Merge 4b7143e845 into a13ab34101

fix(startup): move rtc initialization before MSPI timing tuning to improve stability (v5.1)

See merge request espressif/esp-idf!32555

components/bt/CMakeLists.txt

@@ -787,7 +787,11 @@ if(CONFIG_BT_ENABLED)
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
         target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
-        add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+        if(CONFIG_IDF_TARGET_ESP32C6)
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+        else()
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+        endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
     endif()
 

components/bt/common/btc/core/btc_task.c

@@ -225,8 +225,8 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 /**
  * transfer an message to another module in the different task.
  * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
  * @param  copy_func deep copy function
  * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
@@ -272,7 +272,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 }
 
 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
  * @param  msg       message
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail

components/bt/controller/esp32c3/Kconfig.in

@@ -200,8 +200,8 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
         bool "+15dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_P18
         bool "+18dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
-        bool "+21dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
 endchoice
 
 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
@@ -221,7 +221,7 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
     default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
     default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
     default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P20
     default 0
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP

components/bt/controller/lib_esp32c2/esp32c2-bt-lib

@@ -1 +1 @@
-Subproject commit e652624750341aca124e9f850e261b0c1ac63529
+Subproject commit e5c7ef0bf701d02c2203e26081fdd348d45935e5

components/bt/controller/lib_esp32c3_family

@@ -1 +1 @@
-Subproject commit d874f55e1132416fe18293ae1aa9ac73c40b3261
+Subproject commit b8ef2c474d392a88ea7e6626f89acf1fa5f30e4a

components/bt/controller/lib_esp32c6/esp32c6-bt-lib

@@ -1 +1 @@
-Subproject commit f95513f22be7b21429b01ba05dbfbc98097b5e67
+Subproject commit 3f15aa1d602aedf510dd9c686b3f7e5ea8a44002

components/bt/controller/lib_esp32h2/esp32h2-bt-lib

@@ -1 +1 @@
-Subproject commit 58a293a2b4c305157723908ea29c2776f5803bbc
+Subproject commit 50f567fff506f63b4d06ebea80d0405fe9e39568

components/bt/esp_ble_mesh/mesh_common/mesh_common.c

@@ -77,6 +77,10 @@ uint8_t bt_mesh_get_device_role(struct bt_mesh_model *model, bool srv_send)
     bt_mesh_client_user_data_t *client = NULL;
 
     if (srv_send) {
+        if (IS_ENABLED(CONFIG_BLE_MESH_PROVISIONER) && bt_mesh_is_provisioner_en()) {
+            BT_DBG("Message is sent by a provisioner(server) model");
+            return PROVISIONER;
+        }
         BT_DBG("Message is sent by a server model");
         return NODE;
     }

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -15,6 +15,24 @@
 
 #if (defined BTC_SDP_INCLUDED && BTC_SDP_INCLUDED == TRUE)
 
+static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
+{
+    bool ret = true;
+
+    if (record != NULL) {
+        if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
+            strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
+            LOG_ERROR("Invalid server name!\n");
+            ret = false;
+        }
+    } else {
+        LOG_ERROR("record is NULL!\n");
+        ret = false;
+    }
+
+    return ret;
+}
+
 esp_err_t esp_sdp_register_callback(esp_sdp_cb_t callback)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -85,9 +103,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (record == NULL || record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX
-            || strlen(record->hdr.service_name)+1 != record->hdr.service_name_length) {
-        LOG_ERROR("Invalid server name!\n");
+    if (!esp_sdp_record_integrity_check(record)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -100,7 +116,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
     msg.act = BTC_SDP_ACT_CREATE_RECORD;
 
     memset(&arg, 0, sizeof(btc_sdp_args_t));
-    arg.creat_record.record = (bluetooth_sdp_record *)record;
+    arg.create_record.record = (bluetooth_sdp_record *)record;
 
     /* Switch to BTC context */
     stat = btc_transfer_context(&msg, &arg, sizeof(btc_sdp_args_t),

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -242,6 +242,7 @@ typedef union {
      */
     struct gatts_rsp_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
+        uint16_t conn_id;               /*!< Connection id */
         uint16_t handle;                /*!< Attribute handle which send response */
     } rsp;                              /*!< Gatt server callback param of ESP_GATTS_RESPONSE_EVT */
 

components/bt/host/bluedroid/api/include/api/esp_sdp_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -14,123 +14,131 @@
 extern "C" {
 #endif
 
-#define ESP_SDP_SERVER_NAME_MAX 32                 /*!< Service name max length */
-#define SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH 15    /*!< OPP supported format list maximum length */
+#define ESP_SDP_SERVER_NAME_MAX              32  /*!< Service name max length */
+#define SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH 15  /*!< OPP supported format list maximum length */
+
+#define ESP_SDP_UUID_MAP_MAS  0x1132 /*!< Message Access Service UUID */
+#define ESP_SDP_UUID_MAP_MNS  0x1133 /*!< Message Notification Service UUID */
+#define ESP_SDP_UUID_PBAP_PSE 0x112F /*!< Phone Book Server Equipment UUID */
+#define ESP_SDP_UUID_PBAP_PCE 0x112E /*!< Phone Book Client Equipment UUID */
+#define ESP_SDP_UUID_OPP      0x1105 /*!< Object Push Profile UUID */
+#define ESP_SDP_UUID_SAP      0x112D /*!< SIM Access Profile UUID */
+#define ESP_SDP_UUID_DIP      0x1200 /*!< Device Identification Profile UUID */
+
+#define ESP_SDP_BUILD_BT_UUID16(uuid16_val)                                                                                \
+    (esp_bt_uuid_t) { .len = ESP_UUID_LEN_16, .uuid = {.uuid16 = (uint16_t)(uuid16_val),}, }
 
 typedef enum {
-    ESP_SDP_SUCCESS   = 0,          /*!< Successful operation. */
-    ESP_SDP_FAILURE,                /*!< Generic failure. */
-    ESP_SDP_NO_RESOURCE,            /*!< No more resource */
-    ESP_SDP_NEED_INIT,              /*!< SDP module shall init first */
-    ESP_SDP_NEED_DEINIT,            /*!< SDP module shall deinit first */
-    ESP_SDP_NO_CREATE_RECORD,       /*!< No record created */
+    ESP_SDP_SUCCESS = 0,      /*!< Successful operation. */
+    ESP_SDP_FAILURE,          /*!< Generic failure. */
+    ESP_SDP_NO_RESOURCE,      /*!< No more resource */
+    ESP_SDP_NEED_INIT,        /*!< SDP module shall init first */
+    ESP_SDP_NEED_DEINIT,      /*!< SDP module shall deinit first */
+    ESP_SDP_NO_CREATE_RECORD, /*!< No record created */
 } esp_sdp_status_t;
 
 /**
  * @brief SDP callback function events
  */
 typedef enum {
-    ESP_SDP_INIT_EVT                    = 0,                /*!< When SDP is initialized, the event comes */
-    ESP_SDP_DEINIT_EVT                  = 1,                /*!< When SDP is deinitialized, the event comes */
-    ESP_SDP_SEARCH_COMP_EVT             = 2,                /*!< When SDP search complete, the event comes */
-    ESP_SDP_CREATE_RECORD_COMP_EVT      = 3,                /*!< When create SDP records complete, the event comes */
-    ESP_SDP_REMOVE_RECORD_COMP_EVT      = 4,                /*!< When remove a SDP record complete, the event comes */
+    ESP_SDP_INIT_EVT               = 0, /*!< When SDP is initialized, the event comes */
+    ESP_SDP_DEINIT_EVT             = 1, /*!< When SDP is de-initialized, the event comes */
+    ESP_SDP_SEARCH_COMP_EVT        = 2, /*!< When SDP search complete, the event comes */
+    ESP_SDP_CREATE_RECORD_COMP_EVT = 3, /*!< When create SDP records complete, the event comes */
+    ESP_SDP_REMOVE_RECORD_COMP_EVT = 4, /*!< When remove a SDP record complete, the event comes */
 } esp_sdp_cb_event_t;
 
 /**
  * @brief SDP record type
  */
 typedef enum {
-    ESP_SDP_TYPE_RAW,          /*!< Used to carry raw SDP search data for unknown UUIDs */
-    ESP_SDP_TYPE_MAP_MAS,      /*!< Message Access Profile - Server */
-    ESP_SDP_TYPE_MAP_MNS,      /*!< Message Access Profile - Client (Notification Server) */
-    ESP_SDP_TYPE_PBAP_PSE,     /*!< Phone Book Profile - Server */
-    ESP_SDP_TYPE_PBAP_PCE,     /*!< Phone Book Profile - Client */
-    ESP_SDP_TYPE_OPP_SERVER,   /*!< Object Push Profile */
-    ESP_SDP_TYPE_SAP_SERVER    /*!< SIM Access Profile */
+    ESP_SDP_TYPE_RAW,        /*!< Used to carry raw SDP search data for unknown UUIDs */
+    ESP_SDP_TYPE_MAP_MAS,    /*!< Message Access Profile - Server */
+    ESP_SDP_TYPE_MAP_MNS,    /*!< Message Access Profile - Client (Notification Server) */
+    ESP_SDP_TYPE_PBAP_PSE,   /*!< Phone Book Profile - Server */
+    ESP_SDP_TYPE_PBAP_PCE,   /*!< Phone Book Profile - Client */
+    ESP_SDP_TYPE_OPP_SERVER, /*!< Object Push Profile */
+    ESP_SDP_TYPE_SAP_SERVER, /*!< SIM Access Profile */
 } esp_bluetooth_sdp_types_t;
 
 /**
- * @brief Some signals need additional pointers, hence we introduce a
- *        generic way to handle these pointers.
+ * @brief SDP header structure
  */
 typedef struct bluetooth_sdp_hdr_overlay {
-    esp_bluetooth_sdp_types_t type;            /*!< SDP type */
-    esp_bt_uuid_t  uuid;                       /*!< UUID type， include uuid and uuid length */
-    uint32_t       service_name_length;        /*!< Service name length */
-    char          *service_name;               /*!< service name */
-    int32_t        rfcomm_channel_number;      /*!< rfcomm channel number, if not used set to -1*/
-    int32_t        l2cap_psm;                  /*!< l2cap psm, if not used set to -1 */
-    int32_t        profile_version;            /*!< profile version */
-
-    // User pointers, only used for some signals - see esp_bluetooth_sdp_ops_record_t
-    int            user1_ptr_len;              /*!< see esp_bluetooth_sdp_ops_record_t */
-    uint8_t       *user1_ptr;                  /*!< see esp_bluetooth_sdp_ops_record_t */
-    int            user2_ptr_len;              /*!< see esp_bluetooth_sdp_ops_record_t */
-    uint8_t       *user2_ptr;                  /*!< see esp_bluetooth_sdp_ops_record_t */
+    esp_bluetooth_sdp_types_t type; /*!< SDP type */
+    esp_bt_uuid_t uuid;             /*!< UUID type, include uuid and uuid length, only needed to be set for RAW record creation */
+    uint32_t service_name_length;   /*!< Service name length */
+    char *service_name;             /*!< Service name */
+    int32_t rfcomm_channel_number;  /*!< RFCOMM channel number, if not used set to -1*/
+    int32_t l2cap_psm;              /*!< L2CAP psm, if not used set to -1 */
+    int32_t profile_version;        /*!< Profile version */
+    int user1_ptr_len;              /*!< User data1 length, only used for searching RAW record */
+    uint8_t *user1_ptr;             /*!< User data1 pointer to the raw SDP response data, only used for searching RAW record */
+    int user2_ptr_len;              /*!< User data2 length, only used for searching RAW record */
+    uint8_t *user2_ptr;             /*!< User data2 pointer, only used for searching RAW record */
 } esp_bluetooth_sdp_hdr_overlay_t;
 
 /**
  * @brief Message Access Profile - Server parameters
  */
 typedef struct bluetooth_sdp_mas_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    mas_instance_id;               /*!< MAS Instance ID */
-    uint32_t    supported_features;            /*!< Map supported features */
-    uint32_t    supported_message_types;       /*!< Supported message types */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t mas_instance_id;            /*!< MAS Instance ID */
+    uint32_t supported_features;         /*!< Map supported features */
+    uint32_t supported_message_types;    /*!< Supported message types */
 } esp_bluetooth_sdp_mas_record_t;
 
 /**
  * @brief Message Access Profile - Client (Notification Server) parameters
  */
 typedef struct bluetooth_sdp_mns_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    supported_features;            /*!< Supported features */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t supported_features;         /*!< Supported features */
 } esp_bluetooth_sdp_mns_record_t;
 
 /**
  * @brief Phone Book Profile - Server parameters
  */
 typedef struct bluetooth_sdp_pse_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    supported_features;            /*!< Pbap Supported Features */
-    uint32_t    supported_repositories;        /*!< Supported Repositories */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t supported_features;         /*!< PBAP Supported Features */
+    uint32_t supported_repositories;     /*!< Supported Repositories */
 } esp_bluetooth_sdp_pse_record_t;
 
 /**
  * @brief Phone Book Profile - Client parameters
  */
 typedef struct bluetooth_sdp_pce_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
 } esp_bluetooth_sdp_pce_record_t;
 
 /**
  * @brief Object Push Profile parameters
  */
 typedef struct bluetooth_sdp_ops_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    int         supported_formats_list_len;    /*!< Supported formats list length */
-    uint8_t     supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];  /*!< Supported formats list */
+    esp_bluetooth_sdp_hdr_overlay_t hdr;                                  /*!< General info */
+    int supported_formats_list_len;                                       /*!< Supported formats list length */
+    uint8_t supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH]; /*!< Supported formats list */
 } esp_bluetooth_sdp_ops_record_t;
 
 /**
  * @brief SIM Access Profile parameters
  */
 typedef struct bluetooth_sdp_sap_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
 } esp_bluetooth_sdp_sap_record_t;
 
 /**
  * @brief SDP record parameters union
  */
 typedef union {
-    esp_bluetooth_sdp_hdr_overlay_t   hdr;     /*!< General info */
-    esp_bluetooth_sdp_mas_record_t    mas;     /*!< Message Access Profile - Server */
-    esp_bluetooth_sdp_mns_record_t    mns;     /*!< Message Access Profile - Client (Notification Server) */
-    esp_bluetooth_sdp_pse_record_t    pse;     /*!< Phone Book Profile - Server */
-    esp_bluetooth_sdp_pce_record_t    pce;     /*!< Phone Book Profile - Client */
-    esp_bluetooth_sdp_ops_record_t    ops;     /*!< Object Push Profile */
-    esp_bluetooth_sdp_sap_record_t    sap;     /*!< SIM Access Profile */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    esp_bluetooth_sdp_mas_record_t mas;  /*!< Message Access Profile - Server */
+    esp_bluetooth_sdp_mns_record_t mns;  /*!< Message Access Profile - Client (Notification Server) */
+    esp_bluetooth_sdp_pse_record_t pse;  /*!< Phone Book Profile - Server */
+    esp_bluetooth_sdp_pce_record_t pce;  /*!< Phone Book Profile - Client */
+    esp_bluetooth_sdp_ops_record_t ops;  /*!< Object Push Profile */
+    esp_bluetooth_sdp_sap_record_t sap;  /*!< SIM Access Profile */
 } esp_bluetooth_sdp_record_t;
 
 /**
@@ -141,44 +149,43 @@ typedef union {
      * @brief ESP_SDP_INIT_EVT
      */
     struct sdp_init_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } init;                                 /*!< SDP callback param of ESP_SDP_INIT_EVT */
+        esp_sdp_status_t status; /*!< Status */
+    } init;                      /*!< SDP callback param of ESP_SDP_INIT_EVT */
 
     /**
      * @brief ESP_SDP_DEINIT_EVT
      */
     struct sdp_deinit_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } deinit;                               /*!< SDP callback param of ESP_SDP_DEINIT_EVT */
+        esp_sdp_status_t status; /*!< Status */
+    } deinit;                    /*!< SDP callback param of ESP_SDP_DEINIT_EVT */
 
     /**
      * @brief ESP_SDP_SEARCH_COMP_EVT
      */
     struct sdp_search_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-        esp_bd_addr_t       remote_addr;    /*!< remote device address */
-        esp_bt_uuid_t       sdp_uuid;       /*!< service uuid */
-        int                 record_count;   /*!< Number of SDP records */
-        esp_bluetooth_sdp_record_t *records;/*!< SDP records */
-    } search;                               /*!< SDP callback param of ESP_SDP_SEARCH_COMP_EVT */
+        esp_sdp_status_t status;             /*!< Status */
+        esp_bd_addr_t remote_addr;           /*!< Remote device address */
+        esp_bt_uuid_t sdp_uuid;              /*!< Service uuid */
+        int record_count;                    /*!< Number of SDP records */
+        esp_bluetooth_sdp_record_t *records; /*!< SDP records */
+    } search;                                /*!< SDP callback param of ESP_SDP_SEARCH_COMP_EVT */
 
     /**
      * @brief ESP_SDP_CREATE_RECORD_COMP_EVT
      */
-    struct sdp_crate_record_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-        int                 record_handle;  /*!< SDP record handle */
-    } create_record;                        /*!< SDP callback param of ESP_SDP_CREATE_RECORD_COMP_EVT */
+    struct sdp_create_record_evt_param {
+        esp_sdp_status_t status; /*!< Status */
+        int record_handle;       /*!< SDP record handle */
+    } create_record;             /*!< SDP callback param of ESP_SDP_CREATE_RECORD_COMP_EVT */
 
     /**
      * @brief ESP_SDP_REMOVE_RECORD_COMP_EVT
      */
     struct sdp_remove_record_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } remove_record;                        /*!< SDP callback param of ESP_SDP_REMOVE_RECORD_COMP_EVT */
-
-} esp_sdp_cb_param_t;                       /*!< SDP callback parameter union type */
+        esp_sdp_status_t status; /*!< Status */
+    } remove_record;             /*!< SDP callback param of ESP_SDP_REMOVE_RECORD_COMP_EVT */
 
+} esp_sdp_cb_param_t;
 
 /**
  * @brief       SDP callback function type.

components/bt/host/bluedroid/bta/av/bta_av_act.c

@@ -127,9 +127,6 @@ void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
         }
         /* else ACP && connected. do not clear the handle yet */
         AVRC_Close(rc_handle);
-        if (rc_handle == bta_av_cb.rc_acp_handle) {
-            bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
-        }
         APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
                          p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
     }
@@ -302,7 +299,7 @@ UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
         bda = p_scb->peer_addr;
         status = BTA_AV_RC_ROLE_INT;
     } else {
-        if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL ) {
+        if (shdl != 0 && ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL)) {
             APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
             return p_rcb->handle;
         }
@@ -1143,7 +1140,7 @@ void bta_av_conn_chg(tBTA_AV_DATA *p_data)
                                   p_data->conn_chg.peer_addr[5]);
                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0) {
                     /* AVRCP is already connected.
-                     * need to update the association betwen SCB and RCB */
+                     * need to update the association between SCB and RCB */
                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
                     p_lcb_rc->lidx = 0;
                     p_scb->rc_handle = p_cb->rc_acp_handle;
@@ -1636,6 +1633,8 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
         }
     } else {
         p_cb->rcb[rc_handle].peer_features = peer_features;
+        p_cb->rcb[rc_handle].peer_ct_features = peer_ct_features;
+        p_cb->rcb[rc_handle].peer_tg_features = peer_tg_features;
         rc_feat.rc_handle =  rc_handle;
         rc_feat.peer_features = peer_features;
         rc_feat.peer_ct_features = peer_ct_features;
@@ -1711,7 +1710,8 @@ void bta_av_rc_closed(tBTA_AV_DATA *p_data)
                 bta_av_del_rc(p_rcb);
 
                 /* if the AVRCP is no longer listening, create the listening channel */
-                if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG) {
+                if (bta_av_cb.rc_acp_handle == p_msg->handle && bta_av_cb.features & BTA_AV_FEAT_RCTG) {
+                    bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
                 }
             }

components/bt/host/bluedroid/bta/dm/bta_dm_api.c

@@ -29,6 +29,7 @@
 #include "stack/btm_api.h"
 #include "btm_int.h"
 #include <string.h>
+#include <assert.h>
 #include "bta/utl.h"
 #include "osi/allocator.h"
 
@@ -991,22 +992,67 @@ UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr )
 tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
                                     UINT32 *p_handle )
 {
-    tBTA_STATUS  status = BTA_FAILURE;
+    tBTA_STATUS status = BTA_FAILURE;
 
     if (bta_dm_di_cb.di_num < BTA_DI_NUM_MAX) {
         if (SDP_SetLocalDiRecord((tSDP_DI_RECORD *)p_device_info, p_handle) == SDP_SUCCESS) {
             if (!p_device_info->primary_record) {
-                bta_dm_di_cb.di_handle[bta_dm_di_cb.di_num] = *p_handle;
-                bta_dm_di_cb.di_num ++;
+                for (uint8_t i = 1; i < BTA_DI_NUM_MAX; i++) {
+                    if (!bta_dm_di_cb.di_handle[i]) {
+                        bta_dm_di_cb.di_handle[i] = *p_handle;
+                        break;
+                    }
+                }
+                bta_dm_di_cb.di_num++;
+            } else if (!bta_dm_di_cb.di_handle[0]) {
+                bta_dm_di_cb.di_handle[0] = *p_handle;
+                bta_dm_di_cb.di_num++;
+            } else {
+                assert(bta_dm_di_cb.di_handle[0] == (*p_handle));
             }
 
-            bta_sys_add_uuid(UUID_SERVCLASS_PNP_INFORMATION);
-            status =  BTA_SUCCESS;
+            if (!bta_dm_di_cb.uuid_added) {
+                bta_sys_add_uuid(UUID_SERVCLASS_PNP_INFORMATION);
+                bta_dm_di_cb.uuid_added = TRUE;
+            }
+
+            status = BTA_SUCCESS;
         }
     }
 
     return status;
 }
+
+/*******************************************************************************
+**
+** Function         BTA_DmRemoveLocalDiRecord
+**
+** Description      This function removes a DI record from the local SDP database.
+**
+** Returns          BTA_SUCCESS if record is removed successfully, otherwise error code.
+**
+*******************************************************************************/
+tBTA_STATUS BTA_DmRemoveLocalDiRecord(UINT32 handle)
+{
+    tBTA_STATUS status = BTA_FAILURE;
+
+    for (uint8_t i = 0; i < BTA_DI_NUM_MAX; i++) {
+        if (bta_dm_di_cb.di_handle[i] == handle) {
+            if (SDP_DeleteRecord(handle)) {
+                bta_dm_di_cb.di_handle[i] = 0;
+                bta_dm_di_cb.di_num--;
+                status = BTA_SUCCESS;
+                break;
+            }
+        }
+    }
+
+    if (bta_dm_di_cb.di_num == 0 && bta_dm_di_cb.uuid_added) {
+        bta_sys_remove_uuid(UUID_SERVCLASS_PNP_INFORMATION);
+    }
+
+    return status;
+}
 #endif  ///SDP_INCLUDED == TRUE
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -1541,6 +1541,7 @@ typedef struct {
 #if (SDP_INCLUDED == TRUE)
     tSDP_DISCOVERY_DB     *p_di_db;     /* pointer to the DI discovery database */
 #endif  ///SDP_INCLUDED == TRUE
+    BOOLEAN             uuid_added;
     UINT8               di_num;         /* total local DI record number */
     UINT32              di_handle[BTA_DI_NUM_MAX];  /* local DI record handle, the first one is primary record */
 } tBTA_DM_DI_CB;

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -2125,6 +2125,17 @@ extern UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr );
 *******************************************************************************/
 extern tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
         UINT32 *p_handle );
+
+/*******************************************************************************
+**
+** Function         BTA_DmRemoveLocalDiRecord
+**
+** Description      This function removes a DI record from the local SDP database.
+**
+** Returns          BTA_SUCCESS if record is removed successfully, otherwise error code.
+**
+*******************************************************************************/
+extern tBTA_STATUS BTA_DmRemoveLocalDiRecord(UINT32 handle);
 #endif  ///SDP_INCLUDED == TRUE
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/include/bta/bta_sdp_api.h

@@ -41,7 +41,7 @@ typedef UINT8 tBTA_SDP_STATUS;
 /* SDP I/F callback events */
 /* events received by tBTA_SDP_DM_CBACK */
 #define BTA_SDP_ENABLE_EVT               0  /* SDP service enabled */
-#define BTA_SDP_DISENABLE_EVT            1  /* SDP service disenabled */
+#define BTA_SDP_DISABLE_EVT              1  /* SDP service disenabled */
 #define BTA_SDP_SEARCH_EVT               2  /* SDP search started */
 #define BTA_SDP_SEARCH_COMP_EVT          3  /* SDP search complete */
 #define BTA_SDP_CREATE_RECORD_USER_EVT   4  /* SDP create record complete */
@@ -67,10 +67,17 @@ typedef struct {
     int                 handle;
 } tBTA_SDP_CREATE_RECORD_USER;
 
+/* data associated with BTA_SDP_REMOVE_RECORD_USER_EVT */
+typedef struct {
+    tBTA_SDP_STATUS     status;
+    int                 handle;
+} tBTA_SDP_REMOVE_RECORD_USER;
+
 typedef union {
     tBTA_SDP_STATUS              status;            /* BTA_SDP_SEARCH_EVT */
     tBTA_SDP_SEARCH_COMP         sdp_search_comp;   /* BTA_SDP_SEARCH_COMP_EVT */
     tBTA_SDP_CREATE_RECORD_USER  sdp_create_record; /* BTA_SDP_CREATE_RECORD_USER_EVT */
+    tBTA_SDP_REMOVE_RECORD_USER  sdp_remove_record; /* BTA_SDP_REMOVE_RECORD_USER_EVT */
 } tBTA_SDP;
 
 /* SDP DM Interface callback */
@@ -78,9 +85,11 @@ typedef void (tBTA_SDP_DM_CBACK)(tBTA_SDP_EVT event, tBTA_SDP *p_data, void *use
 
 /* MCE configuration structure */
 typedef struct {
-    UINT16  sdp_db_size;            /* The size of p_sdp_db */
+    UINT16            sdp_raw_size;    /* The size of p_sdp_raw_data */
+    UINT16            sdp_db_size;     /* The size of p_sdp_db */
 #if (SDP_INCLUDED == TRUE)
-    tSDP_DISCOVERY_DB   *p_sdp_db;  /* The data buffer to keep SDP database */
+    UINT8             *p_sdp_raw_data; /* The data buffer to keep raw data */
+    tSDP_DISCOVERY_DB *p_sdp_db;       /* The data buffer to keep SDP database */
 #endif  ///SDP_INCLUDED == TRUE
 } tBTA_SDP_CFG;
 
@@ -108,14 +117,28 @@ extern tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback);
 **
 ** Function         BTA_SdpDisable
 **
-** Description      Disable the SDP search I/F service.
+** Description      This function is used to request a callback to perform disable
+**                  operation. The registered callback will be called with event
+**                  BTA_SDP_DISABLE_EVT.
+**
+** Returns          BTA_SDP_SUCCESS, if the request is being processed.
+**                  BTA_SDP_FAILURE, otherwise.
+**
+*******************************************************************************/
+extern tBTA_SDP_STATUS BTA_SdpDisable(void);
+
+/*******************************************************************************
+**
+** Function         BTA_SdpCleanup
+**
+** Description      Cleanup the SDP search I/F service.
 **                  Free buffer for SDP configuration structure.
 **
 ** Returns          BTA_SDP_SUCCESS if successful.
 **                  BTA_SDP_FAIL if internal failure.
 **
 *******************************************************************************/
-extern tBTA_SDP_STATUS BTA_SdpDisable(void);
+extern tBTA_SDP_STATUS BTA_SdpCleanup(void);
 
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/sdp/bta_sdp.c

@@ -49,10 +49,11 @@ typedef void (*tBTA_SDP_ACTION)(tBTA_SDP_MSG *p_data);
 
 /* action function list */
 const tBTA_SDP_ACTION bta_sdp_action[] = {
-    bta_sdp_enable,  /* BTA_SDP_API_ENABLE_EVT */
-    bta_sdp_search,  /* BTA_SDP_API_SEARCH_EVT */
-    bta_sdp_create_record,  /* BTA_SDP_API_CREATE_RECORD_USER_EVT */
-    bta_sdp_remove_record,  /* BTA_SDP_API_REMOVE_RECORD_USER_EVT */
+    bta_sdp_enable,        /* BTA_SDP_API_ENABLE_EVT */
+    bta_sdp_search,        /* BTA_SDP_API_SEARCH_EVT */
+    bta_sdp_create_record, /* BTA_SDP_API_CREATE_RECORD_USER_EVT */
+    bta_sdp_remove_record, /* BTA_SDP_API_REMOVE_RECORD_USER_EVT */
+    bta_sdp_disable,       /* BTA_SDP_API_DISABLE_EVT */
 };
 
 /*******************************************************************************

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -363,8 +363,8 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
 
     /* Try to extract a service name */
     if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME)) != NULL) {
-        record->pse.hdr.service_name_length = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);
-        record->pse.hdr.service_name = (char *)p_attr->attr_value.v.array;
+        record->hdr.service_name_length = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);
+        record->hdr.service_name = (char *)p_attr->attr_value.v.array;
     }
 
     if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM)) != NULL) {
@@ -373,9 +373,9 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
 
     /* Try to extract an RFCOMM channel */
     if (SDP_FindProtocolListElemInRec(p_rec, UUID_PROTOCOL_RFCOMM, &pe)) {
-        record->pse.hdr.rfcomm_channel_number = pe.params[0];
+        record->hdr.rfcomm_channel_number = pe.params[0];
     }
-    record->hdr.user1_ptr_len = p_bta_sdp_cfg->p_sdp_db->raw_size;
+    record->hdr.user1_ptr_len = p_bta_sdp_cfg->p_sdp_db->raw_used;
     record->hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
@@ -526,6 +526,10 @@ void bta_sdp_search(tBTA_SDP_MSG *p_data)
     SDP_InitDiscoveryDb (p_bta_sdp_cfg->p_sdp_db, p_bta_sdp_cfg->sdp_db_size, 1,
                          bta_sdp_search_uuid, 0, NULL);
 
+    /* tell SDP to keep the raw data */
+    p_bta_sdp_cfg->p_sdp_db->raw_size = p_bta_sdp_cfg->sdp_raw_size;
+    p_bta_sdp_cfg->p_sdp_db->raw_data = p_bta_sdp_cfg->p_sdp_raw_data;
+
     if (!SDP_ServiceSearchAttributeRequest2(p_data->get_search.bd_addr, p_bta_sdp_cfg->p_sdp_db,
                                             bta_sdp_search_cback, (void *)bta_sdp_search_uuid)) {
         bta_sdp_cb.sdp_active = BTA_SDP_ACTIVE_NONE;
@@ -558,7 +562,7 @@ void bta_sdp_create_record(tBTA_SDP_MSG *p_data)
     APPL_TRACE_DEBUG("%s() event: %d\n", __func__, p_data->record.hdr.event);
     tBTA_SDP_CREATE_RECORD_USER bta_sdp = {0};
     bta_sdp.status = BTA_SDP_SUCCESS;
-    bta_sdp.handle = (int)p_data->record.user_data;
+    bta_sdp.handle = -1;
     if (bta_sdp_cb.p_dm_cback) {
         bta_sdp_cb.p_dm_cback(BTA_SDP_CREATE_RECORD_USER_EVT, (tBTA_SDP *)&bta_sdp, p_data->record.user_data);
     }
@@ -576,10 +580,30 @@ void bta_sdp_create_record(tBTA_SDP_MSG *p_data)
 void bta_sdp_remove_record(tBTA_SDP_MSG *p_data)
 {
     APPL_TRACE_DEBUG("%s() event: %d\n", __func__, p_data->record.hdr.event);
+    tBTA_SDP_REMOVE_RECORD_USER bta_sdp;
+    bta_sdp.status = BTA_SDP_SUCCESS;
+    bta_sdp.handle = -1;
+    if (bta_sdp_cb.p_dm_cback) {
+        bta_sdp_cb.p_dm_cback(BTA_SDP_REMOVE_RECORD_USER_EVT, (tBTA_SDP *)&bta_sdp, p_data->record.user_data);
+    }
+}
+
+/*******************************************************************************
+**
+** Function     bta_sdp_disable
+**
+** Description  Removes an SDP record
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_sdp_disable(tBTA_SDP_MSG *p_data)
+{
+    APPL_TRACE_DEBUG("%s()\n", __func__);
     tBTA_SDP bta_sdp;
     bta_sdp.status = BTA_SDP_SUCCESS;
     if (bta_sdp_cb.p_dm_cback) {
-        bta_sdp_cb.p_dm_cback(BTA_SDP_REMOVE_RECORD_USER_EVT, &bta_sdp, p_data->record.user_data);
+        bta_sdp_cb.p_dm_cback(BTA_SDP_DISABLE_EVT, &bta_sdp, NULL);
     }
 }
 

components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c

@@ -65,7 +65,9 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback)
 #if BTA_DYNAMIC_MEMORY == TRUE
     /* Malloc buffer for SDP configuration structure */
     p_bta_sdp_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_sdp_cfg->sdp_db_size);
-    if (p_bta_sdp_cfg->p_sdp_db == NULL) {
+    p_bta_sdp_cfg->p_sdp_raw_data = (UINT8 *)osi_malloc(p_bta_sdp_cfg->sdp_raw_size);
+    if (p_bta_sdp_cfg->p_sdp_db == NULL || p_bta_sdp_cfg->p_sdp_raw_data == NULL) {
+        BTA_SdpCleanup();
         return BTA_SDP_FAILURE;
     }
 #endif
@@ -101,15 +103,34 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback)
 *******************************************************************************/
 tBTA_SDP_STATUS BTA_SdpDisable(void)
 {
+    BT_HDR  *p_buf = NULL;
     tBTA_SDP_STATUS status = BTA_SDP_SUCCESS;
 
+    if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR))) != NULL) {
+        p_buf->event = BTA_SDP_API_DISABLE_EVT;
+        bta_sys_sendmsg(p_buf);
+        status = BTA_SDP_FAILURE;
+    }
+
+    return status;
+}
+
+tBTA_SDP_STATUS BTA_SdpCleanup(void)
+{
     bta_sys_deregister(BTA_ID_SDP);
 #if BTA_DYNAMIC_MEMORY == TRUE
     /* Free buffer for SDP configuration structure */
-    osi_free(p_bta_sdp_cfg->p_sdp_db);
-    p_bta_sdp_cfg->p_sdp_db = NULL;
+    if (p_bta_sdp_cfg->p_sdp_db) {
+        osi_free(p_bta_sdp_cfg->p_sdp_db);
+        p_bta_sdp_cfg->p_sdp_db = NULL;
+    }
+
+    if (p_bta_sdp_cfg->p_sdp_raw_data) {
+        osi_free(p_bta_sdp_cfg->p_sdp_raw_data);
+        p_bta_sdp_cfg->p_sdp_raw_data = NULL;
+    }
 #endif
-    return (status);
+    return BTA_SDP_SUCCESS;
 }
 
 /*******************************************************************************

components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c

@@ -30,16 +30,24 @@
 #define BTA_SDP_DB_SIZE  1500
 #endif
 
+#ifndef BTA_SDP_RAW_DATA_SIZE
+#define BTA_SDP_RAW_DATA_SIZE 1024
+#endif
+
 #if BTA_DYNAMIC_MEMORY == FALSE
+static UINT8 bta_sdp_raw_data[BTA_SDP_RAW_DATA_SIZE];
 static UINT8 __attribute__ ((aligned(4))) bta_sdp_db_data[BTA_SDP_DB_SIZE];
 #endif
 
 /* SDP configuration structure */
 tBTA_SDP_CFG bta_sdp_cfg = {
+    BTA_SDP_RAW_DATA_SIZE,
     BTA_SDP_DB_SIZE,
 #if BTA_DYNAMIC_MEMORY == FALSE
+    bta_sdp_raw_data,
     (tSDP_DISCOVERY_DB *)bta_sdp_db_data /* The data buffer to keep SDP database */
 #else
+    NULL,
     NULL
 #endif
 };

components/bt/host/bluedroid/bta/sdp/include/bta_sdp_int.h

@@ -42,6 +42,7 @@ enum {
     BTA_SDP_API_SEARCH_EVT,
     BTA_SDP_API_CREATE_RECORD_USER_EVT,
     BTA_SDP_API_REMOVE_RECORD_USER_EVT,
+    BTA_SDP_API_DISABLE_EVT,
     BTA_SDP_MAX_INT_EVT
 };
 
@@ -105,6 +106,7 @@ extern void bta_sdp_enable (tBTA_SDP_MSG *p_data);
 extern void bta_sdp_search (tBTA_SDP_MSG *p_data);
 extern void bta_sdp_create_record(tBTA_SDP_MSG *p_data);
 extern void bta_sdp_remove_record(tBTA_SDP_MSG *p_data);
+extern void bta_sdp_disable(tBTA_SDP_MSG *p_data);
 
 #endif  ///SDP_INCLUDED == TRUE
 

components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -40,7 +40,7 @@ static void btc_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 c
 **  Static variables
 ******************************************************************************/
 
-/* flag indicating wheter TG/CT is initialized */
+/* flag indicating whether TG/CT is initialized */
 static uint32_t s_rc_ct_init;
 static uint32_t s_rc_tg_init;
 
@@ -751,7 +751,7 @@ static void btc_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 c
 
         btc_rc_cb.rc_ntf[event_id - 1].registered = TRUE;
         btc_rc_cb.rc_ntf[event_id - 1].label = label;
-        BTC_TRACE_EVENT("%s: New registerd notification: event_id:0x%x, label:0x%x",
+        BTC_TRACE_EVENT("%s: New register notification: event_id:0x%x, label:0x%x",
                         __FUNCTION__, event_id, label);
 
         // set up callback
@@ -947,7 +947,7 @@ void btc_rc_handler(tBTA_AV_EVT event, tBTA_AV *p_data)
                 memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
                 param.conn_stat.connected = true;
                 memcpy(param.conn_stat.remote_bda, btc_rc_cb.rc_addr, sizeof(esp_bd_addr_t));
-                btc_avrc_tg_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+                btc_avrc_tg_cb_to_app(ESP_AVRC_TG_CONNECTION_STATE_EVT, &param);
             }
         } while (0);
         btc_rc_cb.rc_features = p_data->rc_feat.peer_features;
@@ -1041,7 +1041,7 @@ static void btc_avrc_ct_deinit(void)
     BTC_TRACE_API("## %s ##", __FUNCTION__);
 
     if (g_a2dp_on_deinit) {
-        BTC_TRACE_WARNING("A2DP already deinit, AVRC CT shuold deinit in advance of A2DP !!!");
+        BTC_TRACE_WARNING("A2DP already deinit, AVRC CT should deinit in advance of A2DP !!!");
     }
 
     if (s_rc_ct_init != BTC_RC_CT_INIT_MAGIC) {
@@ -1255,7 +1255,7 @@ static bt_status_t btc_avrc_ct_send_passthrough_cmd(uint8_t tl, uint8_t key_code
         BTA_AvRemoteCmd(btc_rc_cb.rc_handle, tl,
                         (tBTA_AV_RC)key_code, (tBTA_AV_STATE)key_state);
         status =  BT_STATUS_SUCCESS;
-        BTC_TRACE_API("%s: succesfully sent passthrough command to BTA", __FUNCTION__);
+        BTC_TRACE_API("%s: successfully sent passthrough command to BTA", __FUNCTION__);
     } else {
         status = BT_STATUS_FAIL;
         BTC_TRACE_DEBUG("%s: feature not supported", __FUNCTION__);
@@ -1298,7 +1298,7 @@ static void btc_avrc_tg_init(void)
         }
 
         if (g_a2dp_on_init) {
-            BTC_TRACE_WARNING("AVRC Taget is expected to be initialized in advance of A2DP !!!");
+            BTC_TRACE_WARNING("AVRC Target is expected to be initialized in advance of A2DP !!!");
         }
     }
 
@@ -1320,7 +1320,7 @@ static void btc_avrc_tg_deinit(void)
     BTC_TRACE_API("## %s ##", __FUNCTION__);
 
     if (g_a2dp_on_deinit) {
-        BTC_TRACE_WARNING("A2DP already deinit, AVRC TG shuold deinit in advance of A2DP !!!");
+        BTC_TRACE_WARNING("A2DP already deinit, AVRC TG should deinit in advance of A2DP !!!");
     }
 
     if (s_rc_tg_init != BTC_RC_TG_INIT_MAGIC) {

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -469,7 +469,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
                 if(gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_16 &&
                    gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_32 &&
                    gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_128) {
-                    BTC_TRACE_ERROR("%s, The Charateristic uuid length = %d is invalid", __func__,\
+                    BTC_TRACE_ERROR("%s, The Characteristic uuid length = %d is invalid", __func__,\
                         gatts_attr_db[i+1].att_desc.uuid_length);
                     return ESP_GATT_INVALID_ATTR_LEN;
                 }
@@ -481,7 +481,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
                         uuid == ESP_GATT_UUID_CHAR_SRVR_CONFIG || uuid == ESP_GATT_UUID_CHAR_PRESENT_FORMAT ||
                         uuid == ESP_GATT_UUID_CHAR_AGG_FORMAT || uuid == ESP_GATT_UUID_CHAR_VALID_RANGE ||
                         uuid == ESP_GATT_UUID_EXT_RPT_REF_DESCR || uuid == ESP_GATT_UUID_RPT_REF_DESCR) {
-                        BTC_TRACE_ERROR("%s, The charateristic value uuid = %d is invalid", __func__, uuid);
+                        BTC_TRACE_ERROR("%s, The characteristic value uuid = %d is invalid", __func__, uuid);
                         return ESP_GATT_INVALID_PDU;
                     }
                 }
@@ -694,6 +694,7 @@ void btc_gatts_call_handler(btc_msg_t *msg)
         }
 
         param.rsp.status = 0;
+        param.rsp.conn_id = BTC_GATT_GET_CONN_ID(arg->send_rsp.conn_id);
         btc_gatts_cb_to_app(ESP_GATTS_RESPONSE_EVT, BTC_GATT_GET_GATT_IF(arg->send_rsp.conn_id), &param);
         break;
     }

components/bt/host/bluedroid/btc/profile/std/include/bt_sdp.h

@@ -34,55 +34,43 @@ typedef enum {
     SDP_TYPE_PBAP_PSE,   // Phone Book Profile - Server
     SDP_TYPE_PBAP_PCE,   // Phone Book Profile - Client
     SDP_TYPE_OPP_SERVER, // Object Push Profile
-    SDP_TYPE_SAP_SERVER  // SIM Access Profile
+    SDP_TYPE_SAP_SERVER, // SIM Access Profile
 } bluetooth_sdp_types;
 
-typedef struct _bluetooth_sdp_hdr {
-    bluetooth_sdp_types type;
-    esp_bt_uuid_t       uuid;
-    uint32_t    service_name_length;
-    char       *service_name;
-    int32_t     rfcomm_channel_number;
-    int32_t     l2cap_psm;
-    int32_t     profile_version;
-} bluetooth_sdp_hdr;
-
 /**
  * Some signals need additional pointers, hence we introduce a
  * generic way to handle these pointers.
  */
 typedef struct _bluetooth_sdp_hdr_overlay {
     bluetooth_sdp_types type;
-    esp_bt_uuid_t       bt_uuid;
-    uint32_t    service_name_length;
-    char       *service_name;
-    int32_t     rfcomm_channel_number;
-    int32_t     l2cap_psm;
-    int32_t     profile_version;
-
-    // User pointers, only used for some signals - see bluetooth_sdp_ops_record
-    int         user1_ptr_len;
-    uint8_t    *user1_ptr;
-    int         user2_ptr_len;
-    uint8_t    *user2_ptr;
+    esp_bt_uuid_t       uuid;
+    uint32_t            service_name_length;
+    char               *service_name;
+    int32_t             rfcomm_channel_number;
+    int32_t             l2cap_psm;
+    int32_t             profile_version;
+    int                 user1_ptr_len;
+    uint8_t            *user1_ptr;
+    int                 user2_ptr_len; // not used
+    uint8_t            *user2_ptr;     // not used
 } bluetooth_sdp_hdr_overlay;
 
 typedef struct _bluetooth_sdp_mas_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    mas_instance_id;
-    uint32_t    supported_features;
-    uint32_t    supported_message_types;
+    uint32_t                  mas_instance_id;
+    uint32_t                  supported_features;
+    uint32_t                  supported_message_types;
 } bluetooth_sdp_mas_record;
 
 typedef struct _bluetooth_sdp_mns_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    supported_features;
+    uint32_t                  supported_features;
 } bluetooth_sdp_mns_record;
 
 typedef struct _bluetooth_sdp_pse_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    supported_features;
-    uint32_t    supported_repositories;
+    uint32_t                  supported_features;
+    uint32_t                  supported_repositories;
 } bluetooth_sdp_pse_record;
 
 typedef struct _bluetooth_sdp_pce_record {
@@ -91,8 +79,8 @@ typedef struct _bluetooth_sdp_pce_record {
 
 typedef struct _bluetooth_sdp_ops_record {
     bluetooth_sdp_hdr_overlay hdr;
-    int         supported_formats_list_len;
-    uint8_t     supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];
+    int                       supported_formats_list_len;
+    uint8_t                   supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];
 } bluetooth_sdp_ops_record;
 
 typedef struct _bluetooth_sdp_sap_record {
@@ -100,13 +88,13 @@ typedef struct _bluetooth_sdp_sap_record {
 } bluetooth_sdp_sap_record;
 
 typedef union {
-    bluetooth_sdp_hdr_overlay   hdr;
-    bluetooth_sdp_mas_record    mas;
-    bluetooth_sdp_mns_record    mns;
-    bluetooth_sdp_pse_record    pse;
-    bluetooth_sdp_pce_record    pce;
-    bluetooth_sdp_ops_record    ops;
-    bluetooth_sdp_sap_record    sap;
+    bluetooth_sdp_hdr_overlay hdr;
+    bluetooth_sdp_mas_record  mas;
+    bluetooth_sdp_mns_record  mns;
+    bluetooth_sdp_pse_record  pse;
+    bluetooth_sdp_pce_record  pce;
+    bluetooth_sdp_ops_record  ops;
+    bluetooth_sdp_sap_record  sap;
 } bluetooth_sdp_record;
 
 #endif /* __BT_SDP_H__ */

components/bt/host/bluedroid/btc/profile/std/include/btc_sdp.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -32,9 +32,9 @@ typedef union {
     } search;
 
     //BTC_SDP_ACT_CREATE_RECORD
-    struct creat_record_arg {
+    struct create_record_arg {
         bluetooth_sdp_record *record;
-    } creat_record;
+    } create_record;
 
     //BTC_SDP_ACT_REMOVE_RECORD
     struct remove_record_arg {

components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c

@@ -25,12 +25,14 @@ typedef enum {
 } sdp_state_t;
 
 typedef struct {
-    sdp_state_t state;
+    uint8_t state;
     int sdp_handle;
-    bluetooth_sdp_record* record_data;
+    esp_bt_uuid_t uuid;
+    void* record_data;
 } sdp_slot_t;
 
 typedef struct {
+    bool search_allowed;
     sdp_slot_t *sdp_slots[SDP_MAX_RECORDS];
     osi_mutex_t sdp_slot_mutex;
 } sdp_local_param_t;
@@ -48,6 +50,21 @@ static sdp_local_param_t *sdp_local_param_ptr;
 #define is_sdp_init() (&sdp_local_param != NULL && sdp_local_param.sdp_slot_mutex != NULL)
 #endif
 
+static void btc_sdp_cleanup(void)
+{
+#if SDP_DYNAMIC_MEMORY == TRUE
+    if (sdp_local_param_ptr) {
+#endif
+        if (sdp_local_param.sdp_slot_mutex) {
+            osi_mutex_free(&sdp_local_param.sdp_slot_mutex);
+            sdp_local_param.sdp_slot_mutex = NULL;
+        }
+#if SDP_DYNAMIC_MEMORY == TRUE
+        osi_free(sdp_local_param_ptr);
+        sdp_local_param_ptr = NULL;
+    }
+#endif
+}
 
 static inline void btc_sdp_cb_to_app(esp_sdp_cb_event_t event, esp_sdp_cb_param_t *param)
 {
@@ -57,46 +74,25 @@ static inline void btc_sdp_cb_to_app(esp_sdp_cb_event_t event, esp_sdp_cb_param_
     }
 }
 
-static void sdp_disable_handler(void)
+static int get_sdp_record_size(bluetooth_sdp_record* in_record)
 {
-    btc_msg_t msg;
-    bt_status_t status;
-
-    msg.sig = BTC_SIG_API_CB;
-    msg.pid = BTC_PID_SDP;
-    msg.act = BTA_SDP_DISENABLE_EVT;
-
-    status = btc_transfer_context(&msg, NULL, 0, NULL, NULL);
-
-    if (status != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
-    }
-}
-
-static int get_sdp_records_size(bluetooth_sdp_record* in_record, int count)
-{
-    bluetooth_sdp_record* record = in_record;
+    bluetooth_sdp_record *record = in_record;
     int records_size = 0;
 
-    for(int i = 0; i < count; i++) {
-        record = &in_record[i];
-        records_size += sizeof(bluetooth_sdp_record);
-        records_size += record->hdr.service_name_length;
-        if(record->hdr.service_name_length > 0){
-            records_size++; /* + '\0' termination of string */
-        }
-        records_size += record->hdr.user1_ptr_len;
-        records_size += record->hdr.user2_ptr_len;
+    records_size += sizeof(bluetooth_sdp_record);
+    records_size += record->hdr.service_name_length;
+    if (record->hdr.service_name_length > 0) {
+        records_size++; /* + '\0' termination of string */
     }
 
     return records_size;
 }
 
-static void set_sdp_handle(int id, int handle)
+static void set_sdp_slot_info(int id, int sdp_handle, esp_bt_uuid_t *uuid)
 {
     sdp_slot_t *slot = NULL;
 
-    BTC_TRACE_DEBUG("%s() id=%d to handle=0x%08x", __func__, id, handle);
+    BTC_TRACE_DEBUG("%s() id=%d to sdp_handle=0x%08x", __func__, id, sdp_handle);
 
     if(id >= SDP_MAX_RECORDS) {
         BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
@@ -104,34 +100,64 @@ static void set_sdp_handle(int id, int handle)
     }
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    slot = sdp_local_param.sdp_slots[id];
-    if (slot == NULL) {
-        osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-        BTC_TRACE_ERROR("%s() id=%d to handle=0x%08x, set failed", __func__, id, handle);
-        return;
-    }
-    slot->sdp_handle = handle;
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+        slot->sdp_handle = sdp_handle;
+        slot->record_data = NULL;
+        if (uuid) {
+            memcpy(&slot->uuid, uuid, sizeof(esp_bt_uuid_t));
+        } else {
+            memset(&slot->uuid, 0, sizeof(esp_bt_uuid_t));
+        }
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
 }
 
-
-static bool get_sdp_record_by_handle(int handle, bluetooth_sdp_record* record)
+static void get_sdp_slot_info(int id, int *sdp_handle, esp_bt_uuid_t *uuid)
 {
     sdp_slot_t *slot = NULL;
 
-    osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-
-    for (int i = 0; i < SDP_MAX_RECORDS; i++) {
-        slot = sdp_local_param.sdp_slots[i];
-        if ((slot != NULL) && (slot->sdp_handle == handle)) {
-            memcpy(record, slot->record_data, sizeof(bluetooth_sdp_record));
-            osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-            return true;
-        }
+    if(id >= SDP_MAX_RECORDS) {
+        BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
+        return;
     }
 
+    osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+
+        if (sdp_handle) {
+            *sdp_handle = slot->sdp_handle;
+        }
+
+        if (uuid) {
+            memcpy(uuid, &slot->uuid, sizeof(esp_bt_uuid_t));
+        }
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-    return false;
 }
 
 static int get_sdp_slot_id_by_handle(int handle)
@@ -152,9 +178,10 @@ static int get_sdp_slot_id_by_handle(int handle)
     return -1;
 }
 
-static sdp_slot_t *start_create_sdp(int id)
+static bluetooth_sdp_record *start_create_sdp(int id)
 {
-    sdp_slot_t *sdp_slot = NULL;
+    sdp_slot_t *slot = NULL;
+    bluetooth_sdp_record* record_data = NULL;
 
     if(id >= SDP_MAX_RECORDS) {
         BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
@@ -162,62 +189,58 @@ static sdp_slot_t *start_create_sdp(int id)
     }
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    sdp_slot = sdp_local_param.sdp_slots[id];
-    if (sdp_slot == NULL) {
-        BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
-    } else if(sdp_slot->state != SDP_RECORD_ALLOCED) {
-        BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__,
-                id, sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
-        /* The record have been removed before this event occurred - e.g. deinit */
-        sdp_slot = NULL;
-    }
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+        record_data = slot->record_data;
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
 
-    return sdp_slot;
+    return record_data;
 }
 
 /* Deep copy all content of in_records into out_records.
  * out_records must point to a chunk of memory large enough to contain all
  * the data. Use getSdpRecordsSize() to calculate the needed size. */
-static void copy_sdp_records(bluetooth_sdp_record* in_records, bluetooth_sdp_record* out_records, int count)
+static void copy_sdp_record_common(bluetooth_sdp_record* in_record, bluetooth_sdp_record* out_record)
 {
-    bluetooth_sdp_record *in_record;
-    bluetooth_sdp_record *out_record;
-    char *free_ptr = (char*)(&out_records[count]); /* set pointer to after the last entry */
+    uint8_t *free_ptr = (uint8_t *)(out_record + 1); /* set pointer to after the last entry */
 
-    for(int i = 0; i < count; i++) {
-        in_record = &in_records[i];
-        out_record = &out_records[i];
-        *out_record = *in_record;
+    memcpy(out_record, in_record, sizeof(bluetooth_sdp_record));
 
-        if(in_record->hdr.service_name == NULL || in_record->hdr.service_name_length == 0) {
-            out_record->hdr.service_name = NULL;
-            out_record->hdr.service_name_length = 0;
-        } else {
-            out_record->hdr.service_name = free_ptr; // Update service_name pointer
-            // Copy string
-            memcpy(free_ptr, in_record->hdr.service_name, in_record->hdr.service_name_length);
-            free_ptr += in_record->hdr.service_name_length;
-            *(free_ptr) = '\0'; // Set '\0' termination of string
-            free_ptr++;
-        }
-        if(in_record->hdr.user1_ptr != NULL) {
-            out_record->hdr.user1_ptr = (UINT8*)free_ptr; // Update pointer
-            memcpy(free_ptr, in_record->hdr.user1_ptr, in_record->hdr.user1_ptr_len); // Copy content
-            free_ptr += in_record->hdr.user1_ptr_len;
-        }
-        if(in_record->hdr.user2_ptr != NULL) {
-            out_record->hdr.user2_ptr = (UINT8*)free_ptr; // Update pointer
-            memcpy(free_ptr, in_record->hdr.user2_ptr, in_record->hdr.user2_ptr_len); // Copy content
-            free_ptr += in_record->hdr.user2_ptr_len;
-        }
+    if (in_record->hdr.service_name == NULL || in_record->hdr.service_name_length == 0) {
+        out_record->hdr.service_name = NULL;
+        out_record->hdr.service_name_length = 0;
+    } else {
+        out_record->hdr.service_name = (char *)free_ptr; // Update service_name pointer
+        // Copy string
+        memcpy(free_ptr, in_record->hdr.service_name, in_record->hdr.service_name_length);
+        free_ptr += in_record->hdr.service_name_length;
+        *(free_ptr) = '\0'; // Set '\0' termination of string
+        free_ptr++;
     }
 }
 
+static void copy_sdp_record(bluetooth_sdp_record* in_record, bluetooth_sdp_record* out_record)
+{
+    copy_sdp_record_common(in_record, out_record);
+}
+
 static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
 {
     int i;
-    int record_size = get_sdp_records_size(in_record, 1);
+    int record_size = get_sdp_record_size(in_record);
     bluetooth_sdp_record *record = NULL;
     sdp_slot_t **slot = NULL;
 
@@ -227,11 +250,10 @@ static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
         return -1;
     }
 
-    copy_sdp_records(in_record, record, 1);
+    copy_sdp_record(in_record, record);
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    for(i = 0; i < SDP_MAX_RECORDS; i++)
-    {
+    for (i = 0; i < SDP_MAX_RECORDS; i++) {
         slot = &sdp_local_param.sdp_slots[i];
         if ((*slot) == NULL) {
             if (((*slot) = (sdp_slot_t *)osi_malloc(sizeof(sdp_slot_t))) == NULL) {
@@ -240,8 +262,8 @@ static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
                 osi_free(record);
                 return -1;
             }
-            (*slot)->state = SDP_RECORD_ALLOCED;
-            (*slot)->record_data = record;
+            (*slot)->state           = SDP_RECORD_ALLOCED;
+            (*slot)->record_data     = record;
             break;
         }
     }
@@ -292,7 +314,7 @@ static int free_sdp_slot(int id)
 }
 
 /* Create a raw SDP record based on information stored in a bluetooth_sdp_raw_record */
-static int add_raw_sdp(const bluetooth_sdp_record* rec)
+static int add_raw_sdp(const bluetooth_sdp_record *rec)
 {
     tSDP_PROTOCOL_ELEM  protoList [2];
     UINT16              browse = UUID_SERVCLASS_PUBLIC_BROWSE_GROUP;
@@ -301,6 +323,7 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
     UINT8               temp[LEN_UUID_128];
     UINT8*              p_temp = temp;
     UINT32              sdp_handle = 0;
+    const esp_bt_uuid_t *p_uuid = &rec->hdr.uuid;
 
     BTC_TRACE_DEBUG("%s(): scn 0x%02x, psm = 0x%04x\n  service name %s", __func__,
             rec->hdr.rfcomm_channel_number, rec->hdr.l2cap_psm, rec->hdr.service_name);
@@ -310,15 +333,15 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
         return sdp_handle;
     }
 
-    if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_16) {
+    if (p_uuid->len == ESP_UUID_LEN_16) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES);
-        UINT16_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid16);
-    } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_32) {
+        UINT16_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid16);
+    } else if (p_uuid->len == ESP_UUID_LEN_32) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_FOUR_BYTES);
-        UINT32_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid32);
-    } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_128) {
+        UINT32_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid32);
+    } else if (p_uuid->len == ESP_UUID_LEN_128) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES);
-        ARRAY_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid128, LEN_UUID_128);
+        ARRAY_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid128, LEN_UUID_128);
     } else {
         SDP_DeleteRecord(sdp_handle);
         sdp_handle = 0;
@@ -357,7 +380,7 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -365,12 +388,12 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
         sdp_handle = 0;
         BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status);
     } else {
-        if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_16) {
-            bta_sys_add_uuid(rec->hdr.bt_uuid.uuid.uuid16);
-        } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_32) {
-            bta_sys_add_uuid_32(rec->hdr.bt_uuid.uuid.uuid32);
-        } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_128) {
-            bta_sys_add_uuid_128((UINT8 *)&rec->hdr.bt_uuid.uuid.uuid128);
+        if (p_uuid->len == ESP_UUID_LEN_16) {
+            bta_sys_add_uuid(p_uuid->uuid.uuid16);
+        } else if (p_uuid->len == ESP_UUID_LEN_32) {
+            bta_sys_add_uuid_32(p_uuid->uuid.uuid32);
+        } else if (p_uuid->len == ESP_UUID_LEN_128) {
+            bta_sys_add_uuid_128((UINT8 *)&p_uuid->uuid.uuid128);
         }
         BTC_TRACE_DEBUG("%s():  SDP Registered (handle 0x%08x)", __func__, sdp_handle);
     }
@@ -448,7 +471,7 @@ static int add_maps_sdp(const bluetooth_sdp_mas_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -523,7 +546,7 @@ static int add_mapc_sdp(const bluetooth_sdp_mns_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -603,7 +626,7 @@ static int add_pbaps_sdp(const bluetooth_sdp_pse_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -649,7 +672,7 @@ static int add_pbapc_sdp(const bluetooth_sdp_pce_record* rec)
                                      UUID_SERVCLASS_PHONE_ACCESS,
                                      rec->hdr.profile_version);
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -736,7 +759,7 @@ static int add_opps_sdp(const bluetooth_sdp_ops_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -799,7 +822,7 @@ static int add_saps_sdp(const bluetooth_sdp_sap_record* rec)
             UUID_SERVCLASS_SAP,
             rec->hdr.profile_version);
 
-    // Make the service browseable
+    // Make the service browsable
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -816,64 +839,183 @@ static int add_saps_sdp(const bluetooth_sdp_sap_record* rec)
 
 static int btc_handle_create_record_event(int id)
 {
-    int handle = -1;
-    const sdp_slot_t *sdp_slot = NULL;
+    int sdp_handle = 0;
+    bluetooth_sdp_record *record = start_create_sdp(id);
+    esp_bt_uuid_t service_uuid = {0};
 
     BTC_TRACE_DEBUG("Sdp Server %s", __func__);
 
-    sdp_slot = start_create_sdp(id);
-    if(sdp_slot != NULL) {
-        bluetooth_sdp_record* record = sdp_slot->record_data;
-        switch(record->hdr.type) {
+    if (record != NULL) {
+        switch (record->hdr.type) {
         case SDP_TYPE_RAW:
-            handle = add_raw_sdp(record);
+            sdp_handle = add_raw_sdp(record);
+            memcpy(&service_uuid, &record->hdr.uuid, sizeof(esp_bt_uuid_t));
             break;
         case SDP_TYPE_MAP_MAS:
-            handle = add_maps_sdp(&record->mas);
+            sdp_handle = add_maps_sdp(&record->mas);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_MESSAGE_ACCESS;
             break;
         case SDP_TYPE_MAP_MNS:
-            handle = add_mapc_sdp(&record->mns);
+            sdp_handle = add_mapc_sdp(&record->mns);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_MESSAGE_NOTIFICATION;
             break;
         case SDP_TYPE_PBAP_PSE:
-            handle = add_pbaps_sdp(&record->pse);
+            sdp_handle = add_pbaps_sdp(&record->pse);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_PBAP_PSE;
             break;
         case SDP_TYPE_PBAP_PCE:
-            handle = add_pbapc_sdp(&record->pce);
+            sdp_handle = add_pbapc_sdp(&record->pce);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_PBAP_PCE;
             break;
         case SDP_TYPE_OPP_SERVER:
-            handle = add_opps_sdp(&record->ops);
+            sdp_handle = add_opps_sdp(&record->ops);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_OBEX_OBJECT_PUSH;
             break;
         case SDP_TYPE_SAP_SERVER:
-            handle = add_saps_sdp(&record->sap);
+            sdp_handle = add_saps_sdp(&record->sap);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_SAP;
             break;
         default:
-            BTC_TRACE_DEBUG("Record type %d is not supported",record->hdr.type);
+            BTC_TRACE_DEBUG("Record type %d is not supported", record->hdr.type);
             break;
         }
-        if(handle != -1) {
-            set_sdp_handle(id, handle);
+
+        if(sdp_handle != 0) {
+            set_sdp_slot_info(id, sdp_handle, &service_uuid);
+            // free the record, since not use it anymore
+            osi_free(record);
+        } else {
+            sdp_handle = -1;
         }
+    } else {
+        sdp_handle = -1;
     }
 
-    return handle;
+    if (sdp_handle == -1) {
+        free_sdp_slot(id);
+    }
+
+    return sdp_handle;
 }
 
-static bool btc_sdp_remove_record_event(int handle)
+static bool btc_sdp_remove_record_event(int id, int *p_sdp_handle)
 {
-    bool result = false;
-
     BTC_TRACE_DEBUG("Sdp Server %s", __func__);
 
-    if(handle != -1 && handle != 0) {
-        result = SDP_DeleteRecord(handle);
-        if(result == false) {
-            BTC_TRACE_ERROR("  Unable to remove handle 0x%08x", handle);
+    bool result = false;
+    int sdp_handle = -1;
+    esp_bt_uuid_t service_uuid = {0};
+
+    get_sdp_slot_info(id, &sdp_handle, &service_uuid);
+
+    if (sdp_handle > 0) {
+        do {
+            result = SDP_DeleteRecord(sdp_handle);
+            if (!result) {
+                BTC_TRACE_ERROR("Unable to remove handle 0x%08x", sdp_handle);
+                break;
+            }
+
+            if (service_uuid.len == ESP_UUID_LEN_16) {
+                bta_sys_remove_uuid(service_uuid.uuid.uuid16);
+            } else if (service_uuid.len == ESP_UUID_LEN_32) {
+                bta_sys_remove_uuid_32(service_uuid.uuid.uuid32);
+            } else if (service_uuid.len == ESP_UUID_LEN_128) {
+                bta_sys_remove_uuid_128((UINT8 *)&service_uuid.uuid.uuid128);
+            }
+        } while (0);
+
+        if (p_sdp_handle) {
+            *p_sdp_handle = sdp_handle;
         }
     }
 
     return result;
 }
 
+static void btc_sdp_cb_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
+{
+    switch (msg->act) {
+    case BTA_SDP_SEARCH_COMP_EVT: {
+        tBTA_SDP_SEARCH_COMP *src_search_comp = (tBTA_SDP_SEARCH_COMP *)p_src;
+        tBTA_SDP_SEARCH_COMP *dest_search_comp = (tBTA_SDP_SEARCH_COMP *)p_dest;
+        int record_count = src_search_comp->record_count;
+
+        for (int i = 0; i < record_count; i++) {
+            bluetooth_sdp_record *src_record = &src_search_comp->records[i];
+            bluetooth_sdp_record *dest_record = &dest_search_comp->records[i];
+            // deep copy service name
+            uint32_t src_service_name_length = src_record->hdr.service_name_length;
+            char *src_service_name = src_record->hdr.service_name;
+            dest_record->hdr.service_name_length = 0;
+            dest_record->hdr.service_name        = NULL;
+            if (src_service_name && src_service_name_length) {
+                char *service_name = (char *)osi_malloc(src_service_name_length + 1);
+                if (service_name) {
+                    memcpy(service_name, src_service_name, src_service_name_length);
+                    service_name[src_service_name_length] = '\0';
+
+                    dest_record->hdr.service_name_length = src_service_name_length;
+                    dest_record->hdr.service_name        = service_name;
+                } else {
+                    BTC_TRACE_ERROR("%s malloc service name failed, orig service name:%s", __func__, src_service_name);
+                }
+            }
+
+            // deep copy user1_ptr fow RAW type
+            int src_user1_ptr_len = src_record->hdr.user1_ptr_len;
+            uint8_t *src_user1_ptr = src_record->hdr.user1_ptr;
+            dest_record->hdr.user1_ptr_len = 0;
+            dest_record->hdr.user1_ptr     = NULL;
+            if (src_record->hdr.type == SDP_TYPE_RAW && src_user1_ptr && src_user1_ptr_len) {
+                uint8_t *user1_ptr = (uint8_t *)osi_malloc(src_user1_ptr_len);
+                if (user1_ptr) {
+                    memcpy(user1_ptr, src_user1_ptr, src_user1_ptr_len);
+
+                    dest_record->hdr.user1_ptr_len = src_user1_ptr_len;
+                    dest_record->hdr.user1_ptr     = user1_ptr;
+                } else {
+                    BTC_TRACE_ERROR("%s malloc user1_ptr failed", __func__);
+                }
+            }
+        }
+
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+static void btc_sdp_cb_arg_deep_free(btc_msg_t *msg)
+{
+    switch (msg->act) {
+    case BTA_SDP_SEARCH_COMP_EVT: {
+        tBTA_SDP_SEARCH_COMP *search_comp = (tBTA_SDP_SEARCH_COMP *)msg->arg;
+        for (size_t i = 0; i < search_comp->record_count; i++) {
+            bluetooth_sdp_record *record = &search_comp->records[i];
+            if (record->hdr.service_name) {
+                osi_free(record->hdr.service_name);
+            }
+
+            if (record->hdr.user1_ptr) {
+                osi_free(record->hdr.user1_ptr);
+            }
+        }
+
+        break;
+    }
+    default:
+        break;
+    }
+}
+
 static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_data)
 {
     btc_msg_t msg;
@@ -881,18 +1023,18 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
 
     switch (event) {
     case BTA_SDP_CREATE_RECORD_USER_EVT: {
-        if (p_data->status == BTA_SDP_SUCCESS) {
+        if (p_data->sdp_create_record.status == BTA_SDP_SUCCESS) {
             p_data->sdp_create_record.handle = btc_handle_create_record_event((int)user_data);
             if (p_data->sdp_create_record.handle < 0) {
-                p_data->status = BTA_SDP_FAILURE;
+                p_data->sdp_create_record.status = BTA_SDP_FAILURE;
             }
         }
     }
     break;
     case BTA_SDP_REMOVE_RECORD_USER_EVT: {
-        if (p_data->status == BTA_SDP_SUCCESS) {
-            if (btc_sdp_remove_record_event((int)user_data) == false) {
-                p_data->status = BTA_SDP_FAILURE;
+        if (p_data->sdp_remove_record.status == BTA_SDP_SUCCESS) {
+            if (btc_sdp_remove_record_event((int)user_data, &p_data->sdp_remove_record.handle) == false) {
+                p_data->sdp_remove_record.status = BTA_SDP_FAILURE;
             }
         }
     }
@@ -905,7 +1047,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
     msg.pid = BTC_PID_SDP;
     msg.act = event;
 
-    status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), NULL, NULL);
+    status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free);
 
     if (status != BT_STATUS_SUCCESS) {
         BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
@@ -930,23 +1072,27 @@ static void btc_sdp_init(void)
             ret = ESP_SDP_NO_RESOURCE;
             break;
         }
-        memset((void *)sdp_local_param_ptr, 0, sizeof(sdp_local_param_t));
 #endif
+        memset(&sdp_local_param, 0, sizeof(sdp_local_param_t));
 
         if (osi_mutex_new(&sdp_local_param.sdp_slot_mutex) != 0) {
-#if SDP_DYNAMIC_MEMORY == TRUE
-            osi_free(sdp_local_param_ptr);
-            sdp_local_param_ptr = NULL;
-#endif
             BTC_TRACE_ERROR("%s osi_mutex_new failed\n", __func__);
             ret = ESP_SDP_NO_RESOURCE;
             break;
         }
 
         ret = BTA_SdpEnable(btc_sdp_dm_cback);
+        if (ret != ESP_SDP_SUCCESS) {
+            BTC_TRACE_ERROR("%s BTA_SdpEnable failed, ret = %d\n", __func__, ret);
+            ret = ESP_SDP_FAILURE;
+            break;
+        }
+
+        sdp_local_param.search_allowed = true;
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
+        btc_sdp_cleanup();
         param.init.status = ret;
         btc_sdp_cb_to_app(ESP_SDP_INIT_EVT, &param);
     }
@@ -956,7 +1102,6 @@ static void btc_sdp_deinit(void)
 {
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
-    int handle;
 
     do {
         if (!is_sdp_init()) {
@@ -966,12 +1111,13 @@ static void btc_sdp_deinit(void)
         }
 
         for(int i = 0; i < SDP_MAX_RECORDS; i++) {
-            handle = free_sdp_slot(i);
-            if (handle > 0) {
-                BTA_SdpRemoveRecordByUser((void*)handle);
+            int sdp_handle = -1;
+            get_sdp_slot_info(i, &sdp_handle, NULL);
+            if (sdp_handle > 0) {
+                BTA_SdpRemoveRecordByUser((void*)i);
             }
         }
-        sdp_disable_handler();
+        BTA_SdpDisable();
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -982,7 +1128,7 @@ static void btc_sdp_deinit(void)
 
 static void btc_sdp_create_record(btc_sdp_args_t *arg)
 {
-    int handle;
+    int slot_id;
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
 
@@ -993,13 +1139,13 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg)
             break;
         }
 
-        handle = alloc_sdp_slot(arg->creat_record.record);
-        if (handle < 0) {
+        slot_id = alloc_sdp_slot(arg->create_record.record);
+        if (slot_id < 0) {
             ret = ESP_SDP_FAILURE;
             break;
         }
 
-        BTA_SdpCreateRecordByUser((void *) handle);
+        BTA_SdpCreateRecordByUser((void *) slot_id);
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1011,7 +1157,6 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg)
 
 static void btc_sdp_remove_record(btc_sdp_args_t *arg)
 {
-    int handle;
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
 
@@ -1022,42 +1167,16 @@ static void btc_sdp_remove_record(btc_sdp_args_t *arg)
             break;
         }
 
-        bluetooth_sdp_record rec;
-        if (get_sdp_record_by_handle(arg->remove_record.record_handle, &rec)) {
-            if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_16) {
-                bta_sys_remove_uuid(rec.hdr.bt_uuid.uuid.uuid16);
-            } else if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_32) {
-                bta_sys_remove_uuid_32(rec.hdr.bt_uuid.uuid.uuid32);
-            } else if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_128) {
-                bta_sys_remove_uuid_128((UINT8 *)&rec.hdr.bt_uuid.uuid.uuid128);
-            }
-        } else {
-            BTC_TRACE_ERROR("%s SDP record with handle %d not found",
-                                __func__, arg->remove_record.record_handle);
-            ret = ESP_SDP_NO_CREATE_RECORD;
-            break;
-        }
-
         /* Get the Record handle, and free the slot */
         /* The application layer record_handle is equivalent to the id of the btc layer */
-        int slot = get_sdp_slot_id_by_handle(arg->remove_record.record_handle);
-        if (slot < 0) {
+        int slot_id = get_sdp_slot_id_by_handle(arg->remove_record.record_handle);
+        if (slot_id < 0) {
+            BTC_TRACE_ERROR("%s SDP record with handle %d not found", __func__, arg->remove_record.record_handle);
             ret = ESP_SDP_NO_CREATE_RECORD;
             break;
         }
 
-        handle = free_sdp_slot(slot);
-
-        BTC_TRACE_DEBUG("Sdp Server %s id=%d to handle=0x%08x",
-                    __func__, arg->remove_record.record_handle, handle);
-
-        /* Pass the actual record handle */
-        if(handle > 0) {
-            BTA_SdpRemoveRecordByUser((void*) handle);
-        } else {
-            ret = ESP_SDP_NO_CREATE_RECORD;
-            break;
-        }
+        BTA_SdpRemoveRecordByUser((void *)slot_id);
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1078,7 +1197,18 @@ static void btc_sdp_search(btc_sdp_args_t *arg)
             break;
         }
 
+        if (!sdp_local_param.search_allowed) {
+            BTC_TRACE_ERROR("%s SDP search is not allowed!", __func__);
+            ret = ESP_SDP_NO_RESOURCE;
+            break;
+        }
+
         BTA_SdpSearch(arg->search.bd_addr, &arg->search.sdp_uuid);
+        /**
+         * ESP_SDP_SEARCH_COMP_EVT will refer service name in BTA sdp database, so it is not allowed to be search until
+         * the previous search is completed
+         */
+        sdp_local_param.search_allowed = false;
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1089,26 +1219,21 @@ static void btc_sdp_search(btc_sdp_args_t *arg)
 
 void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 {
-    btc_sdp_args_t *dst = (btc_sdp_args_t *)p_dest;
-    btc_sdp_args_t *src = (btc_sdp_args_t *)p_src;
-
     switch (msg->act) {
-    case BTC_SDP_ACT_CREATE_RECORD:
-        dst->creat_record.record = (bluetooth_sdp_record *)osi_calloc(sizeof(bluetooth_sdp_record));
-        if (dst->creat_record.record) {
-            memcpy(dst->creat_record.record, src->creat_record.record, sizeof(bluetooth_sdp_record));
+    case BTC_SDP_ACT_CREATE_RECORD: {
+        bluetooth_sdp_record **dst_record = &((btc_sdp_args_t *)p_dest)->create_record.record;
+        bluetooth_sdp_record *src_record = ((btc_sdp_args_t *)p_src)->create_record.record;
+        bluetooth_sdp_record *record = (bluetooth_sdp_record *)osi_calloc(get_sdp_record_size(src_record));
+        if (record) {
+            copy_sdp_record(src_record, record);
         } else {
             BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act);
             break;
         }
 
-        dst->creat_record.record->hdr.service_name = (char *)osi_calloc(src->creat_record.record->hdr.service_name_length);
-        if (dst->creat_record.record->hdr.service_name) {
-            strcpy(dst->creat_record.record->hdr.service_name, src->creat_record.record->hdr.service_name);
-        } else {
-            BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act);
-        }
+        *dst_record = record;
         break;
+    }
     default:
         break;
     }
@@ -1116,17 +1241,15 @@ void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 
 void btc_sdp_arg_deep_free(btc_msg_t *msg)
 {
-    btc_sdp_args_t *arg = (btc_sdp_args_t *)msg->arg;
-
     switch (msg->act) {
-    case BTC_SDP_ACT_CREATE_RECORD:
-        if (arg->creat_record.record) {
-            osi_free(arg->creat_record.record);
-        }
-        if (arg->creat_record.record->hdr.service_name) {
-            osi_free(arg->creat_record.record->hdr.service_name);
+    case BTC_SDP_ACT_CREATE_RECORD: {
+        btc_sdp_args_t *arg = (btc_sdp_args_t *)msg->arg;
+        bluetooth_sdp_record *record = arg->create_record.record;
+        if (record) {
+            osi_free(record);
         }
         break;
+    }
     default:
         break;
     }
@@ -1172,35 +1295,22 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
         param.init.status = p_data->status;
         btc_sdp_cb_to_app(ESP_SDP_INIT_EVT, &param);
         break;
-    case BTA_SDP_DISENABLE_EVT:
-        BTA_SdpDisable();
-        osi_mutex_free(&sdp_local_param.sdp_slot_mutex);
- #if SDP_DYNAMIC_MEMORY == TRUE
-        osi_free(sdp_local_param_ptr);
-        sdp_local_param_ptr = NULL;
- #endif
+    case BTA_SDP_DISABLE_EVT:
+        BTA_SdpCleanup();
+        btc_sdp_cleanup();
         param.deinit.status = ESP_SDP_SUCCESS;
         btc_sdp_cb_to_app(ESP_SDP_DEINIT_EVT, &param);
         break;
     case BTA_SDP_SEARCH_COMP_EVT:
+        // SDP search completed, now can be searched again
+        sdp_local_param.search_allowed = true;
+
         param.search.status = p_data->sdp_search_comp.status;
-        if (param.search.status == ESP_SDP_SUCCESS) {
-            memcpy(param.search.remote_addr, p_data->sdp_search_comp.remote_addr, sizeof(BD_ADDR));
-            memcpy(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid, sizeof(tSDP_UUID));
-            param.search.record_count = p_data->sdp_search_comp.record_count;
-            param.search.records = osi_malloc(sizeof(esp_bluetooth_sdp_record_t)*p_data->sdp_search_comp.record_count);
-            if (param.search.records != NULL) {
-                memcpy(param.search.records, p_data->sdp_search_comp.records,
-                        sizeof(esp_bluetooth_sdp_record_t)*p_data->sdp_search_comp.record_count);
-            } else {
-                BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, event);
-                param.search.status = ESP_SDP_NO_RESOURCE;
-            }
-        }
+        memcpy(param.search.remote_addr, p_data->sdp_search_comp.remote_addr, sizeof(BD_ADDR));
+        memcpy(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid, sizeof(tSDP_UUID));
+        param.search.record_count = p_data->sdp_search_comp.record_count;
+        param.search.records = (esp_bluetooth_sdp_record_t *)p_data->sdp_search_comp.records;
         btc_sdp_cb_to_app(ESP_SDP_SEARCH_COMP_EVT, &param);
-        if (param.search.records != NULL) {
-            osi_free(param.search.records);
-        }
         break;
     case BTA_SDP_CREATE_RECORD_USER_EVT:
         param.create_record.status = p_data->sdp_create_record.status;
@@ -1208,13 +1318,25 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
         btc_sdp_cb_to_app(ESP_SDP_CREATE_RECORD_COMP_EVT, &param);
         break;
     case BTA_SDP_REMOVE_RECORD_USER_EVT:
-        param.remove_record.status = p_data->status;
+        if (p_data->sdp_remove_record.status == BTA_SDP_SUCCESS) {
+            int slot_id = get_sdp_slot_id_by_handle(p_data->sdp_remove_record.handle);
+            if (slot_id < 0) {
+                p_data->sdp_remove_record.status = ESP_SDP_NO_CREATE_RECORD;
+                break;
+            } else {
+                free_sdp_slot(slot_id);
+            }
+        }
+
+        param.remove_record.status = p_data->sdp_remove_record.status;
         btc_sdp_cb_to_app(ESP_SDP_REMOVE_RECORD_COMP_EVT, &param);
         break;
     default:
         BTC_TRACE_DEBUG("%s: Unhandled event (%d)!", __func__, msg->act);
         break;
     }
+
+    btc_sdp_cb_arg_deep_free(msg);
 }
 
 #endif ///defined BTC_SDP_INCLUDED && BTC_SDP_INCLUDED == TRUE

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -48,16 +48,16 @@
 
 //L2CAP
 #ifdef CONFIG_BT_L2CAP_ENABLED
-#define UC_BT_L2CAP_ENABLED                   CONFIG_BT_L2CAP_ENABLED
+#define UC_BT_L2CAP_ENABLED                 CONFIG_BT_L2CAP_ENABLED
 #else
-#define UC_BT_L2CAP_ENABLED                   FALSE
+#define UC_BT_L2CAP_ENABLED                 FALSE
 #endif
 
 //HFP(AG)
 #ifdef CONFIG_BT_HFP_AG_ENABLE
-#define UC_BT_HFP_AG_ENABLED            CONFIG_BT_HFP_AG_ENABLE
+#define UC_BT_HFP_AG_ENABLED                CONFIG_BT_HFP_AG_ENABLE
 #else
-#define UC_BT_HFP_AG_ENABLED            FALSE
+#define UC_BT_HFP_AG_ENABLED                FALSE
 #endif
 
 //HFP(Client)

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -1274,7 +1274,7 @@
 #ifdef CONFIG_IDF_TARGET_ESP32
 #define BTM_BLE_ADV_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #else
-#define BTM_BLE_ADV_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 21}
+#define BTM_BLE_ADV_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 20}
 #endif
 #endif
 
@@ -1282,7 +1282,7 @@
 #ifdef CONFIG_IDF_TARGET_ESP32
 #define BTM_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #else
-#define BTM_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 21}
+#define BTM_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 20}
 #endif
 #endif
 

components/bt/host/bluedroid/device/controller.c

@@ -271,7 +271,7 @@ static void start_up(void)
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE && BLE_42_FEATURE_SUPPORT == FALSE)
-        if (HCI_LE_ENHANCED_PRIVACY_SUPPORTED(controller_param.features_ble.as_array)) {
+        if (HCI_LE_EXT_ADV_SUPPORTED(controller_param.features_ble.as_array)) {
             response = AWAIT_COMMAND(controller_param.packet_factory->make_read_max_adv_data_len());
             controller_param.packet_parser->parse_ble_read_adv_max_len_response(
                 response,

components/bt/host/bluedroid/hci/hci_packet_parser.c

@@ -186,7 +186,9 @@ static void parse_ble_read_resolving_list_size_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_RESOLVING_LIST_SIZE, 1 /* bytes after */);
-    STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
+    if (stream) {
+        STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
+    }
 
     osi_free(response);
 }
@@ -198,10 +200,14 @@ static void parse_ble_read_suggested_default_data_length_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
-    STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
+    if (stream) {
+        STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+        STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
+    }
+
     osi_free(response);
 }
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 static void parse_ble_read_adv_max_len_response(
     BT_HDR *response,
@@ -209,8 +215,10 @@ static void parse_ble_read_adv_max_len_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_MAX_ADV_DATA_LEN, 1 /* bytes after */);
-    // Size: 2 Octets ; Value: 0x001F – 0x0672 ; Maximum supported advertising data length
-    STREAM_TO_UINT16(*adv_max_len_ptr, stream);
+    if (stream) {
+        // Size: 2 Octets ; Value: 0x001F – 0x0672 ; Maximum supported advertising data length
+        STREAM_TO_UINT16(*adv_max_len_ptr, stream);
+    }
 
     osi_free(response);
 }
@@ -254,6 +262,7 @@ static uint8_t *read_command_complete_header(
     STREAM_TO_UINT8(status, stream);
 
     if (status != HCI_SUCCESS) {
+        HCI_TRACE_ERROR("%s failed: opcode 0x%04x, status 0x%02x", __func__, opcode, status);
         return NULL;
     }
 

components/bt/host/bluedroid/stack/avct/avct_lcb.c

@@ -430,10 +430,10 @@ BOOLEAN avct_lcb_last_ccb(tAVCT_LCB *p_lcb, tAVCT_CCB *p_ccb_last)
     tAVCT_CCB   *p_ccb = &avct_cb.ccb[0];
     int         i;
 
-    AVCT_TRACE_WARNING("avct_lcb_last_ccb");
+    AVCT_TRACE_DEBUG("avct_lcb_last_ccb");
     for (i = 0; i < AVCT_NUM_CONN; i++, p_ccb++) {
-        AVCT_TRACE_WARNING("%x: aloc:%d, lcb:%p/%p, ccb:%p/%p",
-                           i, p_ccb->allocated, p_ccb->p_lcb, p_lcb, p_ccb, p_ccb_last);
+        AVCT_TRACE_DEBUG("%x: aloc:%d, lcb:%p/%p, ccb:%p/%p",
+                         i, p_ccb->allocated, p_ccb->p_lcb, p_lcb, p_ccb, p_ccb_last);
         if (p_ccb->allocated && (p_ccb->p_lcb == p_lcb) && (p_ccb != p_ccb_last)) {
             return FALSE;
         }

components/bt/host/bluedroid/stack/include/stack/hcidefs.h

@@ -1867,42 +1867,50 @@ typedef struct {
 #define HCI_PING_SUPPORTED(x) ((x)[HCI_EXT_FEATURE_PING_OFF] & HCI_EXT_FEATURE_PING_MASK)
 
 /*
-**   LE features encoding - page 0 (the only page for now)
+**   LE features encoding - page 0
 */
-/* LE Encryption */
+/* LE Encryption: bit 0 */
 #define HCI_LE_FEATURE_LE_ENCRYPTION_MASK       0x01
 #define HCI_LE_FEATURE_LE_ENCRYPTION_OFF        0
 #define HCI_LE_ENCRYPTION_SUPPORTED(x) ((x)[HCI_LE_FEATURE_LE_ENCRYPTION_OFF] & HCI_LE_FEATURE_LE_ENCRYPTION_MASK)
 
-/* Connection Parameters Request Procedure */
+/* Connection Parameters Request Procedure: bit 1 */
 #define HCI_LE_FEATURE_CONN_PARAM_REQ_MASK       0x02
 #define HCI_LE_FEATURE_CONN_PARAM_REQ_OFF        0
 #define HCI_LE_CONN_PARAM_REQ_SUPPORTED(x) ((x)[HCI_LE_FEATURE_CONN_PARAM_REQ_OFF] & HCI_LE_FEATURE_CONN_PARAM_REQ_MASK)
 
-/* Extended Reject Indication */
+/* Extended Reject Indication: bit 2 */
 #define HCI_LE_FEATURE_EXT_REJ_IND_MASK       0x04
 #define HCI_LE_FEATURE_EXT_REJ_IND_OFF        0
 #define HCI_LE_EXT_REJ_IND_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_REJ_IND_OFF] & HCI_LE_FEATURE_EXT_REJ_IND_MASK)
 
-/* Slave-initiated Features Exchange */
+/* Slave-initiated Features Exchange: bit 3 */
 #define HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_MASK       0x08
 #define HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_OFF        0
 #define HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(x) ((x)[HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_OFF] & HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_MASK)
 
+/* LE Data Packet Length Extension: bit 5 */
+#define HCI_LE_FEATURE_DATA_LEN_EXT_MASK       0x20
+#define HCI_LE_FEATURE_DATA_LEN_EXT_OFF        0
+#define HCI_LE_DATA_LEN_EXT_SUPPORTED(x) ((x)[HCI_LE_FEATURE_DATA_LEN_EXT_OFF] & HCI_LE_FEATURE_DATA_LEN_EXT_MASK)
+
 /* Enhanced privacy Feature: bit 6 */
 #define HCI_LE_FEATURE_ENHANCED_PRIVACY_MASK       0x40
 #define HCI_LE_FEATURE_ENHANCED_PRIVACY_OFF        0
 #define HCI_LE_ENHANCED_PRIVACY_SUPPORTED(x) ((x)[HCI_LE_FEATURE_ENHANCED_PRIVACY_OFF] & HCI_LE_FEATURE_ENHANCED_PRIVACY_MASK)
 
-/* Extended scanner filter policy : 7 */
+/* Extended scanner filter policy: bit 7 */
 #define HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_MASK       0x80
 #define HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_OFF        0
 #define HCI_LE_EXT_SCAN_FILTER_POLICY_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_OFF] & HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_MASK)
 
-/* Slave-initiated Features Exchange */
-#define HCI_LE_FEATURE_DATA_LEN_EXT_MASK       0x20
-#define HCI_LE_FEATURE_DATA_LEN_EXT_OFF        0
-#define HCI_LE_DATA_LEN_EXT_SUPPORTED(x) ((x)[HCI_LE_FEATURE_DATA_LEN_EXT_OFF] & HCI_LE_FEATURE_DATA_LEN_EXT_MASK)
+/*
+**   LE features encoding - page 1
+*/
+/* LE Extended Advertising: bit 12 */
+#define HCI_LE_FEATURE_EXT_ADV_MASK       0x10
+#define HCI_LE_FEATURE_EXT_ADV_OFF        1
+#define HCI_LE_EXT_ADV_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_ADV_OFF] & HCI_LE_FEATURE_EXT_ADV_MASK)
 
 /*
 **   Local Supported Commands encoding

components/bt/host/bluedroid/stack/sdp/sdp_db.c

@@ -276,7 +276,7 @@ static int sdp_compose_proto_list( UINT8 *p, UINT16 num_elem,
 **
 ** Description      This function is called to create a record in the database.
 **                  This would be through the SDP database maintenance API. The
-**                  record is created empty, teh application should then call
+**                  record is created empty, the application should then call
 **                  "add_attribute" to add the record's attributes.
 **
 ** Returns          Record handle if OK, else 0.
@@ -293,15 +293,15 @@ UINT32 SDP_CreateRecord (void)
 
     /* First, check if there is a free record */
     if (p_db->num_records < SDP_MAX_RECORDS) {
-        p_rec =(tSDP_RECORD *)osi_malloc(sizeof(tSDP_RECORD));
-	if (p_rec) {
-    	    memset(p_rec, 0, sizeof(tSDP_RECORD));
-    	    /* Save previous rec */
-    	    if (p_db->num_records) {
-    	        p_rec_prev = list_back(p_db->p_record_list);
-    	    }
-    	    /* Append new record */
-    	    list_append(p_db->p_record_list, p_rec);
+        p_rec = (tSDP_RECORD *)osi_malloc(sizeof(tSDP_RECORD));
+        if (p_rec) {
+            memset(p_rec, 0, sizeof(tSDP_RECORD));
+            /* Save previous rec */
+            if (p_db->num_records) {
+                p_rec_prev = list_back(p_db->p_record_list);
+            }
+            /* Append new record */
+            list_append(p_db->p_record_list, p_rec);
 
             /* We will use a handle of the first unreserved handle plus last record
             ** number + 1 */
@@ -321,10 +321,12 @@ UINT32 SDP_CreateRecord (void)
                               4, buf);
 
             return (p_rec->record_handle);
-	} else {
+        }
+        else {
             SDP_TRACE_ERROR("SDP_CreateRecord fail, memory allocation failed\n");
-	}
-    } else {
+        }
+    }
+    else {
         SDP_TRACE_ERROR("SDP_CreateRecord fail, exceed maximum records:%d\n", SDP_MAX_RECORDS);
     }
 #endif
@@ -354,17 +356,17 @@ BOOLEAN SDP_DeleteRecord (UINT32 handle)
     if (handle == 0 || sdp_cb.server_db.num_records == 0) {
         /* Delete all records in the database */
         sdp_cb.server_db.num_records = 0;
-        for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
-	    list_remove(sdp_cb.server_db.p_record_list, p_node);
-	}
+        for (p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
+            list_remove(sdp_cb.server_db.p_record_list, p_node);
+        }
         /* require new DI record to be created in SDP_SetLocalDiRecord */
         sdp_cb.server_db.di_primary_handle = 0;
 
         return (TRUE);
     } else {
         /* Find the record in the database */
-        for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
-	    p_rec = list_node(p_node);
+        for (p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
+            p_rec = list_node(p_node);
             if (p_rec->record_handle == handle) {
                 /* Found it. Shift everything up one */
                 list_remove(sdp_cb.server_db.p_record_list, p_rec);
@@ -374,7 +376,7 @@ BOOLEAN SDP_DeleteRecord (UINT32 handle)
                 SDP_TRACE_DEBUG("SDP_DeleteRecord ok, num_records:%d\n", sdp_cb.server_db.num_records);
                 /* if we're deleting the primary DI record, clear the */
                 /* value in the control block */
-                if ( sdp_cb.server_db.di_primary_handle == handle ) {
+                if (sdp_cb.server_db.di_primary_handle == handle) {
                     sdp_cb.server_db.di_primary_handle = 0;
                 }
 

components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c

@@ -190,6 +190,11 @@ static void controller_rcv_pkt_ready(void)
     }
 }
 
+static void dummy_controller_rcv_pkt_ready(void)
+{
+  /* Dummy function */
+}
+
 void bt_record_hci_data(uint8_t *data, uint16_t len)
 {
 #if (BT_HCI_LOG_INCLUDED == TRUE)
@@ -203,6 +208,12 @@ void bt_record_hci_data(uint8_t *data, uint16_t len)
 #endif // (BT_HCI_LOG_INCLUDED == TRUE)
 }
 
+static int dummy_host_rcv_pkt(uint8_t *data, uint16_t len)
+{
+    /* Dummy function */
+    return 0;
+}
+
 /*
  * @brief: BT controller callback function, to transfer data packet to the host
  */
@@ -264,6 +275,11 @@ static const esp_vhci_host_callback_t vhci_host_cb = {
     .notify_host_recv = host_rcv_pkt,
 };
 
+static const esp_vhci_host_callback_t dummy_vhci_host_cb = {
+    .notify_host_send_available = dummy_controller_rcv_pkt_ready,
+    .notify_host_recv = dummy_host_rcv_pkt,
+};
+
 
 extern void ble_transport_init(void);
 extern esp_err_t ble_buf_alloc(void);
@@ -313,6 +329,8 @@ esp_err_t esp_nimble_hci_deinit(void)
     }
     ble_transport_deinit();
 
+    esp_vhci_host_register_callback(&dummy_vhci_host_cb);
+
     ble_buf_free();
 
 #if MYNEWT_VAL(BLE_QUEUE_CONG_CHECK)

components/bt/host/nimble/nimble

@@ -1 +1 @@
-Subproject commit 632513c067a5b8ba2eb34b4d809d694829d712f3
+Subproject commit 43226b84d1dc9e333b8b3a3c0a69d74612f936ff

components/bt/include/esp32c3/include/esp_bt.h

@@ -376,17 +376,18 @@ typedef enum {
     ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18dbm */
     ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15dbm */
     ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12dbm */
-    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to  -9dbm */
-    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to  -6dbm */
-    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to  -3dbm */
-    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to   0dbm */
-    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to  +3dbm */
-    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to  +6dbm */
-    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to  +9dbm */
-    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to  +12dbm */
-    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to  +15dbm */
-    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to  +18dbm */
-    ESP_PWR_LVL_P21 = 15,             /*!< Corresponding to  +21dbm */
+    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to -9dbm */
+    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to -6dbm */
+    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to -3dbm */
+    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to 0dbm */
+    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to +3dbm */
+    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to +6dbm */
+    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to +9dbm */
+    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to +12dbm */
+    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to +15dbm */
+    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to +18dbm */
+    ESP_PWR_LVL_P20 = 15,             /*!< Corresponding to +20dbm */
+    ESP_PWR_LVL_P21 = 15,             /*!< Corresponding to +20dbm, this enum variable has been deprecated */
     ESP_PWR_LVL_INVALID = 0xFF,         /*!< Indicates an invalid value */
 } esp_power_level_t;
 

components/bt/porting/transport/driver/uart/hci_driver_uart.c

@@ -154,7 +154,7 @@ hci_driver_uart_deinit(void)
 
     ESP_ERROR_CHECK(uart_driver_delete(s_hci_driver_uart_env.hci_uart_params->hci_uart_port));
 
-    if (!s_hci_driver_uart_env.tx_sem) {
+    if (s_hci_driver_uart_env.tx_sem) {
         vSemaphoreDelete(s_hci_driver_uart_env.tx_sem);
     }
 

components/driver/spi/gpspi/spi_slave_hd.c

@@ -42,8 +42,8 @@ typedef struct {
     QueueHandle_t tx_ret_queue;
     QueueHandle_t rx_trans_queue;
     QueueHandle_t rx_ret_queue;
-    QueueHandle_t tx_cnting_sem;
-    QueueHandle_t rx_cnting_sem;
+    SemaphoreHandle_t tx_cnting_sem;
+    SemaphoreHandle_t rx_cnting_sem;
 
     spi_slave_hd_data_t *tx_desc;
     spi_slave_hd_data_t *rx_desc;
@@ -291,16 +291,14 @@ static IRAM_ATTR void spi_slave_hd_intr_segment(void *arg)
     awoken |= intr_check_clear_callback(host, SPI_EV_CMD9,   callback->cb_cmd9);
     awoken |= intr_check_clear_callback(host, SPI_EV_CMDA,   callback->cb_cmdA);
 
-    bool tx_done = false;
-    bool rx_done = false;
+    bool tx_done = false, rx_done = false;
+    bool tx_event = false, rx_event = false;
 
     portENTER_CRITICAL_ISR(&host->int_spinlock);
-    if (host->tx_desc && spi_slave_hd_hal_check_disable_event(hal, SPI_EV_SEND)) {
-        tx_done = true;
-    }
-    if (host->rx_desc && spi_slave_hd_hal_check_disable_event(hal, SPI_EV_RECV)) {
-        rx_done = true;
-    }
+    tx_event = spi_slave_hd_hal_check_disable_event(hal, SPI_EV_SEND);
+    rx_event = spi_slave_hd_hal_check_disable_event(hal, SPI_EV_RECV);
+    tx_done = host->tx_desc && tx_event;
+    rx_done = host->rx_desc && rx_event;
     portEXIT_CRITICAL_ISR(&host->int_spinlock);
 
     if (tx_done) {

components/driver/test_apps/uart/main/CMakeLists.txt

@@ -1,7 +1,8 @@
 # In order for the cases defined by `TEST_CASE` to be linked into the final elf,
 # the component can be registered as WHOLE_ARCHIVE
 idf_component_register(
-    SRCS "test_app_main.c" "test_uart.c"
-    REQUIRES driver unity
+    SRCS "test_app_main.c" "test_uart.c" "test_uart_auto_lightsleep.c"
+    REQUIRES driver unity esp_pm
+    PRIV_INCLUDE_DIRS .
     WHOLE_ARCHIVE
 )

components/driver/test_apps/uart/main/test_uart_auto_lightsleep.c

@@ -0,0 +1,104 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "sdkconfig.h"
+#include "unity.h"
+#include "driver/uart.h"
+#include "esp_pm.h"
+#include "esp_log.h"
+#include "esp_private/sleep_cpu.h" //for sleep_cpu_configure
+
+#define UART_TAG         "Uart"
+#define TEST_BUF_SIZE    256
+
+//This should be larger than FIFO_SIZE + 2 * TEST_DRIVER_BUF_SIZE, so that blocking will happen
+#define TEST_WRITE_SIZE 1024
+
+#define TEST_RTS   UART_PIN_NO_CHANGE
+#define TEST_CTS   UART_PIN_NO_CHANGE
+
+#define TEST_UART_BAUD_RATE     115200
+
+#define MAX_FREQ    (CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ)
+
+#if CONFIG_XTAL_FREQ_40
+#define MIN_FREQ    10
+#elif CONFIG_XTAL_FREQ_32
+#define MIN_FREQ    8
+#elif CONFIG_XTAL_FREQ_26
+#define MIN_FREQ    13
+#endif
+
+typedef struct {
+    uart_port_t port_num;
+    soc_module_clk_t default_src_clk;
+    int tx_pin_num;
+    int rx_pin_num;
+    uint32_t rx_flow_ctrl_thresh;
+} uart_port_param_t;
+
+
+#if !TEMPORARY_DISABLED_FOR_TARGETS(ESP32P4)
+#if CONFIG_PM_ENABLE
+
+TEST_CASE("uart tx won't be blocked by auto light sleep", "[uart]")
+{
+    uart_port_param_t port_param = {
+        .port_num = UART_NUM_1,                  // Test HP_UART with UART1 port
+        .default_src_clk = UART_SCLK_DEFAULT,
+        .tx_pin_num = 4,
+        .rx_pin_num = 5,
+        .rx_flow_ctrl_thresh = 120,
+    };
+
+    uart_port_t port_num = port_param.port_num;
+
+    // Configure dynamic frequency scaling:
+    // maximum and minimum frequencies are set in sdkconfig,
+    // automatic light sleep is enabled if tickless idle support is enabled.
+    esp_pm_config_t pm_config = {
+        .max_freq_mhz = MAX_FREQ,
+        .min_freq_mhz = MIN_FREQ,
+#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+        .light_sleep_enable = true
+#endif
+    };
+    TEST_ESP_OK(esp_pm_configure(&pm_config));
+
+    uart_config_t uart_config = {
+        .baud_rate = TEST_UART_BAUD_RATE,
+        .data_bits = UART_DATA_8_BITS,
+        .parity    = UART_PARITY_DISABLE,
+        .stop_bits = UART_STOP_BITS_1,
+        .flow_ctrl = UART_HW_FLOWCTRL_DISABLE,
+        .source_clk = port_param.default_src_clk,
+    };
+    int intr_alloc_flags = 0;
+
+    TEST_ESP_OK(uart_driver_install(port_num, TEST_BUF_SIZE, 0, 0, NULL, intr_alloc_flags));
+    TEST_ESP_OK(uart_param_config(port_num, &uart_config));
+    TEST_ESP_OK(uart_set_pin(port_num, port_param.tx_pin_num, port_param.rx_pin_num, TEST_RTS, TEST_CTS));
+
+    // Configure a temporary buffer for the incoming data
+    const int len = TEST_WRITE_SIZE;
+    uint8_t *data = (uint8_t *) malloc(len);
+
+    //If auto lightsleep happen, there will be deadlock in either one of the two following functions
+    uart_write_bytes(port_num, (const char *) data, len);
+    uart_wait_tx_done(port_num, portMAX_DELAY);
+
+    ESP_LOGI(UART_TAG, "return from uart_write_bytes");
+
+    uart_driver_delete(port_num);
+    free(data);
+
+#if CONFIG_PM_POWER_DOWN_CPU_IN_LIGHT_SLEEP
+    //When PD_CPU enabled, retention may cause 14K memory leak. Workaround to release the memory
+    sleep_cpu_configure(false);
+#endif
+}
+#endif // CONFIG_PM_ENABLE
+#endif //!TEMPORARY_DISABLED_FOR_TARGETS(ESP32P4)

components/driver/uart/uart.c

@@ -28,6 +28,7 @@
 #include "sdkconfig.h"
 #include "esp_rom_gpio.h"
 #include "clk_ctrl_os.h"
+#include "esp_pm.h"
 
 #ifdef CONFIG_UART_ISR_IN_IRAM
 #define UART_ISR_ATTR     IRAM_ATTR
@@ -37,6 +38,14 @@
 #define UART_MALLOC_CAPS  MALLOC_CAP_DEFAULT
 #endif
 
+// Whether to use the APB_MAX lock.
+// Requirement of each chip, to keep sending:
+// - ESP32, S2, C3, S3: Protect APB, which is the core clock and clock of UART FIFO
+// - ESP32-C2: Protect APB (UART FIFO clock), core clock (TODO: IDF-8348)
+// - ESP32-C6, H2 and later chips: Protect core clock. Run in light-sleep hasn't been developed yet (TODO: IDF-8349),
+//   also need to avoid auto light-sleep.
+#define PROTECT_APB     (CONFIG_PM_ENABLE)
+
 #define XOFF (0x13)
 #define XON (0x11)
 
@@ -144,6 +153,9 @@ typedef struct {
     void *tx_done_sem_struct;
     void *tx_brk_sem_struct;
 #endif
+#if PROTECT_APB
+    esp_pm_lock_handle_t pm_lock;   ///< Power management lock
+#endif
 } uart_obj_t;
 
 typedef struct {
@@ -1141,15 +1153,19 @@ esp_err_t uart_wait_tx_done(uart_port_t uart_num, TickType_t ticks_to_wait)
     } else {
         ticks_to_wait = ticks_to_wait - (ticks_end - ticks_start);
     }
+
+#if PROTECT_APB
+    esp_pm_lock_acquire(p_uart_obj[uart_num]->pm_lock);
+#endif
     //take 2nd tx_done_sem, wait given from ISR
     res = xSemaphoreTake(p_uart_obj[uart_num]->tx_done_sem, (TickType_t)ticks_to_wait);
-    if (res == pdFALSE) {
-        // The TX_DONE interrupt will be disabled in ISR
-        xSemaphoreGive(p_uart_obj[uart_num]->tx_mux);
-        return ESP_ERR_TIMEOUT;
-    }
+#if PROTECT_APB
+    esp_pm_lock_release(p_uart_obj[uart_num]->pm_lock);
+#endif
+
+    // The TX_DONE interrupt will be disabled in ISR
     xSemaphoreGive(p_uart_obj[uart_num]->tx_mux);
-    return ESP_OK;
+    return (res == pdFALSE) ? ESP_ERR_TIMEOUT : ESP_OK;
 }
 
 int uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len)
@@ -1176,6 +1192,9 @@ static int uart_tx_all(uart_port_t uart_num, const char *src, size_t size, bool
 
     //lock for uart_tx
     xSemaphoreTake(p_uart_obj[uart_num]->tx_mux, (TickType_t)portMAX_DELAY);
+#if PROTECT_APB
+    esp_pm_lock_acquire(p_uart_obj[uart_num]->pm_lock);
+#endif
     p_uart_obj[uart_num]->coll_det_flg = false;
     if (p_uart_obj[uart_num]->tx_buf_size > 0) {
         size_t max_size = xRingbufferGetMaxItemSize(p_uart_obj[uart_num]->tx_ring_buf);
@@ -1219,6 +1238,9 @@ static int uart_tx_all(uart_port_t uart_num, const char *src, size_t size, bool
         }
         xSemaphoreGive(p_uart_obj[uart_num]->tx_fifo_sem);
     }
+#if PROTECT_APB
+    esp_pm_lock_release(p_uart_obj[uart_num]->pm_lock);
+#endif
     xSemaphoreGive(p_uart_obj[uart_num]->tx_mux);
     return original_size;
 }
@@ -1413,6 +1435,11 @@ static void uart_free_driver_obj(uart_obj_t *uart_obj)
     free(uart_obj->tx_brk_sem_struct);
     free(uart_obj->tx_done_sem_struct);
     free(uart_obj->tx_fifo_sem_struct);
+#endif
+#if PROTECT_APB
+    if (uart_obj->pm_lock) {
+        esp_pm_lock_delete(uart_obj->pm_lock);
+    }
 #endif
     free(uart_obj);
 }
@@ -1498,6 +1525,12 @@ static uart_obj_t *uart_alloc_driver_obj(int event_queue_size, int tx_buffer_siz
             !uart_obj->tx_done_sem || !uart_obj->tx_fifo_sem) {
         goto err;
     }
+#endif
+#if PROTECT_APB
+    if (esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "uart_driver",
+                           &uart_obj->pm_lock) != ESP_OK) {
+        goto err;
+    }
 #endif
     return uart_obj;
 

components/esp_https_ota/include/esp_https_ota.h

@@ -235,6 +235,21 @@ esp_err_t esp_https_ota_get_img_desc(esp_https_ota_handle_t https_ota_handle, es
 int esp_https_ota_get_image_len_read(esp_https_ota_handle_t https_ota_handle);
 
 
+/**
+ * @brief  This function returns the HTTP status code of the last HTTP response.
+ *
+ * @note   This API should be called only after esp_https_ota_begin() has been called.
+ *         This can be used to check the HTTP status code of the OTA download process.
+ *
+ * @param[in]   https_ota_handle   pointer to esp_https_ota_handle_t structure
+ *
+ * @return
+ *    - -1    On failure
+ *    - HTTP status code
+ */
+int esp_https_ota_get_status_code(esp_https_ota_handle_t https_ota_handle);
+
+
 /**
 * @brief  This function returns OTA image total size.
 *

components/esp_https_ota/src/esp_https_ota.c

@@ -714,6 +714,15 @@ esp_err_t esp_https_ota_abort(esp_https_ota_handle_t https_ota_handle)
     return err;
 }
 
+int esp_https_ota_get_status_code(esp_https_ota_handle_t https_ota_handle)
+{
+    esp_https_ota_t *handle = (esp_https_ota_t *) https_ota_handle;
+    if (handle == NULL || handle->http_client == NULL) {
+        return -1;
+    }
+    return esp_http_client_get_status_code(handle->http_client);
+}
+
 int esp_https_ota_get_image_len_read(esp_https_ota_handle_t https_ota_handle)
 {
     esp_https_ota_t *handle = (esp_https_ota_t *)https_ota_handle;

components/esp_hw_support/CMakeLists.txt

@@ -16,6 +16,10 @@ if(${target} STREQUAL "esp32c6")
     list(APPEND priv_requires hal)
 endif()
 
+if(CONFIG_RTC_CLK_SRC_INT_RC32K)
+    message(WARNING "Internal RC32K clock is unstable at extreme temperatures and is not recommended for use.")
+endif()
+
 set(srcs "cpu.c" "port/${IDF_TARGET}/esp_cpu_intr.c" "esp_memory_utils.c" "port/${IDF_TARGET}/cpu_region_protect.c")
 if(NOT BOOTLOADER_BUILD)
     list(APPEND srcs "esp_clk.c"

components/esp_hw_support/include/esp_private/rtc_clk.h

@@ -44,12 +44,6 @@ void rtc_clk_bbpll_add_consumer(void);
  */
 void rtc_clk_bbpll_remove_consumer(void);
 
-/**
- * @brief Workaround for C2, S3, C6, H2. Trigger the calibration of PLL. Should be called when the bootloader doesn't provide a good enough PLL accuracy.
-*/
-void rtc_clk_recalib_bbpll(void);
-
-
 #ifdef __cplusplus
 }
 #endif

components/esp_hw_support/port/esp32c2/Kconfig.hw_support

@@ -13,12 +13,15 @@ choice ESP32C2_REV_MIN
         bool "Rev v1.0 (ECO1)"
     config ESP32C2_REV_MIN_1_1
         bool "Rev v1.1 (ECO2)"
+    config ESP32C2_REV_MIN_200
+        bool "Rev v2.0 (ECO4)"
 endchoice
 
 config ESP32C2_REV_MIN_FULL
     int
     default 100 if ESP32C2_REV_MIN_1
     default 101 if ESP32C2_REV_MIN_1_1
+    default 200 if ESP32C2_REV_MIN_200
 
 config ESP_REV_MIN_FULL
     int

components/esp_hw_support/port/esp32c2/rtc_clk.c

@@ -358,24 +358,6 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
-// Workaround for bootloader not calibrated well issue.
-// Placed in IRAM because disabling BBPLL may influence the cache
-void rtc_clk_recalib_bbpll(void)
-{
-    rtc_cpu_freq_config_t old_config;
-    rtc_clk_cpu_freq_get_config(&old_config);
-
-    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
-    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
-    //   Turn off the BBPLL and do calibration again to fix the issue.
-    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
-    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
-    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
-        rtc_clk_cpu_freq_set_xtal();
-        rtc_clk_cpu_freq_set_config(&old_config);
-    }
-}
-
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/port/esp32c6/Kconfig.rtc

@@ -14,6 +14,9 @@ choice RTC_CLK_SRC
         select ESP_SYSTEM_RTC_EXT_OSC
     config RTC_CLK_SRC_INT_RC32K
         bool "Internal 32kHz RC oscillator"
+        help
+            Internal RC32K clock is unstable at extreme temperatures and is not recommended for use.
+            This option will be removed in IDF v6.0.
 endchoice
 
 config RTC_CLK_CAL_CYCLES

components/esp_hw_support/port/esp32c6/rtc_clk.c

@@ -423,25 +423,6 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
-// Workaround for bootloader not calibrated well issue.
-// Placed in IRAM because disabling BBPLL may influence the cache
-void rtc_clk_recalib_bbpll(void)
-{
-    rtc_cpu_freq_config_t old_config;
-    rtc_clk_cpu_freq_get_config(&old_config);
-
-    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
-    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
-    //   Turn off the BBPLL and do calibration again to fix the issue.
-    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
-    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
-    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
-        rtc_clk_cpu_freq_set_xtal();
-        rtc_clk_cpu_freq_set_config(&old_config);
-    }
-}
-
-
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/port/esp32h2/Kconfig.rtc

@@ -14,6 +14,9 @@ choice RTC_CLK_SRC
         select ESP_SYSTEM_RTC_EXT_OSC
     config RTC_CLK_SRC_INT_RC32K
         bool "Internal 32kHz RC oscillator"
+        help
+            Internal RC32K clock is unstable at extreme temperatures and is not recommended for use.
+            This option will be removed in IDF v6.0.
 endchoice
 
 config RTC_CLK_CAL_CYCLES

components/esp_hw_support/port/esp32h2/rtc_clk.c

@@ -239,7 +239,7 @@ static void rtc_clk_cpu_freq_to_pll_mhz(int cpu_freq_mhz)
 /**
  * Switch to FLASH_PLL as cpu clock source.
  * On ESP32H2, FLASH_PLL frequency is 64MHz.
- * PLL must alreay be enabled.
+ * PLL must already be enabled.
  */
 static void rtc_clk_cpu_freq_to_flash_pll(uint32_t cpu_freq_mhz, uint32_t cpu_divider)
 {
@@ -475,21 +475,3 @@ bool rtc_dig_8m_enabled(void)
 {
     return clk_ll_rc_fast_digi_is_enabled();
 }
-
-// Workaround for bootloader not calibrated well issue.
-// Placed in IRAM because disabling BBPLL may influence the cache
-void rtc_clk_recalib_bbpll(void)
-{
-    rtc_cpu_freq_config_t old_config;
-    rtc_clk_cpu_freq_get_config(&old_config);
-
-    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
-    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
-    //   Turn off the BBPLL and do calibration again to fix the issue. Flash_PLL comes from the same source as PLL.
-    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
-    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
-    if (old_config.source == SOC_CPU_CLK_SRC_PLL || old_config.source == SOC_CPU_CLK_SRC_FLASH_PLL) {
-        rtc_clk_cpu_freq_set_xtal();
-        rtc_clk_cpu_freq_set_config(&old_config);
-    }
-}

components/esp_hw_support/port/esp32s3/rtc_clk.c

@@ -189,7 +189,7 @@ static void rtc_clk_bbpll_configure(rtc_xtal_freq_t xtal_freq, int pll_freq)
  */
 static void rtc_clk_cpu_freq_to_pll_mhz(int cpu_freq_mhz)
 {
-    /* There are totally 6 LDO slaves(all on by default). At the moment of swithing LDO slave, LDO voltage will also change instantaneously.
+    /* There are totally 6 LDO slaves(all on by default). At the moment of switching LDO slave, LDO voltage will also change instantaneously.
      * LDO slave can reduce the voltage change caused by switching frequency.
      * CPU frequency <= 40M : just open 3 LDO slaves; CPU frequency = 80M : open 4 LDO slaves; CPU frequency = 160M : open 5 LDO slaves; CPU frequency = 240M : open 6 LDO slaves;
      *
@@ -463,25 +463,6 @@ bool rtc_dig_8m_enabled(void)
     return clk_ll_rc_fast_digi_is_enabled();
 }
 
-// Workaround for bootloader not calibrated well issue.
-// Placed in IRAM because disabling BBPLL may influence the cache
-void rtc_clk_recalib_bbpll(void)
-{
-    rtc_cpu_freq_config_t old_config;
-    rtc_clk_cpu_freq_get_config(&old_config);
-
-    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
-    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
-    //   Turn off the BBPLL and do calibration again to fix the issue.
-    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
-    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
-    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
-        rtc_clk_cpu_freq_set_xtal();
-        rtc_clk_cpu_freq_set_config(&old_config);
-    }
-}
-
-
 /* Name used in libphy.a:phy_chip_v7.o
  * TODO: update the library to use rtc_clk_xtal_freq_get
  */

components/esp_hw_support/sleep_clock.c

@@ -37,7 +37,12 @@ static esp_err_t sleep_clock_system_retention_init(void *arg)
     #define N_REGS_PCR()    (((PCR_PWDET_SAR_CLK_CONF_REG - DR_REG_PCR_BASE) / 4) + 1)
 #endif
     const static sleep_retention_entries_config_t pcr_regs_retention[] = {
-        [0] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0), DR_REG_PCR_BASE, DR_REG_PCR_BASE, N_REGS_PCR(), 0, 0), .owner = ENTRY(0) | ENTRY(2) }  /* pcr */
+        [0] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0),   DR_REG_PCR_BASE,            DR_REG_PCR_BASE,            N_REGS_PCR(),           0, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [1] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(1),   PCR_RESET_EVENT_BYPASS_REG, PCR_RESET_EVENT_BYPASS_REG, 1,                      0, 0), .owner = ENTRY(0) | ENTRY(2) },
+#if CONFIG_IDF_TARGET_ESP32H2
+        [2] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(2),   PCR_BUS_CLK_UPDATE_REG,     PCR_BUS_CLOCK_UPDATE,       PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [3] = { .config = REGDMA_LINK_WAIT_INIT      (REGDMA_PCR_LINK(3),   PCR_BUS_CLK_UPDATE_REG,     0x0,                        PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+#endif
     };
 
     esp_err_t err = sleep_retention_entries_create(pcr_regs_retention, ARRAY_SIZE(pcr_regs_retention), REGDMA_LINK_PRI_SYS_CLK, SLEEP_RETENTION_MODULE_CLOCK_SYSTEM);

components/esp_netif/include/esp_netif.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -821,6 +821,17 @@ esp_err_t esp_netif_get_ip6_global(esp_netif_t *esp_netif, esp_ip6_addr_t *if_ip
  *      number of returned IPv6 addresses
  */
 int esp_netif_get_all_ip6(esp_netif_t *esp_netif, esp_ip6_addr_t if_ip6[]);
+
+/**
+ * @brief  Get all preferred IPv6 addresses of the specified interface
+ *
+ * @param[in]  esp_netif Handle to esp-netif instance
+ * @param[out] if_ip6 Array of IPv6 addresses will be copied to the argument
+ *
+ * @return
+ *      number of returned IPv6 addresses
+ */
+int esp_netif_get_all_preferred_ip6(esp_netif_t *esp_netif, esp_ip6_addr_t if_ip6[]);
 #endif
 
 /**

components/esp_netif/lwip/esp_netif_lwip.c

@@ -2159,6 +2159,30 @@ int esp_netif_get_all_ip6(esp_netif_t *esp_netif, esp_ip6_addr_t if_ip6[])
     }
     return addr_count;
 }
+
+int esp_netif_get_all_preferred_ip6(esp_netif_t *esp_netif, esp_ip6_addr_t if_ip6[])
+{
+    ESP_LOGV(TAG, "%s esp-netif:%p", __func__, esp_netif);
+
+    if (esp_netif == NULL || if_ip6 == NULL) {
+        return 0;
+    }
+
+    int addr_count = 0;
+    struct netif *p_netif = esp_netif->lwip_netif;
+
+    if (p_netif != NULL && netif_is_up(p_netif)) {
+        for (int i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
+            // Only return the IPs which are:
+            // 1. the state is preferred
+            // 2. not the IP6_ADDR_ANY(all bits are `0`)
+            if (ip6_addr_ispreferred(netif_ip6_addr_state(p_netif, i)) && !ip_addr_cmp(&p_netif->ip6_addr[i], IP6_ADDR_ANY)) {
+                memcpy(&if_ip6[addr_count++], &p_netif->ip6_addr[i], sizeof(ip6_addr_t));
+            }
+        }
+    }
+    return addr_count;
+}
 #endif
 
 esp_netif_flags_t esp_netif_get_flags(esp_netif_t *esp_netif)

components/esp_phy/CMakeLists.txt

@@ -57,22 +57,30 @@ if(link_binary_libs)
 
     idf_component_get_property(esp_phy_lib esp_phy COMPONENT_LIB)
 
+    if(CONFIG_ESP_PHY_ENABLE_CERT_TEST)
+        if(CONFIG_IDF_TARGET_ESP32)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libbttestmode.a
+            librftest.a $<TARGET_FILE:${esp_phy_lib}>)
+        elseif(CONFIG_IDF_TARGET_ESP32S2)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> librftest.a
+            librfate.a $<TARGET_FILE:${esp_phy_lib}>)
+        else()
+            target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libbttestmode.a
+            librfate.a librftest.a $<TARGET_FILE:${esp_phy_lib}>)
+        endif()
+    endif()
+
     if(CONFIG_IDF_TARGET_ESP32)
         target_link_libraries(${COMPONENT_LIB} PUBLIC rtc)
         target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libphy.a librtc.a
         $<TARGET_FILE:${esp_phy_lib}>)
-    elseif(CONFIG_IDF_TARGET_ESP32S2)
-        target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libphy.a
-        $<TARGET_FILE:${esp_phy_lib}>)
     elseif(CONFIG_SOC_BT_SUPPORTED OR CONFIG_SOC_IEEE802154_SUPPORTED)
         target_link_libraries(${COMPONENT_LIB} PUBLIC btbb)
         target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libphy.a libbtbb.a
         $<TARGET_FILE:${esp_phy_lib}>)
-    endif()
-
-    if(CONFIG_ESP_PHY_ENABLE_CERT_TEST)
-        target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libbttestmode.a
-        librfate.a librftest.a $<TARGET_FILE:${esp_phy_lib}>)
+    elseif(CONFIG_SOC_WIFI_SUPPORTED)
+        target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${esp_phy_lib}> libphy.a
+        $<TARGET_FILE:${esp_phy_lib}>)
     endif()
 endif()
 

components/esp_phy/Kconfig

@@ -124,7 +124,6 @@ menu "PHY"
     config ESP_PHY_ENABLE_CERT_TEST
         bool "Enable RF certification test functions"
         default n
-        depends on IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3
         help
             If enabled, you can use RF certification test APIs.
 

components/esp_phy/include/esp_phy_cert_test.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -63,7 +63,7 @@ typedef struct {
     uint32_t phy_rx_correct_count; /*!< The number of desired packets received */
     int phy_rx_rssi;               /*!< Average RSSI of desired packets */
     uint32_t phy_rx_total_count;   /*!< The number of total packets received */
-    uint32_t phy_rx_result_flag;   /*!< 0 means no RX info; 1 means the lastest Wi-Fi RX info; 2 means the lastest BLE RX info. */
+    uint32_t phy_rx_result_flag;   /*!< 0 means no RX info; 1 means the latest Wi-Fi RX info; 2 means the latest BLE RX info. */
 } esp_phy_rx_result_t;
 
 /**
@@ -120,7 +120,7 @@ void esp_phy_cbw40m_en(bool en);
 void esp_phy_wifi_tx(uint32_t chan, esp_phy_wifi_rate_t rate, int8_t backoff, uint32_t length_byte, uint32_t packet_delay, uint32_t packet_num);
 
 /**
- * @brief Test start/stop command, used to stop transmitting or reciving state.
+ * @brief Test start/stop command, used to stop transmitting or receiving state.
  *
  * @param value:
  *     Value should be set to 3 before TX/RX.

components/esp_phy/lib

@@ -1 +1 @@
-Subproject commit 06e7625de197bc12797dd701d6762229bca01826
+Subproject commit 8608fcf54d51e81f2e74ebf335fa33f61953f7c8

components/esp_phy/src/phy_init.c

@@ -301,6 +301,8 @@ void esp_phy_disable(esp_phy_modem_t modem)
         phy_digital_regs_store();
 #endif
 #if SOC_PM_SUPPORT_PMU_MODEM_STATE && CONFIG_ESP_WIFI_ENHANCED_LIGHT_SLEEP
+        extern void pm_mac_modem_clear_rf_power_state(void);
+        pm_mac_modem_clear_rf_power_state();
         if (sleep_modem_wifi_modem_state_enabled()) {
             sleep_modem_wifi_do_phy_retention(false);
         } else

components/esp_ringbuf/ringbuf.c

@@ -504,6 +504,13 @@ static BaseType_t prvCheckItemAvail(Ringbuffer_t *pxRingbuffer)
         return pdFALSE;     //Byte buffers do not allow multiple retrievals before return
     }
     if ((pxRingbuffer->xItemsWaiting > 0) && ((pxRingbuffer->pucRead != pxRingbuffer->pucWrite) || (pxRingbuffer->uxRingbufferFlags & rbBUFFER_FULL_FLAG))) {
+        // If the ring buffer is a no-split buffer, the read pointer must point to an item that has been written to.
+        if ((pxRingbuffer->uxRingbufferFlags & (rbBYTE_BUFFER_FLAG | rbALLOW_SPLIT_FLAG)) == 0) {
+            ItemHeader_t *pxHeader = (ItemHeader_t *)pxRingbuffer->pucRead;
+            if ((pxHeader->uxItemFlags & rbITEM_WRITTEN_FLAG) == 0) {
+                return pdFALSE;
+            }
+        }
         return pdTRUE;      //Items/data available for retrieval
     } else {
         return pdFALSE;     //No items/data available for retrieval
@@ -987,9 +994,6 @@ BaseType_t xRingbufferSendAcquire(RingbufHandle_t xRingbuffer, void **ppvItem, s
     if (xItemSize > pxRingbuffer->xMaxItemSize) {
         return pdFALSE;     //Data will never ever fit in the queue.
     }
-    if ((pxRingbuffer->uxRingbufferFlags & rbBYTE_BUFFER_FLAG) && xItemSize == 0) {
-        return pdTRUE;      //Sending 0 bytes to byte buffer has no effect
-    }
 
     return prvSendAcquireGeneric(pxRingbuffer, NULL, ppvItem, xItemSize, xTicksToWait);
 }

components/esp_ringbuf/test_apps/main/test_ringbuf.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -804,6 +804,8 @@ TEST_CASE("Test ring buffer ISR", "[esp_ringbuf]")
  * tested.
  */
 
+#if !CONFIG_FREERTOS_UNICORE
+
 #define SRAND_SEED                      3   //Arbitrarily chosen srand() seed
 #define SMP_TEST_ITERATIONS             4
 
@@ -1018,6 +1020,7 @@ TEST_CASE("Test static ring buffer SMP", "[esp_ringbuf]")
     cleanup();
 }
 #endif
+#endif //!CONFIG_FREERTOS_UNICORE
 
 #if !CONFIG_RINGBUF_PLACE_FUNCTIONS_INTO_FLASH && !CONFIG_RINGBUF_PLACE_ISR_FUNCTIONS_INTO_FLASH
 /* -------------------------- Test ring buffer IRAM ------------------------- */
@@ -1027,7 +1030,7 @@ static IRAM_ATTR __attribute__((noinline)) bool iram_ringbuf_test(void)
     bool result = true;
     uint8_t item[4];
     size_t item_size;
-    RingbufHandle_t handle = xRingbufferCreate(CONT_DATA_TEST_BUFF_LEN, RINGBUF_TYPE_NOSPLIT);
+    RingbufHandle_t handle = xRingbufferCreate(BUFFER_SIZE, RINGBUF_TYPE_NOSPLIT);
     result = result && (handle != NULL);
     spi_flash_guard_get()->start(); // Disables flash cache
 
@@ -1092,3 +1095,80 @@ TEST_CASE("Test ringbuffer 0 item size", "[esp_ringbuf]")
     vRingbufferDelete(allow_split_rb);
     vRingbufferDelete(byte_rb);
 }
+
+/* ---------------------------- Test no-split ring buffer SendAquire and SendComplete ---------------------------
+ * The following test case tests the SendAquire and SendComplete functions of the no-split ring buffer.
+ *
+ * The test case will do the following...
+ * 1) Create a no-split ring buffer.
+ * 2) Acquire space on the buffer to send an item.
+ * 3) Send the item to the buffer.
+ * 4) Verify that the item is received correctly.
+ * 5) Acquire space on the buffer until the buffer is full.
+ * 6) Send the items out-of-order to the buffer.
+ * 7) Verify that the items are not received until the first item is sent.
+ * 8) Send the first item.
+ * 9) Verify that the items are received in the correct order.
+ */
+TEST_CASE("Test no-split buffers always receive items in order", "[esp_ringbuf]")
+{
+    // Create buffer
+    RingbufHandle_t buffer_handle = xRingbufferCreate(BUFFER_SIZE, RINGBUF_TYPE_NOSPLIT);
+    TEST_ASSERT_MESSAGE(buffer_handle != NULL, "Failed to create ring buffer");
+
+    // Acquire space on the buffer to send an item and write to the item
+    void *item1;
+    TEST_ASSERT_EQUAL(pdTRUE, xRingbufferSendAcquire(buffer_handle, &item1, MEDIUM_ITEM_SIZE, TIMEOUT_TICKS));
+    *(uint32_t *)item1 = 0x123;
+
+    // Send the item to the buffer
+    TEST_ASSERT_EQUAL(pdTRUE, xRingbufferSendComplete(buffer_handle, item1));
+
+    // Verify that the item is received correctly
+    size_t item_size;
+    uint32_t *received_item = xRingbufferReceive(buffer_handle, &item_size, TIMEOUT_TICKS);
+    TEST_ASSERT_NOT_NULL(received_item);
+    TEST_ASSERT_EQUAL(item_size, MEDIUM_ITEM_SIZE);
+    TEST_ASSERT_EQUAL(*(uint32_t *)received_item, 0x123);
+
+    // Return the space to the buffer after receiving the item
+    vRingbufferReturnItem(buffer_handle, received_item);
+
+    // At this point, the buffer should be empty
+    UBaseType_t items_waiting;
+    vRingbufferGetInfo(buffer_handle, NULL, NULL, NULL, NULL, &items_waiting);
+    TEST_ASSERT_MESSAGE(items_waiting == 0, "Incorrect items waiting");
+
+    // Acquire space on the buffer until the buffer is full
+#define MAX_NUM_ITEMS ( BUFFER_SIZE / ( MEDIUM_ITEM_SIZE + ITEM_HDR_SIZE ) )
+    void *items[MAX_NUM_ITEMS];
+    for (int i = 0; i < MAX_NUM_ITEMS; i++) {
+        TEST_ASSERT_EQUAL(pdTRUE, xRingbufferSendAcquire(buffer_handle, &items[i], MEDIUM_ITEM_SIZE, TIMEOUT_TICKS));
+        TEST_ASSERT_NOT_NULL(items[i]);
+        *(uint32_t *)items[i] = (0x100 + i);
+    }
+
+    // Verify that the buffer is full by attempting to acquire space for another item
+    void *another_item;
+    TEST_ASSERT_EQUAL(pdFALSE, xRingbufferSendAcquire(buffer_handle, &another_item, MEDIUM_ITEM_SIZE, TIMEOUT_TICKS));
+
+    // Send the items out-of-order to the buffer. Verify that the items are not received until the first item is sent.
+    // In this case, we send the items in the reverse order until the first item is sent.
+    for (int i = MAX_NUM_ITEMS - 1; i > 0; i--) {
+        TEST_ASSERT_EQUAL(pdTRUE, xRingbufferSendComplete(buffer_handle, items[i]));
+        TEST_ASSERT_NULL(xRingbufferReceive(buffer_handle, &item_size, 0));
+    }
+
+    // Send the first item
+    TEST_ASSERT_EQUAL(pdTRUE, xRingbufferSendComplete(buffer_handle, items[0]));
+
+    // Verify that the items are received in the correct order
+    for (int i = 0; i < MAX_NUM_ITEMS; i++) {
+        received_item = xRingbufferReceive(buffer_handle, &item_size, TIMEOUT_TICKS);
+        TEST_ASSERT_EQUAL(*(uint32_t *)received_item, (0x100 + i));
+        vRingbufferReturnItem(buffer_handle, received_item);
+    }
+
+    // Cleanup
+    vRingbufferDelete(buffer_handle);
+}

components/esp_rom/CMakeLists.txt

@@ -225,6 +225,10 @@ else() # Regular app build
 
         if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
             rom_linker_script("mbedtls")
+            # For ESP32C2(ECO4), mbedTLS in ROM has been updated to v3.6.0-LTS
+            if(CONFIG_ESP32C2_REV_MIN_FULL GREATER_EQUAL 200)
+                rom_linker_script("mbedtls.eco4")
+            endif()
         endif()
 
         if(CONFIG_NEWLIB_NANO_FORMAT)
@@ -232,6 +236,10 @@ else() # Regular app build
             rom_linker_script("newlib-nano")
         endif()
 
+        if(CONFIG_ESP32C2_REV_MIN_FULL GREATER_EQUAL 200)
+            rom_linker_script("eco4")
+        endif()
+
     elseif(target STREQUAL "esp32c6")
         rom_linker_script("newlib")
         rom_linker_script("version")

components/esp_rom/esp32c2/ld/esp32c2.rom.ld

@@ -1570,8 +1570,8 @@ rcSetTxAmpduLimit = 0x40001c90;
 /* rcTxUpdatePer = 0x40001c94;*/
 rcUpdateAckSnr = 0x40001c98;
 /*rcUpdateRate = 0x40001c9c;*/
-rcUpdateTxDone = 0x40001ca0;
-rcUpdateTxDoneAmpdu2 = 0x40001ca4;
+/*rcUpdateTxDone = 0x40001ca0;*/
+/*rcUpdateTxDoneAmpdu2 = 0x40001ca4;*/
 rcUpSched = 0x40001ca8;
 rssi_margin = 0x40001cac;
 rx11NRate2AMPDULimit = 0x40001cb0;

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.eco4.ld

@@ -0,0 +1,221 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/***************************************
+ Group eco4_rom_mbedtls
+ ***************************************/
+
+/* Functions */
+mbedtls_mpi_init = 0x400026dc;
+mbedtls_mpi_free = 0x400026e0;
+mbedtls_mpi_grow = 0x400026e4;
+mbedtls_mpi_shrink = 0x400026e8;
+mbedtls_mpi_copy = 0x400026ec;
+mbedtls_mpi_safe_cond_assign = 0x400026f0;
+mbedtls_mpi_safe_cond_swap = 0x400026f4;
+mbedtls_mpi_lset = 0x400026f8;
+mbedtls_mpi_get_bit = 0x400026fc;
+mbedtls_mpi_set_bit = 0x40002700;
+mbedtls_mpi_lsb = 0x40002704;
+mbedtls_mpi_bitlen = 0x40002708;
+mbedtls_mpi_size = 0x4000270c;
+mbedtls_mpi_read_binary = 0x40002710;
+mbedtls_mpi_write_binary = 0x40002714;
+mbedtls_mpi_shift_l = 0x40002718;
+mbedtls_mpi_shift_r = 0x4000271c;
+mbedtls_mpi_cmp_abs = 0x40002720;
+mbedtls_mpi_cmp_mpi = 0x40002724;
+mbedtls_mpi_lt_mpi_ct = 0x40002728;
+mbedtls_mpi_cmp_int = 0x4000272c;
+mbedtls_mpi_add_abs = 0x40002730;
+mbedtls_mpi_sub_abs = 0x40002734;
+mbedtls_mpi_add_mpi = 0x40002738;
+mbedtls_mpi_sub_mpi = 0x4000273c;
+mbedtls_mpi_add_int = 0x40002740;
+mbedtls_mpi_sub_int = 0x40002744;
+mbedtls_mpi_mul_mpi = 0x40002748;
+mbedtls_mpi_mul_int = 0x4000274c;
+mbedtls_mpi_div_mpi = 0x40002750;
+mbedtls_mpi_div_int = 0x40002754;
+mbedtls_mpi_mod_mpi = 0x40002758;
+mbedtls_mpi_mod_int = 0x4000275c;
+mbedtls_mpi_exp_mod = 0x40002760;
+mbedtls_mpi_fill_random = 0x40002764;
+mbedtls_mpi_gcd = 0x40002768;
+mbedtls_mpi_inv_mod = 0x4000276c;
+mbedtls_mpi_is_prime_ext = 0x40002770;
+
+/***************************************
+ Group eco4_rom_mbedtls
+ ***************************************/
+
+/* Functions */
+rom_mbedtls_threading_set_alt = 0x40002c0c;
+mbedtls_aes_crypt_cfb8 = 0x40002c10;
+mbedtls_mpi_swap = 0x40002c14;
+mbedtls_mpi_read_string = 0x40002c18;
+mbedtls_mpi_write_string = 0x40002c1c;
+mbedtls_mpi_read_binary_le = 0x40002c20;
+mbedtls_mpi_write_binary_le = 0x40002c24;
+mbedtls_mpi_random = 0x40002c28;
+mbedtls_mpi_gen_prime = 0x40002c2c;
+mbedtls_ecp_check_budget = 0x40002c30;
+mbedtls_ecp_set_max_ops = 0x40002c34;
+mbedtls_ecp_restart_is_enabled = 0x40002c38;
+mbedtls_ecp_get_type = 0x40002c3c;
+mbedtls_ecp_curve_list = 0x40002c40;
+mbedtls_ecp_grp_id_list = 0x40002c44;
+mbedtls_ecp_curve_info_from_grp_id = 0x40002c48;
+mbedtls_ecp_curve_info_from_tls_id = 0x40002c4c;
+mbedtls_ecp_curve_info_from_name = 0x40002c50;
+mbedtls_ecp_point_init = 0x40002c54;
+mbedtls_ecp_group_init = 0x40002c58;
+mbedtls_ecp_keypair_init = 0x40002c5c;
+mbedtls_ecp_point_free = 0x40002c60;
+mbedtls_ecp_group_free = 0x40002c64;
+mbedtls_ecp_keypair_free = 0x40002c68;
+mbedtls_ecp_restart_init = 0x40002c6c;
+mbedtls_ecp_restart_free = 0x40002c70;
+mbedtls_ecp_copy = 0x40002c74;
+mbedtls_ecp_group_copy = 0x40002c78;
+mbedtls_ecp_set_zero = 0x40002c7c;
+mbedtls_ecp_is_zero = 0x40002c80;
+mbedtls_ecp_point_cmp = 0x40002c84;
+mbedtls_ecp_point_read_string = 0x40002c88;
+mbedtls_ecp_point_write_binary = 0x40002c8c;
+mbedtls_ecp_point_read_binary = 0x40002c90;
+mbedtls_ecp_tls_read_point = 0x40002c94;
+mbedtls_ecp_tls_write_point = 0x40002c98;
+mbedtls_ecp_group_load = 0x40002c9c;
+mbedtls_ecp_tls_read_group = 0x40002ca0;
+mbedtls_ecp_tls_read_group_id = 0x40002ca4;
+mbedtls_ecp_tls_write_group = 0x40002ca8;
+mbedtls_ecp_mul = 0x40002cac;
+mbedtls_ecp_mul_restartable = 0x40002cb0;
+mbedtls_ecp_muladd = 0x40002cb4;
+mbedtls_ecp_muladd_restartable = 0x40002cb8;
+mbedtls_ecp_check_pubkey = 0x40002cbc;
+mbedtls_ecp_check_privkey = 0x40002cc0;
+mbedtls_ecp_gen_privkey = 0x40002cc4;
+mbedtls_ecp_gen_keypair_base = 0x40002cc8;
+mbedtls_ecp_gen_keypair = 0x40002ccc;
+mbedtls_ecp_gen_key = 0x40002cd0;
+mbedtls_ecp_read_key = 0x40002cd4;
+mbedtls_ecp_write_key_ext = 0x40002cd8;
+mbedtls_ecp_check_pub_priv = 0x40002cdc;
+mbedtls_ecp_export = 0x40002ce0;
+mbedtls_asn1_get_enum = 0x40002ce4;
+mbedtls_asn1_sequence_free = 0x40002ce8;
+mbedtls_asn1_traverse_sequence_of = 0x40002cec;
+mbedtls_asn1_find_named_data = 0x40002cf0;
+mbedtls_asn1_free_named_data_list = 0x40002cf4;
+mbedtls_asn1_free_named_data_list_shallow = 0x40002cf8;
+mbedtls_asn1_write_raw_buffer = 0x40002cfc;
+mbedtls_asn1_write_null = 0x40002d00;
+mbedtls_asn1_write_oid = 0x40002d04;
+mbedtls_asn1_write_algorithm_identifier = 0x40002d08;
+mbedtls_asn1_write_bool = 0x40002d0c;
+mbedtls_asn1_write_int = 0x40002d10;
+mbedtls_asn1_write_enum = 0x40002d14;
+mbedtls_asn1_write_tagged_string = 0x40002d18;
+mbedtls_asn1_write_printable_string = 0x40002d1c;
+mbedtls_asn1_write_utf8_string = 0x40002d20;
+mbedtls_asn1_write_ia5_string = 0x40002d24;
+mbedtls_asn1_write_bitstring = 0x40002d28;
+mbedtls_asn1_write_named_bitstring = 0x40002d2c;
+mbedtls_asn1_write_octet_string = 0x40002d30;
+mbedtls_asn1_store_named_data = 0x40002d34;
+mbedtls_ccm_starts = 0x40002d38;
+mbedtls_ccm_set_lengths = 0x40002d3c;
+mbedtls_ccm_update_ad = 0x40002d40;
+mbedtls_ccm_update = 0x40002d44;
+mbedtls_ccm_finish = 0x40002d48;
+mbedtls_cipher_list = 0x40002d4c;
+mbedtls_cipher_info_from_string = 0x40002d50;
+mbedtls_cipher_info_from_type = 0x40002d54;
+mbedtls_cipher_info_from_values = 0x40002d58;
+mbedtls_cipher_free = 0x40002d5c;
+mbedtls_cipher_setup = 0x40002d60;
+mbedtls_cipher_setkey = 0x40002d64;
+mbedtls_cipher_set_iv = 0x40002d68;
+mbedtls_cipher_update_ad = 0x40002d6c;
+mbedtls_cipher_update = 0x40002d70;
+mbedtls_cipher_write_tag = 0x40002d74;
+mbedtls_cipher_check_tag = 0x40002d78;
+mbedtls_cipher_auth_encrypt_ext = 0x40002d7c;
+mbedtls_cipher_auth_decrypt_ext = 0x40002d80;
+mbedtls_cipher_cmac_reset = 0x40002d84;
+mbedtls_cipher_cmac = 0x40002d88;
+mbedtls_aes_cmac_prf_128 = 0x40002d8c;
+mbedtls_ctr_drbg_set_prediction_resistance = 0x40002d90;
+mbedtls_ctr_drbg_set_entropy_len = 0x40002d94;
+mbedtls_ctr_drbg_set_nonce_len = 0x40002d98;
+mbedtls_ctr_drbg_set_reseed_interval = 0x40002d9c;
+mbedtls_ctr_drbg_update = 0x40002da0;
+mbedtls_base64_encode = 0x40002da4;
+mbedtls_rsa_init = 0x40002da8;
+mbedtls_rsa_set_padding = 0x40002dac;
+mbedtls_rsa_get_padding_mode = 0x40002db0;
+mbedtls_rsa_get_md_alg = 0x40002db4;
+mbedtls_rsa_import = 0x40002db8;
+mbedtls_rsa_import_raw = 0x40002dbc;
+mbedtls_rsa_complete = 0x40002dc0;
+mbedtls_rsa_export = 0x40002dc4;
+mbedtls_rsa_export_raw = 0x40002dc8;
+mbedtls_rsa_export_crt = 0x40002dcc;
+mbedtls_rsa_get_len = 0x40002dd0;
+mbedtls_rsa_gen_key = 0x40002dd4;
+mbedtls_rsa_check_pubkey = 0x40002dd8;
+mbedtls_rsa_check_privkey = 0x40002ddc;
+mbedtls_rsa_check_pub_priv = 0x40002de0;
+mbedtls_rsa_public = 0x40002de4;
+mbedtls_rsa_private = 0x40002de8;
+mbedtls_rsa_pkcs1_encrypt = 0x40002dec;
+mbedtls_rsa_rsaes_pkcs1_v15_encrypt = 0x40002df0;
+mbedtls_rsa_rsaes_oaep_encrypt = 0x40002df4;
+mbedtls_rsa_pkcs1_decrypt = 0x40002df8;
+mbedtls_rsa_rsaes_pkcs1_v15_decrypt = 0x40002dfc;
+mbedtls_rsa_rsaes_oaep_decrypt = 0x40002e00;
+mbedtls_rsa_pkcs1_sign = 0x40002e04;
+mbedtls_rsa_rsassa_pkcs1_v15_sign = 0x40002e08;
+mbedtls_rsa_rsassa_pss_sign_ext = 0x40002e0c;
+mbedtls_rsa_rsassa_pss_sign = 0x40002e10;
+mbedtls_rsa_pkcs1_verify = 0x40002e14;
+mbedtls_rsa_rsassa_pkcs1_v15_verify = 0x40002e18;
+mbedtls_rsa_rsassa_pss_verify = 0x40002e1c;
+mbedtls_rsa_rsassa_pss_verify_ext = 0x40002e20;
+mbedtls_rsa_copy = 0x40002e24;
+mbedtls_rsa_free = 0x40002e28;
+mbedtls_ecdh_can_do = 0x40002e2c;
+mbedtls_ecdh_gen_public = 0x40002e30;
+mbedtls_ecdh_compute_shared = 0x40002e34;
+mbedtls_ecdh_init = 0x40002e38;
+mbedtls_ecdh_setup = 0x40002e3c;
+mbedtls_ecdh_free = 0x40002e40;
+mbedtls_ecdh_make_params = 0x40002e44;
+mbedtls_ecdh_read_params = 0x40002e48;
+mbedtls_ecdh_get_params = 0x40002e4c;
+mbedtls_ecdh_make_public = 0x40002e50;
+mbedtls_ecdh_read_public = 0x40002e54;
+mbedtls_ecdh_calc_secret = 0x40002e58;
+mbedtls_ecdh_enable_restart = 0x40002e5c;
+mbedtls_ecdsa_can_do = 0x40002e60;
+mbedtls_ecdsa_sign = 0x40002e64;
+mbedtls_ecdsa_sign_det_ext = 0x40002e68;
+mbedtls_ecdsa_sign_restartable = 0x40002e6c;
+mbedtls_ecdsa_sign_det_restartable = 0x40002e70;
+mbedtls_ecdsa_verify = 0x40002e74;
+mbedtls_ecdsa_verify_restartable = 0x40002e78;
+mbedtls_ecdsa_write_signature = 0x40002e7c;
+mbedtls_ecdsa_write_signature_restartable = 0x40002e80;
+mbedtls_ecdsa_read_signature = 0x40002e84;
+mbedtls_ecdsa_read_signature_restartable = 0x40002e88;
+mbedtls_ecdsa_genkey = 0x40002e8c;
+mbedtls_ecdsa_from_keypair = 0x40002e90;
+mbedtls_ecdsa_init = 0x40002e94;
+mbedtls_ecdsa_free = 0x40002e98;
+mbedtls_ecdsa_restart_init = 0x40002e9c;
+mbedtls_ecdsa_restart_free = 0x40002ea0;

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.ld

@@ -74,7 +74,7 @@ mbedtls_sha512_clone = 0x40002a50;
 mbedtls_sha512_starts = 0x40002a54;
 mbedtls_sha512_update = 0x40002a58;
 mbedtls_sha512_finish = 0x40002a5c;
-mbedtls_internal_sha512_process = 0x40002a60;
+/*mbedtls_internal_sha512_process = 0x40002a60;*/
 mbedtls_sha512 = 0x40002a64;
 mbedtls_aes_xts_init = 0x40002b68;
 mbedtls_aes_xts_free = 0x40002b6c;
@@ -95,7 +95,7 @@ mbedtls_md5_clone = 0x40002be0;
 mbedtls_md5_starts = 0x40002be4;
 mbedtls_md5_update = 0x40002be8;
 mbedtls_md5_finish = 0x40002bec;
-mbedtls_internal_md5_process = 0x40002bf0;
+/*mbedtls_internal_md5_process = 0x40002bf0;*/
 mbedtls_md5 = 0x40002bf4;
 mbedtls_sha1 = 0x40002c08;
 /* Data (.data, .bss, .rodata) */

components/esp_rom/esp32c3/ld/esp32c3.rom.eco7.ld

@@ -27,7 +27,7 @@ ppProcTxSecFrame = 0x400016dc;
 /*ppRxFragmentProc = 0x40001704;*/
 /* rcGetSched = 0x40001764;*/
 rcTxUpdatePer = 0x40001770;
-rcUpdateTxDone = 0x4000177c;
+/*rcUpdateTxDone = 0x4000177c;*/
 wDevCheckBlockError = 0x400017b4;
 /* wDev_IndicateFrame = 0x400017c8;*/
 wDev_ProcessFiq = 0x400017f0;

components/esp_rom/esp32c3/ld/esp32c3.rom.ld

@@ -1609,7 +1609,7 @@ rcSetTxAmpduLimit = 0x4000176c;
 rcUpdateAckSnr = 0x40001774;
 /*rcUpdateRate = 0x40001778;*/
 /* rcUpdateTxDone = 0x4000177c; */
-rcUpdateTxDoneAmpdu2 = 0x40001780;
+/*rcUpdateTxDoneAmpdu2 = 0x40001780;*/
 rcUpSched = 0x40001784;
 rssi_margin = 0x40001788;
 rx11NRate2AMPDULimit = 0x4000178c;

components/esp_rom/esp32c6/ld/esp32c6.rom.pp.ld

@@ -130,8 +130,8 @@ rcSetTxAmpduLimit = 0x40000d88;
 rcTxUpdatePer = 0x40000d8c;
 rcUpdateAckSnr = 0x40000d90;
 /*rcUpdateRate = 0x40000d94;*/
-rcUpdateTxDone = 0x40000d98;
-rcUpdateTxDoneAmpdu2 = 0x40000d9c;
+/*rcUpdateTxDone = 0x40000d98;*/
+/*rcUpdateTxDoneAmpdu2 = 0x40000d9c;*/
 rcUpSched = 0x40000da0;
 rssi_margin = 0x40000da4;
 rx11NRate2AMPDULimit = 0x40000da8;

components/esp_rom/esp32s3/ld/esp32s3.rom.ld

@@ -1913,7 +1913,7 @@ rcSetTxAmpduLimit = 0x40005784;
 rcUpdateAckSnr = 0x4000579c;
 /*rcUpdateRate = 0x400057a8;*/
 /* rcUpdateTxDone = 0x400057b4; */
-rcUpdateTxDoneAmpdu2 = 0x400057c0;
+/*rcUpdateTxDoneAmpdu2 = 0x400057c0;*/
 rcUpSched = 0x400057cc;
 rssi_margin = 0x400057d8;
 rx11NRate2AMPDULimit = 0x400057e4;

components/esp_rom/patches/esp_rom_systimer.c

@@ -11,7 +11,7 @@
 
 #if CONFIG_HAL_SYSTIMER_USE_ROM_IMPL
 
-#if CONFIG_IDF_TARGET_ESP32C2
+#if CONFIG_IDF_TARGET_ESP32C2 && (CONFIG_ESP32C2_REV_MIN_FULL < 200)
 void systimer_hal_init(systimer_hal_context_t *hal)
 {
     hal->dev = &SYSTIMER;
@@ -62,7 +62,7 @@ void systimer_hal_counter_value_advance(systimer_hal_context_t *hal, uint32_t co
     systimer_ll_set_counter_value(hal->dev, counter_id, new_count.val);
     systimer_ll_apply_counter_value(hal->dev, counter_id);
 }
-#endif // CONFIG_IDF_TARGET_ESP32C2
+#endif // CONFIG_IDF_TARGET_ESP32C2 && (CONFIG_ESP32C2_REV_MIN_FULL < 200)
 
 #if CONFIG_IDF_TARGET_ESP32C6 || CONFIG_IDF_TARGET_ESP32H2
 void systimer_hal_init(systimer_hal_context_t *hal)

components/esp_system/fpga_overrides.c

@@ -64,14 +64,18 @@ void IRAM_ATTR bootloader_fill_random(void *buffer, size_t length)
     }
 }
 
-void esp_clk_init(void)
+void esp_rtc_init(void)
 {
-    s_warn();
 #if SOC_PMU_SUPPORTED
     pmu_init();
 #endif
 }
 
+void esp_clk_init(void)
+{
+    s_warn();
+}
+
 void esp_perip_clk_init(void)
 {
 

components/esp_system/port/cpu_start.c

@@ -259,6 +259,17 @@ static void start_other_core(void)
     }
 }
 
+#if CONFIG_IDF_TARGET_ESP32
+static void restore_app_mmu_from_pro_mmu(void)
+{
+    const int mmu_reg_num = 2048;
+    volatile uint32_t* from = (uint32_t*)DR_REG_FLASH_MMU_TABLE_PRO;
+    volatile uint32_t* to = (uint32_t*)DR_REG_FLASH_MMU_TABLE_APP;
+    for (int i = 0; i < mmu_reg_num; i++) {
+        *(to++) = *(from++);
+    }
+}
+#endif
 // This function is needed to make the multicore app runnable on a unicore bootloader (built with FREERTOS UNICORE).
 // It does some cache settings for other CPUs.
 void IRAM_ATTR do_multicore_settings(void)
@@ -270,9 +281,11 @@ void IRAM_ATTR do_multicore_settings(void)
         Cache_Read_Disable(1);
         Cache_Flush(1);
         DPORT_REG_SET_BIT(DPORT_APP_CACHE_CTRL1_REG, DPORT_APP_CACHE_MMU_IA_CLR);
+        mmu_init(1);
         DPORT_REG_CLR_BIT(DPORT_APP_CACHE_CTRL1_REG, DPORT_APP_CACHE_MMU_IA_CLR);
         // We do not enable cache for CPU1 now because it will be done later in start_other_core().
     }
+    restore_app_mmu_from_pro_mmu();
 #endif
 
     cache_bus_mask_t cache_bus_mask_core0 = cache_ll_l1_get_enabled_bus(0);
@@ -444,6 +457,10 @@ void IRAM_ATTR call_start_cpu0(void)
     // For Octal flash, it's hard to implement a read_id function in OPI mode for all vendors.
     // So we have to read it here in SPI mode, before entering the OPI mode.
     bootloader_flash_update_id();
+
+    // Configure the power related stuff. After this the MSPI timing tuning can be done.
+    esp_rtc_init();
+
     /**
      * This function initialise the Flash chip to the user-defined settings.
      *
@@ -452,14 +469,9 @@ void IRAM_ATTR call_start_cpu0(void)
      * In this stage, we re-configure the Flash (and MSPI) to required configuration
      */
     spi_flash_init_chip_state();
-
-    // In earlier version of ESP-IDF, the PLL provided by bootloader is not stable enough.
-    // Do calibration again here so that we can use better clock for the timing tuning.
-#if CONFIG_ESP_SYSTEM_BBPLL_RECALIB
-    rtc_clk_recalib_bbpll();
-#endif
 #if SOC_MEMSPI_SRC_FREQ_120M
-    // This function needs to be called when PLL is enabled
+    // This function needs to be called when PLL is enabled. Needs to be called after spi_flash_init_chip_state in case
+    // some state of flash is modified.
     mspi_timing_flash_tuning();
 #endif
 

components/esp_system/port/include/esp_clk_internal.h

@@ -18,6 +18,15 @@ extern "C" {
  * Private clock-related functions
  */
 
+/**
+ * @brief Initialize rtc-related settings
+ *
+ * Called from cpu_start.c, not intended to be called from other places.
+ * This function configures the power related stuff.
+ * After this the MSPI timing tuning can be done.
+ */
+void esp_rtc_init(void);
+
 /**
  * @brief Initialize clock-related settings
  *

components/esp_system/port/soc/esp32/clk.c

@@ -106,11 +106,14 @@ static void select_rtc_slow_clk(slow_clk_sel_t slow_clk)
     esp_clk_slowclk_cal_set(cal_val);
 }
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
     rtc_config_t cfg = RTC_CONFIG_DEFAULT();
     rtc_init(cfg);
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
 #if (CONFIG_APP_COMPATIBLE_PRE_V2_1_BOOTLOADERS || CONFIG_APP_INIT_CLK)
     /* Check the bootloader set the XTAL frequency.
 

components/esp_system/port/soc/esp32c2/clk.c

@@ -51,12 +51,19 @@ typedef enum {
 } slow_clk_sel_t;
 
 static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
+static __attribute__((unused)) void recalib_bbpll(void);
 
 static const char *TAG = "clk";
 
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
+#if CONFIG_ESP_SYSTEM_BBPLL_RECALIB
+    // In earlier version of ESP-IDF, the PLL provided by bootloader is not stable enough.
+    // Do calibration again here so that we can use better clock for the timing tuning.
+    recalib_bbpll();
+#endif
+
 #if !CONFIG_IDF_ENV_FPGA
     rtc_config_t cfg = RTC_CONFIG_DEFAULT();
     soc_reset_reason_t rst_reas;
@@ -65,7 +72,12 @@ static const char *TAG = "clk";
         cfg.cali_ocode = 1;
     }
     rtc_init(cfg);
+#endif
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
+#if !CONFIG_IDF_ENV_FPGA
 #ifndef CONFIG_XTAL_FREQ_AUTO
     assert(rtc_clk_xtal_freq_get() == CONFIG_XTAL_FREQ);
 #endif
@@ -266,3 +278,21 @@ __attribute__((weak)) void esp_perip_clk_init(void)
      */
     periph_module_enable(PERIPH_TIMG0_MODULE);
 }
+
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+static void IRAM_ATTR NOINLINE_ATTR recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}

components/esp_system/port/soc/esp32c3/clk.c

@@ -56,7 +56,7 @@ static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
 static const char *TAG = "clk";
 
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
 #if !CONFIG_IDF_ENV_FPGA
     rtc_config_t cfg = RTC_CONFIG_DEFAULT();
@@ -70,7 +70,10 @@ static const char *TAG = "clk";
         cfg.cali_ocode = 1;
     }
     rtc_init(cfg);
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
     assert(rtc_clk_xtal_freq_get() == RTC_XTAL_FREQ_40M);
 
     bool rc_fast_d256_is_enabled = rtc_clk_8md256_enabled();

components/esp_system/port/soc/esp32c6/clk.c

@@ -37,18 +37,30 @@
 #define MHZ (1000000)
 
 static void select_rtc_slow_clk(soc_rtc_slow_clk_src_t rtc_slow_clk_src);
+static __attribute__((unused)) void recalib_bbpll(void);
 
 static const char *TAG = "clk";
 
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
+#if CONFIG_ESP_SYSTEM_BBPLL_RECALIB
+    // In earlier version of ESP-IDF, the PLL provided by bootloader is not stable enough.
+    // Do calibration again here so that we can use better clock for the timing tuning.
+    recalib_bbpll();
+#endif
+
 #if !CONFIG_IDF_ENV_FPGA
     pmu_init();
     if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON) {
         esp_ocode_calib_init();
     }
+#endif
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
+#if !CONFIG_IDF_ENV_FPGA
     assert(rtc_clk_xtal_freq_get() == RTC_XTAL_FREQ_40M);
 
     rtc_clk_8m_enable(true);
@@ -302,3 +314,21 @@ __attribute__((weak)) void esp_perip_clk_init(void)
      */
     periph_module_enable(PERIPH_TIMG0_MODULE);
 }
+
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+static void IRAM_ATTR NOINLINE_ATTR recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}

components/esp_system/port/soc/esp32h2/clk.c

@@ -37,15 +37,27 @@
 #define MHZ (1000000)
 
 static void select_rtc_slow_clk(soc_rtc_slow_clk_src_t rtc_slow_clk_src);
+static __attribute__((unused)) void recalib_bbpll(void);
 
 static const char *TAG = "clk";
 
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
+#if CONFIG_ESP_SYSTEM_BBPLL_RECALIB
+    // In earlier version of ESP-IDF, the PLL provided by bootloader is not stable enough.
+    // Do calibration again here so that we can use better clock for the timing tuning.
+    recalib_bbpll();
+#endif
+
 #if !CONFIG_IDF_ENV_FPGA
     pmu_init();
+#endif
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
+#if !CONFIG_IDF_ENV_FPGA
     assert(rtc_clk_xtal_freq_get() == RTC_XTAL_FREQ_32M);
 
     rtc_clk_8m_enable(true);
@@ -296,3 +308,21 @@ __attribute__((weak)) void esp_perip_clk_init(void)
      */
     periph_module_enable(PERIPH_TIMG0_MODULE);
 }
+
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+static void IRAM_ATTR NOINLINE_ATTR recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue. Flash_PLL comes from the same source as PLL.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL || old_config.source == SOC_CPU_CLK_SRC_FLASH_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}

components/esp_system/port/soc/esp32s2/clk.c

@@ -60,7 +60,7 @@ typedef enum {
 
 static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
     rtc_config_t cfg = RTC_CONFIG_DEFAULT();
     soc_reset_reason_t rst_reas = esp_rom_get_reset_reason(0);
@@ -74,7 +74,10 @@ static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
         }
     }
     rtc_init(cfg);
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
     bool rc_fast_d256_is_enabled = rtc_clk_8md256_enabled();
     rtc_clk_8m_enable(true, rc_fast_d256_is_enabled);
     rtc_clk_fast_src_set(SOC_RTC_FAST_CLK_SRC_RC_FAST);

components/esp_system/port/soc/esp32s3/clk.c

@@ -53,9 +53,16 @@ typedef enum {
 } slow_clk_sel_t;
 
 static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
+static __attribute__((unused)) void recalib_bbpll(void);
 
- __attribute__((weak)) void esp_clk_init(void)
+void esp_rtc_init(void)
 {
+#if CONFIG_ESP_SYSTEM_BBPLL_RECALIB
+    // In earlier version of ESP-IDF, the PLL provided by bootloader is not stable enough.
+    // Do calibration again here so that we can use better clock for the timing tuning.
+    recalib_bbpll();
+#endif
+
     rtc_config_t cfg = RTC_CONFIG_DEFAULT();
     soc_reset_reason_t rst_reas;
     rst_reas = esp_rom_get_reset_reason(0);
@@ -64,7 +71,10 @@ static void select_rtc_slow_clk(slow_clk_sel_t slow_clk);
         cfg.cali_ocode = 1;
     }
     rtc_init(cfg);
+}
 
+__attribute__((weak)) void esp_clk_init(void)
+{
     assert(rtc_clk_xtal_freq_get() == RTC_XTAL_FREQ_40M);
 
     bool rc_fast_d256_is_enabled = rtc_clk_8md256_enabled();
@@ -324,3 +334,21 @@ __attribute__((weak)) void esp_perip_clk_init(void)
      */
     periph_module_enable(PERIPH_TIMG0_MODULE);
 }
+
+// Workaround for bootloader not calibrated well issue.
+// Placed in IRAM because disabling BBPLL may influence the cache
+static void IRAM_ATTR NOINLINE_ATTR recalib_bbpll(void)
+{
+    rtc_cpu_freq_config_t old_config;
+    rtc_clk_cpu_freq_get_config(&old_config);
+
+    // There are two paths we arrive here: 1. CPU reset. 2. Other reset reasons.
+    // - For other reasons, the bootloader will set CPU source to BBPLL and enable it. But there are calibration issues.
+    //   Turn off the BBPLL and do calibration again to fix the issue.
+    // - For CPU reset, the CPU source will be set to XTAL, while the BBPLL is kept to meet USB Serial JTAG's
+    //   requirements. In this case, we don't touch BBPLL to avoid USJ disconnection.
+    if (old_config.source == SOC_CPU_CLK_SRC_PLL) {
+        rtc_clk_cpu_freq_set_xtal();
+        rtc_clk_cpu_freq_set_config(&old_config);
+    }
+}

components/esp_wifi/Kconfig

@@ -249,7 +249,10 @@ menu "Wi-Fi"
         range 6 32
         default 32
         help
-            Set the number of WiFi management short buffer.
+            Set the maximum number of Wi-Fi management short buffers. These buffers are dynamically allocated,
+            with their size determined by the length of the management packet to be sent. When a management
+            packet is less than 64 bytes, the Wi-Fi driver classifies it as a short management packet and
+            assigns it to one of these buffers.
 
     config ESP_WIFI_IRAM_OPT
         bool "WiFi IRAM speed optimization"

components/esp_wifi/include/esp_wifi_types.h

@@ -884,6 +884,7 @@ typedef enum {
     WIFI_EVENT_STA_BEACON_TIMEOUT,       /**< Station beacon timeout */
 
     WIFI_EVENT_CONNECTIONLESS_MODULE_WAKE_INTERVAL_START,   /**< Connectionless module wake interval start */
+    /* Add next events after this only */
 
     WIFI_EVENT_AP_WPS_RG_SUCCESS,       /**< Soft-AP wps succeeds in registrar mode */
     WIFI_EVENT_AP_WPS_RG_FAILED,        /**< Soft-AP wps fails in registrar mode */

components/esp_wifi/lib

@@ -1 +1 @@
-Subproject commit f02e216eb868abbfde5fd564a956ec08483946ce
+Subproject commit b6a8a3e02f0b6386916a82d97a3b7bece68d301a

components/esp_wifi/src/wifi_init.c

@@ -579,3 +579,19 @@ void nan_sm_handle_event(void *p1, int p2)
 }
 
 #endif
+
+#if CONFIG_IDF_TARGET_ESP32C2
+#if CONFIG_ESP32C2_REV_MIN_FULL < 200
+void esp32c2_eco4_rom_ptr_init(void)
+{
+    /* Do not remove, stub to overwrite weak link in Wi-Fi Lib */
+}
+#endif
+#endif
+
+#ifndef CONFIG_ESP_WIFI_SLP_SAMPLE_BEACON_FEATURE
+void pm_beacon_offset_funcs_init(void)
+{
+    /* Do not remove, stub to overwrite weak link in Wi-Fi Lib */
+}
+#endif

components/esptool_py/CMakeLists.txt

@@ -60,10 +60,19 @@ consist of two ota app without factory or test partitions.")
 endif()  # NOT BOOTLOADER_BUILD
 
 if(BOOTLOADER_BUILD)
-  # Generate bootloader post-build check of the bootloader size against the offset
-  partition_table_add_check_bootloader_size_target(bootloader_check_size
-      DEPENDS gen_project_binary
-      BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
-      RESULT bootloader_check_size_command)
-  add_dependencies(app bootloader_check_size)  # note: in the subproject, so the target is 'app'...
+    # Generate bootloader post-build check of the bootloader size against the offset
+    partition_table_add_check_bootloader_size_target(bootloader_check_size
+        DEPENDS gen_project_binary
+        BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
+        RESULT bootloader_check_size_command)
+    add_dependencies(app bootloader_check_size)  # note: in the subproject, so the target is 'app'...
+
+    if(CONFIG_SECURE_BOOT_V2_ENABLED AND CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
+        # Check the size of the bootloader + signature block.
+        partition_table_add_check_bootloader_size_target(bootloader_check_size_signed
+            DEPENDS gen_signed_bootloader
+            BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
+            RESULT bootloader_check_size_signed_command)
+        add_dependencies(app bootloader_check_size_signed)  # note: in the subproject, so the target is 'app'...
+    endif()
 endif()

components/freertos/esp_additions/idf_additions.c

@@ -85,15 +85,44 @@ err:
 
 #if ( configSUPPORT_STATIC_ALLOCATION == 1 )
 
+    static void prvTaskDeleteWithCaps( TaskHandle_t xTaskToDelete )
+    {
+        /* Return value unused if asserts are disabled */
+        BaseType_t __attribute__( ( unused ) ) xResult;
+        StaticTask_t * pxTaskBuffer;
+        StackType_t * puxStackBuffer;
+
+        /* The task to be deleted must not be running.
+         * So we suspend the task before deleting it. */
+        vTaskSuspend( xTaskToDelete );
+
+        /* Wait for the task to be suspended */
+        while( eRunning == eTaskGetState( xTaskToDelete ) )
+        {
+            taskYIELD();
+        }
+
+        configASSERT( eRunning != eTaskGetState( xTaskToDelete ) );
+
+        xResult = xTaskGetStaticBuffers( xTaskToDelete, &puxStackBuffer, &pxTaskBuffer );
+        configASSERT( xResult == pdTRUE );
+        configASSERT( puxStackBuffer != NULL );
+        configASSERT( pxTaskBuffer != NULL );
+
+        /* We can delete the task and free the memory buffers. */
+        vTaskDelete( xTaskToDelete );
+
+        /* Free the memory buffers */
+        heap_caps_free( puxStackBuffer );
+        vPortFree( pxTaskBuffer );
+    }
+
     static void prvTaskDeleteWithCapsTask( void * pvParameters )
     {
         TaskHandle_t xTaskToDelete = ( TaskHandle_t ) pvParameters;
 
-        /* The task to be deleted must not be running */
-        configASSERT( eRunning != eTaskGetState( xTaskToDelete ) );
-
         /* Delete the WithCaps task */
-        vTaskDeleteWithCaps( xTaskToDelete );
+        prvTaskDeleteWithCaps( xTaskToDelete );
 
         /* Delete the temporary clean up task */
         vTaskDelete( NULL );
@@ -102,7 +131,7 @@ err:
     void vTaskDeleteWithCaps( TaskHandle_t xTaskToDelete )
     {
         /* THIS FUNCTION SHOULD NOT BE CALLED FROM AN INTERRUPT CONTEXT. */
-        /*TODO: Update it to use portASSERT_IF_IN_ISR() instead. (IDF-10540) */
+        /* TODO: Update it to use portASSERT_IF_IN_ISR() instead. (IDF-10540) */
         vPortAssertIfInISR();
 
         TaskHandle_t xCurrentTaskHandle = xTaskGetCurrentTaskHandle();
@@ -155,58 +184,8 @@ err:
             }
         }
 
-        #if ( configNUM_CORES > 1 )
-            else if( eRunning == eTaskGetState( xTaskToDelete ) )
-            {
-                /* The WithCaps task is running on another core.
-                 * We suspend the task first and then delete it. */
-                vTaskSuspend( xTaskToDelete );
-
-                /* Wait for the task to be suspended */
-                while( eRunning == eTaskGetState( xTaskToDelete ) )
-                {
-                    portYIELD_WITHIN_API();
-                }
-
-                BaseType_t xResult;
-                StaticTask_t * pxTaskBuffer;
-                StackType_t * puxStackBuffer;
-
-                xResult = xTaskGetStaticBuffers( xTaskToDelete, &puxStackBuffer, &pxTaskBuffer );
-                configASSERT( xResult == pdTRUE );
-                configASSERT( puxStackBuffer != NULL );
-                configASSERT( pxTaskBuffer != NULL );
-
-                /* Delete the task */
-                vTaskDelete( xTaskToDelete );
-
-                /* Free the memory buffers */
-                heap_caps_free( puxStackBuffer );
-                vPortFree( pxTaskBuffer );
-            }
-        #endif /* if ( configNUM_CORES > 1 ) */
-        else
-        {
-            /* The WithCaps task is not running and is being deleted
-             * from another task's context. */
-            configASSERT( eRunning != eTaskGetState( xTaskToDelete ) );
-
-            BaseType_t xResult;
-            StaticTask_t * pxTaskBuffer;
-            StackType_t * puxStackBuffer;
-
-            xResult = xTaskGetStaticBuffers( xTaskToDelete, &puxStackBuffer, &pxTaskBuffer );
-            configASSERT( xResult == pdTRUE );
-            configASSERT( puxStackBuffer != NULL );
-            configASSERT( pxTaskBuffer != NULL );
-
-            /* We can delete the task and free the memory buffers. */
-            vTaskDelete( xTaskToDelete );
-
-            /* Free the memory buffers */
-            heap_caps_free( puxStackBuffer );
-            vPortFree( pxTaskBuffer );
-        } /* if( ( xTaskToDelete == NULL ) || ( xTaskToDelete == xCurrentTaskHandle ) ) */
+        /* Delete the WithCaps task */
+        prvTaskDeleteWithCaps( xTaskToDelete );
     }
 
 /* ---------------------------------- Queue --------------------------------- */
@@ -254,7 +233,8 @@ err:
 
     void vQueueDeleteWithCaps( QueueHandle_t xQueue )
     {
-        BaseType_t xResult;
+        /* Return value unused if asserts are disabled */
+        BaseType_t __attribute__( ( unused ) ) xResult;
         StaticQueue_t * pxQueueBuffer;
         uint8_t * pucQueueStorageBuffer;
 
@@ -316,7 +296,8 @@ err:
 
     void vSemaphoreDeleteWithCaps( SemaphoreHandle_t xSemaphore )
     {
-        BaseType_t xResult;
+        /* Return value unused if asserts are disabled */
+        BaseType_t __attribute__( ( unused ) ) xResult;
         StaticSemaphore_t * pxSemaphoreBuffer;
 
         /* Retrieve the buffer used to create the semaphore before deleting it
@@ -378,7 +359,8 @@ err:
     void vStreamBufferGenericDeleteWithCaps( StreamBufferHandle_t xStreamBuffer,
                                              BaseType_t xIsMessageBuffer )
     {
-        BaseType_t xResult;
+        /* Return value unused if asserts are disabled */
+        BaseType_t __attribute__( ( unused ) ) xResult;
         StaticStreamBuffer_t * pxStaticStreamBuffer;
         uint8_t * pucStreamBufferStorageArea;
 

components/freertos/test_apps/freertos/misc/test_idf_additions.c

@@ -86,6 +86,34 @@ TEST_CASE("IDF additions: Task creation with memory caps and self deletion", "[f
     xTaskNotifyGive(task_handle);
 }
 
+#if CONFIG_SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY
+
+TEST_CASE("IDF additions: Task creation with SPIRAM memory caps and self deletion stress test", "[freertos]")
+{
+#define TEST_NUM_TASKS      5
+#define TEST_NUM_ITERATIONS 1000
+    TaskHandle_t task_handle[TEST_NUM_TASKS];
+    StackType_t *puxStackBuffer;
+    StaticTask_t *pxTaskBuffer;
+
+    for (int j = 0; j < TEST_NUM_ITERATIONS; j++) {
+        for (int i = 0; i < TEST_NUM_TASKS; i++) {
+            // Create a task with caps
+            TEST_ASSERT_EQUAL(pdPASS, xTaskCreateWithCaps(task_with_caps_self_delete, "task", 4096, NULL, UNITY_FREERTOS_PRIORITY, &task_handle[i], MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT));
+            TEST_ASSERT_NOT_EQUAL(NULL, task_handle);
+            // Get the task's memory
+            TEST_ASSERT_EQUAL(pdTRUE, xTaskGetStaticBuffers(task_handle[i], &puxStackBuffer, &pxTaskBuffer));
+        }
+
+        for (int i = 0; i < TEST_NUM_TASKS; i++) {
+            // Notify the task to delete itself
+            xTaskNotifyGive(task_handle[i]);
+        }
+    }
+}
+
+#endif /* CONFIG_SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY */
+
 #if ( CONFIG_FREERTOS_NUMBER_OF_CORES > 1 )
 
 static void task_with_caps_running_on_other_core(void *arg)

components/freertos/test_apps/freertos/sdkconfig.ci.psram

@@ -5,6 +5,7 @@ CONFIG_IDF_TARGET="esp32"
 # Enable SPIRAM
 CONFIG_SPIRAM=y
 CONFIG_SPIRAM_OCCUPY_NO_HOST=y
+CONFIG_SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY=y
 
 # Disable encrypted flash reads/writes to save IRAM in this build configuration
 CONFIG_SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE=n

components/hal/esp32c6/include/hal/gpio_ll.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -91,6 +91,15 @@ static inline void gpio_ll_pullup_en(gpio_dev_t *hw, uint32_t gpio_num)
 __attribute__((always_inline))
 static inline void gpio_ll_pullup_dis(gpio_dev_t *hw, uint32_t gpio_num)
 {
+    // The pull-up value of the USB pins are controlled by the pins’ pull-up value together with USB pull-up value
+    // USB DP pin is default to PU enabled
+    // Note that esp32c6 has supported USB_EXCHG_PINS feature. If this efuse is burnt, the gpio pin
+    // which should be checked is USB_INT_PHY0_DM_GPIO_NUM instead.
+    // TODO: read the specific efuse with efuse_ll.h
+    if (gpio_num == USB_DP_GPIO_NUM) {
+        SET_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_PAD_PULL_OVERRIDE);
+        CLEAR_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_DP_PULLUP);
+    }
     REG_CLR_BIT(IO_MUX_GPIO0_REG + (gpio_num * 4), FUN_PU);
 }
 
@@ -114,15 +123,6 @@ static inline void gpio_ll_pulldown_en(gpio_dev_t *hw, uint32_t gpio_num)
 __attribute__((always_inline))
 static inline void gpio_ll_pulldown_dis(gpio_dev_t *hw, uint32_t gpio_num)
 {
-    // The pull-up value of the USB pins are controlled by the pins’ pull-up value together with USB pull-up value
-    // USB DP pin is default to PU enabled
-    // Note that esp32c6 has supported USB_EXCHG_PINS feature. If this efuse is burnt, the gpio pin
-    // which should be checked is USB_DM_GPIO_NUM instead.
-    // TODO: read the specific efuse with efuse_ll.h
-    if (gpio_num == USB_DP_GPIO_NUM) {
-        SET_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_PAD_PULL_OVERRIDE);
-        CLEAR_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_DP_PULLUP);
-    }
     REG_CLR_BIT(IO_MUX_GPIO0_REG + (gpio_num * 4), FUN_PD);
 }
 

components/hal/esp32h2/include/hal/gpio_ll.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -90,6 +90,15 @@ static inline void gpio_ll_pullup_en(gpio_dev_t *hw, gpio_num_t gpio_num)
 __attribute__((always_inline))
 static inline void gpio_ll_pullup_dis(gpio_dev_t *hw, gpio_num_t gpio_num)
 {
+    // The pull-up value of the USB pins are controlled by the pins’ pull-up value together with USB pull-up value
+    // USB DP pin is default to PU enabled
+    // Note that esp32h2 has supported USB_EXCHG_PINS feature. If this efuse is burnt, the gpio pin
+    // which should be checked is USB_INT_PHY0_DM_GPIO_NUM instead.
+    // TODO: read the specific efuse with efuse_ll.h
+    if (gpio_num == USB_DP_GPIO_NUM) {
+        SET_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_PAD_PULL_OVERRIDE);
+        CLEAR_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_DP_PULLUP);
+    }
     REG_CLR_BIT(IO_MUX_GPIO0_REG + (gpio_num * 4), FUN_PU);
 }
 
@@ -113,15 +122,6 @@ static inline void gpio_ll_pulldown_en(gpio_dev_t *hw, gpio_num_t gpio_num)
 __attribute__((always_inline))
 static inline void gpio_ll_pulldown_dis(gpio_dev_t *hw, gpio_num_t gpio_num)
 {
-    // The pull-up value of the USB pins are controlled by the pins’ pull-up value together with USB pull-up value
-    // USB DP pin is default to PU enabled
-    // Note that esp32h2 has supported USB_EXCHG_PINS feature. If this efuse is burnt, the gpio pin
-    // which should be checked is USB_DM_GPIO_NUM instead.
-    // TODO: read the specific efuse with efuse_ll.h
-    if (gpio_num == USB_DP_GPIO_NUM) {
-        SET_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_PAD_PULL_OVERRIDE);
-        CLEAR_PERI_REG_MASK(USB_SERIAL_JTAG_CONF0_REG, USB_SERIAL_JTAG_DP_PULLUP);
-    }
     REG_CLR_BIT(IO_MUX_GPIO0_REG + (gpio_num * 4), FUN_PD);
 }
 

components/heap/Kconfig

@@ -125,7 +125,7 @@ menu "Heap memory debugging"
 
     config HEAP_TLSF_CHECK_PATCH
         bool "Patch the tlsf_check_pool() for ROM HEAP TLSF implementation"
-        depends on IDF_TARGET_ESP32C2 && ESP32C2_REV_MIN_FULL < 200
+        depends on IDF_TARGET_ESP32C2
         default y
         help
             ROM does not contain the patch of tlsf_check_pool() allowing perform

components/ieee802154/driver/esp_ieee802154_ack.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -17,9 +17,11 @@
 
 static ieee802154_pending_table_t ieee802154_pending_table;
 
-#define BIT_SET(mask, pos) ((mask) |= (1UL << (pos)))
-#define BIT_CLR(mask, pos) ((mask) &= ~(1UL << (pos)))
-#define BIT_IST(mask, pos) ((mask) & (1UL << (pos)))
+#define GET_MASK_ITEM_FROM_TABLE(mask, pos) (mask[(pos) / IEEE802154_PENDING_TABLE_MASK_BITS])
+
+#define BIT_SET(mask, pos) (GET_MASK_ITEM_FROM_TABLE(mask, pos) |= (1UL << (pos % IEEE802154_PENDING_TABLE_MASK_BITS)))
+#define BIT_CLR(mask, pos) (GET_MASK_ITEM_FROM_TABLE(mask, pos) &= ~(1UL << (pos % IEEE802154_PENDING_TABLE_MASK_BITS)))
+#define BIT_IST(mask, pos) (GET_MASK_ITEM_FROM_TABLE(mask, pos) & (1UL << (pos % IEEE802154_PENDING_TABLE_MASK_BITS)))
 
 static IRAM_ATTR bool ieee802154_addr_in_pending_table(const uint8_t *addr, bool is_short)
 {
@@ -114,9 +116,9 @@ void ieee802154_reset_pending_table(bool is_short)
 {
     // Consider this function may be called in ISR, only clear the mask bits for finishing the process quickly.
     if (is_short) {
-        ieee802154_pending_table.short_addr_mask = 0;
+        memset(ieee802154_pending_table.short_addr_mask, 0, IEEE802154_PENDING_TABLE_MASK_SIZE);
     } else {
-        ieee802154_pending_table.ext_addr_mask = 0;
+        memset(ieee802154_pending_table.ext_addr_mask, 0, IEEE802154_PENDING_TABLE_MASK_SIZE);
     }
 }
 

components/ieee802154/private_include/esp_ieee802154_ack.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -8,6 +8,7 @@
 
 #include <stdint.h>
 #include <stdbool.h>
+#include "sdkconfig.h"
 #include "esp_err.h"
 #include "esp_ieee802154_frame.h"
 
@@ -18,11 +19,14 @@ extern "C" {
 /**
  * @brief The radio pending table, which is utilized to determine whether the received frame should be responded to with pending bit enabled.
  */
+
+#define IEEE802154_PENDING_TABLE_MASK_BITS (8)
+#define IEEE802154_PENDING_TABLE_MASK_SIZE (((CONFIG_IEEE802154_PENDING_TABLE_SIZE - 1) / IEEE802154_PENDING_TABLE_MASK_BITS) + 1)
 typedef struct {
     uint8_t short_addr[CONFIG_IEEE802154_PENDING_TABLE_SIZE][IEEE802154_FRAME_SHORT_ADDR_SIZE]; /*!< Short address table */
     uint8_t ext_addr[CONFIG_IEEE802154_PENDING_TABLE_SIZE][IEEE802154_FRAME_EXT_ADDR_SIZE];     /*!< Extend address table */
-    uint32_t short_addr_mask;                                                                   /*!< The mask which the index of short address table is used */
-    uint32_t ext_addr_mask;                                                                     /*!< The mask which the index of extended address table is used */
+    uint8_t short_addr_mask[IEEE802154_PENDING_TABLE_MASK_SIZE];                                /*!< The mask which the index of short address table is used */
+    uint8_t ext_addr_mask[IEEE802154_PENDING_TABLE_MASK_SIZE];                                  /*!< The mask which the index of extended address table is used */
 } ieee802154_pending_table_t;
 
 /**

components/lwip/Kconfig

@@ -837,6 +837,27 @@ menu "LWIP"
         default 0x1 if LWIP_TCPIP_TASK_AFFINITY_CPU1
 
 
+    config LWIP_IPV6_ND6_NUM_PREFIXES
+        int "Max number of entries in IPv6 on-link prefixes cache"
+        depends on LWIP_IPV6
+        default 5
+        help
+            Maximum number of entries in IPv6 on-link prefixes cache
+
+    config LWIP_IPV6_ND6_NUM_ROUTERS
+        int "Max number of entries in IPv6 default routers cache"
+        depends on LWIP_IPV6
+        default 3
+        help
+            Maximum number of entries in IPv6 default routers cache
+
+    config LWIP_IPV6_ND6_NUM_DESTINATIONS
+        int "Max number of entries in IPv6 destinations cache"
+        depends on LWIP_IPV6
+        default 10
+        help
+            Maximum number of entries in IPv6 destinations cache
+
     menuconfig LWIP_PPP_SUPPORT
         bool "Enable PPP support"
         default n

components/lwip/lwip

@@ -1 +1 @@
-Subproject commit f79221431fa9042b3572d271d687de66da7560c4
+Subproject commit bced058f737eaabea1aa193f3c365ee78ff555f3

components/lwip/port/include/lwipopts.h

@@ -1250,6 +1250,20 @@ static inline uint32_t timeout_from_offered(uint32_t lease, uint32_t min)
  */
 #define LWIP_ND6_NUM_NEIGHBORS          CONFIG_LWIP_IPV6_ND6_NUM_NEIGHBORS
 
+/**
+ * LWIP_ND6_NUM_PREFIXES: Maximum number of entries in IPv6 on-link prefixes cache
+ */
+#define LWIP_ND6_NUM_PREFIXES          CONFIG_LWIP_IPV6_ND6_NUM_PREFIXES
+
+/**
+ * LWIP_ND6_NUM_ROUTERS: Maximum number of entries in IPv6 default routers cache
+ */
+#define LWIP_ND6_NUM_ROUTERS          CONFIG_LWIP_IPV6_ND6_NUM_ROUTERS
+
+/**
+ * LWIP_ND6_NUM_DESTINATIONS: Maximum number of entries in IPv6 destinations cache
+ */
+#define LWIP_ND6_NUM_DESTINATIONS          CONFIG_LWIP_IPV6_ND6_NUM_DESTINATIONS
 /*
    ---------------------------------------
    ---------- Hook options ---------------

components/mbedtls/CMakeLists.txt

@@ -12,6 +12,10 @@ endif()
 set(mbedtls_srcs "")
 set(mbedtls_include_dirs "port/include" "mbedtls/include" "mbedtls/library")
 
+if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
+    list(APPEND mbedtls_include_dirs "port/mbedtls_rom")
+endif()
+
 if(CONFIG_MBEDTLS_CERTIFICATE_BUNDLE)
     list(APPEND mbedtls_srcs "esp_crt_bundle/esp_crt_bundle.c")
     list(APPEND mbedtls_include_dirs "esp_crt_bundle/include")
@@ -88,6 +92,11 @@ set(Python3_EXECUTABLE ${python})
 # Needed to for include_next includes to work from within mbedtls
 include_directories("${COMPONENT_DIR}/port/include")
 
+# Needed to for mbedtls_rom includes to work from within mbedtls
+if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
+    include_directories("${COMPONENT_DIR}/port/mbedtls_rom")
+endif()
+
 # Import mbedtls library targets
 add_subdirectory(mbedtls)
 

components/mbedtls/Kconfig

@@ -1084,22 +1084,26 @@ menu "mbedTLS"
 
     config MBEDTLS_USE_CRYPTO_ROM_IMPL
         bool "Use ROM implementation of the crypto algorithm"
-        depends on ESP_ROM_HAS_MBEDTLS_CRYPTO_LIB && IDF_EXPERIMENTAL_FEATURES
+        depends on ESP_ROM_HAS_MBEDTLS_CRYPTO_LIB
         default "n"
         select MBEDTLS_SHA512_C
         select MBEDTLS_AES_C
         select MBEDTLS_CCM_C
+        select MBEDTLS_CMAC_C
         select MBEDTLS_ROM_MD5
         select MBEDTLS_HARDWARE_SHA
+        select MBEDTLS_ECP_RESTARTABLE
+        select MBEDTLS_THREADING_C
         help
             Enable this flag to use mbedtls crypto algorithm from ROM instead of ESP-IDF.
 
             This configuration option saves flash footprint in the application binary.
-            Note that the version of mbedtls crypto algorithm library in ROM is v2.16.12.
-            We have done the security analysis of the mbedtls revision in ROM (v2.16.12)
+            Note that the version of mbedtls crypto algorithm library in ROM(ECO1~ECO3) is v2.16.12,
+            and the version of mbedtls crypto algorithm library in ROM(ECO4) is v3.6.0.
+            We have done the security analysis of the mbedtls revision in ROM (ECO1~ECO4)
             and ensured that affected symbols have been patched (removed). If in the future
             mbedtls revisions there are security issues that also affects the version in
-            ROM (v2.16.12) then we shall patch the relevant symbols. This would increase
+            ROM (ECO1~ECO4) then we shall patch the relevant symbols. This would increase
             the flash footprint and hence care must be taken to keep some reserved space
             for the application binary in flash layout.