If the previous type is rejectlist, and changed to acceptlist, then the
+ *                   filter will be an empty acceptlist, which means no heartbeat messages
+ *                   will be reported. Users need to add SRC or DST into the filter entry,
+ *                   then heartbeat messages from the SRC or to the DST will be reported.
+ *
+ * @param[in]     type: Heartbeat filter type (acceptlist or rejectlist).
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_type(uint8_t type);
+
+/**
+ * @brief         This function is called by Provisioner to add or remove a heartbeat filter entry.
+ *
+ * @note          1. If the operation is "ADD", the "hb_src" can be set to the SRC (can only be a
+ *                   unicast address) of heartbeat messages, and the "hb_dst" can be set to the
+ *                   DST (unicast address or group address), at least one of them needs to be set.
+ *                   - If only one of them is set, the filter entry will only use the configured
+ *                     SRC or DST to filter heartbeat messages.
+ *                   - If both of them are set, the SRC and DST will both be used to decide if a
+ *                     heartbeat message will be handled.
+ *                   - If SRC or DST already exists in some filter entry, then the corresponding
+ *                     entry will be cleaned firstly, then a new entry will be allocated to store
+ *                     the information.
+ *                2. If the operation is "REMOVE", the "hb_src" can be set to the SRC (can only be
+ *                   a unicast address) of heartbeat messages, and the "hb_dst" can be set to the
+ *                   DST (unicast address or group address), at least one of them needs to be set.
+ *                   - The filter entry with the same SRC or DST will be removed.
+ *
+ * @param[in]     op:   Add or REMOVE
+ * @param[in]     info: Heartbeat filter entry information, including:
+ *                      hb_src - Heartbeat source address;
+ *                      hb_dst - Heartbeat destination address;
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_set_heartbeat_filter_info(uint8_t op, esp_ble_mesh_heartbeat_filter_info_t *info);
+
+/**
+ * @brief         This function is called by Provisioner to directly erase the mesh
+ *                information from nvs namespace.
+ *
+ * @note          This function can be invoked when the mesh stack is not initialized
+ *                or has been de-initialized.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_direct_erase_settings(void);
+
+/**
+ * @brief         This function is called by Provisioner to open a nvs namespace
+ *                for storing mesh information.
+ *
+ * @note          Before open another nvs namespace, the previously opened nvs
+ *                namespace must be closed firstly.
+ *
+ * @param[in]     index: Settings index.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_open_settings_with_index(uint8_t index);
+
+/**
+ * @brief         This function is called by Provisioner to open a nvs namespace
+ *                for storing mesh information.
+ *
+ * @note          Before open another nvs namespace, the previously opened nvs
+ *                namespace must be closed firstly.
+ *
+ * @param[in]     uid: Settings user id.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_open_settings_with_uid(const char *uid);
+
+/**
+ * @brief         This function is called by Provisioner to close a nvs namespace
+ *                which is opened previously for storing mesh information.
+ *
+ * @note          1. Before closing the nvs namespace, it must be open.
+ *                2. When the function is invoked, the Provisioner functionality
+ *                   will be disabled firstly, and:
+ *                   a) If the "erase" flag is set to false, the mesh information
+ *                      will be cleaned (e.g. removing NetKey, AppKey, nodes, etc)
+ *                      from the mesh stack.
+ *                   b) If the "erase" flag is set to true, the mesh information
+ *                      stored in the nvs namespace will also be erased besides
+ *                      been cleaned from the mesh stack.
+ *                3. If Provisioner tries to work properly again, we can invoke the
+ *                   open function to open a new nvs namespace or a previously added
+ *                   one, and restore the mesh information from it if not erased.
+ *                4. The working process shall be as following:
+ *                   a) Open settings A
+ *                   b) Start to provision and control nodes
+ *                   c) Close settings A
+ *                   d) Open settings B
+ *                   e) Start to provision and control other nodes
+ *                   f) Close settings B
+ *                   g) ......
+ *
+ * @param[in]     index: Settings index.
+ * @param[in]     erase: Indicate if erasing mesh information.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_close_settings_with_index(uint8_t index, bool erase);
+
+/**
+ * @brief         This function is called by Provisioner to close a nvs namespace
+ *                which is opened previously for storing mesh information.
+ *
+ * @note          1. Before closing the nvs namespace, it must be open.
+ *                2. When the function is invoked, the Provisioner functionality
+ *                   will be disabled firstly, and:
+ *                   a) If the "erase" flag is set to false, the mesh information
+ *                      will be cleaned (e.g. removing NetKey, AppKey, nodes, etc)
+ *                      from the mesh stack.
+ *                   b) If the "erase" flag is set to true, the mesh information
+ *                      stored in the nvs namespace will also be erased besides
+ *                      been cleaned from the mesh stack.
+ *                3. If Provisioner tries to work properly again, we can invoke the
+ *                   open function to open a new nvs namespace or a previously added
+ *                   one, and restore the mesh information from it if not erased.
+ *                4. The working process shall be as following:
+ *                   a) Open settings A
+ *                   b) Start to provision and control nodes
+ *                   c) Close settings A
+ *                   d) Open settings B
+ *                   e) Start to provision and control other nodes
+ *                   f) Close settings B
+ *                   g) ......
+ *
+ * @param[in]     uid: Settings user id.
+ * @param[in]     erase: Indicate if erasing mesh information.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_close_settings_with_uid(const char *uid, bool erase);
+
+/**
+ * @brief         This function is called by Provisioner to erase the mesh information
+ *                and settings user id from a nvs namespace.
+ *
+ * @note          When this function is called, the nvs namespace must not be open.
+ *                This function is used to erase the mesh information and settings
+ *                user id which are not used currently.
+ *
+ * @param[in]     index: Settings index.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_delete_settings_with_index(uint8_t index);
+
+/**
+ * @brief         This function is called by Provisioner to erase the mesh information
+ *                and settings user id from a nvs namespace.
+ *
+ * @note          When this function is called, the nvs namespace must not be open.
+ *                This function is used to erase the mesh information and settings
+ *                user id which are not used currently.
+ *
+ * @param[in]     uid: Settings user id.
+ *
+ * @return        ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_provisioner_delete_settings_with_uid(const char *uid);
+
+/**
+ * @brief         This function is called by Provisioner to get settings user id.
+ *
+ * @param[in]     index: Settings index.
+ *
+ * @return        Setting user id on success or NULL on failure.
+ *
+ */
+const char *esp_ble_mesh_provisioner_get_settings_uid(uint8_t index);
+
+/**
+ * @brief         This function is called by Provisioner to get settings index.
+ *
+ * @param[in]     uid: Settings user id.
+ *
+ * @return        Settings index.
+ *
+ */
+uint8_t esp_ble_mesh_provisioner_get_settings_index(const char *uid);
+
+/**
+ * @brief         This function is called by Provisioner to get the number of free
+ *                settings user id.
+ *
+ * @return        Number of free settings user id.
+ *
+ */
+uint8_t esp_ble_mesh_provisioner_get_free_settings_count(void);
 
 /**
  * @brief         This function is called to get fast provisioning application key.

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_provisioning_api.h

@@ -69,6 +69,12 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers);
 /**
  * @brief        Unprovisioned device set own oob public key & private key pair.
  *
+ * @note         In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+ *               The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+ *               use an out-of-band mechanism to exchange the public keys.
+ *               So as an unprovisioned device, it should use this function to input
+ *               the Public Key exchanged through the out-of-band mechanism.
+ *
  * @param[in]    pub_key_x:   Unprovisioned device's Public Key X
  * @param[in]    pub_key_y:   Unprovisioned device's Public Key Y
  * @param[in]    private_key: Unprovisioned device's Private Key
@@ -76,7 +82,7 @@ esp_err_t esp_ble_mesh_node_prov_disable(esp_ble_mesh_prov_bearer_t bearers);
  * @return       ESP_OK on success or error code otherwise.
  */
 esp_err_t esp_ble_mesh_node_set_oob_pub_key(uint8_t pub_key_x[32], uint8_t pub_key_y[32],
-        uint8_t private_key[32]);
+                                            uint8_t private_key[32]);
 
 /**
  * @brief        Provide provisioning input OOB number.
@@ -121,6 +127,10 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name);
 /**
  * @brief        Provisioner inputs unprovisioned device's oob public key.
  *
+ * @note         In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+ *               The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+ *               use an out-of-band mechanism to exchange the public keys.
+ *
  * @param[in]    link_idx:   The provisioning link index
  * @param[in]    pub_key_x:  Unprovisioned device's Public Key X
  * @param[in]    pub_key_y:  Unprovisioned device's Public Key Y
@@ -128,7 +138,7 @@ esp_err_t esp_ble_mesh_set_unprovisioned_device_name(const char *name);
  * @return       ESP_OK on success or error code otherwise.
  */
 esp_err_t esp_ble_mesh_provisioner_read_oob_pub_key(uint8_t link_idx, uint8_t pub_key_x[32],
-        uint8_t pub_key_y[32]);
+                                                    uint8_t pub_key_y[32]);
 
 /**
  * @brief        Provide provisioning input OOB string.
@@ -232,7 +242,7 @@ esp_err_t esp_ble_mesh_provisioner_prov_disable(esp_ble_mesh_prov_bearer_t beare
  *
  */
 esp_err_t esp_ble_mesh_provisioner_add_unprov_dev(esp_ble_mesh_unprov_dev_add_t *add_dev,
-        esp_ble_mesh_dev_add_flag_t flags);
+                                                  esp_ble_mesh_dev_add_flag_t flags);
 
 /** @brief Provision an unprovisioned device and assign a fixed unicast address for it in advance.
  *
@@ -257,16 +267,17 @@ esp_err_t esp_ble_mesh_provisioner_add_unprov_dev(esp_ble_mesh_unprov_dev_add_t
  *            and "esp_ble_mesh_provisioner_prov_device_with_addr" by a Provisioner.
  */
 esp_err_t esp_ble_mesh_provisioner_prov_device_with_addr(const uint8_t uuid[16],
-            esp_ble_mesh_bd_addr_t addr, esp_ble_mesh_addr_type_t addr_type,
-            esp_ble_mesh_prov_bearer_t bearer, uint16_t oob_info, uint16_t unicast_addr);
+                                                         esp_ble_mesh_bd_addr_t addr,
+                                                         esp_ble_mesh_addr_type_t addr_type,
+                                                         esp_ble_mesh_prov_bearer_t bearer,
+                                                         uint16_t oob_info, uint16_t unicast_addr);
 
 /**
- * @brief        Delete device from queue, reset current provisioning link and reset the node.
+ * @brief        Delete device from queue, and reset current provisioning link with the device.
  *
- * @note         If the device is in the queue, remove it from the queue; if the device is being
- *               provisioned, terminate the provisioning procedure; if the device has already
- *               been provisioned, reset the device. And either one of the addr or device UUID
- *               can be input.
+ * @note         If the device is in the queue, remove it from the queue; if the device is
+ *               being provisioned, terminate the provisioning procedure. Either one of the
+ *               device address or device UUID can be used as input.
  *
  * @param[in]    del_dev: Pointer to a struct containing the device information.
  *
@@ -290,8 +301,8 @@ esp_err_t esp_ble_mesh_provisioner_delete_dev(esp_ble_mesh_device_delete_t *del_
  *
  */
 typedef void (*esp_ble_mesh_prov_adv_cb_t)(const esp_ble_mesh_bd_addr_t addr, const esp_ble_mesh_addr_type_t addr_type,
-        const uint8_t adv_type, const uint8_t *dev_uuid,
-        uint16_t oob_info, esp_ble_mesh_prov_bearer_t bearer);
+                                           const uint8_t adv_type, const uint8_t *dev_uuid,
+                                           uint16_t oob_info, esp_ble_mesh_prov_bearer_t bearer);
 
 /**
  * @brief         This function is called by Provisioner to set the part of the device UUID
@@ -307,7 +318,7 @@ typedef void (*esp_ble_mesh_prov_adv_cb_t)(const esp_ble_mesh_bd_addr_t addr, co
  *
  */
 esp_err_t esp_ble_mesh_provisioner_set_dev_uuid_match(const uint8_t *match_val, uint8_t match_len,
-        uint8_t offset, bool prov_after_match);
+                                                      uint8_t offset, bool prov_after_match);
 
 /**
  * @brief         This function is called by Provisioner to set provisioning data information
@@ -323,6 +334,19 @@ esp_err_t esp_ble_mesh_provisioner_set_prov_data_info(esp_ble_mesh_prov_data_inf
 /**
  * @brief         This function is called by Provisioner to set static oob value used for provisioning.
  *
+ * @note          The Bluetooth SIG recommends that mesh implementations enforce a randomly selected
+ *                AuthValue using all of the available bits, where permitted by the implementation.
+ *                A large entropy helps ensure that a brute-force of the AuthValue, even a static
+ *                AuthValue, cannot normally be completed in a reasonable time (CVE-2020-26557).
+ *
+ *                AuthValues selected using a cryptographically secure random or pseudorandom number
+ *                generator and having the maximum permitted entropy (128-bits) will be most difficult
+ *                to brute-force. AuthValues with reduced entropy or generated in a predictable manner
+ *                will not grant the same level of protection against this vulnerability. Selecting a
+ *                new AuthValue with each provisioning attempt can also make it more difficult to launch
+ *                a brute-force attack by requiring the attacker to restart the search with each
+ *                provisioning attempt (CVE-2020-26556).
+ *
  * @param[in]     value:  Pointer to the static oob value.
  * @param[in]     length: Length of the static oob value.
  *

components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h

@@ -65,7 +65,8 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void);
  *
  */
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
-        esp_ble_mesh_addr_type_t addr_type, uint16_t net_idx);
+                                            esp_ble_mesh_addr_type_t addr_type,
+                                            uint16_t net_idx);
 
 /**
  * @brief        Proxy Client terminates a connection with the Proxy Server.
@@ -87,8 +88,8 @@ esp_err_t esp_ble_mesh_proxy_client_disconnect(uint8_t conn_handle);
  * @return       ESP_OK on success or error code otherwise.
  *
  */
-esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle,
-        uint16_t net_idx, esp_ble_mesh_proxy_filter_type_t filter_type);
+esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle, uint16_t net_idx,
+                                                    esp_ble_mesh_proxy_filter_type_t filter_type);
 
 /**
  * @brief        Proxy Client adds address to the Proxy Server filter list.
@@ -101,8 +102,8 @@ esp_err_t esp_ble_mesh_proxy_client_set_filter_type(uint8_t conn_handle,
  * @return       ESP_OK on success or error code otherwise.
  *
  */
-esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle,
-        uint16_t net_idx, uint16_t *addr, uint16_t addr_num);
+esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle, uint16_t net_idx,
+                                                    uint16_t *addr, uint16_t addr_num);
 
 /**
  * @brief        Proxy Client removes address from the Proxy Server filter list.
@@ -115,8 +116,8 @@ esp_err_t esp_ble_mesh_proxy_client_add_filter_addr(uint8_t conn_handle,
  * @return       ESP_OK on success or error code otherwise.
  *
  */
-esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle,
-        uint16_t net_idx, uint16_t *addr, uint16_t addr_num);
+esp_err_t esp_ble_mesh_proxy_client_remove_filter_addr(uint8_t conn_handle, uint16_t net_idx,
+                                                       uint16_t *addr, uint16_t addr_num);
 
 #ifdef __cplusplus
 }

components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h

@@ -17,6 +17,7 @@
 
 #include <stdint.h>
 
+#include "mesh_config.h"
 #include "mesh_common.h"
 #include "proxy_server.h"
 #include "provisioner_main.h"
@@ -50,6 +51,12 @@ extern "C" {
 /*!< The maximum length of a BLE Mesh unprovisioned device name */
 #define ESP_BLE_MESH_DEVICE_NAME_MAX_LEN    DEVICE_NAME_SIZE
 
+/*!< The maximum length of settings user id */
+#define ESP_BLE_MESH_SETTINGS_UID_SIZE      20
+
+/*!< Invalid settings index */
+#define ESP_BLE_MESH_INVALID_SETTINGS_IDX   0xFF
+
 /*!< Define the BLE Mesh octet 16 bytes size */
 #define ESP_BLE_MESH_OCTET16_LEN    16
 typedef uint8_t esp_ble_mesh_octet16_t[ESP_BLE_MESH_OCTET16_LEN];
@@ -58,6 +65,15 @@ typedef uint8_t esp_ble_mesh_octet16_t[ESP_BLE_MESH_OCTET16_LEN];
 #define ESP_BLE_MESH_OCTET8_LEN     8
 typedef uint8_t esp_ble_mesh_octet8_t[ESP_BLE_MESH_OCTET8_LEN];
 
+/*!< Invalid Company ID */
+#define ESP_BLE_MESH_CID_NVAL                     0xFFFF
+
+/*!< Special TTL value to request using configured default TTL */
+#define ESP_BLE_MESH_TTL_DEFAULT                  0xFF
+
+/*!< Maximum allowed TTL value */
+#define ESP_BLE_MESH_TTL_MAX                      0x7F
+
 #define ESP_BLE_MESH_ADDR_UNASSIGNED              0x0000
 #define ESP_BLE_MESH_ADDR_ALL_NODES               0xFFFF
 #define ESP_BLE_MESH_ADDR_PROXIES                 0xFFFC
@@ -262,7 +278,7 @@ typedef enum {
 #define ESP_BLE_MESH_MODEL_OP_2(b0, b1)     (((b0) << 8) | (b1))
 #define ESP_BLE_MESH_MODEL_OP_3(b0, cid)    ((((b0) << 16) | 0xC00000) | (cid))
 
-/*!< This macro is associated with BLE_MESH_MODEL in mesh_access.h */
+/*!< This macro is associated with BLE_MESH_MODEL_CB in mesh_access.h */
 #define ESP_BLE_MESH_SIG_MODEL(_id, _op, _pub, _user_data)          \
 {                                                                   \
     .model_id = (_id),                                              \
@@ -275,7 +291,7 @@ typedef enum {
     .user_data = _user_data,                                        \
 }
 
-/*!< This macro is associated with BLE_MESH_MODEL_VND in mesh_access.h */
+/*!< This macro is associated with BLE_MESH_MODEL_VND_CB in mesh_access.h */
 #define ESP_BLE_MESH_VENDOR_MODEL(_company, _id, _op, _pub, _user_data) \
 {                                                                       \
     .vnd.company_id = (_company),                                       \
@@ -452,6 +468,19 @@ typedef struct {
  */
 #define ESP_BLE_MESH_MODEL_OP_END {0, 0, 0}
 
+/** Abstraction that describes a model callback structure.
+ *  This structure is associated with struct bt_mesh_model_cb in mesh_access.h.
+ */
+typedef struct {
+    /** Callback used during model initialization. Initialized by the stack. */
+    esp_ble_mesh_cb_t init_cb;
+
+#if CONFIG_BLE_MESH_DEINIT
+    /** Callback used during model deinitialization. Initialized by the stack. */
+    esp_ble_mesh_cb_t deinit_cb;
+#endif /* CONFIG_BLE_MESH_DEINIT */
+} esp_ble_mesh_model_cbs_t;
+
 /** Abstraction that describes a Mesh Model instance.
  *  This structure is associated with struct bt_mesh_model in mesh_access.h
  */
@@ -485,6 +514,9 @@ struct esp_ble_mesh_model {
     /** Model operation context */
     esp_ble_mesh_model_op_t *op;
 
+    /** Model callback structure */
+    esp_ble_mesh_model_cbs_t *cb;
+
     /** Model-specific user data */
     void *user_data;
 };
@@ -519,7 +551,7 @@ typedef struct {
     /** Force sending reliably by using segment acknowledgement */
     uint8_t  send_rel: 1;
 
-    /** TTL, or BLE_MESH_TTL_DEFAULT for default TTL. */
+    /** TTL, or ESP_BLE_MESH_TTL_DEFAULT for default TTL. */
     uint8_t  send_ttl;
 
     /** Opcode of a received message. Not used for sending message. */
@@ -550,6 +582,12 @@ typedef struct {
     /** Out of Band information field. */
     esp_ble_mesh_prov_oob_info_t oob_info;
 
+    /* NOTE: In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+     * The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+     * support an out-of-band mechanism to exchange the public keys.
+     * So as an unprovisioned device, it should enable this flag to support
+     * using an out-of-band mechanism to exchange Public Key.
+     */
     /** Flag indicates whether unprovisioned devices support OOB public key */
     bool oob_pub_key;
 
@@ -603,12 +641,29 @@ typedef struct {
     /** Provisioning Algorithm for the Provisioner */
     uint8_t        prov_algorithm;
 
+    /* NOTE: In order to avoid suffering brute-forcing attack (CVE-2020-26559).
+     * The Bluetooth SIG recommends that potentially vulnerable mesh provisioners
+     * use an out-of-band mechanism to exchange the public keys.
+     */
     /** Provisioner public key oob */
     uint8_t        prov_pub_key_oob;
 
     /** Callback used to notify to set device OOB Public Key. Initialized by the stack. */
     esp_ble_mesh_cb_t provisioner_prov_read_oob_pub_key;
 
+    /* NOTE: The Bluetooth SIG recommends that mesh implementations enforce a randomly
+     * selected AuthValue using all of the available bits, where permitted by the
+     * implementation. A large entropy helps ensure that a brute-force of the AuthValue,
+     * even a static AuthValue, cannot normally be completed in a reasonable time (CVE-2020-26557).
+     *
+     * AuthValues selected using a cryptographically secure random or pseudorandom number
+     * generator and having the maximum permitted entropy (128-bits) will be most difficult
+     * to brute-force. AuthValues with reduced entropy or generated in a predictable manner
+     * will not grant the same level of protection against this vulnerability. Selecting a
+     * new AuthValue with each provisioning attempt can also make it more difficult to launch
+     * a brute-force attack by requiring the attacker to restart the search with each
+     * provisioning attempt (CVE-2020-26556).
+     */
     /** Provisioner static oob value */
     uint8_t        *prov_static_oob_val;
     /** Provisioner static oob value length */
@@ -745,35 +800,19 @@ typedef enum {
     PROXY_FILTER_BLACKLIST,
 } esp_ble_mesh_proxy_filter_type_t;
 
-/** Count for sending BLE advertising packet infinitely */
-#define ESP_BLE_MESH_BLE_ADV_INFINITE   0xFFFF
+/*!< Provisioner heartbeat filter type */
+#define ESP_BLE_MESH_HEARTBEAT_FILTER_ACCEPTLIST    0x00
+#define ESP_BLE_MESH_HEARTBEAT_FILTER_REJECTLIST    0x01
 
-/*!< This enum value is the priority of BLE advertising packet */
-typedef enum {
-    ESP_BLE_MESH_BLE_ADV_PRIO_LOW,
-    ESP_BLE_MESH_BLE_ADV_PRIO_HIGH,
-} esp_ble_mesh_ble_adv_priority_t;
+/*!< Provisioner heartbeat filter operation */
+#define ESP_BLE_MESH_HEARTBEAT_FILTER_ADD           0x00
+#define ESP_BLE_MESH_HEARTBEAT_FILTER_REMOVE        0x01
 
-/** Context of BLE advertising parameters. */
+/** Context of Provisioner heartbeat filter information to be set */
 typedef struct {
-    uint16_t interval;                  /*!< BLE advertising interval */
-    uint8_t  adv_type;                  /*!< BLE advertising type */
-    uint8_t  own_addr_type;             /*!< Own address type */
-    uint8_t  peer_addr_type;            /*!< Peer address type */
-    uint8_t  peer_addr[BD_ADDR_LEN];    /*!< Peer address */
-    uint16_t duration;                  /*!< Duration is milliseconds */
-    uint16_t period;                    /*!< Period in milliseconds */
-    uint16_t count;                     /*!< Number of advertising duration */
-    uint8_t  priority:2;                /*!< Priority of BLE advertising packet */
-} esp_ble_mesh_ble_adv_param_t;
-
-/** Context of BLE advertising data. */
-typedef struct {
-    uint8_t adv_data_len;       /*!< Advertising data length */
-    uint8_t adv_data[31];       /*!< Advertising data */
-    uint8_t scan_rsp_data_len;  /*!< Scan response data length */
-    uint8_t scan_rsp_data[31];  /*!< Scan response data */
-} esp_ble_mesh_ble_adv_data_t;
+    uint16_t hb_src;    /*!< Heartbeat source address (unicast address) */
+    uint16_t hb_dst;    /*!< Heartbeat destination address (unicast address or group address) */
+} esp_ble_mesh_heartbeat_filter_info_t;
 
 /*!< This enum value is the event of node/provisioner/fast provisioning */
 typedef enum {
@@ -795,6 +834,9 @@ typedef enum {
     ESP_BLE_MESH_NODE_PROXY_IDENTITY_ENABLE_COMP_EVT,           /*!< Enable BLE Mesh Proxy Identity advertising completion event */
     ESP_BLE_MESH_NODE_PROXY_GATT_ENABLE_COMP_EVT,               /*!< Enable BLE Mesh GATT Proxy Service completion event */
     ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT,              /*!< Disable BLE Mesh GATT Proxy Service completion event */
+    ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT,               /*!< Node add NetKey locally completion event */
+    ESP_BLE_MESH_NODE_ADD_LOCAL_APP_KEY_COMP_EVT,               /*!< Node add AppKey locally completion event */
+    ESP_BLE_MESH_NODE_BIND_APP_KEY_TO_MODEL_COMP_EVT,           /*!< Node bind AppKey to model locally completion event */
     ESP_BLE_MESH_PROVISIONER_PROV_ENABLE_COMP_EVT,              /*!< Provisioner enable provisioning functionality completion event */
     ESP_BLE_MESH_PROVISIONER_PROV_DISABLE_COMP_EVT,             /*!< Provisioner disable provisioning functionality completion event */
     ESP_BLE_MESH_PROVISIONER_RECV_UNPROV_ADV_PKT_EVT,           /*!< Provisioner receives unprovisioned device beacon event */
@@ -806,7 +848,7 @@ typedef enum {
     ESP_BLE_MESH_PROVISIONER_PROV_COMPLETE_EVT,                 /*!< Provisioner provisioning done event */
     ESP_BLE_MESH_PROVISIONER_ADD_UNPROV_DEV_COMP_EVT,           /*!< Provisioner add a device to the list which contains devices that are waiting/going to be provisioned completion event */
     ESP_BLE_MESH_PROVISIONER_PROV_DEV_WITH_ADDR_COMP_EVT,       /*!< Provisioner start to provision an unprovisioned device completion event */
-    ESP_BLE_MESH_PROVISIONER_DELETE_DEV_COMP_EVT,               /*!< Provisioner delete a device from the list, close provisioning link with the device if it exists and remove the device from network completion event */
+    ESP_BLE_MESH_PROVISIONER_DELETE_DEV_COMP_EVT,               /*!< Provisioner delete a device from the list, close provisioning link with the device completion event */
     ESP_BLE_MESH_PROVISIONER_SET_DEV_UUID_MATCH_COMP_EVT,       /*!< Provisioner set the value to be compared with part of the unprovisioned device UUID completion event */
     ESP_BLE_MESH_PROVISIONER_SET_PROV_DATA_INFO_COMP_EVT,       /*!< Provisioner set net_idx/flags/iv_index used for provisioning completion event */
     ESP_BLE_MESH_PROVISIONER_SET_STATIC_OOB_VALUE_COMP_EVT,     /*!< Provisioner set static oob value used for provisioning completion event */
@@ -823,6 +865,17 @@ typedef enum {
     ESP_BLE_MESH_PROVISIONER_STORE_NODE_COMP_DATA_COMP_EVT,     /*!< Provisioner store node composition data completion event */
     ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_UUID_COMP_EVT,    /*!< Provisioner delete node with uuid completion event */
     ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_ADDR_COMP_EVT,    /*!< Provisioner delete node with unicast address completion event */
+    ESP_BLE_MESH_PROVISIONER_ENABLE_HEARTBEAT_RECV_COMP_EVT,     /*!< Provisioner start to receive heartbeat message completion event */
+    ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_TYPE_COMP_EVT, /*!< Provisioner set the heartbeat filter type completion event */
+    ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_INFO_COMP_EVT, /*!< Provisioner set the heartbeat filter information completion event */
+    ESP_BLE_MESH_PROVISIONER_RECV_HEARTBEAT_MESSAGE_EVT,         /*!< Provisioner receive heartbeat message event */
+    ESP_BLE_MESH_PROVISIONER_DRIECT_ERASE_SETTINGS_COMP_EVT,        /*!< Provisioner directly erase settings completion event */
+    ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_INDEX_COMP_EVT,     /*!< Provisioner open settings with index completion event */
+    ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_UID_COMP_EVT,       /*!< Provisioner open settings with user id completion event */
+    ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_INDEX_COMP_EVT,    /*!< Provisioner close settings with index completion event */
+    ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_UID_COMP_EVT,      /*!< Provisioner close settings with user id completion event */
+    ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_INDEX_COMP_EVT,   /*!< Provisioner delete settings with index completion event */
+    ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_UID_COMP_EVT,     /*!< Provisioner delete settings with user id completion event */
     ESP_BLE_MESH_SET_FAST_PROV_INFO_COMP_EVT,                   /*!< Set fast provisioning information (e.g. unicast address range, net_idx, etc.) completion event */
     ESP_BLE_MESH_SET_FAST_PROV_ACTION_COMP_EVT,                 /*!< Set fast provisioning action completion event */
     ESP_BLE_MESH_HEARTBEAT_MESSAGE_RECV_EVT,                    /*!< Receive Heartbeat message event */
@@ -842,8 +895,8 @@ typedef enum {
     ESP_BLE_MESH_PROXY_CLIENT_SET_FILTER_TYPE_COMP_EVT,         /*!< Proxy Client set filter type completion event */
     ESP_BLE_MESH_PROXY_CLIENT_ADD_FILTER_ADDR_COMP_EVT,         /*!< Proxy Client add filter address completion event */
     ESP_BLE_MESH_PROXY_CLIENT_REMOVE_FILTER_ADDR_COMP_EVT,      /*!< Proxy Client remove filter address completion event */
-    ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT,                /*!< Start BLE advertising completion event */
-    ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT,                 /*!< Stop BLE advertising completion event */
+    ESP_BLE_MESH_MODEL_SUBSCRIBE_GROUP_ADDR_COMP_EVT,           /*!< Local model subscribes group address completion event */
+    ESP_BLE_MESH_MODEL_UNSUBSCRIBE_GROUP_ADDR_COMP_EVT,         /*!< Local model unsubscribes group address completion event */
     ESP_BLE_MESH_DEINIT_MESH_COMP_EVT,                          /*!< De-initialize BLE Mesh stack completion event */
     ESP_BLE_MESH_PROV_EVT_MAX,
 } esp_ble_mesh_prov_cb_event_t;
@@ -960,6 +1013,31 @@ typedef union {
     struct ble_mesh_proxy_gatt_disable_comp_param {
         int err_code;                           /*!< Indicate the result of disabling Mesh Proxy Service */
     } node_proxy_gatt_disable_comp;             /*!< Event parameter of ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT
+     */
+    struct ble_mesh_node_add_local_net_key_comp_param {
+        int err_code;                           /*!< Indicate the result of adding local NetKey by the node */
+        uint16_t net_idx;                       /*!< NetKey Index */
+    } node_add_net_key_comp;                    /*!< Event parameter of ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_ADD_LOCAL_APP_KEY_COMP_EVT
+     */
+    struct ble_mesh_node_add_local_app_key_comp_param {
+        int err_code;                           /*!< Indicate the result of adding local AppKey by the node */
+        uint16_t net_idx;                       /*!< NetKey Index */
+        uint16_t app_idx;                       /*!< AppKey Index */
+    } node_add_app_key_comp;                    /*!< Event parameter of ESP_BLE_MESH_NODE_ADD_LOCAL_APP_KEY_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_BIND_APP_KEY_TO_MODEL_COMP_EVT
+     */
+    struct ble_mesh_node_bind_local_mod_app_comp_param {
+        int err_code;                           /*!< Indicate the result of binding AppKey with model by the node */
+        uint16_t element_addr;                  /*!< Element address */
+        uint16_t app_idx;                       /*!< AppKey Index */
+        uint16_t company_id;                    /*!< Company ID */
+        uint16_t model_id;                      /*!< Model ID */
+    } node_bind_app_key_to_model_comp;          /*!< Event parameter of ESP_BLE_MESH_NODE_BIND_APP_KEY_TO_MODEL_COMP_EVT */
     /**
      * @brief ESP_BLE_MESH_PROVISIONER_RECV_UNPROV_ADV_PKT_EVT
      */
@@ -1107,6 +1185,7 @@ typedef union {
      */
     struct ble_mesh_provisioner_add_local_app_key_comp_param {
         int err_code;                           /*!< Indicate the result of adding local AppKey by the Provisioner */
+        uint16_t net_idx;                       /*!< NetKey Index */
         uint16_t app_idx;                       /*!< AppKey Index */
     } provisioner_add_app_key_comp;             /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_ADD_LOCAL_APP_KEY_COMP_EVT */
     /**
@@ -1151,17 +1230,103 @@ typedef union {
     /**
      * @brief ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_UUID_COMP_EVT
      */
-    struct ble_mesh_provisioner_delete_node_with_uuid_comp_data_comp_param {
+    struct ble_mesh_provisioner_delete_node_with_uuid_comp_param {
         int err_code;                           /*!< Indicate the result of deleting node with uuid by the Provisioner */
         uint8_t uuid[16];                       /*!< Node device uuid */
     } provisioner_delete_node_with_uuid_comp;   /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_UUID_COMP_EVT */
     /**
      * @brief ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_ADDR_COMP_EVT
      */
-    struct ble_mesh_provisioner_delete_node_with_addr_comp_data_comp_param {
+    struct ble_mesh_provisioner_delete_node_with_addr_comp_param {
         int err_code;                           /*!< Indicate the result of deleting node with unicast address by the Provisioner */
         uint16_t unicast_addr;                  /*!< Node unicast address */
     } provisioner_delete_node_with_addr_comp;   /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_DELETE_NODE_WITH_ADDR_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_ENABLE_HEARTBEAT_RECV_COMP_EVT
+     */
+    struct {
+        int err_code;                           /*!< Indicate the result of enabling/disabling to receive heartbeat messages by the Provisioner */
+        bool enable;                            /*!< Indicate enabling or disabling receiving heartbeat messages */
+    } provisioner_enable_heartbeat_recv_comp;   /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_ENABLE_HEARTBEAT_RECV_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_TYPE_COMP_EVT
+     */
+    struct {
+        int err_code;                               /*!< Indicate the result of setting the heartbeat filter type by the Provisioner */
+        uint8_t type;                               /*!< Type of the filter used for receiving heartbeat messages */
+    } provisioner_set_heartbeat_filter_type_comp;   /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_TYPE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_INFO_COMP_EVT
+     */
+    struct {
+        int err_code;                               /*!< Indicate the result of setting the heartbeat filter address by the Provisioner */
+        uint8_t  op;                                /*!< Operation (add, remove, clean) */
+        uint16_t hb_src;                            /*!< Heartbeat source address */
+        uint16_t hb_dst;                            /*!< Heartbeat destination address */
+    } provisioner_set_heartbeat_filter_info_comp;   /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_SET_HEARTBEAT_FILTER_INFO_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_RECV_HEARTBEAT_MESSAGE_EVT
+     */
+    struct {
+        uint16_t hb_src;            /*!< Heartbeat source address */
+        uint16_t hb_dst;            /*!< Heartbeat destination address */
+        uint8_t  init_ttl;          /*!< Heartbeat InitTTL */
+        uint8_t  rx_ttl;            /*!< Heartbeat RxTTL */
+        uint8_t  hops;              /*!< Heartbeat hops (InitTTL - RxTTL + 1) */
+        uint16_t feature;           /*!< Bit field of currently active features of the node */
+        int8_t   rssi;              /*!< RSSI of the heartbeat message */
+    } provisioner_recv_heartbeat;   /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_RECV_HEARTBEAT_MESSAGE_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_DRIECT_ERASE_SETTINGS_COMP_EVT
+     */
+    struct {
+        int err_code;                           /*!< Indicate the result of directly erasing settings by the Provisioner */
+    } provisioner_direct_erase_settings_comp;   /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_DRIECT_ERASE_SETTINGS_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_INDEX_COMP_EVT
+     */
+    struct {
+        int err_code;                               /*!< Indicate the result of opening settings with index by the Provisioner */
+        uint8_t index;                              /*!< Index of Provisioner settings */
+    } provisioner_open_settings_with_index_comp;    /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_INDEX_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_UID_COMP_EVT
+     */
+    struct {
+        int err_code;                                   /*!< Indicate the result of opening settings with user id by the Provisioner */
+        uint8_t index;                                  /*!< Index of Provisioner settings */
+        char uid[ESP_BLE_MESH_SETTINGS_UID_SIZE + 1];   /*!< Provisioner settings user id */
+    } provisioner_open_settings_with_uid_comp;          /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_OPEN_SETTINGS_WITH_UID_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_INDEX_COMP_EVT
+     */
+    struct {
+        int err_code;                               /*!< Indicate the result of closing settings with index by the Provisioner */
+        uint8_t index;                              /*!< Index of Provisioner settings */
+    } provisioner_close_settings_with_index_comp;   /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_INDEX_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_UID_COMP_EVT
+     */
+    struct {
+        int err_code;                                   /*!< Indicate the result of closing settings with user id by the Provisioner */
+        uint8_t index;                                  /*!< Index of Provisioner settings */
+        char uid[ESP_BLE_MESH_SETTINGS_UID_SIZE + 1];   /*!< Provisioner settings user id */
+    } provisioner_close_settings_with_uid_comp;         /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_CLOSE_SETTINGS_WITH_UID_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_INDEX_COMP_EVT
+     */
+    struct {
+        int err_code;                               /*!< Indicate the result of deleting settings with index by the Provisioner */
+        uint8_t index;                              /*!< Index of Provisioner settings */
+    } provisioner_delete_settings_with_index_comp;  /*!< Event parameter of ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_INDEX_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_UID_COMP_EVT
+     */
+    struct {
+        int err_code;                                   /*!< Indicate the result of deleting settings with user id by the Provisioner */
+        uint8_t index;                                  /*!< Index of Provisioner settings */
+        char uid[ESP_BLE_MESH_SETTINGS_UID_SIZE + 1];   /*!< Provisioner settings user id */
+    } provisioner_delete_settings_with_uid_comp;        /*!< Event parameters of ESP_BLE_MESH_PROVISIONER_DELETE_SETTINGS_WITH_UID_COMP_EVT */
     /**
      * @brief ESP_BLE_MESH_SET_FAST_PROV_INFO_COMP_EVT
      */
@@ -1313,19 +1478,25 @@ typedef union {
         uint16_t net_idx;                       /*!< Corresponding NetKey Index */
     } proxy_client_remove_filter_addr_comp;     /*!< Event parameter of ESP_BLE_MESH_PROXY_CLIENT_REMOVE_FILTER_ADDR_COMP_EVT */
     /**
-     * @brief ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT
+     * @brief ESP_BLE_MESH_MODEL_SUBSCRIBE_GROUP_ADDR_COMP_EVT
      */
-    struct ble_mesh_start_ble_advertising_comp_param {
-        int err_code;                           /*!< Indicate the result of starting BLE advertising */
-        uint8_t index;                          /*!< Index of the BLE advertising */
-    } start_ble_advertising_comp;               /*!< Event parameter of ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT */
+    struct ble_mesh_model_sub_group_addr_comp_param {
+        int err_code;                           /*!< Indicate the result of local model subscribing group address */
+        uint16_t element_addr;                  /*!< Element address */
+        uint16_t company_id;                    /*!< Company ID */
+        uint16_t model_id;                      /*!< Model ID */
+        uint16_t group_addr;                    /*!< Group Address */
+    } model_sub_group_addr_comp;                /*!< Event parameters of ESP_BLE_MESH_MODEL_SUBSCRIBE_GROUP_ADDR_COMP_EVT */
     /**
-     * @brief ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT
+     * @brief ESP_BLE_MESH_MODEL_UNSUBSCRIBE_GROUP_ADDR_COMP_EVT
      */
-    struct ble_mesh_stop_ble_advertising_comp_param {
-        int err_code;                           /*!< Indicate the result of stopping BLE advertising */
-        uint8_t index;                          /*!< Index of the BLE advertising */
-    } stop_ble_advertising_comp;                /*!< Event parameter of ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT */
+    struct ble_mesh_model_unsub_group_addr_comp_param {
+        int err_code;                           /*!< Indicate the result of local model unsubscribing group address */
+        uint16_t element_addr;                  /*!< Element address */
+        uint16_t company_id;                    /*!< Company ID */
+        uint16_t model_id;                      /*!< Model ID */
+        uint16_t group_addr;                    /*!< Group Address */
+    } model_unsub_group_addr_comp;              /*!< Event parameters of ESP_BLE_MESH_MODEL_UNSUBSCRIBE_GROUP_ADDR_COMP_EVT */
     /**
      * @brief ESP_BLE_MESH_DEINIT_MESH_COMP_EVT
      */
@@ -1929,8 +2100,8 @@ typedef struct {
     int64_t  timestamp; /*!< Time when the last message is received */
 } esp_ble_mesh_last_msg_info_t;
 
-#define ESP_BLE_MESH_SERVER_RSP_BY_APP  0   /*!< Response will be sent internally */
-#define ESP_BLE_MESH_SERVER_AUTO_RSP    1   /*!< Response need to be sent in the application */
+#define ESP_BLE_MESH_SERVER_RSP_BY_APP  0   /*!< Response need to be sent in the application */
+#define ESP_BLE_MESH_SERVER_AUTO_RSP    1   /*!< Response will be sent internally */
 
 /** Parameters of the Server Model response control */
 typedef struct {
@@ -1983,6 +2154,11 @@ typedef union {
         uint16_t temperature;   /*!< The value of the Light CTL Temperature state */
         int16_t  delta_uv;      /*!< The value of the Light CTL Delta UV state */
     } light_ctl_temp_delta_uv;  /*!< The Light CTL Temperature & Delta UV states */
+    struct {
+        uint16_t lightness;     /*!< The value of the Light HSL Lightness state */
+        uint16_t hue;           /*!< The value of the Light HSL Hue state */
+        uint16_t saturation;    /*!< The value of the Light HSL Saturation state */
+    } light_hsl;                /*!< The Light HSL composite state */
     struct {
         uint16_t lightness;     /*!< The value of the Light HSL Lightness state */
     } light_hsl_lightness;      /*!< The Light HSL Lightness state */
@@ -2010,6 +2186,7 @@ typedef enum {
     ESP_BLE_MESH_LIGHT_LIGHTNESS_LINEAR_STATE,
     ESP_BLE_MESH_LIGHT_CTL_LIGHTNESS_STATE,
     ESP_BLE_MESH_LIGHT_CTL_TEMP_DELTA_UV_STATE,
+    ESP_BLE_MESH_LIGHT_HSL_STATE,
     ESP_BLE_MESH_LIGHT_HSL_LIGHTNESS_STATE,
     ESP_BLE_MESH_LIGHT_HSL_HUE_STATE,
     ESP_BLE_MESH_LIGHT_HSL_SATURATION_STATE,

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_config_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_config_model.h"
 #include "esp_ble_mesh_config_model_api.h"
 
+#if CONFIG_BLE_MESH_CFG_CLI
 esp_err_t esp_ble_mesh_register_config_client_callback(esp_ble_mesh_cfg_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -26,13 +27,6 @@ esp_err_t esp_ble_mesh_register_config_client_callback(esp_ble_mesh_cfg_client_c
     return (btc_profile_cb_set(BTC_PID_CONFIG_CLIENT, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_mesh_register_config_server_callback(esp_ble_mesh_cfg_server_cb_t callback)
-{
-    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
-
-    return (btc_profile_cb_set(BTC_PID_CONFIG_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
-}
-
 static bool config_client_get_need_param(esp_ble_mesh_opcode_t opcode)
 {
     switch (opcode) {
@@ -53,13 +47,15 @@ static bool config_client_get_need_param(esp_ble_mesh_opcode_t opcode)
 }
 
 esp_err_t esp_ble_mesh_config_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_cfg_client_get_state_t *get_state)
+                                               esp_ble_mesh_cfg_client_get_state_t *get_state)
 {
     btc_ble_mesh_config_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !ESP_BLE_MESH_ADDR_IS_UNICAST(params->ctx.addr) ||
-        (config_client_get_need_param(params->opcode) && !get_state)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        !ESP_BLE_MESH_ADDR_IS_UNICAST(params->ctx.addr) ||
+        (config_client_get_need_param(params->opcode) && get_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -71,18 +67,20 @@ esp_err_t esp_ble_mesh_config_client_get_state(esp_ble_mesh_client_common_param_
     arg.cfg_client_get_state.params = params;
     arg.cfg_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy,
+                btc_ble_mesh_config_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_config_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_cfg_client_set_state_t *set_state)
+                                               esp_ble_mesh_cfg_client_set_state_t *set_state)
 {
     btc_ble_mesh_config_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !ESP_BLE_MESH_ADDR_IS_UNICAST(params->ctx.addr) ||
-        (params->opcode != ESP_BLE_MESH_MODEL_OP_NODE_RESET && !set_state)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        !ESP_BLE_MESH_ADDR_IS_UNICAST(params->ctx.addr) ||
+        (params->opcode != ESP_BLE_MESH_MODEL_OP_NODE_RESET && set_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -94,6 +92,14 @@ esp_err_t esp_ble_mesh_config_client_set_state(esp_ble_mesh_client_common_param_
     arg.cfg_client_set_state.params = params;
     arg.cfg_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_config_client_args_t), btc_ble_mesh_config_client_arg_deep_copy,
+                btc_ble_mesh_config_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_CFG_CLI */
+
+esp_err_t esp_ble_mesh_register_config_server_callback(esp_ble_mesh_cfg_server_cb_t callback)
+{
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    return (btc_profile_cb_set(BTC_PID_CONFIG_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_generic_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_generic_model.h"
 #include "esp_ble_mesh_generic_model_api.h"
 
+#if CONFIG_BLE_MESH_GENERIC_CLIENT
 esp_err_t esp_ble_mesh_register_generic_client_callback(esp_ble_mesh_generic_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -40,13 +41,16 @@ static bool generic_client_get_need_param(esp_ble_mesh_opcode_t opcode)
 }
 
 esp_err_t esp_ble_mesh_generic_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_generic_client_get_state_t *get_state)
+                                                esp_ble_mesh_generic_client_get_state_t *get_state)
 {
     btc_ble_mesh_generic_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr ||
-        (generic_client_get_need_param(params->opcode) && !get_state)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED ||
+        (generic_client_get_need_param(params->opcode) && get_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -58,17 +62,20 @@ esp_err_t esp_ble_mesh_generic_client_get_state(esp_ble_mesh_client_common_param
     arg.generic_client_get_state.params = params;
     arg.generic_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy,
+                btc_ble_mesh_generic_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_generic_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_generic_client_set_state_t *set_state)
+                                                esp_ble_mesh_generic_client_set_state_t *set_state)
 {
     btc_ble_mesh_generic_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !set_state) {
+    if (params == NULL || params->model == NULL || set_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -80,13 +87,16 @@ esp_err_t esp_ble_mesh_generic_client_set_state(esp_ble_mesh_client_common_param
     arg.generic_client_set_state.params = params;
     arg.generic_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_generic_client_args_t), btc_ble_mesh_generic_client_arg_deep_copy,
+                btc_ble_mesh_generic_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_GENERIC_CLIENT */
 
+#if CONFIG_BLE_MESH_GENERIC_SERVER
 esp_err_t esp_ble_mesh_register_generic_server_callback(esp_ble_mesh_generic_server_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     return (btc_profile_cb_set(BTC_PID_GENERIC_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_GENERIC_SERVER */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_health_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_health_model.h"
 #include "esp_ble_mesh_health_model_api.h"
 
+#if CONFIG_BLE_MESH_HEALTH_CLI
 esp_err_t esp_ble_mesh_register_health_client_callback(esp_ble_mesh_health_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -26,21 +27,17 @@ esp_err_t esp_ble_mesh_register_health_client_callback(esp_ble_mesh_health_clien
     return (btc_profile_cb_set(BTC_PID_HEALTH_CLIENT, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
 
-esp_err_t esp_ble_mesh_register_health_server_callback(esp_ble_mesh_health_server_cb_t callback)
-{
-    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
-
-    return (btc_profile_cb_set(BTC_PID_HEALTH_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
-}
-
 esp_err_t esp_ble_mesh_health_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_health_client_get_state_t *get_state)
+                                               esp_ble_mesh_health_client_get_state_t *get_state)
 {
     btc_ble_mesh_health_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || (!get_state &&
-        params->opcode == ESP_BLE_MESH_MODEL_OP_HEALTH_FAULT_GET)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED ||
+        (params->opcode == ESP_BLE_MESH_MODEL_OP_HEALTH_FAULT_GET && get_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -52,17 +49,20 @@ esp_err_t esp_ble_mesh_health_client_get_state(esp_ble_mesh_client_common_param_
     arg.health_client_get_state.params = params;
     arg.health_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy,
+                btc_ble_mesh_health_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_health_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_health_client_set_state_t *set_state)
+                                               esp_ble_mesh_health_client_set_state_t *set_state)
 {
     btc_ble_mesh_health_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !set_state) {
+    if (params == NULL || params->model == NULL || set_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -74,8 +74,17 @@ esp_err_t esp_ble_mesh_health_client_set_state(esp_ble_mesh_client_common_param_
     arg.health_client_set_state.params = params;
     arg.health_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_client_args_t), btc_ble_mesh_health_client_arg_deep_copy,
+                btc_ble_mesh_health_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_HEALTH_CLI */
+
+#if CONFIG_BLE_MESH_HEALTH_SRV
+esp_err_t esp_ble_mesh_register_health_server_callback(esp_ble_mesh_health_server_cb_t callback)
+{
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    return (btc_profile_cb_set(BTC_PID_HEALTH_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_health_server_fault_update(esp_ble_mesh_elem_t *element)
@@ -94,6 +103,7 @@ esp_err_t esp_ble_mesh_health_server_fault_update(esp_ble_mesh_elem_t *element)
     msg.act = BTC_BLE_MESH_ACT_HEALTH_SERVER_FAULT_UPDATE;
     arg.health_fault_update.element = element;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_server_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_health_server_args_t), NULL, NULL)
             == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_HEALTH_SRV */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_lighting_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_lighting_model.h"
 #include "esp_ble_mesh_lighting_model_api.h"
 
+#if CONFIG_BLE_MESH_LIGHTING_CLIENT
 esp_err_t esp_ble_mesh_register_light_client_callback(esp_ble_mesh_light_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -27,13 +28,16 @@ esp_err_t esp_ble_mesh_register_light_client_callback(esp_ble_mesh_light_client_
 }
 
 esp_err_t esp_ble_mesh_light_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_light_client_get_state_t *get_state)
+                                              esp_ble_mesh_light_client_get_state_t *get_state)
 {
     btc_ble_mesh_lighting_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || (!get_state &&
-        params->opcode == ESP_BLE_MESH_MODEL_OP_LIGHT_LC_PROPERTY_GET)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED ||
+        (params->opcode == ESP_BLE_MESH_MODEL_OP_LIGHT_LC_PROPERTY_GET && get_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -45,17 +49,20 @@ esp_err_t esp_ble_mesh_light_client_get_state(esp_ble_mesh_client_common_param_t
     arg.light_client_get_state.params = params;
     arg.light_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy,
+                btc_ble_mesh_lighting_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_light_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_light_client_set_state_t *set_state)
+                                              esp_ble_mesh_light_client_set_state_t *set_state)
 {
     btc_ble_mesh_lighting_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !set_state) {
+    if (params == NULL || params->model == NULL || set_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -67,13 +74,16 @@ esp_err_t esp_ble_mesh_light_client_set_state(esp_ble_mesh_client_common_param_t
     arg.light_client_set_state.params = params;
     arg.light_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_lighting_client_args_t), btc_ble_mesh_lighting_client_arg_deep_copy,
+                btc_ble_mesh_lighting_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_LIGHTING_CLIENT */
 
+#if CONFIG_BLE_MESH_LIGHTING_SERVER
 esp_err_t esp_ble_mesh_register_lighting_server_callback(esp_ble_mesh_lighting_server_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     return (btc_profile_cb_set(BTC_PID_LIGHTING_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_LIGHTING_SERVER */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_sensor_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_sensor_model.h"
 #include "esp_ble_mesh_sensor_model_api.h"
 
+#if CONFIG_BLE_MESH_SENSOR_CLI
 esp_err_t esp_ble_mesh_register_sensor_client_callback(esp_ble_mesh_sensor_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -27,12 +28,15 @@ esp_err_t esp_ble_mesh_register_sensor_client_callback(esp_ble_mesh_sensor_clien
 }
 
 esp_err_t esp_ble_mesh_sensor_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_sensor_client_get_state_t *get_state)
+                                               esp_ble_mesh_sensor_client_get_state_t *get_state)
 {
     btc_ble_mesh_sensor_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !get_state) {
+    if (params == NULL || params->model == NULL || get_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -44,17 +48,20 @@ esp_err_t esp_ble_mesh_sensor_client_get_state(esp_ble_mesh_client_common_param_
     arg.sensor_client_get_state.params = params;
     arg.sensor_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy,
+                btc_ble_mesh_sensor_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_sensor_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_sensor_client_set_state_t *set_state)
+                                               esp_ble_mesh_sensor_client_set_state_t *set_state)
 {
     btc_ble_mesh_sensor_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !set_state) {
+    if (params == NULL || params->model == NULL || set_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -66,15 +73,16 @@ esp_err_t esp_ble_mesh_sensor_client_set_state(esp_ble_mesh_client_common_param_
     arg.sensor_client_set_state.params = params;
     arg.sensor_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_sensor_client_args_t), btc_ble_mesh_sensor_client_arg_deep_copy,
+                btc_ble_mesh_sensor_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_SENSOR_CLI */
 
+#if CONFIG_BLE_MESH_SENSOR_SERVER
 esp_err_t esp_ble_mesh_register_sensor_server_callback(esp_ble_mesh_sensor_server_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     return (btc_profile_cb_set(BTC_PID_SENSOR_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
-
-
+#endif /* CONFIG_BLE_MESH_SENSOR_SERVER */

components/bt/esp_ble_mesh/api/models/esp_ble_mesh_time_scene_model_api.c

@@ -19,6 +19,7 @@
 #include "btc_ble_mesh_time_scene_model.h"
 #include "esp_ble_mesh_time_scene_model_api.h"
 
+#if CONFIG_BLE_MESH_TIME_SCENE_CLIENT
 esp_err_t esp_ble_mesh_register_time_scene_client_callback(esp_ble_mesh_time_scene_client_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
@@ -27,13 +28,16 @@ esp_err_t esp_ble_mesh_register_time_scene_client_callback(esp_ble_mesh_time_sce
 }
 
 esp_err_t esp_ble_mesh_time_scene_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_time_scene_client_get_state_t *get_state)
+                                                   esp_ble_mesh_time_scene_client_get_state_t *get_state)
 {
     btc_ble_mesh_time_scene_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || (!get_state &&
-        params->opcode == ESP_BLE_MESH_MODEL_OP_SCHEDULER_ACT_GET)) {
+    if (params == NULL || params->model == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED ||
+        (params->opcode == ESP_BLE_MESH_MODEL_OP_SCHEDULER_ACT_GET && get_state == NULL)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -45,17 +49,20 @@ esp_err_t esp_ble_mesh_time_scene_client_get_state(esp_ble_mesh_client_common_pa
     arg.time_scene_client_get_state.params = params;
     arg.time_scene_client_get_state.get_state = get_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy,
+                btc_ble_mesh_time_scene_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
 esp_err_t esp_ble_mesh_time_scene_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_time_scene_client_set_state_t *set_state)
+                                                   esp_ble_mesh_time_scene_client_set_state_t *set_state)
 {
     btc_ble_mesh_time_scene_client_args_t arg = {0};
     btc_msg_t msg = {0};
 
-    if (!params || !params->model || !params->ctx.addr || !set_state) {
+    if (params == NULL || params->model == NULL || set_state == NULL ||
+        params->ctx.net_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.app_idx == ESP_BLE_MESH_KEY_UNUSED ||
+        params->ctx.addr == ESP_BLE_MESH_ADDR_UNASSIGNED) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -67,14 +74,16 @@ esp_err_t esp_ble_mesh_time_scene_client_set_state(esp_ble_mesh_client_common_pa
     arg.time_scene_client_set_state.params = params;
     arg.time_scene_client_set_state.set_state = set_state;
 
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_time_scene_client_args_t), btc_ble_mesh_time_scene_client_arg_deep_copy,
+                btc_ble_mesh_time_scene_client_arg_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
+#endif /* CONFIG_BLE_MESH_TIME_SCENE_CLIENT */
 
+#if CONFIG_BLE_MESH_TIME_SCENE_SERVER
 esp_err_t esp_ble_mesh_register_time_scene_server_callback(esp_ble_mesh_time_scene_server_cb_t callback)
 {
     ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
 
     return (btc_profile_cb_set(BTC_PID_TIME_SCENE_SERVER, callback) == 0 ? ESP_OK : ESP_FAIL);
 }
-
+#endif /* CONFIG_BLE_MESH_TIME_SCENE_SERVER */

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_config_model_api.h

@@ -756,7 +756,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_cfg_client_cb_t)(esp_ble_mesh_cfg_client_cb_event_t event,
-        esp_ble_mesh_cfg_client_cb_param_t *param);
+                                              esp_ble_mesh_cfg_client_cb_param_t *param);
 
 /**
  * @brief   Configuration Server Model callback function type
@@ -764,7 +764,7 @@ typedef void (* esp_ble_mesh_cfg_client_cb_t)(esp_ble_mesh_cfg_client_cb_event_t
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_cfg_server_cb_t)(esp_ble_mesh_cfg_server_cb_event_t event,
-        esp_ble_mesh_cfg_server_cb_param_t *param);
+                                              esp_ble_mesh_cfg_server_cb_param_t *param);
 
 /**
  * @brief         Register BLE Mesh Config Client Model callback.
@@ -800,7 +800,7 @@ esp_err_t esp_ble_mesh_register_config_server_callback(esp_ble_mesh_cfg_server_c
  *
  */
 esp_err_t esp_ble_mesh_config_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_cfg_client_get_state_t *get_state);
+                                               esp_ble_mesh_cfg_client_get_state_t *get_state);
 
 /**
  * @brief         Set the value of the Configuration Server Model states using the Config Client Model set messages.
@@ -816,7 +816,7 @@ esp_err_t esp_ble_mesh_config_client_get_state(esp_ble_mesh_client_common_param_
  *
  */
 esp_err_t esp_ble_mesh_config_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_cfg_client_set_state_t *set_state);
+                                               esp_ble_mesh_cfg_client_set_state_t *set_state);
 
 #ifdef __cplusplus
 }

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_generic_model_api.h

@@ -367,10 +367,10 @@ typedef struct {
 
 /** Parameters of Generic Battery Status. */
 typedef struct {
-    u32_t battery_level     : 8;  /*!< Value of Generic Battery Level state */
-    u32_t time_to_discharge : 24; /*!< Value of Generic Battery Time to Discharge state */
-    u32_t time_to_charge    : 24; /*!< Value of Generic Battery Time to Charge state */
-    u32_t flags             : 8;  /*!< Value of Generic Battery Flags state */
+    uint32_t battery_level     : 8;  /*!< Value of Generic Battery Level state */
+    uint32_t time_to_discharge : 24; /*!< Value of Generic Battery Time to Discharge state */
+    uint32_t time_to_charge    : 24; /*!< Value of Generic Battery Time to Charge state */
+    uint32_t flags             : 8;  /*!< Value of Generic Battery Flags state */
 } esp_ble_mesh_gen_battery_status_cb_t;
 
 /** Parameters of Generic Location Global Status. */
@@ -483,7 +483,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_generic_client_cb_t)(esp_ble_mesh_generic_client_cb_event_t event,
-        esp_ble_mesh_generic_client_cb_param_t *param);
+                                                  esp_ble_mesh_generic_client_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Generic Client Model callback.
@@ -509,7 +509,7 @@ esp_err_t esp_ble_mesh_register_generic_client_callback(esp_ble_mesh_generic_cli
  *
  */
 esp_err_t esp_ble_mesh_generic_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_generic_client_get_state_t *get_state);
+                                                esp_ble_mesh_generic_client_get_state_t *get_state);
 
 /**
  * @brief       Set the value of Generic Server Model states using the Generic Client Model set messages.
@@ -525,7 +525,7 @@ esp_err_t esp_ble_mesh_generic_client_get_state(esp_ble_mesh_client_common_param
  *
  */
 esp_err_t esp_ble_mesh_generic_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_generic_client_set_state_t *set_state);
+                                                esp_ble_mesh_generic_client_set_state_t *set_state);
 
 /**
  * @brief Generic Server Models related context.
@@ -1285,7 +1285,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_generic_server_cb_t)(esp_ble_mesh_generic_server_cb_event_t event,
-        esp_ble_mesh_generic_server_cb_param_t *param);
+                                                  esp_ble_mesh_generic_server_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Generic Server Model callback.

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_health_model_api.h

@@ -335,7 +335,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_health_client_cb_t)(esp_ble_mesh_health_client_cb_event_t event,
-        esp_ble_mesh_health_client_cb_param_t *param);
+                                                 esp_ble_mesh_health_client_cb_param_t *param);
 
 /**
  * @brief   Health Server Model callback function type
@@ -343,7 +343,7 @@ typedef void (* esp_ble_mesh_health_client_cb_t)(esp_ble_mesh_health_client_cb_e
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_health_server_cb_t)(esp_ble_mesh_health_server_cb_event_t event,
-        esp_ble_mesh_health_server_cb_param_t *param);
+                                                 esp_ble_mesh_health_server_cb_param_t *param);
 
 /**
  * @brief         Register BLE Mesh Health Model callback, the callback will report Health Client & Server Model events.
@@ -379,7 +379,7 @@ esp_err_t esp_ble_mesh_register_health_server_callback(esp_ble_mesh_health_serve
  *
  */
 esp_err_t esp_ble_mesh_health_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_health_client_get_state_t *get_state);
+                                               esp_ble_mesh_health_client_get_state_t *get_state);
 
 /**
  * @brief         This function is called to set the Health Server states using the Health Client Model set messages.
@@ -395,7 +395,7 @@ esp_err_t esp_ble_mesh_health_client_get_state(esp_ble_mesh_client_common_param_
  *
  */
 esp_err_t esp_ble_mesh_health_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_health_client_set_state_t *set_state);
+                                               esp_ble_mesh_health_client_set_state_t *set_state);
 
 /**
  * @brief         This function is called by the Health Server Model to update the context of its Health Current status.

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_lighting_model_api.h

@@ -539,7 +539,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_light_client_cb_t)(esp_ble_mesh_light_client_cb_event_t event,
-        esp_ble_mesh_light_client_cb_param_t *param);
+                                                esp_ble_mesh_light_client_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Light Client Model callback.
@@ -565,7 +565,7 @@ esp_err_t esp_ble_mesh_register_light_client_callback(esp_ble_mesh_light_client_
  *
  */
 esp_err_t esp_ble_mesh_light_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_light_client_get_state_t *get_state);
+                                              esp_ble_mesh_light_client_get_state_t *get_state);
 
 /**
  * @brief       Set the value of Light Server Model states using the Light Client Model set messages.
@@ -581,7 +581,7 @@ esp_err_t esp_ble_mesh_light_client_get_state(esp_ble_mesh_client_common_param_t
  *
  */
 esp_err_t esp_ble_mesh_light_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_light_client_set_state_t *set_state);
+                                              esp_ble_mesh_light_client_set_state_t *set_state);
 
 /**
  * @brief Lighting Server Models related context.
@@ -1663,7 +1663,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_lighting_server_cb_t)(esp_ble_mesh_lighting_server_cb_event_t event,
-        esp_ble_mesh_lighting_server_cb_param_t *param);
+                                                   esp_ble_mesh_lighting_server_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Lighting Server Model callback.

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_sensor_model_api.h

@@ -215,7 +215,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_sensor_client_cb_t)(esp_ble_mesh_sensor_client_cb_event_t event,
-        esp_ble_mesh_sensor_client_cb_param_t *param);
+                                                 esp_ble_mesh_sensor_client_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Sensor Client Model callback.
@@ -241,7 +241,7 @@ esp_err_t esp_ble_mesh_register_sensor_client_callback(esp_ble_mesh_sensor_clien
  *
  */
 esp_err_t esp_ble_mesh_sensor_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_sensor_client_get_state_t *get_state);
+                                               esp_ble_mesh_sensor_client_get_state_t *get_state);
 
 /**
  * @brief       Set the value of Sensor Server Model states using the Sensor Client Model set messages.
@@ -257,7 +257,7 @@ esp_err_t esp_ble_mesh_sensor_client_get_state(esp_ble_mesh_client_common_param_
  *
  */
 esp_err_t esp_ble_mesh_sensor_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_sensor_client_set_state_t *set_state);
+                                               esp_ble_mesh_sensor_client_set_state_t *set_state);
 
 /**
  * @brief Sensor Server Models related context.
@@ -698,7 +698,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_sensor_server_cb_t)(esp_ble_mesh_sensor_server_cb_event_t event,
-        esp_ble_mesh_sensor_server_cb_param_t *param);
+                                                 esp_ble_mesh_sensor_server_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Sensor Server Model callback.

components/bt/esp_ble_mesh/api/models/include/esp_ble_mesh_time_scene_model_api.h

@@ -276,7 +276,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_time_scene_client_cb_t)(esp_ble_mesh_time_scene_client_cb_event_t event,
-        esp_ble_mesh_time_scene_client_cb_param_t *param);
+                                                     esp_ble_mesh_time_scene_client_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Time Scene Client Model callback.
@@ -301,7 +301,7 @@ esp_err_t esp_ble_mesh_register_time_scene_client_callback(esp_ble_mesh_time_sce
  * @return      ESP_OK on success or error code otherwise.
  */
 esp_err_t esp_ble_mesh_time_scene_client_get_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_time_scene_client_get_state_t *get_state);
+                                                   esp_ble_mesh_time_scene_client_get_state_t *get_state);
 
 /**
  * @brief       Set the value of Time Scene Server Model states using the Time Scene Client Model set messages.
@@ -316,7 +316,7 @@ esp_err_t esp_ble_mesh_time_scene_client_get_state(esp_ble_mesh_client_common_pa
  * @return      ESP_OK on success or error code otherwise.
  */
 esp_err_t esp_ble_mesh_time_scene_client_set_state(esp_ble_mesh_client_common_param_t *params,
-        esp_ble_mesh_time_scene_client_set_state_t *set_state);
+                                                   esp_ble_mesh_time_scene_client_set_state_t *set_state);
 
 /**
  * @brief Time Scene Server Models related context.
@@ -900,7 +900,7 @@ typedef enum {
  * @param   param: Pointer to callback parameter
  */
 typedef void (* esp_ble_mesh_time_scene_server_cb_t)(esp_ble_mesh_time_scene_server_cb_event_t event,
-        esp_ble_mesh_time_scene_server_cb_param_t *param);
+                                                     esp_ble_mesh_time_scene_server_cb_param_t *param);
 
 /**
  * @brief       Register BLE Mesh Time and Scenes Server Model callback.

components/bt/esp_ble_mesh/btc/btc_ble_mesh_ble.c

@@ -0,0 +1,203 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdint.h>
+#include <string.h>
+
+#include "btc_ble_mesh_ble.h"
+#include "adv.h"
+#include "scan.h"
+#include "mesh_bearer_adapt.h"
+#include "esp_ble_mesh_ble_api.h"
+
+#if CONFIG_BLE_MESH_BLE_COEX_SUPPORT
+
+static void btc_ble_mesh_ble_copy_req_data(btc_msg_t *msg, void *p_dst, void *p_src)
+{
+#if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN
+    esp_ble_mesh_ble_cb_param_t *p_dst_data = (esp_ble_mesh_ble_cb_param_t *)p_dst;
+    esp_ble_mesh_ble_cb_param_t *p_src_data = (esp_ble_mesh_ble_cb_param_t *)p_src;
+
+    if (!msg || !p_src_data || !p_dst_data) {
+        BT_ERR("%s, Invalid parameter", __func__);
+        return;
+    }
+
+    switch (msg->act) {
+    case ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT:
+        if (p_src_data->scan_ble_adv_pkt.data && p_src_data->scan_ble_adv_pkt.length) {
+            p_dst_data->scan_ble_adv_pkt.length = p_src_data->scan_ble_adv_pkt.length;
+            p_dst_data->scan_ble_adv_pkt.data = bt_mesh_calloc(p_src_data->scan_ble_adv_pkt.length);
+            if (p_dst_data->scan_ble_adv_pkt.data) {
+                memcpy(p_dst_data->scan_ble_adv_pkt.data, p_src_data->scan_ble_adv_pkt.data,
+                       p_src_data->scan_ble_adv_pkt.length);
+            } else {
+                BT_ERR("%s, Out of memory, act %d", __func__, msg->act);
+            }
+        }
+        break;
+    default:
+        break;
+    }
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */
+}
+
+static void btc_ble_mesh_ble_free_req_data(btc_msg_t *msg)
+{
+#if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN
+    esp_ble_mesh_ble_cb_param_t *arg = NULL;
+
+    if (!msg || !msg->arg) {
+        BT_ERR("%s, Invalid parameter", __func__);
+        return;
+    }
+
+    arg = (esp_ble_mesh_ble_cb_param_t *)msg->arg;
+
+    switch (msg->act) {
+    case ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT:
+        if (arg->scan_ble_adv_pkt.data) {
+            bt_mesh_free(arg->scan_ble_adv_pkt.data);
+        }
+        break;
+    default:
+        break;
+    }
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */
+}
+
+static void btc_ble_mesh_ble_callback(esp_ble_mesh_ble_cb_param_t *cb_params, uint8_t act)
+{
+    btc_msg_t msg = {0};
+
+    /* If corresponding callback is not registered, event will not be posted. */
+    if (!btc_profile_cb_get(BTC_PID_BLE_MESH_BLE_COEX)) {
+        return;
+    }
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_BLE_MESH_BLE_COEX;
+    msg.act = act;
+
+    btc_transfer_context(&msg, cb_params, cb_params == NULL ? 0 : sizeof(esp_ble_mesh_ble_cb_param_t),
+                         btc_ble_mesh_ble_copy_req_data, btc_ble_mesh_ble_free_req_data);
+}
+
+#if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN
+void bt_mesh_ble_scan_cb_evt_to_btc(const bt_mesh_addr_t *addr,
+                                    uint8_t adv_type, uint8_t data[],
+                                    uint16_t length, int8_t rssi)
+{
+    esp_ble_mesh_ble_cb_param_t param = {0};
+
+    if (addr == NULL) {
+        BT_ERR("%s, Invalid parameter", __func__);
+        return;
+    }
+
+    memcpy(param.scan_ble_adv_pkt.addr, addr->val, sizeof(addr->val));
+    param.scan_ble_adv_pkt.addr_type = addr->type;
+    if (data && length) {
+        param.scan_ble_adv_pkt.data = data;
+        param.scan_ble_adv_pkt.length = length;
+    }
+    param.scan_ble_adv_pkt.adv_type = adv_type;
+    param.scan_ble_adv_pkt.rssi = rssi;
+
+    btc_ble_mesh_ble_callback(&param, ESP_BLE_MESH_SCAN_BLE_ADVERTISING_PKT_EVT);
+}
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */
+
+void btc_ble_mesh_ble_call_handler(btc_msg_t *msg)
+{
+    esp_ble_mesh_ble_cb_param_t param = {0};
+    btc_ble_mesh_ble_args_t *arg = NULL;
+
+    if (!msg || !msg->arg) {
+        BT_ERR("%s, Invalid parameter", __func__);
+        return;
+    }
+
+    arg = (btc_ble_mesh_ble_args_t *)msg->arg;
+
+    switch (msg->act) {
+#if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
+    case BTC_BLE_MESH_ACT_START_BLE_ADV: {
+        struct bt_mesh_ble_adv_param *set = (struct bt_mesh_ble_adv_param *)&arg->start_ble_adv.param;
+        struct bt_mesh_ble_adv_data *data = NULL;
+        if (arg->start_ble_adv.data.adv_data_len || arg->start_ble_adv.data.scan_rsp_data_len) {
+            data = (struct bt_mesh_ble_adv_data *)&arg->start_ble_adv.data;
+        }
+
+        param.start_ble_advertising_comp.err_code =
+            bt_mesh_start_ble_advertising(set, data, &param.start_ble_advertising_comp.index);
+
+        btc_ble_mesh_ble_callback(&param, ESP_BLE_MESH_START_BLE_ADVERTISING_COMP_EVT);
+        break;
+    }
+    case BTC_BLE_MESH_ACT_STOP_BLE_ADV:
+        param.stop_ble_advertising_comp.index = arg->stop_ble_adv.index;
+        param.stop_ble_advertising_comp.err_code =
+            bt_mesh_stop_ble_advertising(arg->stop_ble_adv.index);
+
+        btc_ble_mesh_ble_callback(&param, ESP_BLE_MESH_STOP_BLE_ADVERTISING_COMP_EVT);
+        break;
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_ADV */
+#if CONFIG_BLE_MESH_SUPPORT_BLE_SCAN
+    case BTC_BLE_MESH_ACT_START_BLE_SCAN:
+        param.start_ble_scan_comp.err_code =
+            bt_mesh_start_ble_scan((struct bt_mesh_ble_scan_param *)&arg->start_ble_scan.param);
+        btc_ble_mesh_ble_callback(&param, ESP_BLE_MESH_START_BLE_SCANNING_COMP_EVT);
+        break;
+    case BTC_BLE_MESH_ACT_STOP_BLE_SCAN:
+        param.stop_ble_scan_comp.err_code = bt_mesh_stop_ble_scan();
+        btc_ble_mesh_ble_callback(&param, ESP_BLE_MESH_STOP_BLE_SCANNING_COMP_EVT);
+        break;
+#endif /* CONFIG_BLE_MESH_SUPPORT_BLE_SCAN */
+    default:
+        return;
+    }
+}
+
+static inline void btc_ble_mesh_ble_cb_to_app(esp_ble_mesh_ble_cb_event_t event,
+                                              esp_ble_mesh_ble_cb_param_t *param)
+{
+    esp_ble_mesh_ble_cb_t btc_ble_mesh_cb =
+        (esp_ble_mesh_ble_cb_t)btc_profile_cb_get(BTC_PID_BLE_MESH_BLE_COEX);
+    if (btc_ble_mesh_cb) {
+        btc_ble_mesh_cb(event, param);
+    }
+}
+
+void btc_ble_mesh_ble_cb_handler(btc_msg_t *msg)
+{
+    esp_ble_mesh_ble_cb_param_t *param = NULL;
+
+    if (!msg) {
+        BT_ERR("%s, Invalid parameter", __func__);
+        return;
+    }
+
+    param = (esp_ble_mesh_ble_cb_param_t *)msg->arg;
+
+    if (msg->act < ESP_BLE_MESH_BLE_EVT_MAX) {
+        btc_ble_mesh_ble_cb_to_app(msg->act, param);
+    } else {
+        BT_ERR("%s, Unknown act %d", __func__, msg->act);
+    }
+
+    btc_ble_mesh_ble_free_req_data(msg);
+}
+
+#endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */