Merge c37523a06f into fc1c79ebc1

Bugfix/fix hid cod setting[backport 5.2]

See merge request espressif/esp-idf!33338

.gitlab/ci/common.yml

@@ -39,7 +39,7 @@ variables:
   GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
   # we're using .cache folder for caches
   GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.2.1
+  LATEST_GIT_TAG: v5.2.3
 
   SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
   # by default we will fetch all submodules

Kconfig

@@ -611,4 +611,3 @@ mainmenu "Espressif IoT Development Framework Configuration"
             - CONFIG_ESPTOOLPY_FLASHFREQ_120M && CONFIG_ESPTOOLPY_FLASH_SAMPLE_MODE_DTR
             - CONFIG_SPIRAM_SPEED_120M && CONFIG_SPIRAM_MODE_OCT
             - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
-            - CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL

components/bt/CMakeLists.txt

@@ -863,7 +863,11 @@ if(CONFIG_BT_ENABLED)
                 "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
         target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
     elseif(CONFIG_BT_CONTROLLER_ENABLED)
-        add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+        if(CONFIG_IDF_TARGET_ESP32C6)
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+        else()
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+        endif()
         target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
     endif()
 

components/bt/common/btc/core/btc_task.c

@@ -295,8 +295,8 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 /**
  * transfer an message to another module in the different task.
  * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
  * @param  copy_func deep copy function
  * @param  free_func deep free function
  * @return           BT_STATUS_SUCCESS: success
@@ -342,7 +342,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 }
 
 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
  * @param  msg       message
  * @return           BT_STATUS_SUCCESS: success
  *                   others: fail

components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c

@@ -442,8 +442,10 @@ uint8_t esp_blufi_init(void)
 void esp_blufi_deinit(void)
 {
     blufi_env.enabled = false;
-    btc_msg_t msg;
     esp_blufi_cb_param_t param;
+    btc_msg_t msg;
+    memset (&msg, 0x0, sizeof (msg));
+    msg.sig = BTC_SIG_API_CB;
     msg.pid = BTC_PID_BLUFI;
     msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
     param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;

components/bt/controller/esp32c3/Kconfig.in

@@ -200,8 +200,8 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
         bool "+15dBm"
     config BT_CTRL_DFT_TX_POWER_LEVEL_P18
         bool "+18dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
-        bool "+21dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
 endchoice
 
 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
@@ -221,7 +221,7 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
     default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
     default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
     default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P20
     default 0
 
 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP

components/bt/controller/lib_esp32

@@ -1 +1 @@
-Subproject commit 3bb36a79cdfad65c656b9238e0d46b935775ed72
+Subproject commit 8112ca2c575c6feb32d755623f097f1b66759490

components/bt/controller/lib_esp32c2/esp32c2-bt-lib

@@ -1 +1 @@
-Subproject commit e652624750341aca124e9f850e261b0c1ac63529
+Subproject commit e5c7ef0bf701d02c2203e26081fdd348d45935e5

components/bt/controller/lib_esp32c3_family

@@ -1 +1 @@
-Subproject commit ef1dfc518572e9cda55f13906e32207b40ee280b
+Subproject commit 061e70c319576bf28b5695f5478dbe01ad18b18d

components/bt/controller/lib_esp32c6/esp32c6-bt-lib

@@ -1 +1 @@
-Subproject commit f95513f22be7b21429b01ba05dbfbc98097b5e67
+Subproject commit 3f15aa1d602aedf510dd9c686b3f7e5ea8a44002

components/bt/controller/lib_esp32h2/esp32h2-bt-lib

@@ -1 +1 @@
-Subproject commit 58a293a2b4c305157723908ea29c2776f5803bbc
+Subproject commit 50f567fff506f63b4d06ebea80d0405fe9e39568

components/bt/host/bluedroid/Kconfig.in

@@ -144,6 +144,13 @@ config BT_HID_DEVICE_ENABLED
     help
         This enables the BT HID Device
 
+config BT_HID_DEVICE_TASK_SIZE
+    int "Bluetooth HID event (callback to application) task stack size"
+    depends on BT_HID_DEVICE_ENABLED
+    default 4096
+    help
+        This selects the esp_hid task size
+
 config BT_BLE_ENABLED
     bool "Bluetooth Low Energy"
     depends on BT_BLUEDROID_ENABLED

components/bt/host/bluedroid/api/esp_gap_ble_api.c

@@ -493,13 +493,17 @@ uint8_t *esp_ble_resolve_adv_data_by_type( uint8_t *adv_data, uint16_t adv_data_
 
     if (((type < ESP_BLE_AD_TYPE_FLAG) || (type > ESP_BLE_AD_TYPE_128SERVICE_DATA)) &&
             (type != ESP_BLE_AD_MANUFACTURER_SPECIFIC_TYPE)) {
-        LOG_ERROR("the eir type not define, type = %x\n", type);
+        LOG_ERROR("The advertising data type is not defined, type = %x", type);
         *length = 0;
         return NULL;
     }
 
-    if (adv_data == NULL || adv_data_len == 0) {
-        LOG_ERROR("Invalid advertising data.\n");
+    if (adv_data_len == 0) {
+        *length = 0;
+        return NULL;
+    }
+    if (adv_data == NULL) {
+        LOG_ERROR("Invalid advertising data.");
         *length = 0;
         return NULL;
     }

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -15,6 +15,24 @@
 
 #if (defined BTC_SDP_INCLUDED && BTC_SDP_INCLUDED == TRUE)
 
+static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
+{
+    bool ret = true;
+
+    if (record != NULL) {
+        if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
+            strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
+            LOG_ERROR("Invalid server name!\n");
+            ret = false;
+        }
+    } else {
+        LOG_ERROR("record is NULL!\n");
+        ret = false;
+    }
+
+    return ret;
+}
+
 esp_err_t esp_sdp_register_callback(esp_sdp_cb_t callback)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
@@ -85,9 +103,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
 {
     ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
 
-    if (record == NULL || record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX
-            || strlen(record->hdr.service_name)+1 != record->hdr.service_name_length) {
-        LOG_ERROR("Invalid server name!\n");
+    if (!esp_sdp_record_integrity_check(record)) {
         return ESP_ERR_INVALID_ARG;
     }
 
@@ -100,7 +116,7 @@ esp_err_t esp_sdp_create_record(esp_bluetooth_sdp_record_t *record)
     msg.act = BTC_SDP_ACT_CREATE_RECORD;
 
     memset(&arg, 0, sizeof(btc_sdp_args_t));
-    arg.creat_record.record = (bluetooth_sdp_record *)record;
+    arg.create_record.record = (bluetooth_sdp_record *)record;
 
     /* Switch to BTC context */
     stat = btc_transfer_context(&msg, &arg, sizeof(btc_sdp_args_t),

components/bt/host/bluedroid/api/include/api/esp_gap_bt_api.h

@@ -206,6 +206,28 @@ typedef enum {
     ESP_BT_COD_MAJOR_DEV_UNCATEGORIZED       = 31,   /*!< Uncategorized: device not specified */
 } esp_bt_cod_major_dev_t;
 
+/// Minor device class field of Class of Device for Peripheral Major Class
+typedef enum {
+    ESP_BT_COD_MINOR_PERIPHERAL_KEYBOARD            = 0x10, /*!< Keyboard */
+    ESP_BT_COD_MINOR_PERIPHERAL_POINTING            = 0x20, /*!< Pointing */
+    ESP_BT_COD_MINOR_PERIPHERAL_COMBO               = 0x30, /*!< Combo
+                                                            ESP_BT_COD_MINOR_PERIPHERAL_KEYBOARD, ESP_BT_COD_MINOR_PERIPHERAL_POINTING
+                                                            and ESP_BT_COD_MINOR_PERIPHERAL_COMBO can be OR'd with one of the
+                                                            following values to identify a multifunctional device. e.g.
+                                                                ESP_BT_COD_MINOR_PERIPHERAL_KEYBOARD | ESP_BT_COD_MINOR_PERIPHERAL_GAMEPAD
+                                                                ESP_BT_COD_MINOR_PERIPHERAL_POINTING | ESP_BT_COD_MINOR_PERIPHERAL_SENSING_DEVICE
+                                                             */
+    ESP_BT_COD_MINOR_PERIPHERAL_JOYSTICK            = 0x01, /*!< Joystick */
+    ESP_BT_COD_MINOR_PERIPHERAL_GAMEPAD             = 0x02, /*!< Gamepad */
+    ESP_BT_COD_MINOR_PERIPHERAL_REMOTE_CONTROL      = 0x03, /*!< Remote Control */
+    ESP_BT_COD_MINOR_PERIPHERAL_SENSING_DEVICE      = 0x04, /*!< Sensing Device */
+    ESP_BT_COD_MINOR_PERIPHERAL_DIGITIZING_TABLET   = 0x05, /*!< Digitizing Tablet */
+    ESP_BT_COD_MINOR_PERIPHERAL_CARD_READER         = 0x06, /*!< Card Reader */
+    ESP_BT_COD_MINOR_PERIPHERAL_DIGITAL_PAN         = 0x07, /*!< Digital Pan */
+    ESP_BT_COD_MINOR_PERIPHERAL_HAND_SCANNER        = 0x08, /*!< Hand Scanner */
+    ESP_BT_COD_MINOR_PERIPHERAL_HAND_GESTURAL_INPUT = 0x09, /*!< Hand Gestural Input */
+} esp_bt_cod_minor_peripheral_t;
+
 /// Bits of major device class field
 #define ESP_BT_COD_MAJOR_DEV_BIT_MASK         (0x1f00) /*!< Major device bit mask */
 #define ESP_BT_COD_MAJOR_DEV_BIT_OFFSET       (8)      /*!< Major device bit offset */

components/bt/host/bluedroid/api/include/api/esp_gatts_api.h

@@ -242,6 +242,7 @@ typedef union {
      */
     struct gatts_rsp_evt_param {
         esp_gatt_status_t status;       /*!< Operation status */
+        uint16_t conn_id;               /*!< Connection id */
         uint16_t handle;                /*!< Attribute handle which send response */
     } rsp;                              /*!< Gatt server callback param of ESP_GATTS_RESPONSE_EVT */
 

components/bt/host/bluedroid/api/include/api/esp_hidd_api.h

@@ -98,6 +98,12 @@ typedef struct {
     uint8_t subclass;                                /*!< HID device subclass */
     uint8_t *desc_list;                              /*!< HID descriptor list */
     int desc_list_len;                               /*!< size in bytes of HID descriptor list */
+
+    // DID Profile SDP
+    uint16_t vendor_id;                              /*!< HID Vendor ID */
+    uint16_t product_id;                             /*!< HID Product ID */
+    uint16_t version;                                /*!< HID Product Version */
+    uint8_t vendor_id_source;                        /*!< HID Country Code */
 } esp_hidd_app_param_t;
 
 /**

components/bt/host/bluedroid/api/include/api/esp_sdp_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -14,123 +14,131 @@
 extern "C" {
 #endif
 
-#define ESP_SDP_SERVER_NAME_MAX 32                 /*!< Service name max length */
-#define SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH 15    /*!< OPP supported format list maximum length */
+#define ESP_SDP_SERVER_NAME_MAX              32  /*!< Service name max length */
+#define SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH 15  /*!< OPP supported format list maximum length */
+
+#define ESP_SDP_UUID_MAP_MAS  0x1132 /*!< Message Access Service UUID */
+#define ESP_SDP_UUID_MAP_MNS  0x1133 /*!< Message Notification Service UUID */
+#define ESP_SDP_UUID_PBAP_PSE 0x112F /*!< Phone Book Server Equipment UUID */
+#define ESP_SDP_UUID_PBAP_PCE 0x112E /*!< Phone Book Client Equipment UUID */
+#define ESP_SDP_UUID_OPP      0x1105 /*!< Object Push Profile UUID */
+#define ESP_SDP_UUID_SAP      0x112D /*!< SIM Access Profile UUID */
+#define ESP_SDP_UUID_DIP      0x1200 /*!< Device Identification Profile UUID */
+
+#define ESP_SDP_BUILD_BT_UUID16(uuid16_val)                                                                                \
+    (esp_bt_uuid_t) { .len = ESP_UUID_LEN_16, .uuid = {.uuid16 = (uint16_t)(uuid16_val),}, }
 
 typedef enum {
-    ESP_SDP_SUCCESS   = 0,          /*!< Successful operation. */
-    ESP_SDP_FAILURE,                /*!< Generic failure. */
-    ESP_SDP_NO_RESOURCE,            /*!< No more resource */
-    ESP_SDP_NEED_INIT,              /*!< SDP module shall init first */
-    ESP_SDP_NEED_DEINIT,            /*!< SDP module shall deinit first */
-    ESP_SDP_NO_CREATE_RECORD,       /*!< No record created */
+    ESP_SDP_SUCCESS = 0,      /*!< Successful operation. */
+    ESP_SDP_FAILURE,          /*!< Generic failure. */
+    ESP_SDP_NO_RESOURCE,      /*!< No more resource */
+    ESP_SDP_NEED_INIT,        /*!< SDP module shall init first */
+    ESP_SDP_NEED_DEINIT,      /*!< SDP module shall deinit first */
+    ESP_SDP_NO_CREATE_RECORD, /*!< No record created */
 } esp_sdp_status_t;
 
 /**
  * @brief SDP callback function events
  */
 typedef enum {
-    ESP_SDP_INIT_EVT                    = 0,                /*!< When SDP is initialized, the event comes */
-    ESP_SDP_DEINIT_EVT                  = 1,                /*!< When SDP is deinitialized, the event comes */
-    ESP_SDP_SEARCH_COMP_EVT             = 2,                /*!< When SDP search complete, the event comes */
-    ESP_SDP_CREATE_RECORD_COMP_EVT      = 3,                /*!< When create SDP records complete, the event comes */
-    ESP_SDP_REMOVE_RECORD_COMP_EVT      = 4,                /*!< When remove a SDP record complete, the event comes */
+    ESP_SDP_INIT_EVT               = 0, /*!< When SDP is initialized, the event comes */
+    ESP_SDP_DEINIT_EVT             = 1, /*!< When SDP is de-initialized, the event comes */
+    ESP_SDP_SEARCH_COMP_EVT        = 2, /*!< When SDP search complete, the event comes */
+    ESP_SDP_CREATE_RECORD_COMP_EVT = 3, /*!< When create SDP records complete, the event comes */
+    ESP_SDP_REMOVE_RECORD_COMP_EVT = 4, /*!< When remove a SDP record complete, the event comes */
 } esp_sdp_cb_event_t;
 
 /**
  * @brief SDP record type
  */
 typedef enum {
-    ESP_SDP_TYPE_RAW,          /*!< Used to carry raw SDP search data for unknown UUIDs */
-    ESP_SDP_TYPE_MAP_MAS,      /*!< Message Access Profile - Server */
-    ESP_SDP_TYPE_MAP_MNS,      /*!< Message Access Profile - Client (Notification Server) */
-    ESP_SDP_TYPE_PBAP_PSE,     /*!< Phone Book Profile - Server */
-    ESP_SDP_TYPE_PBAP_PCE,     /*!< Phone Book Profile - Client */
-    ESP_SDP_TYPE_OPP_SERVER,   /*!< Object Push Profile */
-    ESP_SDP_TYPE_SAP_SERVER    /*!< SIM Access Profile */
+    ESP_SDP_TYPE_RAW,        /*!< Used to carry raw SDP search data for unknown UUIDs */
+    ESP_SDP_TYPE_MAP_MAS,    /*!< Message Access Profile - Server */
+    ESP_SDP_TYPE_MAP_MNS,    /*!< Message Access Profile - Client (Notification Server) */
+    ESP_SDP_TYPE_PBAP_PSE,   /*!< Phone Book Profile - Server */
+    ESP_SDP_TYPE_PBAP_PCE,   /*!< Phone Book Profile - Client */
+    ESP_SDP_TYPE_OPP_SERVER, /*!< Object Push Profile */
+    ESP_SDP_TYPE_SAP_SERVER, /*!< SIM Access Profile */
 } esp_bluetooth_sdp_types_t;
 
 /**
- * @brief Some signals need additional pointers, hence we introduce a
- *        generic way to handle these pointers.
+ * @brief SDP header structure
  */
 typedef struct bluetooth_sdp_hdr_overlay {
-    esp_bluetooth_sdp_types_t type;            /*!< SDP type */
-    esp_bt_uuid_t  uuid;                       /*!< UUID type， include uuid and uuid length */
-    uint32_t       service_name_length;        /*!< Service name length */
-    char          *service_name;               /*!< service name */
-    int32_t        rfcomm_channel_number;      /*!< rfcomm channel number, if not used set to -1*/
-    int32_t        l2cap_psm;                  /*!< l2cap psm, if not used set to -1 */
-    int32_t        profile_version;            /*!< profile version */
-
-    // User pointers, only used for some signals - see esp_bluetooth_sdp_ops_record_t
-    int            user1_ptr_len;              /*!< see esp_bluetooth_sdp_ops_record_t */
-    uint8_t       *user1_ptr;                  /*!< see esp_bluetooth_sdp_ops_record_t */
-    int            user2_ptr_len;              /*!< see esp_bluetooth_sdp_ops_record_t */
-    uint8_t       *user2_ptr;                  /*!< see esp_bluetooth_sdp_ops_record_t */
+    esp_bluetooth_sdp_types_t type; /*!< SDP type */
+    esp_bt_uuid_t uuid;             /*!< UUID type, include uuid and uuid length, only needed to be set for RAW record creation */
+    uint32_t service_name_length;   /*!< Service name length */
+    char *service_name;             /*!< Service name */
+    int32_t rfcomm_channel_number;  /*!< RFCOMM channel number, if not used set to -1*/
+    int32_t l2cap_psm;              /*!< L2CAP psm, if not used set to -1 */
+    int32_t profile_version;        /*!< Profile version */
+    int user1_ptr_len;              /*!< User data1 length, only used for searching RAW record */
+    uint8_t *user1_ptr;             /*!< User data1 pointer to the raw SDP response data, only used for searching RAW record */
+    int user2_ptr_len;              /*!< User data2 length, only used for searching RAW record */
+    uint8_t *user2_ptr;             /*!< User data2 pointer, only used for searching RAW record */
 } esp_bluetooth_sdp_hdr_overlay_t;
 
 /**
  * @brief Message Access Profile - Server parameters
  */
 typedef struct bluetooth_sdp_mas_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    mas_instance_id;               /*!< MAS Instance ID */
-    uint32_t    supported_features;            /*!< Map supported features */
-    uint32_t    supported_message_types;       /*!< Supported message types */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t mas_instance_id;            /*!< MAS Instance ID */
+    uint32_t supported_features;         /*!< Map supported features */
+    uint32_t supported_message_types;    /*!< Supported message types */
 } esp_bluetooth_sdp_mas_record_t;
 
 /**
  * @brief Message Access Profile - Client (Notification Server) parameters
  */
 typedef struct bluetooth_sdp_mns_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    supported_features;            /*!< Supported features */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t supported_features;         /*!< Supported features */
 } esp_bluetooth_sdp_mns_record_t;
 
 /**
  * @brief Phone Book Profile - Server parameters
  */
 typedef struct bluetooth_sdp_pse_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    uint32_t    supported_features;            /*!< Pbap Supported Features */
-    uint32_t    supported_repositories;        /*!< Supported Repositories */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    uint32_t supported_features;         /*!< PBAP Supported Features */
+    uint32_t supported_repositories;     /*!< Supported Repositories */
 } esp_bluetooth_sdp_pse_record_t;
 
 /**
  * @brief Phone Book Profile - Client parameters
  */
 typedef struct bluetooth_sdp_pce_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
 } esp_bluetooth_sdp_pce_record_t;
 
 /**
  * @brief Object Push Profile parameters
  */
 typedef struct bluetooth_sdp_ops_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
-    int         supported_formats_list_len;    /*!< Supported formats list length */
-    uint8_t     supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];  /*!< Supported formats list */
+    esp_bluetooth_sdp_hdr_overlay_t hdr;                                  /*!< General info */
+    int supported_formats_list_len;                                       /*!< Supported formats list length */
+    uint8_t supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH]; /*!< Supported formats list */
 } esp_bluetooth_sdp_ops_record_t;
 
 /**
  * @brief SIM Access Profile parameters
  */
 typedef struct bluetooth_sdp_sap_record {
-    esp_bluetooth_sdp_hdr_overlay_t hdr;       /*!< General info */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
 } esp_bluetooth_sdp_sap_record_t;
 
 /**
  * @brief SDP record parameters union
  */
 typedef union {
-    esp_bluetooth_sdp_hdr_overlay_t   hdr;     /*!< General info */
-    esp_bluetooth_sdp_mas_record_t    mas;     /*!< Message Access Profile - Server */
-    esp_bluetooth_sdp_mns_record_t    mns;     /*!< Message Access Profile - Client (Notification Server) */
-    esp_bluetooth_sdp_pse_record_t    pse;     /*!< Phone Book Profile - Server */
-    esp_bluetooth_sdp_pce_record_t    pce;     /*!< Phone Book Profile - Client */
-    esp_bluetooth_sdp_ops_record_t    ops;     /*!< Object Push Profile */
-    esp_bluetooth_sdp_sap_record_t    sap;     /*!< SIM Access Profile */
+    esp_bluetooth_sdp_hdr_overlay_t hdr; /*!< General info */
+    esp_bluetooth_sdp_mas_record_t mas;  /*!< Message Access Profile - Server */
+    esp_bluetooth_sdp_mns_record_t mns;  /*!< Message Access Profile - Client (Notification Server) */
+    esp_bluetooth_sdp_pse_record_t pse;  /*!< Phone Book Profile - Server */
+    esp_bluetooth_sdp_pce_record_t pce;  /*!< Phone Book Profile - Client */
+    esp_bluetooth_sdp_ops_record_t ops;  /*!< Object Push Profile */
+    esp_bluetooth_sdp_sap_record_t sap;  /*!< SIM Access Profile */
 } esp_bluetooth_sdp_record_t;
 
 /**
@@ -141,44 +149,43 @@ typedef union {
      * @brief ESP_SDP_INIT_EVT
      */
     struct sdp_init_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } init;                                 /*!< SDP callback param of ESP_SDP_INIT_EVT */
+        esp_sdp_status_t status; /*!< Status */
+    } init;                      /*!< SDP callback param of ESP_SDP_INIT_EVT */
 
     /**
      * @brief ESP_SDP_DEINIT_EVT
      */
     struct sdp_deinit_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } deinit;                               /*!< SDP callback param of ESP_SDP_DEINIT_EVT */
+        esp_sdp_status_t status; /*!< Status */
+    } deinit;                    /*!< SDP callback param of ESP_SDP_DEINIT_EVT */
 
     /**
      * @brief ESP_SDP_SEARCH_COMP_EVT
      */
     struct sdp_search_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-        esp_bd_addr_t       remote_addr;    /*!< remote device address */
-        esp_bt_uuid_t       sdp_uuid;       /*!< service uuid */
-        int                 record_count;   /*!< Number of SDP records */
-        esp_bluetooth_sdp_record_t *records;/*!< SDP records */
-    } search;                               /*!< SDP callback param of ESP_SDP_SEARCH_COMP_EVT */
+        esp_sdp_status_t status;             /*!< Status */
+        esp_bd_addr_t remote_addr;           /*!< Remote device address */
+        esp_bt_uuid_t sdp_uuid;              /*!< Service uuid */
+        int record_count;                    /*!< Number of SDP records */
+        esp_bluetooth_sdp_record_t *records; /*!< SDP records */
+    } search;                                /*!< SDP callback param of ESP_SDP_SEARCH_COMP_EVT */
 
     /**
      * @brief ESP_SDP_CREATE_RECORD_COMP_EVT
      */
-    struct sdp_crate_record_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-        int                 record_handle;  /*!< SDP record handle */
-    } create_record;                        /*!< SDP callback param of ESP_SDP_CREATE_RECORD_COMP_EVT */
+    struct sdp_create_record_evt_param {
+        esp_sdp_status_t status; /*!< Status */
+        int record_handle;       /*!< SDP record handle */
+    } create_record;             /*!< SDP callback param of ESP_SDP_CREATE_RECORD_COMP_EVT */
 
     /**
      * @brief ESP_SDP_REMOVE_RECORD_COMP_EVT
      */
     struct sdp_remove_record_evt_param {
-        esp_sdp_status_t    status;         /*!< status */
-    } remove_record;                        /*!< SDP callback param of ESP_SDP_REMOVE_RECORD_COMP_EVT */
-
-} esp_sdp_cb_param_t;                       /*!< SDP callback parameter union type */
+        esp_sdp_status_t status; /*!< Status */
+    } remove_record;             /*!< SDP callback param of ESP_SDP_REMOVE_RECORD_COMP_EVT */
 
+} esp_sdp_cb_param_t;
 
 /**
  * @brief       SDP callback function type.

components/bt/host/bluedroid/bta/av/bta_av_act.c

@@ -127,9 +127,6 @@ void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
         }
         /* else ACP && connected. do not clear the handle yet */
         AVRC_Close(rc_handle);
-        if (rc_handle == bta_av_cb.rc_acp_handle) {
-            bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
-        }
         APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
                          p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
     }
@@ -302,7 +299,7 @@ UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
         bda = p_scb->peer_addr;
         status = BTA_AV_RC_ROLE_INT;
     } else {
-        if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL ) {
+        if (shdl != 0 && ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL)) {
             APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
             return p_rcb->handle;
         }
@@ -1143,7 +1140,7 @@ void bta_av_conn_chg(tBTA_AV_DATA *p_data)
                                   p_data->conn_chg.peer_addr[5]);
                 if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0) {
                     /* AVRCP is already connected.
-                     * need to update the association betwen SCB and RCB */
+                     * need to update the association between SCB and RCB */
                     p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
                     p_lcb_rc->lidx = 0;
                     p_scb->rc_handle = p_cb->rc_acp_handle;
@@ -1636,6 +1633,8 @@ void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
         }
     } else {
         p_cb->rcb[rc_handle].peer_features = peer_features;
+        p_cb->rcb[rc_handle].peer_ct_features = peer_ct_features;
+        p_cb->rcb[rc_handle].peer_tg_features = peer_tg_features;
         rc_feat.rc_handle =  rc_handle;
         rc_feat.peer_features = peer_features;
         rc_feat.peer_ct_features = peer_ct_features;
@@ -1711,7 +1710,8 @@ void bta_av_rc_closed(tBTA_AV_DATA *p_data)
                 bta_av_del_rc(p_rcb);
 
                 /* if the AVRCP is no longer listening, create the listening channel */
-                if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG) {
+                if (bta_av_cb.rc_acp_handle == p_msg->handle && bta_av_cb.features & BTA_AV_FEAT_RCTG) {
+                    bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
                     bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
                 }
             }

components/bt/host/bluedroid/bta/dm/bta_dm_api.c

@@ -29,6 +29,7 @@
 #include "stack/btm_api.h"
 #include "btm_int.h"
 #include <string.h>
+#include <assert.h>
 #include "bta/utl.h"
 #include "osi/allocator.h"
 
@@ -1061,22 +1062,67 @@ UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr )
 tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
                                     UINT32 *p_handle )
 {
-    tBTA_STATUS  status = BTA_FAILURE;
+    tBTA_STATUS status = BTA_FAILURE;
 
     if (bta_dm_di_cb.di_num < BTA_DI_NUM_MAX) {
         if (SDP_SetLocalDiRecord((tSDP_DI_RECORD *)p_device_info, p_handle) == SDP_SUCCESS) {
             if (!p_device_info->primary_record) {
-                bta_dm_di_cb.di_handle[bta_dm_di_cb.di_num] = *p_handle;
-                bta_dm_di_cb.di_num ++;
+                for (uint8_t i = 1; i < BTA_DI_NUM_MAX; i++) {
+                    if (!bta_dm_di_cb.di_handle[i]) {
+                        bta_dm_di_cb.di_handle[i] = *p_handle;
+                        break;
+                    }
+                }
+                bta_dm_di_cb.di_num++;
+            } else if (!bta_dm_di_cb.di_handle[0]) {
+                bta_dm_di_cb.di_handle[0] = *p_handle;
+                bta_dm_di_cb.di_num++;
+            } else {
+                assert(bta_dm_di_cb.di_handle[0] == (*p_handle));
             }
 
-            bta_sys_add_uuid(UUID_SERVCLASS_PNP_INFORMATION);
-            status =  BTA_SUCCESS;
+            if (!bta_dm_di_cb.uuid_added) {
+                bta_sys_add_uuid(UUID_SERVCLASS_PNP_INFORMATION);
+                bta_dm_di_cb.uuid_added = TRUE;
+            }
+
+            status = BTA_SUCCESS;
         }
     }
 
     return status;
 }
+
+/*******************************************************************************
+**
+** Function         BTA_DmRemoveLocalDiRecord
+**
+** Description      This function removes a DI record from the local SDP database.
+**
+** Returns          BTA_SUCCESS if record is removed successfully, otherwise error code.
+**
+*******************************************************************************/
+tBTA_STATUS BTA_DmRemoveLocalDiRecord(UINT32 handle)
+{
+    tBTA_STATUS status = BTA_FAILURE;
+
+    for (uint8_t i = 0; i < BTA_DI_NUM_MAX; i++) {
+        if (bta_dm_di_cb.di_handle[i] == handle) {
+            if (SDP_DeleteRecord(handle)) {
+                bta_dm_di_cb.di_handle[i] = 0;
+                bta_dm_di_cb.di_num--;
+                status = BTA_SUCCESS;
+                break;
+            }
+        }
+    }
+
+    if (bta_dm_di_cb.di_num == 0 && bta_dm_di_cb.uuid_added) {
+        bta_sys_remove_uuid(UUID_SERVCLASS_PNP_INFORMATION);
+    }
+
+    return status;
+}
 #endif  ///SDP_INCLUDED == TRUE
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -1575,6 +1575,7 @@ typedef struct {
 #if (SDP_INCLUDED == TRUE)
     tSDP_DISCOVERY_DB     *p_di_db;     /* pointer to the DI discovery database */
 #endif  ///SDP_INCLUDED == TRUE
+    BOOLEAN             uuid_added;
     UINT8               di_num;         /* total local DI record number */
     UINT32              di_handle[BTA_DI_NUM_MAX];  /* local DI record handle, the first one is primary record */
 } tBTA_DM_DI_CB;

components/bt/host/bluedroid/bta/hd/bta_hd_act.c

@@ -175,6 +175,16 @@ void bta_hd_register_act(tBTA_HD_DATA *p_data)
                      p_app_data->subclass, p_app_data->d_len, p_app_data->d_data);
     bta_sys_add_uuid(UUID_SERVCLASS_HUMAN_INTERFACE);
 
+    // Set DID Profile SDP Record
+    tBTA_DI_RECORD bqb_device_info;
+    bqb_device_info.vendor = p_app_data->vendor_id;
+    bqb_device_info.vendor_id_source = p_app_data->vendor_id_source;
+    bqb_device_info.product = p_app_data->product_id;
+    bqb_device_info.version = p_app_data->version;
+    bqb_device_info.primary_record = TRUE;
+
+    BTA_DmSetLocalDiRecord(&bqb_device_info, &bta_hd_cb.sdp_handle);
+
     HID_DevSetIncomingQos(p_app_data->in_qos.service_type, p_app_data->in_qos.token_rate,
                           p_app_data->in_qos.token_bucket_size, p_app_data->in_qos.peak_bandwidth,
                           p_app_data->in_qos.access_latency, p_app_data->in_qos.delay_variation);

components/bt/host/bluedroid/bta/hd/bta_hd_api.c

@@ -114,6 +114,13 @@ extern void BTA_HdRegisterApp(tBTA_HD_APP_INFO *p_app_info, tBTA_HD_QOS_INFO *p_
         p_buf->subclass = p_app_info->subclass;
         p_buf->d_len = p_app_info->descriptor.dl_len;
         memcpy(p_buf->d_data, p_app_info->descriptor.dsc_list, p_app_info->descriptor.dl_len);
+        
+        // copy DID profile SDP info
+        p_buf->vendor_id = p_app_info->vendor_id;
+        p_buf->product_id = p_app_info->product_id;
+        p_buf->version = p_app_info->version;
+        p_buf->vendor_id_source = p_app_info->vendor_id_source;
+        
         // copy qos data as-is
         memcpy(&p_buf->in_qos, p_in_qos, sizeof(tBTA_HD_QOS_INFO));
         memcpy(&p_buf->out_qos, p_out_qos, sizeof(tBTA_HD_QOS_INFO));

components/bt/host/bluedroid/bta/hd/include/bta_hd_int.h

@@ -75,6 +75,13 @@ typedef struct {
     uint8_t subclass;
     uint16_t d_len;
     uint8_t d_data[BTA_HD_APP_DESCRIPTOR_LEN];
+
+    // DID SDP Information (Device Information)
+    uint16_t vendor_id;
+    uint16_t product_id;
+    uint16_t version;
+    uint8_t vendor_id_source;
+
     tBTA_HD_QOS_INFO in_qos;
     tBTA_HD_QOS_INFO out_qos;
 } tBTA_HD_REGISTER_APP;

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -2172,6 +2172,17 @@ extern UINT16 BTA_DmGetConnectionState( BD_ADDR bd_addr );
 *******************************************************************************/
 extern tBTA_STATUS BTA_DmSetLocalDiRecord( tBTA_DI_RECORD *p_device_info,
         UINT32 *p_handle );
+
+/*******************************************************************************
+**
+** Function         BTA_DmRemoveLocalDiRecord
+**
+** Description      This function removes a DI record from the local SDP database.
+**
+** Returns          BTA_SUCCESS if record is removed successfully, otherwise error code.
+**
+*******************************************************************************/
+extern tBTA_STATUS BTA_DmRemoveLocalDiRecord(UINT32 handle);
 #endif  ///SDP_INCLUDED == TRUE
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/include/bta/bta_hd_api.h

@@ -69,6 +69,13 @@ typedef struct {
     char *p_description;
     char *p_provider;
     uint8_t subclass;
+
+    // SDP Idenification info
+    uint16_t vendor_id;         // 0x0201
+    uint16_t product_id;        // 0x0202
+    uint16_t version;           // 0x0203
+    uint8_t vendor_id_source;   // 0x0205
+
     tBTA_HD_DEV_DESCR descriptor;
 } tBTA_HD_APP_INFO;
 

components/bt/host/bluedroid/bta/include/bta/bta_sdp_api.h

@@ -41,7 +41,7 @@ typedef UINT8 tBTA_SDP_STATUS;
 /* SDP I/F callback events */
 /* events received by tBTA_SDP_DM_CBACK */
 #define BTA_SDP_ENABLE_EVT               0  /* SDP service enabled */
-#define BTA_SDP_DISENABLE_EVT            1  /* SDP service disenabled */
+#define BTA_SDP_DISABLE_EVT              1  /* SDP service disenabled */
 #define BTA_SDP_SEARCH_EVT               2  /* SDP search started */
 #define BTA_SDP_SEARCH_COMP_EVT          3  /* SDP search complete */
 #define BTA_SDP_CREATE_RECORD_USER_EVT   4  /* SDP create record complete */
@@ -67,10 +67,17 @@ typedef struct {
     int                 handle;
 } tBTA_SDP_CREATE_RECORD_USER;
 
+/* data associated with BTA_SDP_REMOVE_RECORD_USER_EVT */
+typedef struct {
+    tBTA_SDP_STATUS     status;
+    int                 handle;
+} tBTA_SDP_REMOVE_RECORD_USER;
+
 typedef union {
     tBTA_SDP_STATUS              status;            /* BTA_SDP_SEARCH_EVT */
     tBTA_SDP_SEARCH_COMP         sdp_search_comp;   /* BTA_SDP_SEARCH_COMP_EVT */
     tBTA_SDP_CREATE_RECORD_USER  sdp_create_record; /* BTA_SDP_CREATE_RECORD_USER_EVT */
+    tBTA_SDP_REMOVE_RECORD_USER  sdp_remove_record; /* BTA_SDP_REMOVE_RECORD_USER_EVT */
 } tBTA_SDP;
 
 /* SDP DM Interface callback */
@@ -78,9 +85,11 @@ typedef void (tBTA_SDP_DM_CBACK)(tBTA_SDP_EVT event, tBTA_SDP *p_data, void *use
 
 /* MCE configuration structure */
 typedef struct {
-    UINT16  sdp_db_size;            /* The size of p_sdp_db */
+    UINT16            sdp_raw_size;    /* The size of p_sdp_raw_data */
+    UINT16            sdp_db_size;     /* The size of p_sdp_db */
 #if (SDP_INCLUDED == TRUE)
-    tSDP_DISCOVERY_DB   *p_sdp_db;  /* The data buffer to keep SDP database */
+    UINT8             *p_sdp_raw_data; /* The data buffer to keep raw data */
+    tSDP_DISCOVERY_DB *p_sdp_db;       /* The data buffer to keep SDP database */
 #endif  ///SDP_INCLUDED == TRUE
 } tBTA_SDP_CFG;
 
@@ -108,14 +117,28 @@ extern tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback);
 **
 ** Function         BTA_SdpDisable
 **
-** Description      Disable the SDP search I/F service.
+** Description      This function is used to request a callback to perform disable
+**                  operation. The registered callback will be called with event
+**                  BTA_SDP_DISABLE_EVT.
+**
+** Returns          BTA_SDP_SUCCESS, if the request is being processed.
+**                  BTA_SDP_FAILURE, otherwise.
+**
+*******************************************************************************/
+extern tBTA_SDP_STATUS BTA_SdpDisable(void);
+
+/*******************************************************************************
+**
+** Function         BTA_SdpCleanup
+**
+** Description      Cleanup the SDP search I/F service.
 **                  Free buffer for SDP configuration structure.
 **
 ** Returns          BTA_SDP_SUCCESS if successful.
 **                  BTA_SDP_FAIL if internal failure.
 **
 *******************************************************************************/
-extern tBTA_SDP_STATUS BTA_SdpDisable(void);
+extern tBTA_SDP_STATUS BTA_SdpCleanup(void);
 
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/sdp/bta_sdp.c

@@ -49,10 +49,11 @@ typedef void (*tBTA_SDP_ACTION)(tBTA_SDP_MSG *p_data);
 
 /* action function list */
 const tBTA_SDP_ACTION bta_sdp_action[] = {
-    bta_sdp_enable,  /* BTA_SDP_API_ENABLE_EVT */
-    bta_sdp_search,  /* BTA_SDP_API_SEARCH_EVT */
-    bta_sdp_create_record,  /* BTA_SDP_API_CREATE_RECORD_USER_EVT */
-    bta_sdp_remove_record,  /* BTA_SDP_API_REMOVE_RECORD_USER_EVT */
+    bta_sdp_enable,        /* BTA_SDP_API_ENABLE_EVT */
+    bta_sdp_search,        /* BTA_SDP_API_SEARCH_EVT */
+    bta_sdp_create_record, /* BTA_SDP_API_CREATE_RECORD_USER_EVT */
+    bta_sdp_remove_record, /* BTA_SDP_API_REMOVE_RECORD_USER_EVT */
+    bta_sdp_disable,       /* BTA_SDP_API_DISABLE_EVT */
 };
 
 /*******************************************************************************

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -363,8 +363,8 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
 
     /* Try to extract a service name */
     if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_NAME)) != NULL) {
-        record->pse.hdr.service_name_length = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);
-        record->pse.hdr.service_name = (char *)p_attr->attr_value.v.array;
+        record->hdr.service_name_length = SDP_DISC_ATTR_LEN(p_attr->attr_len_type);
+        record->hdr.service_name = (char *)p_attr->attr_value.v.array;
     }
 
     if ((p_attr = SDP_FindAttributeInRec(p_rec, ATTR_ID_GOEP_L2CAP_PSM)) != NULL) {
@@ -373,9 +373,9 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
 
     /* Try to extract an RFCOMM channel */
     if (SDP_FindProtocolListElemInRec(p_rec, UUID_PROTOCOL_RFCOMM, &pe)) {
-        record->pse.hdr.rfcomm_channel_number = pe.params[0];
+        record->hdr.rfcomm_channel_number = pe.params[0];
     }
-    record->hdr.user1_ptr_len = p_bta_sdp_cfg->p_sdp_db->raw_size;
+    record->hdr.user1_ptr_len = p_bta_sdp_cfg->p_sdp_db->raw_used;
     record->hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
@@ -526,6 +526,10 @@ void bta_sdp_search(tBTA_SDP_MSG *p_data)
     SDP_InitDiscoveryDb (p_bta_sdp_cfg->p_sdp_db, p_bta_sdp_cfg->sdp_db_size, 1,
                          bta_sdp_search_uuid, 0, NULL);
 
+    /* tell SDP to keep the raw data */
+    p_bta_sdp_cfg->p_sdp_db->raw_size = p_bta_sdp_cfg->sdp_raw_size;
+    p_bta_sdp_cfg->p_sdp_db->raw_data = p_bta_sdp_cfg->p_sdp_raw_data;
+
     if (!SDP_ServiceSearchAttributeRequest2(p_data->get_search.bd_addr, p_bta_sdp_cfg->p_sdp_db,
                                             bta_sdp_search_cback, (void *)bta_sdp_search_uuid)) {
         bta_sdp_cb.sdp_active = BTA_SDP_ACTIVE_NONE;
@@ -558,7 +562,7 @@ void bta_sdp_create_record(tBTA_SDP_MSG *p_data)
     APPL_TRACE_DEBUG("%s() event: %d\n", __func__, p_data->record.hdr.event);
     tBTA_SDP_CREATE_RECORD_USER bta_sdp = {0};
     bta_sdp.status = BTA_SDP_SUCCESS;
-    bta_sdp.handle = (int)p_data->record.user_data;
+    bta_sdp.handle = -1;
     if (bta_sdp_cb.p_dm_cback) {
         bta_sdp_cb.p_dm_cback(BTA_SDP_CREATE_RECORD_USER_EVT, (tBTA_SDP *)&bta_sdp, p_data->record.user_data);
     }
@@ -576,10 +580,30 @@ void bta_sdp_create_record(tBTA_SDP_MSG *p_data)
 void bta_sdp_remove_record(tBTA_SDP_MSG *p_data)
 {
     APPL_TRACE_DEBUG("%s() event: %d\n", __func__, p_data->record.hdr.event);
+    tBTA_SDP_REMOVE_RECORD_USER bta_sdp;
+    bta_sdp.status = BTA_SDP_SUCCESS;
+    bta_sdp.handle = -1;
+    if (bta_sdp_cb.p_dm_cback) {
+        bta_sdp_cb.p_dm_cback(BTA_SDP_REMOVE_RECORD_USER_EVT, (tBTA_SDP *)&bta_sdp, p_data->record.user_data);
+    }
+}
+
+/*******************************************************************************
+**
+** Function     bta_sdp_disable
+**
+** Description  Removes an SDP record
+**
+** Returns      void
+**
+*******************************************************************************/
+void bta_sdp_disable(tBTA_SDP_MSG *p_data)
+{
+    APPL_TRACE_DEBUG("%s()\n", __func__);
     tBTA_SDP bta_sdp;
     bta_sdp.status = BTA_SDP_SUCCESS;
     if (bta_sdp_cb.p_dm_cback) {
-        bta_sdp_cb.p_dm_cback(BTA_SDP_REMOVE_RECORD_USER_EVT, &bta_sdp, p_data->record.user_data);
+        bta_sdp_cb.p_dm_cback(BTA_SDP_DISABLE_EVT, &bta_sdp, NULL);
     }
 }
 

components/bt/host/bluedroid/bta/sdp/bta_sdp_api.c

@@ -65,7 +65,9 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback)
 #if BTA_DYNAMIC_MEMORY == TRUE
     /* Malloc buffer for SDP configuration structure */
     p_bta_sdp_cfg->p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(p_bta_sdp_cfg->sdp_db_size);
-    if (p_bta_sdp_cfg->p_sdp_db == NULL) {
+    p_bta_sdp_cfg->p_sdp_raw_data = (UINT8 *)osi_malloc(p_bta_sdp_cfg->sdp_raw_size);
+    if (p_bta_sdp_cfg->p_sdp_db == NULL || p_bta_sdp_cfg->p_sdp_raw_data == NULL) {
+        BTA_SdpCleanup();
         return BTA_SDP_FAILURE;
     }
 #endif
@@ -101,15 +103,34 @@ tBTA_SDP_STATUS BTA_SdpEnable(tBTA_SDP_DM_CBACK *p_cback)
 *******************************************************************************/
 tBTA_SDP_STATUS BTA_SdpDisable(void)
 {
+    BT_HDR  *p_buf = NULL;
     tBTA_SDP_STATUS status = BTA_SDP_SUCCESS;
 
+    if ((p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR))) != NULL) {
+        p_buf->event = BTA_SDP_API_DISABLE_EVT;
+        bta_sys_sendmsg(p_buf);
+        status = BTA_SDP_FAILURE;
+    }
+
+    return status;
+}
+
+tBTA_SDP_STATUS BTA_SdpCleanup(void)
+{
     bta_sys_deregister(BTA_ID_SDP);
 #if BTA_DYNAMIC_MEMORY == TRUE
     /* Free buffer for SDP configuration structure */
-    osi_free(p_bta_sdp_cfg->p_sdp_db);
-    p_bta_sdp_cfg->p_sdp_db = NULL;
+    if (p_bta_sdp_cfg->p_sdp_db) {
+        osi_free(p_bta_sdp_cfg->p_sdp_db);
+        p_bta_sdp_cfg->p_sdp_db = NULL;
+    }
+
+    if (p_bta_sdp_cfg->p_sdp_raw_data) {
+        osi_free(p_bta_sdp_cfg->p_sdp_raw_data);
+        p_bta_sdp_cfg->p_sdp_raw_data = NULL;
+    }
 #endif
-    return (status);
+    return BTA_SDP_SUCCESS;
 }
 
 /*******************************************************************************

components/bt/host/bluedroid/bta/sdp/bta_sdp_cfg.c

@@ -30,16 +30,24 @@
 #define BTA_SDP_DB_SIZE  1500
 #endif
 
+#ifndef BTA_SDP_RAW_DATA_SIZE
+#define BTA_SDP_RAW_DATA_SIZE 1024
+#endif
+
 #if BTA_DYNAMIC_MEMORY == FALSE
+static UINT8 bta_sdp_raw_data[BTA_SDP_RAW_DATA_SIZE];
 static UINT8 __attribute__ ((aligned(4))) bta_sdp_db_data[BTA_SDP_DB_SIZE];
 #endif
 
 /* SDP configuration structure */
 tBTA_SDP_CFG bta_sdp_cfg = {
+    BTA_SDP_RAW_DATA_SIZE,
     BTA_SDP_DB_SIZE,
 #if BTA_DYNAMIC_MEMORY == FALSE
+    bta_sdp_raw_data,
     (tSDP_DISCOVERY_DB *)bta_sdp_db_data /* The data buffer to keep SDP database */
 #else
+    NULL,
     NULL
 #endif
 };

components/bt/host/bluedroid/bta/sdp/include/bta_sdp_int.h

@@ -42,6 +42,7 @@ enum {
     BTA_SDP_API_SEARCH_EVT,
     BTA_SDP_API_CREATE_RECORD_USER_EVT,
     BTA_SDP_API_REMOVE_RECORD_USER_EVT,
+    BTA_SDP_API_DISABLE_EVT,
     BTA_SDP_MAX_INT_EVT
 };
 
@@ -105,6 +106,7 @@ extern void bta_sdp_enable (tBTA_SDP_MSG *p_data);
 extern void bta_sdp_search (tBTA_SDP_MSG *p_data);
 extern void bta_sdp_create_record(tBTA_SDP_MSG *p_data);
 extern void bta_sdp_remove_record(tBTA_SDP_MSG *p_data);
+extern void bta_sdp_disable(tBTA_SDP_MSG *p_data);
 
 #endif  ///SDP_INCLUDED == TRUE
 

components/bt/host/bluedroid/btc/profile/std/avrc/btc_avrc.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -40,7 +40,7 @@ static void btc_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 c
 **  Static variables
 ******************************************************************************/
 
-/* flag indicating wheter TG/CT is initialized */
+/* flag indicating whether TG/CT is initialized */
 static uint32_t s_rc_ct_init;
 static uint32_t s_rc_tg_init;
 
@@ -751,7 +751,7 @@ static void btc_rc_upstreams_evt(UINT16 event, tAVRC_COMMAND *pavrc_cmd, UINT8 c
 
         btc_rc_cb.rc_ntf[event_id - 1].registered = TRUE;
         btc_rc_cb.rc_ntf[event_id - 1].label = label;
-        BTC_TRACE_EVENT("%s: New registerd notification: event_id:0x%x, label:0x%x",
+        BTC_TRACE_EVENT("%s: New register notification: event_id:0x%x, label:0x%x",
                         __FUNCTION__, event_id, label);
 
         // set up callback
@@ -947,7 +947,7 @@ void btc_rc_handler(tBTA_AV_EVT event, tBTA_AV *p_data)
                 memset(&param, 0, sizeof(esp_avrc_ct_cb_param_t));
                 param.conn_stat.connected = true;
                 memcpy(param.conn_stat.remote_bda, btc_rc_cb.rc_addr, sizeof(esp_bd_addr_t));
-                btc_avrc_tg_cb_to_app(ESP_AVRC_CT_CONNECTION_STATE_EVT, &param);
+                btc_avrc_tg_cb_to_app(ESP_AVRC_TG_CONNECTION_STATE_EVT, &param);
             }
         } while (0);
         btc_rc_cb.rc_features = p_data->rc_feat.peer_features;
@@ -1041,7 +1041,7 @@ static void btc_avrc_ct_deinit(void)
     BTC_TRACE_API("## %s ##", __FUNCTION__);
 
     if (g_a2dp_on_deinit) {
-        BTC_TRACE_WARNING("A2DP already deinit, AVRC CT shuold deinit in advance of A2DP !!!");
+        BTC_TRACE_WARNING("A2DP already deinit, AVRC CT should deinit in advance of A2DP !!!");
     }
 
     if (s_rc_ct_init != BTC_RC_CT_INIT_MAGIC) {
@@ -1255,7 +1255,7 @@ static bt_status_t btc_avrc_ct_send_passthrough_cmd(uint8_t tl, uint8_t key_code
         BTA_AvRemoteCmd(btc_rc_cb.rc_handle, tl,
                         (tBTA_AV_RC)key_code, (tBTA_AV_STATE)key_state);
         status =  BT_STATUS_SUCCESS;
-        BTC_TRACE_API("%s: succesfully sent passthrough command to BTA", __FUNCTION__);
+        BTC_TRACE_API("%s: successfully sent passthrough command to BTA", __FUNCTION__);
     } else {
         status = BT_STATUS_FAIL;
         BTC_TRACE_DEBUG("%s: feature not supported", __FUNCTION__);
@@ -1298,7 +1298,7 @@ static void btc_avrc_tg_init(void)
         }
 
         if (g_a2dp_on_init) {
-            BTC_TRACE_WARNING("AVRC Taget is expected to be initialized in advance of A2DP !!!");
+            BTC_TRACE_WARNING("AVRC Target is expected to be initialized in advance of A2DP !!!");
         }
     }
 
@@ -1320,7 +1320,7 @@ static void btc_avrc_tg_deinit(void)
     BTC_TRACE_API("## %s ##", __FUNCTION__);
 
     if (g_a2dp_on_deinit) {
-        BTC_TRACE_WARNING("A2DP already deinit, AVRC TG shuold deinit in advance of A2DP !!!");
+        BTC_TRACE_WARNING("A2DP already deinit, AVRC TG should deinit in advance of A2DP !!!");
     }
 
     if (s_rc_tg_init != BTC_RC_TG_INIT_MAGIC) {

components/bt/host/bluedroid/btc/profile/std/gatt/btc_gatts.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -469,7 +469,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
                 if(gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_16 &&
                    gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_32 &&
                    gatts_attr_db[i+1].att_desc.uuid_length != ESP_UUID_LEN_128) {
-                    BTC_TRACE_ERROR("%s, The Charateristic uuid length = %d is invalid", __func__,\
+                    BTC_TRACE_ERROR("%s, The Characteristic uuid length = %d is invalid", __func__,\
                         gatts_attr_db[i+1].att_desc.uuid_length);
                     return ESP_GATT_INVALID_ATTR_LEN;
                 }
@@ -481,7 +481,7 @@ static esp_gatt_status_t btc_gatts_check_valid_attr_tab(esp_gatts_attr_db_t *gat
                         uuid == ESP_GATT_UUID_CHAR_SRVR_CONFIG || uuid == ESP_GATT_UUID_CHAR_PRESENT_FORMAT ||
                         uuid == ESP_GATT_UUID_CHAR_AGG_FORMAT || uuid == ESP_GATT_UUID_CHAR_VALID_RANGE ||
                         uuid == ESP_GATT_UUID_EXT_RPT_REF_DESCR || uuid == ESP_GATT_UUID_RPT_REF_DESCR) {
-                        BTC_TRACE_ERROR("%s, The charateristic value uuid = %d is invalid", __func__, uuid);
+                        BTC_TRACE_ERROR("%s, The characteristic value uuid = %d is invalid", __func__, uuid);
                         return ESP_GATT_INVALID_PDU;
                     }
                 }
@@ -694,6 +694,7 @@ void btc_gatts_call_handler(btc_msg_t *msg)
         }
 
         param.rsp.status = 0;
+        param.rsp.conn_id = BTC_GATT_GET_CONN_ID(arg->send_rsp.conn_id);
         btc_gatts_cb_to_app(ESP_GATTS_RESPONSE_EVT, BTC_GATT_GET_GATT_IF(arg->send_rsp.conn_id), &param);
         break;
     }

components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c

@@ -341,6 +341,13 @@ static void btc_hd_register_app(esp_hidd_app_param_t *p_app_param, esp_hidd_qos_
         btc_hd_cb.out_qos.access_latency = p_out_qos->access_latency;
         btc_hd_cb.out_qos.delay_variation = p_out_qos->delay_variation;
 
+        // Copy SDP record information for DID (Device Identification Profile)
+        btc_hd_cb.app_info.vendor_id = p_app_param->vendor_id;
+        btc_hd_cb.app_info.product_id = p_app_param->product_id;
+        btc_hd_cb.app_info.version = p_app_param->version;
+        btc_hd_cb.app_info.vendor_id_source = p_app_param->vendor_id_source;
+
+
         BTA_HdRegisterApp(&btc_hd_cb.app_info, &btc_hd_cb.in_qos, &btc_hd_cb.out_qos);
     } while(0);
 

components/bt/host/bluedroid/btc/profile/std/include/bt_sdp.h

@@ -34,55 +34,43 @@ typedef enum {
     SDP_TYPE_PBAP_PSE,   // Phone Book Profile - Server
     SDP_TYPE_PBAP_PCE,   // Phone Book Profile - Client
     SDP_TYPE_OPP_SERVER, // Object Push Profile
-    SDP_TYPE_SAP_SERVER  // SIM Access Profile
+    SDP_TYPE_SAP_SERVER, // SIM Access Profile
 } bluetooth_sdp_types;
 
-typedef struct _bluetooth_sdp_hdr {
-    bluetooth_sdp_types type;
-    esp_bt_uuid_t       uuid;
-    uint32_t    service_name_length;
-    char       *service_name;
-    int32_t     rfcomm_channel_number;
-    int32_t     l2cap_psm;
-    int32_t     profile_version;
-} bluetooth_sdp_hdr;
-
 /**
  * Some signals need additional pointers, hence we introduce a
  * generic way to handle these pointers.
  */
 typedef struct _bluetooth_sdp_hdr_overlay {
     bluetooth_sdp_types type;
-    esp_bt_uuid_t       bt_uuid;
-    uint32_t    service_name_length;
-    char       *service_name;
-    int32_t     rfcomm_channel_number;
-    int32_t     l2cap_psm;
-    int32_t     profile_version;
-
-    // User pointers, only used for some signals - see bluetooth_sdp_ops_record
-    int         user1_ptr_len;
-    uint8_t    *user1_ptr;
-    int         user2_ptr_len;
-    uint8_t    *user2_ptr;
+    esp_bt_uuid_t       uuid;
+    uint32_t            service_name_length;
+    char               *service_name;
+    int32_t             rfcomm_channel_number;
+    int32_t             l2cap_psm;
+    int32_t             profile_version;
+    int                 user1_ptr_len;
+    uint8_t            *user1_ptr;
+    int                 user2_ptr_len; // not used
+    uint8_t            *user2_ptr;     // not used
 } bluetooth_sdp_hdr_overlay;
 
 typedef struct _bluetooth_sdp_mas_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    mas_instance_id;
-    uint32_t    supported_features;
-    uint32_t    supported_message_types;
+    uint32_t                  mas_instance_id;
+    uint32_t                  supported_features;
+    uint32_t                  supported_message_types;
 } bluetooth_sdp_mas_record;
 
 typedef struct _bluetooth_sdp_mns_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    supported_features;
+    uint32_t                  supported_features;
 } bluetooth_sdp_mns_record;
 
 typedef struct _bluetooth_sdp_pse_record {
     bluetooth_sdp_hdr_overlay hdr;
-    uint32_t    supported_features;
-    uint32_t    supported_repositories;
+    uint32_t                  supported_features;
+    uint32_t                  supported_repositories;
 } bluetooth_sdp_pse_record;
 
 typedef struct _bluetooth_sdp_pce_record {
@@ -91,8 +79,8 @@ typedef struct _bluetooth_sdp_pce_record {
 
 typedef struct _bluetooth_sdp_ops_record {
     bluetooth_sdp_hdr_overlay hdr;
-    int         supported_formats_list_len;
-    uint8_t     supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];
+    int                       supported_formats_list_len;
+    uint8_t                   supported_formats_list[SDP_OPP_SUPPORTED_FORMATS_MAX_LENGTH];
 } bluetooth_sdp_ops_record;
 
 typedef struct _bluetooth_sdp_sap_record {
@@ -100,13 +88,13 @@ typedef struct _bluetooth_sdp_sap_record {
 } bluetooth_sdp_sap_record;
 
 typedef union {
-    bluetooth_sdp_hdr_overlay   hdr;
-    bluetooth_sdp_mas_record    mas;
-    bluetooth_sdp_mns_record    mns;
-    bluetooth_sdp_pse_record    pse;
-    bluetooth_sdp_pce_record    pce;
-    bluetooth_sdp_ops_record    ops;
-    bluetooth_sdp_sap_record    sap;
+    bluetooth_sdp_hdr_overlay hdr;
+    bluetooth_sdp_mas_record  mas;
+    bluetooth_sdp_mns_record  mns;
+    bluetooth_sdp_pse_record  pse;
+    bluetooth_sdp_pce_record  pce;
+    bluetooth_sdp_ops_record  ops;
+    bluetooth_sdp_sap_record  sap;
 } bluetooth_sdp_record;
 
 #endif /* __BT_SDP_H__ */

components/bt/host/bluedroid/btc/profile/std/include/btc_sdp.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -32,9 +32,9 @@ typedef union {
     } search;
 
     //BTC_SDP_ACT_CREATE_RECORD
-    struct creat_record_arg {
+    struct create_record_arg {
         bluetooth_sdp_record *record;
-    } creat_record;
+    } create_record;
 
     //BTC_SDP_ACT_REMOVE_RECORD
     struct remove_record_arg {

components/bt/host/bluedroid/btc/profile/std/sdp/btc_sdp.c

@@ -25,12 +25,14 @@ typedef enum {
 } sdp_state_t;
 
 typedef struct {
-    sdp_state_t state;
+    uint8_t state;
     int sdp_handle;
-    bluetooth_sdp_record* record_data;
+    esp_bt_uuid_t uuid;
+    void* record_data;
 } sdp_slot_t;
 
 typedef struct {
+    bool search_allowed;
     sdp_slot_t *sdp_slots[SDP_MAX_RECORDS];
     osi_mutex_t sdp_slot_mutex;
 } sdp_local_param_t;
@@ -48,6 +50,21 @@ static sdp_local_param_t *sdp_local_param_ptr;
 #define is_sdp_init() (&sdp_local_param != NULL && sdp_local_param.sdp_slot_mutex != NULL)
 #endif
 
+static void btc_sdp_cleanup(void)
+{
+#if SDP_DYNAMIC_MEMORY == TRUE
+    if (sdp_local_param_ptr) {
+#endif
+        if (sdp_local_param.sdp_slot_mutex) {
+            osi_mutex_free(&sdp_local_param.sdp_slot_mutex);
+            sdp_local_param.sdp_slot_mutex = NULL;
+        }
+#if SDP_DYNAMIC_MEMORY == TRUE
+        osi_free(sdp_local_param_ptr);
+        sdp_local_param_ptr = NULL;
+    }
+#endif
+}
 
 static inline void btc_sdp_cb_to_app(esp_sdp_cb_event_t event, esp_sdp_cb_param_t *param)
 {
@@ -57,46 +74,25 @@ static inline void btc_sdp_cb_to_app(esp_sdp_cb_event_t event, esp_sdp_cb_param_
     }
 }
 
-static void sdp_disable_handler(void)
+static int get_sdp_record_size(bluetooth_sdp_record* in_record)
 {
-    btc_msg_t msg;
-    bt_status_t status;
-
-    msg.sig = BTC_SIG_API_CB;
-    msg.pid = BTC_PID_SDP;
-    msg.act = BTA_SDP_DISENABLE_EVT;
-
-    status = btc_transfer_context(&msg, NULL, 0, NULL, NULL);
-
-    if (status != BT_STATUS_SUCCESS) {
-        BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
-    }
-}
-
-static int get_sdp_records_size(bluetooth_sdp_record* in_record, int count)
-{
-    bluetooth_sdp_record* record = in_record;
+    bluetooth_sdp_record *record = in_record;
     int records_size = 0;
 
-    for(int i = 0; i < count; i++) {
-        record = &in_record[i];
-        records_size += sizeof(bluetooth_sdp_record);
-        records_size += record->hdr.service_name_length;
-        if(record->hdr.service_name_length > 0){
-            records_size++; /* + '\0' termination of string */
-        }
-        records_size += record->hdr.user1_ptr_len;
-        records_size += record->hdr.user2_ptr_len;
+    records_size += sizeof(bluetooth_sdp_record);
+    records_size += record->hdr.service_name_length;
+    if (record->hdr.service_name_length > 0) {
+        records_size++; /* + '\0' termination of string */
     }
 
     return records_size;
 }
 
-static void set_sdp_handle(int id, int handle)
+static void set_sdp_slot_info(int id, int sdp_handle, esp_bt_uuid_t *uuid)
 {
     sdp_slot_t *slot = NULL;
 
-    BTC_TRACE_DEBUG("%s() id=%d to handle=0x%08x", __func__, id, handle);
+    BTC_TRACE_DEBUG("%s() id=%d to sdp_handle=0x%08x", __func__, id, sdp_handle);
 
     if(id >= SDP_MAX_RECORDS) {
         BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
@@ -104,34 +100,64 @@ static void set_sdp_handle(int id, int handle)
     }
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    slot = sdp_local_param.sdp_slots[id];
-    if (slot == NULL) {
-        osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-        BTC_TRACE_ERROR("%s() id=%d to handle=0x%08x, set failed", __func__, id, handle);
-        return;
-    }
-    slot->sdp_handle = handle;
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+        slot->sdp_handle = sdp_handle;
+        slot->record_data = NULL;
+        if (uuid) {
+            memcpy(&slot->uuid, uuid, sizeof(esp_bt_uuid_t));
+        } else {
+            memset(&slot->uuid, 0, sizeof(esp_bt_uuid_t));
+        }
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
 }
 
-
-static bool get_sdp_record_by_handle(int handle, bluetooth_sdp_record* record)
+static void get_sdp_slot_info(int id, int *sdp_handle, esp_bt_uuid_t *uuid)
 {
     sdp_slot_t *slot = NULL;
 
-    osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-
-    for (int i = 0; i < SDP_MAX_RECORDS; i++) {
-        slot = sdp_local_param.sdp_slots[i];
-        if ((slot != NULL) && (slot->sdp_handle == handle)) {
-            memcpy(record, slot->record_data, sizeof(bluetooth_sdp_record));
-            osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-            return true;
-        }
+    if(id >= SDP_MAX_RECORDS) {
+        BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
+        return;
     }
 
+    osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+
+        if (sdp_handle) {
+            *sdp_handle = slot->sdp_handle;
+        }
+
+        if (uuid) {
+            memcpy(uuid, &slot->uuid, sizeof(esp_bt_uuid_t));
+        }
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
-    return false;
 }
 
 static int get_sdp_slot_id_by_handle(int handle)
@@ -152,9 +178,10 @@ static int get_sdp_slot_id_by_handle(int handle)
     return -1;
 }
 
-static sdp_slot_t *start_create_sdp(int id)
+static bluetooth_sdp_record *start_create_sdp(int id)
 {
-    sdp_slot_t *sdp_slot = NULL;
+    sdp_slot_t *slot = NULL;
+    bluetooth_sdp_record* record_data = NULL;
 
     if(id >= SDP_MAX_RECORDS) {
         BTC_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
@@ -162,62 +189,58 @@ static sdp_slot_t *start_create_sdp(int id)
     }
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    sdp_slot = sdp_local_param.sdp_slots[id];
-    if (sdp_slot == NULL) {
-        BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
-    } else if(sdp_slot->state != SDP_RECORD_ALLOCED) {
-        BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__,
-                id, sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
-        /* The record have been removed before this event occurred - e.g. deinit */
-        sdp_slot = NULL;
-    }
+
+    do {
+        slot = sdp_local_param.sdp_slots[id];
+        if (slot == NULL) {
+            BTC_TRACE_ERROR("%s() id = %d ", __func__, id);
+            break;
+        }
+
+        if (slot->state != SDP_RECORD_ALLOCED) {
+            BTC_TRACE_ERROR("%s() failed - state for id %d is state = %d expected %d", __func__, id,
+                            sdp_local_param.sdp_slots[id]->state, SDP_RECORD_ALLOCED);
+            break;
+        }
+        record_data = slot->record_data;
+    } while (0);
+
     osi_mutex_unlock(&sdp_local_param.sdp_slot_mutex);
 
-    return sdp_slot;
+    return record_data;
 }
 
 /* Deep copy all content of in_records into out_records.
  * out_records must point to a chunk of memory large enough to contain all
  * the data. Use getSdpRecordsSize() to calculate the needed size. */
-static void copy_sdp_records(bluetooth_sdp_record* in_records, bluetooth_sdp_record* out_records, int count)
+static void copy_sdp_record_common(bluetooth_sdp_record* in_record, bluetooth_sdp_record* out_record)
 {
-    bluetooth_sdp_record *in_record;
-    bluetooth_sdp_record *out_record;
-    char *free_ptr = (char*)(&out_records[count]); /* set pointer to after the last entry */
+    uint8_t *free_ptr = (uint8_t *)(out_record + 1); /* set pointer to after the last entry */
 
-    for(int i = 0; i < count; i++) {
-        in_record = &in_records[i];
-        out_record = &out_records[i];
-        *out_record = *in_record;
+    memcpy(out_record, in_record, sizeof(bluetooth_sdp_record));
 
-        if(in_record->hdr.service_name == NULL || in_record->hdr.service_name_length == 0) {
-            out_record->hdr.service_name = NULL;
-            out_record->hdr.service_name_length = 0;
-        } else {
-            out_record->hdr.service_name = free_ptr; // Update service_name pointer
-            // Copy string
-            memcpy(free_ptr, in_record->hdr.service_name, in_record->hdr.service_name_length);
-            free_ptr += in_record->hdr.service_name_length;
-            *(free_ptr) = '\0'; // Set '\0' termination of string
-            free_ptr++;
-        }
-        if(in_record->hdr.user1_ptr != NULL) {
-            out_record->hdr.user1_ptr = (UINT8*)free_ptr; // Update pointer
-            memcpy(free_ptr, in_record->hdr.user1_ptr, in_record->hdr.user1_ptr_len); // Copy content
-            free_ptr += in_record->hdr.user1_ptr_len;
-        }
-        if(in_record->hdr.user2_ptr != NULL) {
-            out_record->hdr.user2_ptr = (UINT8*)free_ptr; // Update pointer
-            memcpy(free_ptr, in_record->hdr.user2_ptr, in_record->hdr.user2_ptr_len); // Copy content
-            free_ptr += in_record->hdr.user2_ptr_len;
-        }
+    if (in_record->hdr.service_name == NULL || in_record->hdr.service_name_length == 0) {
+        out_record->hdr.service_name = NULL;
+        out_record->hdr.service_name_length = 0;
+    } else {
+        out_record->hdr.service_name = (char *)free_ptr; // Update service_name pointer
+        // Copy string
+        memcpy(free_ptr, in_record->hdr.service_name, in_record->hdr.service_name_length);
+        free_ptr += in_record->hdr.service_name_length;
+        *(free_ptr) = '\0'; // Set '\0' termination of string
+        free_ptr++;
     }
 }
 
+static void copy_sdp_record(bluetooth_sdp_record* in_record, bluetooth_sdp_record* out_record)
+{
+    copy_sdp_record_common(in_record, out_record);
+}
+
 static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
 {
     int i;
-    int record_size = get_sdp_records_size(in_record, 1);
+    int record_size = get_sdp_record_size(in_record);
     bluetooth_sdp_record *record = NULL;
     sdp_slot_t **slot = NULL;
 
@@ -227,11 +250,10 @@ static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
         return -1;
     }
 
-    copy_sdp_records(in_record, record, 1);
+    copy_sdp_record(in_record, record);
 
     osi_mutex_lock(&sdp_local_param.sdp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
-    for(i = 0; i < SDP_MAX_RECORDS; i++)
-    {
+    for (i = 0; i < SDP_MAX_RECORDS; i++) {
         slot = &sdp_local_param.sdp_slots[i];
         if ((*slot) == NULL) {
             if (((*slot) = (sdp_slot_t *)osi_malloc(sizeof(sdp_slot_t))) == NULL) {
@@ -240,8 +262,8 @@ static int alloc_sdp_slot(bluetooth_sdp_record* in_record)
                 osi_free(record);
                 return -1;
             }
-            (*slot)->state = SDP_RECORD_ALLOCED;
-            (*slot)->record_data = record;
+            (*slot)->state           = SDP_RECORD_ALLOCED;
+            (*slot)->record_data     = record;
             break;
         }
     }
@@ -292,7 +314,7 @@ static int free_sdp_slot(int id)
 }
 
 /* Create a raw SDP record based on information stored in a bluetooth_sdp_raw_record */
-static int add_raw_sdp(const bluetooth_sdp_record* rec)
+static int add_raw_sdp(const bluetooth_sdp_record *rec)
 {
     tSDP_PROTOCOL_ELEM  protoList [2];
     UINT16              browse = UUID_SERVCLASS_PUBLIC_BROWSE_GROUP;
@@ -301,6 +323,7 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
     UINT8               temp[LEN_UUID_128];
     UINT8*              p_temp = temp;
     UINT32              sdp_handle = 0;
+    const esp_bt_uuid_t *p_uuid = &rec->hdr.uuid;
 
     BTC_TRACE_DEBUG("%s(): scn 0x%02x, psm = 0x%04x\n  service name %s", __func__,
             rec->hdr.rfcomm_channel_number, rec->hdr.l2cap_psm, rec->hdr.service_name);
@@ -310,15 +333,15 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
         return sdp_handle;
     }
 
-    if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_16) {
+    if (p_uuid->len == ESP_UUID_LEN_16) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES);
-        UINT16_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid16);
-    } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_32) {
+        UINT16_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid16);
+    } else if (p_uuid->len == ESP_UUID_LEN_32) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_FOUR_BYTES);
-        UINT32_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid32);
-    } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_128) {
+        UINT32_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid32);
+    } else if (p_uuid->len == ESP_UUID_LEN_128) {
         UINT8_TO_BE_STREAM (p_temp, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES);
-        ARRAY_TO_BE_STREAM (p_temp, rec->hdr.bt_uuid.uuid.uuid128, LEN_UUID_128);
+        ARRAY_TO_BE_STREAM (p_temp, p_uuid->uuid.uuid128, LEN_UUID_128);
     } else {
         SDP_DeleteRecord(sdp_handle);
         sdp_handle = 0;
@@ -357,7 +380,7 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -365,12 +388,12 @@ static int add_raw_sdp(const bluetooth_sdp_record* rec)
         sdp_handle = 0;
         BTC_TRACE_ERROR("%s() FAILED, status = %d", __func__, status);
     } else {
-        if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_16) {
-            bta_sys_add_uuid(rec->hdr.bt_uuid.uuid.uuid16);
-        } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_32) {
-            bta_sys_add_uuid_32(rec->hdr.bt_uuid.uuid.uuid32);
-        } else if (rec->hdr.bt_uuid.len == ESP_UUID_LEN_128) {
-            bta_sys_add_uuid_128((UINT8 *)&rec->hdr.bt_uuid.uuid.uuid128);
+        if (p_uuid->len == ESP_UUID_LEN_16) {
+            bta_sys_add_uuid(p_uuid->uuid.uuid16);
+        } else if (p_uuid->len == ESP_UUID_LEN_32) {
+            bta_sys_add_uuid_32(p_uuid->uuid.uuid32);
+        } else if (p_uuid->len == ESP_UUID_LEN_128) {
+            bta_sys_add_uuid_128((UINT8 *)&p_uuid->uuid.uuid128);
         }
         BTC_TRACE_DEBUG("%s():  SDP Registered (handle 0x%08x)", __func__, sdp_handle);
     }
@@ -448,7 +471,7 @@ static int add_maps_sdp(const bluetooth_sdp_mas_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -523,7 +546,7 @@ static int add_mapc_sdp(const bluetooth_sdp_mns_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -603,7 +626,7 @@ static int add_pbaps_sdp(const bluetooth_sdp_pse_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -649,7 +672,7 @@ static int add_pbapc_sdp(const bluetooth_sdp_pce_record* rec)
                                      UUID_SERVCLASS_PHONE_ACCESS,
                                      rec->hdr.profile_version);
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -736,7 +759,7 @@ static int add_opps_sdp(const bluetooth_sdp_ops_record* rec)
                 UINT_DESC_TYPE, (UINT32)2, temp);
     }
 
-    /* Make the service browseable */
+    /* Make the service browsable */
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -799,7 +822,7 @@ static int add_saps_sdp(const bluetooth_sdp_sap_record* rec)
             UUID_SERVCLASS_SAP,
             rec->hdr.profile_version);
 
-    // Make the service browseable
+    // Make the service browsable
     status &= SDP_AddUuidSequence (sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, &browse);
 
     if (!status) {
@@ -816,64 +839,183 @@ static int add_saps_sdp(const bluetooth_sdp_sap_record* rec)
 
 static int btc_handle_create_record_event(int id)
 {
-    int handle = -1;
-    const sdp_slot_t *sdp_slot = NULL;
+    int sdp_handle = 0;
+    bluetooth_sdp_record *record = start_create_sdp(id);
+    esp_bt_uuid_t service_uuid = {0};
 
     BTC_TRACE_DEBUG("Sdp Server %s", __func__);
 
-    sdp_slot = start_create_sdp(id);
-    if(sdp_slot != NULL) {
-        bluetooth_sdp_record* record = sdp_slot->record_data;
-        switch(record->hdr.type) {
+    if (record != NULL) {
+        switch (record->hdr.type) {
         case SDP_TYPE_RAW:
-            handle = add_raw_sdp(record);
+            sdp_handle = add_raw_sdp(record);
+            memcpy(&service_uuid, &record->hdr.uuid, sizeof(esp_bt_uuid_t));
             break;
         case SDP_TYPE_MAP_MAS:
-            handle = add_maps_sdp(&record->mas);
+            sdp_handle = add_maps_sdp(&record->mas);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_MESSAGE_ACCESS;
             break;
         case SDP_TYPE_MAP_MNS:
-            handle = add_mapc_sdp(&record->mns);
+            sdp_handle = add_mapc_sdp(&record->mns);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_MESSAGE_NOTIFICATION;
             break;
         case SDP_TYPE_PBAP_PSE:
-            handle = add_pbaps_sdp(&record->pse);
+            sdp_handle = add_pbaps_sdp(&record->pse);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_PBAP_PSE;
             break;
         case SDP_TYPE_PBAP_PCE:
-            handle = add_pbapc_sdp(&record->pce);
+            sdp_handle = add_pbapc_sdp(&record->pce);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_PBAP_PCE;
             break;
         case SDP_TYPE_OPP_SERVER:
-            handle = add_opps_sdp(&record->ops);
+            sdp_handle = add_opps_sdp(&record->ops);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_OBEX_OBJECT_PUSH;
             break;
         case SDP_TYPE_SAP_SERVER:
-            handle = add_saps_sdp(&record->sap);
+            sdp_handle = add_saps_sdp(&record->sap);
+            service_uuid.len = ESP_UUID_LEN_16;
+            service_uuid.uuid.uuid16 = UUID_SERVCLASS_SAP;
             break;
         default:
-            BTC_TRACE_DEBUG("Record type %d is not supported",record->hdr.type);
+            BTC_TRACE_DEBUG("Record type %d is not supported", record->hdr.type);
             break;
         }
-        if(handle != -1) {
-            set_sdp_handle(id, handle);
+
+        if(sdp_handle != 0) {
+            set_sdp_slot_info(id, sdp_handle, &service_uuid);
+            // free the record, since not use it anymore
+            osi_free(record);
+        } else {
+            sdp_handle = -1;
         }
+    } else {
+        sdp_handle = -1;
     }
 
-    return handle;
+    if (sdp_handle == -1) {
+        free_sdp_slot(id);
+    }
+
+    return sdp_handle;
 }
 
-static bool btc_sdp_remove_record_event(int handle)
+static bool btc_sdp_remove_record_event(int id, int *p_sdp_handle)
 {
-    bool result = false;
-
     BTC_TRACE_DEBUG("Sdp Server %s", __func__);
 
-    if(handle != -1 && handle != 0) {
-        result = SDP_DeleteRecord(handle);
-        if(result == false) {
-            BTC_TRACE_ERROR("  Unable to remove handle 0x%08x", handle);
+    bool result = false;
+    int sdp_handle = -1;
+    esp_bt_uuid_t service_uuid = {0};
+
+    get_sdp_slot_info(id, &sdp_handle, &service_uuid);
+
+    if (sdp_handle > 0) {
+        do {
+            result = SDP_DeleteRecord(sdp_handle);
+            if (!result) {
+                BTC_TRACE_ERROR("Unable to remove handle 0x%08x", sdp_handle);
+                break;
+            }
+
+            if (service_uuid.len == ESP_UUID_LEN_16) {
+                bta_sys_remove_uuid(service_uuid.uuid.uuid16);
+            } else if (service_uuid.len == ESP_UUID_LEN_32) {
+                bta_sys_remove_uuid_32(service_uuid.uuid.uuid32);
+            } else if (service_uuid.len == ESP_UUID_LEN_128) {
+                bta_sys_remove_uuid_128((UINT8 *)&service_uuid.uuid.uuid128);
+            }
+        } while (0);
+
+        if (p_sdp_handle) {
+            *p_sdp_handle = sdp_handle;
         }
     }
 
     return result;
 }
 
+static void btc_sdp_cb_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
+{
+    switch (msg->act) {
+    case BTA_SDP_SEARCH_COMP_EVT: {
+        tBTA_SDP_SEARCH_COMP *src_search_comp = (tBTA_SDP_SEARCH_COMP *)p_src;
+        tBTA_SDP_SEARCH_COMP *dest_search_comp = (tBTA_SDP_SEARCH_COMP *)p_dest;
+        int record_count = src_search_comp->record_count;
+
+        for (int i = 0; i < record_count; i++) {
+            bluetooth_sdp_record *src_record = &src_search_comp->records[i];
+            bluetooth_sdp_record *dest_record = &dest_search_comp->records[i];
+            // deep copy service name
+            uint32_t src_service_name_length = src_record->hdr.service_name_length;
+            char *src_service_name = src_record->hdr.service_name;
+            dest_record->hdr.service_name_length = 0;
+            dest_record->hdr.service_name        = NULL;
+            if (src_service_name && src_service_name_length) {
+                char *service_name = (char *)osi_malloc(src_service_name_length + 1);
+                if (service_name) {
+                    memcpy(service_name, src_service_name, src_service_name_length);
+                    service_name[src_service_name_length] = '\0';
+
+                    dest_record->hdr.service_name_length = src_service_name_length;
+                    dest_record->hdr.service_name        = service_name;
+                } else {
+                    BTC_TRACE_ERROR("%s malloc service name failed, orig service name:%s", __func__, src_service_name);
+                }
+            }
+
+            // deep copy user1_ptr fow RAW type
+            int src_user1_ptr_len = src_record->hdr.user1_ptr_len;
+            uint8_t *src_user1_ptr = src_record->hdr.user1_ptr;
+            dest_record->hdr.user1_ptr_len = 0;
+            dest_record->hdr.user1_ptr     = NULL;
+            if (src_record->hdr.type == SDP_TYPE_RAW && src_user1_ptr && src_user1_ptr_len) {
+                uint8_t *user1_ptr = (uint8_t *)osi_malloc(src_user1_ptr_len);
+                if (user1_ptr) {
+                    memcpy(user1_ptr, src_user1_ptr, src_user1_ptr_len);
+
+                    dest_record->hdr.user1_ptr_len = src_user1_ptr_len;
+                    dest_record->hdr.user1_ptr     = user1_ptr;
+                } else {
+                    BTC_TRACE_ERROR("%s malloc user1_ptr failed", __func__);
+                }
+            }
+        }
+
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+static void btc_sdp_cb_arg_deep_free(btc_msg_t *msg)
+{
+    switch (msg->act) {
+    case BTA_SDP_SEARCH_COMP_EVT: {
+        tBTA_SDP_SEARCH_COMP *search_comp = (tBTA_SDP_SEARCH_COMP *)msg->arg;
+        for (size_t i = 0; i < search_comp->record_count; i++) {
+            bluetooth_sdp_record *record = &search_comp->records[i];
+            if (record->hdr.service_name) {
+                osi_free(record->hdr.service_name);
+            }
+
+            if (record->hdr.user1_ptr) {
+                osi_free(record->hdr.user1_ptr);
+            }
+        }
+
+        break;
+    }
+    default:
+        break;
+    }
+}
+
 static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_data)
 {
     btc_msg_t msg;
@@ -881,18 +1023,18 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
 
     switch (event) {
     case BTA_SDP_CREATE_RECORD_USER_EVT: {
-        if (p_data->status == BTA_SDP_SUCCESS) {
+        if (p_data->sdp_create_record.status == BTA_SDP_SUCCESS) {
             p_data->sdp_create_record.handle = btc_handle_create_record_event((int)user_data);
             if (p_data->sdp_create_record.handle < 0) {
-                p_data->status = BTA_SDP_FAILURE;
+                p_data->sdp_create_record.status = BTA_SDP_FAILURE;
             }
         }
     }
     break;
     case BTA_SDP_REMOVE_RECORD_USER_EVT: {
-        if (p_data->status == BTA_SDP_SUCCESS) {
-            if (btc_sdp_remove_record_event((int)user_data) == false) {
-                p_data->status = BTA_SDP_FAILURE;
+        if (p_data->sdp_remove_record.status == BTA_SDP_SUCCESS) {
+            if (btc_sdp_remove_record_event((int)user_data, &p_data->sdp_remove_record.handle) == false) {
+                p_data->sdp_remove_record.status = BTA_SDP_FAILURE;
             }
         }
     }
@@ -905,7 +1047,7 @@ static void btc_sdp_dm_cback(tBTA_SDP_EVT event, tBTA_SDP* p_data, void* user_da
     msg.pid = BTC_PID_SDP;
     msg.act = event;
 
-    status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), NULL, NULL);
+    status = btc_transfer_context(&msg, p_data, sizeof(tBTA_SDP), btc_sdp_cb_arg_deep_copy, btc_sdp_cb_arg_deep_free);
 
     if (status != BT_STATUS_SUCCESS) {
         BTC_TRACE_ERROR("%s btc_transfer_context failed", __func__);
@@ -930,23 +1072,27 @@ static void btc_sdp_init(void)
             ret = ESP_SDP_NO_RESOURCE;
             break;
         }
-        memset((void *)sdp_local_param_ptr, 0, sizeof(sdp_local_param_t));
 #endif
+        memset(&sdp_local_param, 0, sizeof(sdp_local_param_t));
 
         if (osi_mutex_new(&sdp_local_param.sdp_slot_mutex) != 0) {
-#if SDP_DYNAMIC_MEMORY == TRUE
-            osi_free(sdp_local_param_ptr);
-            sdp_local_param_ptr = NULL;
-#endif
             BTC_TRACE_ERROR("%s osi_mutex_new failed\n", __func__);
             ret = ESP_SDP_NO_RESOURCE;
             break;
         }
 
         ret = BTA_SdpEnable(btc_sdp_dm_cback);
+        if (ret != ESP_SDP_SUCCESS) {
+            BTC_TRACE_ERROR("%s BTA_SdpEnable failed, ret = %d\n", __func__, ret);
+            ret = ESP_SDP_FAILURE;
+            break;
+        }
+
+        sdp_local_param.search_allowed = true;
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
+        btc_sdp_cleanup();
         param.init.status = ret;
         btc_sdp_cb_to_app(ESP_SDP_INIT_EVT, &param);
     }
@@ -956,7 +1102,6 @@ static void btc_sdp_deinit(void)
 {
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
-    int handle;
 
     do {
         if (!is_sdp_init()) {
@@ -966,12 +1111,13 @@ static void btc_sdp_deinit(void)
         }
 
         for(int i = 0; i < SDP_MAX_RECORDS; i++) {
-            handle = free_sdp_slot(i);
-            if (handle > 0) {
-                BTA_SdpRemoveRecordByUser((void*)handle);
+            int sdp_handle = -1;
+            get_sdp_slot_info(i, &sdp_handle, NULL);
+            if (sdp_handle > 0) {
+                BTA_SdpRemoveRecordByUser((void*)i);
             }
         }
-        sdp_disable_handler();
+        BTA_SdpDisable();
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -982,7 +1128,7 @@ static void btc_sdp_deinit(void)
 
 static void btc_sdp_create_record(btc_sdp_args_t *arg)
 {
-    int handle;
+    int slot_id;
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
 
@@ -993,13 +1139,13 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg)
             break;
         }
 
-        handle = alloc_sdp_slot(arg->creat_record.record);
-        if (handle < 0) {
+        slot_id = alloc_sdp_slot(arg->create_record.record);
+        if (slot_id < 0) {
             ret = ESP_SDP_FAILURE;
             break;
         }
 
-        BTA_SdpCreateRecordByUser((void *) handle);
+        BTA_SdpCreateRecordByUser((void *) slot_id);
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1011,7 +1157,6 @@ static void btc_sdp_create_record(btc_sdp_args_t *arg)
 
 static void btc_sdp_remove_record(btc_sdp_args_t *arg)
 {
-    int handle;
     esp_sdp_cb_param_t param;
     esp_sdp_status_t ret = ESP_SDP_SUCCESS;
 
@@ -1022,42 +1167,16 @@ static void btc_sdp_remove_record(btc_sdp_args_t *arg)
             break;
         }
 
-        bluetooth_sdp_record rec;
-        if (get_sdp_record_by_handle(arg->remove_record.record_handle, &rec)) {
-            if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_16) {
-                bta_sys_remove_uuid(rec.hdr.bt_uuid.uuid.uuid16);
-            } else if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_32) {
-                bta_sys_remove_uuid_32(rec.hdr.bt_uuid.uuid.uuid32);
-            } else if (rec.hdr.bt_uuid.len == ESP_UUID_LEN_128) {
-                bta_sys_remove_uuid_128((UINT8 *)&rec.hdr.bt_uuid.uuid.uuid128);
-            }
-        } else {
-            BTC_TRACE_ERROR("%s SDP record with handle %d not found",
-                                __func__, arg->remove_record.record_handle);
-            ret = ESP_SDP_NO_CREATE_RECORD;
-            break;
-        }
-
         /* Get the Record handle, and free the slot */
         /* The application layer record_handle is equivalent to the id of the btc layer */
-        int slot = get_sdp_slot_id_by_handle(arg->remove_record.record_handle);
-        if (slot < 0) {
+        int slot_id = get_sdp_slot_id_by_handle(arg->remove_record.record_handle);
+        if (slot_id < 0) {
+            BTC_TRACE_ERROR("%s SDP record with handle %d not found", __func__, arg->remove_record.record_handle);
             ret = ESP_SDP_NO_CREATE_RECORD;
             break;
         }
 
-        handle = free_sdp_slot(slot);
-
-        BTC_TRACE_DEBUG("Sdp Server %s id=%d to handle=0x%08x",
-                    __func__, arg->remove_record.record_handle, handle);
-
-        /* Pass the actual record handle */
-        if(handle > 0) {
-            BTA_SdpRemoveRecordByUser((void*) handle);
-        } else {
-            ret = ESP_SDP_NO_CREATE_RECORD;
-            break;
-        }
+        BTA_SdpRemoveRecordByUser((void *)slot_id);
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1078,7 +1197,18 @@ static void btc_sdp_search(btc_sdp_args_t *arg)
             break;
         }
 
+        if (!sdp_local_param.search_allowed) {
+            BTC_TRACE_ERROR("%s SDP search is not allowed!", __func__);
+            ret = ESP_SDP_NO_RESOURCE;
+            break;
+        }
+
         BTA_SdpSearch(arg->search.bd_addr, &arg->search.sdp_uuid);
+        /**
+         * ESP_SDP_SEARCH_COMP_EVT will refer service name in BTA sdp database, so it is not allowed to be search until
+         * the previous search is completed
+         */
+        sdp_local_param.search_allowed = false;
     } while(0);
 
     if (ret != ESP_SDP_SUCCESS) {
@@ -1089,26 +1219,21 @@ static void btc_sdp_search(btc_sdp_args_t *arg)
 
 void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 {
-    btc_sdp_args_t *dst = (btc_sdp_args_t *)p_dest;
-    btc_sdp_args_t *src = (btc_sdp_args_t *)p_src;
-
     switch (msg->act) {
-    case BTC_SDP_ACT_CREATE_RECORD:
-        dst->creat_record.record = (bluetooth_sdp_record *)osi_calloc(sizeof(bluetooth_sdp_record));
-        if (dst->creat_record.record) {
-            memcpy(dst->creat_record.record, src->creat_record.record, sizeof(bluetooth_sdp_record));
+    case BTC_SDP_ACT_CREATE_RECORD: {
+        bluetooth_sdp_record **dst_record = &((btc_sdp_args_t *)p_dest)->create_record.record;
+        bluetooth_sdp_record *src_record = ((btc_sdp_args_t *)p_src)->create_record.record;
+        bluetooth_sdp_record *record = (bluetooth_sdp_record *)osi_calloc(get_sdp_record_size(src_record));
+        if (record) {
+            copy_sdp_record(src_record, record);
         } else {
             BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act);
             break;
         }
 
-        dst->creat_record.record->hdr.service_name = (char *)osi_calloc(src->creat_record.record->hdr.service_name_length);
-        if (dst->creat_record.record->hdr.service_name) {
-            strcpy(dst->creat_record.record->hdr.service_name, src->creat_record.record->hdr.service_name);
-        } else {
-            BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, msg->act);
-        }
+        *dst_record = record;
         break;
+    }
     default:
         break;
     }
@@ -1116,17 +1241,15 @@ void btc_sdp_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 
 void btc_sdp_arg_deep_free(btc_msg_t *msg)
 {
-    btc_sdp_args_t *arg = (btc_sdp_args_t *)msg->arg;
-
     switch (msg->act) {
-    case BTC_SDP_ACT_CREATE_RECORD:
-        if (arg->creat_record.record) {
-            osi_free(arg->creat_record.record);
-        }
-        if (arg->creat_record.record->hdr.service_name) {
-            osi_free(arg->creat_record.record->hdr.service_name);
+    case BTC_SDP_ACT_CREATE_RECORD: {
+        btc_sdp_args_t *arg = (btc_sdp_args_t *)msg->arg;
+        bluetooth_sdp_record *record = arg->create_record.record;
+        if (record) {
+            osi_free(record);
         }
         break;
+    }
     default:
         break;
     }
@@ -1172,35 +1295,22 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
         param.init.status = p_data->status;
         btc_sdp_cb_to_app(ESP_SDP_INIT_EVT, &param);
         break;
-    case BTA_SDP_DISENABLE_EVT:
-        BTA_SdpDisable();
-        osi_mutex_free(&sdp_local_param.sdp_slot_mutex);
- #if SDP_DYNAMIC_MEMORY == TRUE
-        osi_free(sdp_local_param_ptr);
-        sdp_local_param_ptr = NULL;
- #endif
+    case BTA_SDP_DISABLE_EVT:
+        BTA_SdpCleanup();
+        btc_sdp_cleanup();
         param.deinit.status = ESP_SDP_SUCCESS;
         btc_sdp_cb_to_app(ESP_SDP_DEINIT_EVT, &param);
         break;
     case BTA_SDP_SEARCH_COMP_EVT:
+        // SDP search completed, now can be searched again
+        sdp_local_param.search_allowed = true;
+
         param.search.status = p_data->sdp_search_comp.status;
-        if (param.search.status == ESP_SDP_SUCCESS) {
-            memcpy(param.search.remote_addr, p_data->sdp_search_comp.remote_addr, sizeof(BD_ADDR));
-            memcpy(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid, sizeof(tSDP_UUID));
-            param.search.record_count = p_data->sdp_search_comp.record_count;
-            param.search.records = osi_malloc(sizeof(esp_bluetooth_sdp_record_t)*p_data->sdp_search_comp.record_count);
-            if (param.search.records != NULL) {
-                memcpy(param.search.records, p_data->sdp_search_comp.records,
-                        sizeof(esp_bluetooth_sdp_record_t)*p_data->sdp_search_comp.record_count);
-            } else {
-                BTC_TRACE_ERROR("%s %d osi_malloc failed\n", __func__, event);
-                param.search.status = ESP_SDP_NO_RESOURCE;
-            }
-        }
+        memcpy(param.search.remote_addr, p_data->sdp_search_comp.remote_addr, sizeof(BD_ADDR));
+        memcpy(&param.search.sdp_uuid, &p_data->sdp_search_comp.uuid, sizeof(tSDP_UUID));
+        param.search.record_count = p_data->sdp_search_comp.record_count;
+        param.search.records = (esp_bluetooth_sdp_record_t *)p_data->sdp_search_comp.records;
         btc_sdp_cb_to_app(ESP_SDP_SEARCH_COMP_EVT, &param);
-        if (param.search.records != NULL) {
-            osi_free(param.search.records);
-        }
         break;
     case BTA_SDP_CREATE_RECORD_USER_EVT:
         param.create_record.status = p_data->sdp_create_record.status;
@@ -1208,13 +1318,25 @@ void btc_sdp_cb_handler(btc_msg_t *msg)
         btc_sdp_cb_to_app(ESP_SDP_CREATE_RECORD_COMP_EVT, &param);
         break;
     case BTA_SDP_REMOVE_RECORD_USER_EVT:
-        param.remove_record.status = p_data->status;
+        if (p_data->sdp_remove_record.status == BTA_SDP_SUCCESS) {
+            int slot_id = get_sdp_slot_id_by_handle(p_data->sdp_remove_record.handle);
+            if (slot_id < 0) {
+                p_data->sdp_remove_record.status = ESP_SDP_NO_CREATE_RECORD;
+                break;
+            } else {
+                free_sdp_slot(slot_id);
+            }
+        }
+
+        param.remove_record.status = p_data->sdp_remove_record.status;
         btc_sdp_cb_to_app(ESP_SDP_REMOVE_RECORD_COMP_EVT, &param);
         break;
     default:
         BTC_TRACE_DEBUG("%s: Unhandled event (%d)!", __func__, msg->act);
         break;
     }
+
+    btc_sdp_cb_arg_deep_free(msg);
 }
 
 #endif ///defined BTC_SDP_INCLUDED && BTC_SDP_INCLUDED == TRUE

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -48,16 +48,16 @@
 
 //L2CAP
 #ifdef CONFIG_BT_L2CAP_ENABLED
-#define UC_BT_L2CAP_ENABLED                   CONFIG_BT_L2CAP_ENABLED
+#define UC_BT_L2CAP_ENABLED                 CONFIG_BT_L2CAP_ENABLED
 #else
-#define UC_BT_L2CAP_ENABLED                   FALSE
+#define UC_BT_L2CAP_ENABLED                 FALSE
 #endif
 
 //HFP(AG)
 #ifdef CONFIG_BT_HFP_AG_ENABLE
-#define UC_BT_HFP_AG_ENABLED            CONFIG_BT_HFP_AG_ENABLE
+#define UC_BT_HFP_AG_ENABLED                CONFIG_BT_HFP_AG_ENABLE
 #else
-#define UC_BT_HFP_AG_ENABLED            FALSE
+#define UC_BT_HFP_AG_ENABLED                FALSE
 #endif
 
 //HFP(Client)

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -1282,7 +1282,7 @@
 #ifdef CONFIG_IDF_TARGET_ESP32
 #define BTM_BLE_ADV_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #else
-#define BTM_BLE_ADV_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 21}
+#define BTM_BLE_ADV_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 20}
 #endif
 #endif
 
@@ -1290,7 +1290,7 @@
 #ifdef CONFIG_IDF_TARGET_ESP32
 #define BTM_TX_POWER {-12, -9, -6, -3, 0, 3, 6, 9}
 #else
-#define BTM_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 21}
+#define BTM_TX_POWER {-24, -21, -18, -15, -12, -9, -6, -3, 0, 3, 6, 9, 12, 15, 18, 20}
 #endif
 #endif
 
@@ -1503,7 +1503,8 @@
 #endif
 
 #ifndef SDP_MAX_PAD_LEN
-#define SDP_MAX_PAD_LEN             300
+// HHL Custom Code we have to increase this to 500 to fit the full procon descriptor
+#define SDP_MAX_PAD_LEN             500
 #endif
 
 /* The maximum length, in bytes, of an attribute. */

components/bt/host/bluedroid/device/controller.c

@@ -269,7 +269,7 @@ static void start_up(void)
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)
 
 #if (BLE_50_FEATURE_SUPPORT == TRUE && BLE_42_FEATURE_SUPPORT == FALSE)
-        if (HCI_LE_ENHANCED_PRIVACY_SUPPORTED(controller_param.features_ble.as_array)) {
+        if (HCI_LE_EXT_ADV_SUPPORTED(controller_param.features_ble.as_array)) {
             response = AWAIT_COMMAND(controller_param.packet_factory->make_read_max_adv_data_len());
             controller_param.packet_parser->parse_ble_read_adv_max_len_response(
                 response,

components/bt/host/bluedroid/hci/hci_packet_parser.c

@@ -186,7 +186,9 @@ static void parse_ble_read_resolving_list_size_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_RESOLVING_LIST_SIZE, 1 /* bytes after */);
-    STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
+    if (stream) {
+        STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
+    }
 
     osi_free(response);
 }
@@ -198,10 +200,14 @@ static void parse_ble_read_suggested_default_data_length_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
-    STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
+    if (stream) {
+        STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+        STREAM_TO_UINT16(*ble_default_packet_txtime_ptr, stream);
+    }
+
     osi_free(response);
 }
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
 static void parse_ble_read_adv_max_len_response(
     BT_HDR *response,
@@ -209,8 +215,10 @@ static void parse_ble_read_adv_max_len_response(
 {
 
     uint8_t *stream = read_command_complete_header(response, HCI_BLE_RD_MAX_ADV_DATA_LEN, 1 /* bytes after */);
-    // Size: 2 Octets ; Value: 0x001F – 0x0672 ; Maximum supported advertising data length
-    STREAM_TO_UINT16(*adv_max_len_ptr, stream);
+    if (stream) {
+        // Size: 2 Octets ; Value: 0x001F – 0x0672 ; Maximum supported advertising data length
+        STREAM_TO_UINT16(*adv_max_len_ptr, stream);
+    }
 
     osi_free(response);
 }
@@ -254,6 +262,7 @@ static uint8_t *read_command_complete_header(
     STREAM_TO_UINT8(status, stream);
 
     if (status != HCI_SUCCESS) {
+        HCI_TRACE_ERROR("%s failed: opcode 0x%04x, status 0x%02x", __func__, opcode, status);
         return NULL;
     }
 

components/bt/host/bluedroid/stack/avct/avct_lcb.c

@@ -430,10 +430,10 @@ BOOLEAN avct_lcb_last_ccb(tAVCT_LCB *p_lcb, tAVCT_CCB *p_ccb_last)
     tAVCT_CCB   *p_ccb = &avct_cb.ccb[0];
     int         i;
 
-    AVCT_TRACE_WARNING("avct_lcb_last_ccb");
+    AVCT_TRACE_DEBUG("avct_lcb_last_ccb");
     for (i = 0; i < AVCT_NUM_CONN; i++, p_ccb++) {
-        AVCT_TRACE_WARNING("%x: aloc:%d, lcb:%p/%p, ccb:%p/%p",
-                           i, p_ccb->allocated, p_ccb->p_lcb, p_lcb, p_ccb, p_ccb_last);
+        AVCT_TRACE_DEBUG("%x: aloc:%d, lcb:%p/%p, ccb:%p/%p",
+                         i, p_ccb->allocated, p_ccb->p_lcb, p_lcb, p_ccb, p_ccb_last);
         if (p_ccb->allocated && (p_ccb->p_lcb == p_lcb) && (p_ccb != p_ccb_last)) {
             return FALSE;
         }

components/bt/host/bluedroid/stack/btm/btm_ble_addr.c

@@ -384,6 +384,10 @@ static BOOLEAN btm_ble_match_random_bda(tBTM_SEC_DEV_REC *p_dev_rec)
 void btm_ble_resolve_random_addr(BD_ADDR random_bda, tBTM_BLE_RESOLVE_CBACK *p_cback, void *p)
 {
 #if (SMP_INCLUDED == TRUE)
+    if (btm_cb.addr_res_en == FALSE) {
+        return;
+    }
+
     tBTM_LE_RANDOM_CB   *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
     list_node_t         *p_node    = NULL;
     tBTM_SEC_DEV_REC *p_dev_rec    = NULL;
@@ -458,6 +462,10 @@ tBTM_SEC_DEV_REC *btm_find_dev_by_identity_addr(BD_ADDR bd_addr, UINT8 addr_type
 BOOLEAN btm_identity_addr_to_random_pseudo(BD_ADDR bd_addr, UINT8 *p_addr_type, BOOLEAN refresh)
 {
 #if BLE_PRIVACY_SPT == TRUE
+    if (btm_cb.addr_res_en == FALSE) {
+        return TRUE;
+    }
+
     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_dev_by_identity_addr(bd_addr, *p_addr_type);
 
     BTM_TRACE_EVENT ("%s", __func__);
@@ -491,6 +499,10 @@ BOOLEAN btm_identity_addr_to_random_pseudo(BD_ADDR bd_addr, UINT8 *p_addr_type,
 BOOLEAN btm_random_pseudo_to_identity_addr(BD_ADDR random_pseudo, UINT8 *p_static_addr_type)
 {
 #if BLE_PRIVACY_SPT == TRUE
+    if (btm_cb.addr_res_en == FALSE) {
+        return TRUE;
+    }
+
     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_dev (random_pseudo);
 
     if (p_dev_rec != NULL) {

components/bt/host/bluedroid/stack/btm/btm_main.c

@@ -84,6 +84,7 @@ void btm_init (void)
 #if BLE_INCLUDED == TRUE
     btm_ble_lock_init();
     btm_ble_sem_init();
+    btm_cb.addr_res_en = TRUE;
 #endif
     btm_sec_dev_init();
 #if (BLE_50_FEATURE_SUPPORT == TRUE)
@@ -133,3 +134,10 @@ uint8_t btm_acl_active_count(void)
 
     return count;
 }
+
+void btm_ble_addr_resolve_enable(bool enable)
+{
+#if (BLE_INCLUDED == TRUE)
+    btm_cb.addr_res_en = enable;
+#endif
+}

components/bt/host/bluedroid/stack/btm/btm_pm.c

@@ -199,15 +199,20 @@ tBTM_STATUS BTM_SetPowerMode (UINT8 pm_id, BD_ADDR remote_bda, tBTM_PM_PWR_MD *p
     }
 
     p_cb = p_acl_cb->p_pm_mode_db;
+
     if (mode != BTM_PM_MD_ACTIVE) {
         /* check if the requested mode is supported */
         ind = mode - BTM_PM_MD_HOLD; /* make it base 0 */
         p_features = BTM_ReadLocalFeatures();
         if ( !(p_features[ btm_pm_mode_off[ind] ] & btm_pm_mode_msk[ind] ) ) {
+            //#if BTM_PM_DEBUG == TRUE
+                BTM_TRACE_DEBUG( "BTM_SetPowerMode: Unsupported BTM Mode");
+            //#endif
             return BTM_MODE_UNSUPPORTED;
         }
     }
 
+
     if (mode == p_cb->state) { /* the requested mode is current mode */
         /* already in the requested mode and the current interval has less latency than the max */
         if ( (mode == BTM_PM_MD_ACTIVE) ||
@@ -228,18 +233,18 @@ tBTM_STATUS BTM_SetPowerMode (UINT8 pm_id, BD_ADDR remote_bda, tBTM_PM_PWR_MD *p
             (btm_cb.pm_reg_db[pm_id].mask & BTM_PM_REG_SET))
             || ((pm_id == BTM_PM_SET_ONLY_ID)
 		&& (btm_cb.pm_pend_link_hdl != BTM_INVALID_HANDLE)) ) {
-#if BTM_PM_DEBUG == TRUE
+//#if BTM_PM_DEBUG == TRUE
         BTM_TRACE_DEBUG( "BTM_SetPowerMode: Saving cmd acl handle %d temp_pm_id %d", p_acl_cb->hci_handle, temp_pm_id);
-#endif  // BTM_PM_DEBUG
+//#endif  // BTM_PM_DEBUG
         /* Make sure mask is set to BTM_PM_REG_SET */
         btm_cb.pm_reg_db[temp_pm_id].mask |= BTM_PM_REG_SET;
         *(&p_cb->req_mode[temp_pm_id]) = *((tBTM_PM_PWR_MD *)p_mode);
         p_cb->chg_ind = TRUE;
     }
 
-#if BTM_PM_DEBUG == TRUE
+//#if BTM_PM_DEBUG == TRUE
     BTM_TRACE_DEBUG( "btm_pm state:0x%x, pm_pend_link_hdl: %d", p_cb->state, btm_cb.pm_pend_link_hdl);
-#endif  // BTM_PM_DEBUG
+//#endif  // BTM_PM_DEBUG
     /* if mode == hold or pending, return */
     if ( (p_cb->state == BTM_PM_STS_HOLD) ||
             (p_cb->state ==  BTM_PM_STS_PENDING) ||
@@ -543,7 +548,7 @@ static tBTM_PM_MODE btm_pm_get_set_mode(UINT8 pm_id, tBTM_PM_MCB *p_cb, tBTM_PM_
 ** Function     btm_pm_snd_md_req
 ** Description  get the resulting mode and send the resuest to host controller
 ** Returns      tBTM_STATUS
-**, BOOLEAN *p_chg_ind
+**
 *******************************************************************************/
 static tBTM_STATUS btm_pm_snd_md_req(UINT8 pm_id, UINT16 link_hdl, tBTM_PM_PWR_MD *p_mode)
 {
@@ -565,6 +570,8 @@ static tBTM_STATUS btm_pm_snd_md_req(UINT8 pm_id, UINT16 link_hdl, tBTM_PM_PWR_M
         /* already in the resulting mode */
         if ( (mode == BTM_PM_MD_ACTIVE) ||
                 ((md_res.max >= p_cb->interval) && (md_res.min <= p_cb->interval)) ) {
+            // Clear request change indication because already in result mode
+            p_cb->chg_ind = FALSE;
             return BTM_CMD_STORED;
         }
         /* Otherwise, needs to wake, then sleep */
@@ -689,7 +696,7 @@ static void btm_pm_check_stored(void)
 ** Description      This function is called when an HCI command status event occurs
 **                  for power manager related commands.
 **
-** Input Parms      status - status of the event (HCI_SUCCESS if no errors)
+** Input Params     status - status of the event (HCI_SUCCESS if no errors)
 **
 ** Returns          none.
 **
@@ -717,7 +724,7 @@ void btm_pm_proc_cmd_status(UINT8 status)
 #if BTM_PM_DEBUG == TRUE
         BTM_TRACE_DEBUG( "btm_pm_proc_cmd_status new state:0x%x", p_cb->state);
 #endif // BTM_PM_DEBUG
-    } else { /* the command was not successfull. Stay in the same state */
+    } else { /* the command was not successful. Stay in the same state */
         pm_status = BTM_PM_STS_ERROR;
     }
 
@@ -737,13 +744,23 @@ void btm_pm_proc_cmd_status(UINT8 status)
     btm_pm_check_stored();
 }
 
+__attribute__((weak))
+void btm_hcif_mode_change_cb(BOOLEAN succeeded, UINT16 hci_handle, UINT8 mode, UINT16 interval)
+{
+    // This is the weak implementation, which will be overwritten
+    (void) succeeded;
+    (void) hci_handle;
+    (void) mode;
+    (void) interval;
+}
+
 /*******************************************************************************
 **
 ** Function         btm_process_mode_change
 **
 ** Description      This function is called when an HCI mode change event occurs.
 **
-** Input Parms      hci_status - status of the event (HCI_SUCCESS if no errors)
+** Input Params     hci_status - status of the event (HCI_SUCCESS if no errors)
 **                  hci_handle - connection handle associated with the change
 **                  mode - HCI_MODE_ACTIVE, HCI_MODE_HOLD, HCI_MODE_SNIFF, or HCI_MODE_PARK
 **                  interval - number of baseband slots (meaning depends on mode)
@@ -753,6 +770,12 @@ void btm_pm_proc_cmd_status(UINT8 status)
 *******************************************************************************/
 void btm_pm_proc_mode_change (UINT8 hci_status, UINT16 hci_handle, UINT8 mode, UINT16 interval)
 {
+    bool success = (hci_status == HCI_SUCCESS) ? true : false;
+    /* Custom HHL Code Callback */
+    btm_hcif_mode_change_cb(success, hci_handle, mode, interval);
+    // test not using the rest
+    return;
+
     tACL_CONN   *p;
     tBTM_PM_MCB *p_cb = NULL;
     int yy;

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -884,6 +884,7 @@ typedef struct {
     UINT16                  ediv;       /* received ediv value from LTK request */
     UINT8                   key_size;
     tBTM_BLE_VSC_CB         cmn_ble_vsc_cb;
+    BOOLEAN                 addr_res_en;   /* internal use for test: address resolution enable/disable */
 #endif
 
     /* Packet types supported by the local device */
@@ -1088,6 +1089,11 @@ BOOLEAN    btm_acl_notif_conn_collision (BD_ADDR bda);
 void btm_pm_reset(void);
 tBTM_PM_MCB *btm_pm_sm_alloc(void);
 void btm_pm_proc_cmd_status(UINT8 status);
+
+// Custom code
+void btm_hcif_mode_change_interval(UINT8 mode, UINT16 interval);
+// end custom code
+
 void btm_pm_proc_mode_change (UINT8 hci_status, UINT16 hci_handle, UINT8 mode,
                               UINT16 interval);
 void btm_pm_proc_ssr_evt (UINT8 *p, UINT16 evt_len);

components/bt/host/bluedroid/stack/btu/btu_hcif.c

@@ -2152,7 +2152,9 @@ static void btu_ble_ext_adv_report_evt(UINT8 *p, UINT16 evt_len)
 {
     tBTM_BLE_EXT_ADV_REPORT ext_adv_report = {0};
     UINT8 num_reports = {0};
+#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
     UINT8 *pp = p;
+#endif
     //UINT8 legacy_event_type = 0;
     UINT16 evt_type = 0;
     uint8_t addr_type;

components/bt/host/bluedroid/stack/hcic/hcicmds.c

@@ -749,6 +749,15 @@ BOOLEAN btsnd_hcic_hold_mode (UINT16 handle, UINT16 max_hold_period,
     return (TRUE);
 }
 
+__attribute__((weak))
+void btsnd_hcic_sniff_mode_cb(BOOLEAN sniff, UINT16 tx_lat, UINT16 rx_lat)
+{
+    // This is the weak implementation, which will be overwritten
+    (void) sniff;
+    (void) tx_lat;
+    (void) rx_lat;
+}
+
 BOOLEAN btsnd_hcic_sniff_mode (UINT16 handle, UINT16 max_sniff_period,
                                UINT16 min_sniff_period, UINT16 sniff_attempt,
                                UINT16 sniff_timeout)
@@ -774,6 +783,12 @@ BOOLEAN btsnd_hcic_sniff_mode (UINT16 handle, UINT16 max_sniff_period,
     UINT16_TO_STREAM (pp, sniff_attempt);
     UINT16_TO_STREAM (pp, sniff_timeout);
 
+    // HHL Custom Code
+    btsnd_hcic_sniff_mode_cb(true, min_sniff_period, max_sniff_period);
+
+    // Try ignoring the commands for now
+    return (TRUE);
+    // End custom code
     btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID,  p);
     HCI_TRACE_WARNING("hci cmd send: sniff: hdl 0x%x, intv(%d %d)",
                     handle, min_sniff_period, max_sniff_period);
@@ -801,6 +816,10 @@ BOOLEAN btsnd_hcic_exit_sniff_mode (UINT16 handle)
 
     btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID,  p);
     HCI_TRACE_WARNING("hci cmd send: unsniff: hdl 0x%x", handle);
+
+    // HHL Custom Code
+    btsnd_hcic_sniff_mode_cb(false, 0, 0);
+
     return TRUE;
 }
 

components/bt/host/bluedroid/stack/include/stack/hcidefs.h

@@ -1868,42 +1868,50 @@ typedef struct {
 #define HCI_PING_SUPPORTED(x) ((x)[HCI_EXT_FEATURE_PING_OFF] & HCI_EXT_FEATURE_PING_MASK)
 
 /*
-**   LE features encoding - page 0 (the only page for now)
+**   LE features encoding - page 0
 */
-/* LE Encryption */
+/* LE Encryption: bit 0 */
 #define HCI_LE_FEATURE_LE_ENCRYPTION_MASK       0x01
 #define HCI_LE_FEATURE_LE_ENCRYPTION_OFF        0
 #define HCI_LE_ENCRYPTION_SUPPORTED(x) ((x)[HCI_LE_FEATURE_LE_ENCRYPTION_OFF] & HCI_LE_FEATURE_LE_ENCRYPTION_MASK)
 
-/* Connection Parameters Request Procedure */
+/* Connection Parameters Request Procedure: bit 1 */
 #define HCI_LE_FEATURE_CONN_PARAM_REQ_MASK       0x02
 #define HCI_LE_FEATURE_CONN_PARAM_REQ_OFF        0
 #define HCI_LE_CONN_PARAM_REQ_SUPPORTED(x) ((x)[HCI_LE_FEATURE_CONN_PARAM_REQ_OFF] & HCI_LE_FEATURE_CONN_PARAM_REQ_MASK)
 
-/* Extended Reject Indication */
+/* Extended Reject Indication: bit 2 */
 #define HCI_LE_FEATURE_EXT_REJ_IND_MASK       0x04
 #define HCI_LE_FEATURE_EXT_REJ_IND_OFF        0
 #define HCI_LE_EXT_REJ_IND_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_REJ_IND_OFF] & HCI_LE_FEATURE_EXT_REJ_IND_MASK)
 
-/* Slave-initiated Features Exchange */
+/* Slave-initiated Features Exchange: bit 3 */
 #define HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_MASK       0x08
 #define HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_OFF        0
 #define HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(x) ((x)[HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_OFF] & HCI_LE_FEATURE_SLAVE_INIT_FEAT_EXC_MASK)
 
+/* LE Data Packet Length Extension: bit 5 */
+#define HCI_LE_FEATURE_DATA_LEN_EXT_MASK       0x20
+#define HCI_LE_FEATURE_DATA_LEN_EXT_OFF        0
+#define HCI_LE_DATA_LEN_EXT_SUPPORTED(x) ((x)[HCI_LE_FEATURE_DATA_LEN_EXT_OFF] & HCI_LE_FEATURE_DATA_LEN_EXT_MASK)
+
 /* Enhanced privacy Feature: bit 6 */
 #define HCI_LE_FEATURE_ENHANCED_PRIVACY_MASK       0x40
 #define HCI_LE_FEATURE_ENHANCED_PRIVACY_OFF        0
 #define HCI_LE_ENHANCED_PRIVACY_SUPPORTED(x) ((x)[HCI_LE_FEATURE_ENHANCED_PRIVACY_OFF] & HCI_LE_FEATURE_ENHANCED_PRIVACY_MASK)
 
-/* Extended scanner filter policy : 7 */
+/* Extended scanner filter policy: bit 7 */
 #define HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_MASK       0x80
 #define HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_OFF        0
 #define HCI_LE_EXT_SCAN_FILTER_POLICY_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_OFF] & HCI_LE_FEATURE_EXT_SCAN_FILTER_POLICY_MASK)
 
-/* Slave-initiated Features Exchange */
-#define HCI_LE_FEATURE_DATA_LEN_EXT_MASK       0x20
-#define HCI_LE_FEATURE_DATA_LEN_EXT_OFF        0
-#define HCI_LE_DATA_LEN_EXT_SUPPORTED(x) ((x)[HCI_LE_FEATURE_DATA_LEN_EXT_OFF] & HCI_LE_FEATURE_DATA_LEN_EXT_MASK)
+/*
+**   LE features encoding - page 1
+*/
+/* LE Extended Advertising: bit 12 */
+#define HCI_LE_FEATURE_EXT_ADV_MASK       0x10
+#define HCI_LE_FEATURE_EXT_ADV_OFF        1
+#define HCI_LE_EXT_ADV_SUPPORTED(x) ((x)[HCI_LE_FEATURE_EXT_ADV_OFF] & HCI_LE_FEATURE_EXT_ADV_MASK)
 
 /*
 **   Local Supported Commands encoding

components/bt/host/bluedroid/stack/sdp/sdp_db.c

@@ -276,7 +276,7 @@ static int sdp_compose_proto_list( UINT8 *p, UINT16 num_elem,
 **
 ** Description      This function is called to create a record in the database.
 **                  This would be through the SDP database maintenance API. The
-**                  record is created empty, teh application should then call
+**                  record is created empty, the application should then call
 **                  "add_attribute" to add the record's attributes.
 **
 ** Returns          Record handle if OK, else 0.
@@ -293,15 +293,15 @@ UINT32 SDP_CreateRecord (void)
 
     /* First, check if there is a free record */
     if (p_db->num_records < SDP_MAX_RECORDS) {
-        p_rec =(tSDP_RECORD *)osi_malloc(sizeof(tSDP_RECORD));
-	if (p_rec) {
-    	    memset(p_rec, 0, sizeof(tSDP_RECORD));
-    	    /* Save previous rec */
-    	    if (p_db->num_records) {
-    	        p_rec_prev = list_back(p_db->p_record_list);
-    	    }
-    	    /* Append new record */
-    	    list_append(p_db->p_record_list, p_rec);
+        p_rec = (tSDP_RECORD *)osi_malloc(sizeof(tSDP_RECORD));
+        if (p_rec) {
+            memset(p_rec, 0, sizeof(tSDP_RECORD));
+            /* Save previous rec */
+            if (p_db->num_records) {
+                p_rec_prev = list_back(p_db->p_record_list);
+            }
+            /* Append new record */
+            list_append(p_db->p_record_list, p_rec);
 
             /* We will use a handle of the first unreserved handle plus last record
             ** number + 1 */
@@ -321,10 +321,12 @@ UINT32 SDP_CreateRecord (void)
                               4, buf);
 
             return (p_rec->record_handle);
-	} else {
+        }
+        else {
             SDP_TRACE_ERROR("SDP_CreateRecord fail, memory allocation failed\n");
-	}
-    } else {
+        }
+    }
+    else {
         SDP_TRACE_ERROR("SDP_CreateRecord fail, exceed maximum records:%d\n", SDP_MAX_RECORDS);
     }
 #endif
@@ -354,17 +356,17 @@ BOOLEAN SDP_DeleteRecord (UINT32 handle)
     if (handle == 0 || sdp_cb.server_db.num_records == 0) {
         /* Delete all records in the database */
         sdp_cb.server_db.num_records = 0;
-        for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
-	    list_remove(sdp_cb.server_db.p_record_list, p_node);
-	}
+        for (p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
+            list_remove(sdp_cb.server_db.p_record_list, p_node);
+        }
         /* require new DI record to be created in SDP_SetLocalDiRecord */
         sdp_cb.server_db.di_primary_handle = 0;
 
         return (TRUE);
     } else {
         /* Find the record in the database */
-        for(p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
-	    p_rec = list_node(p_node);
+        for (p_node = list_begin(sdp_cb.server_db.p_record_list); p_node; p_node = list_next(p_node)) {
+            p_rec = list_node(p_node);
             if (p_rec->record_handle == handle) {
                 /* Found it. Shift everything up one */
                 list_remove(sdp_cb.server_db.p_record_list, p_rec);
@@ -374,7 +376,7 @@ BOOLEAN SDP_DeleteRecord (UINT32 handle)
                 SDP_TRACE_DEBUG("SDP_DeleteRecord ok, num_records:%d\n", sdp_cb.server_db.num_records);
                 /* if we're deleting the primary DI record, clear the */
                 /* value in the control block */
-                if ( sdp_cb.server_db.di_primary_handle == handle ) {
+                if (sdp_cb.server_db.di_primary_handle == handle) {
                     sdp_cb.server_db.di_primary_handle = 0;
                 }
 

components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c

@@ -190,6 +190,11 @@ static void controller_rcv_pkt_ready(void)
     }
 }
 
+static void dummy_controller_rcv_pkt_ready(void)
+{
+  /* Dummy function */
+}
+
 void bt_record_hci_data(uint8_t *data, uint16_t len)
 {
 #if (BT_HCI_LOG_INCLUDED == TRUE)
@@ -203,6 +208,12 @@ void bt_record_hci_data(uint8_t *data, uint16_t len)
 #endif // (BT_HCI_LOG_INCLUDED == TRUE)
 }
 
+static int dummy_host_rcv_pkt(uint8_t *data, uint16_t len)
+{
+    /* Dummy function */
+    return 0;
+}
+
 /*
  * @brief: BT controller callback function, to transfer data packet to the host
  */
@@ -264,6 +275,11 @@ static const esp_vhci_host_callback_t vhci_host_cb = {
     .notify_host_recv = host_rcv_pkt,
 };
 
+static const esp_vhci_host_callback_t dummy_vhci_host_cb = {
+    .notify_host_send_available = dummy_controller_rcv_pkt_ready,
+    .notify_host_recv = dummy_host_rcv_pkt,
+};
+
 
 extern void ble_transport_init(void);
 extern esp_err_t ble_buf_alloc(void);
@@ -313,6 +329,8 @@ esp_err_t esp_nimble_hci_deinit(void)
     }
     ble_transport_deinit();
 
+    esp_vhci_host_register_callback(&dummy_vhci_host_cb);
+
     ble_buf_free();
 
 #if MYNEWT_VAL(BLE_QUEUE_CONG_CHECK)

components/bt/host/nimble/nimble

@@ -1 +1 @@
-Subproject commit d87234ed14144c9dc140a2376a38bf04efb1311d
+Subproject commit 8b3951670c8f7a69874f64a85562b872c25ba02e

components/bt/include/esp32c3/include/esp_bt.h

@@ -376,17 +376,18 @@ typedef enum {
     ESP_PWR_LVL_N18 = 2,              /*!< Corresponding to -18dbm */
     ESP_PWR_LVL_N15 = 3,              /*!< Corresponding to -15dbm */
     ESP_PWR_LVL_N12 = 4,              /*!< Corresponding to -12dbm */
-    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to  -9dbm */
-    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to  -6dbm */
-    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to  -3dbm */
-    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to   0dbm */
-    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to  +3dbm */
-    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to  +6dbm */
-    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to  +9dbm */
-    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to  +12dbm */
-    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to  +15dbm */
-    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to  +18dbm */
-    ESP_PWR_LVL_P21 = 15,             /*!< Corresponding to  +21dbm */
+    ESP_PWR_LVL_N9  = 5,              /*!< Corresponding to -9dbm */
+    ESP_PWR_LVL_N6  = 6,              /*!< Corresponding to -6dbm */
+    ESP_PWR_LVL_N3  = 7,              /*!< Corresponding to -3dbm */
+    ESP_PWR_LVL_N0  = 8,              /*!< Corresponding to 0dbm */
+    ESP_PWR_LVL_P3  = 9,              /*!< Corresponding to +3dbm */
+    ESP_PWR_LVL_P6  = 10,             /*!< Corresponding to +6dbm */
+    ESP_PWR_LVL_P9  = 11,             /*!< Corresponding to +9dbm */
+    ESP_PWR_LVL_P12 = 12,             /*!< Corresponding to +12dbm */
+    ESP_PWR_LVL_P15 = 13,             /*!< Corresponding to +15dbm */
+    ESP_PWR_LVL_P18 = 14,             /*!< Corresponding to +18dbm */
+    ESP_PWR_LVL_P20 = 15,             /*!< Corresponding to +20dbm */
+    ESP_PWR_LVL_P21 = 15,             /*!< Corresponding to +20dbm, this enum variable has been deprecated */
     ESP_PWR_LVL_INVALID = 0xFF,         /*!< Indicates an invalid value */
 } esp_power_level_t;
 

components/bt/porting/npl/freertos/src/npl_os_freertos.c

@@ -21,6 +21,7 @@
 #include "esp_log.h"
 #include "soc/soc_caps.h"
 #include "esp_bt.h"
+#include "bt_osi_mem.h"
 
 portMUX_TYPE ble_port_mutex = portMUX_INITIALIZER_UNLOCKED;
 
@@ -95,7 +96,7 @@ IRAM_ATTR npl_freertos_event_init(struct ble_npl_event *ev, ble_npl_event_fn *fn
     }
 #else
     if(!ev->event) {
-        ev->event = malloc(sizeof(struct ble_npl_event_freertos));
+        ev->event = bt_osi_mem_malloc_internal(sizeof(struct ble_npl_event_freertos));
     }
 #endif
     event = (struct ble_npl_event_freertos *)ev->event;
@@ -113,7 +114,7 @@ IRAM_ATTR npl_freertos_event_deinit(struct ble_npl_event *ev)
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_ev_pool,ev->event);
 #else
-    free(ev->event);
+    bt_osi_mem_free(ev->event);
 #endif
     ev->event = NULL;
 }
@@ -144,7 +145,7 @@ npl_freertos_eventq_init(struct ble_npl_eventq *evq)
     }
 #else
     if(!evq->eventq) {
-        evq->eventq = malloc(sizeof(struct ble_npl_eventq_freertos));
+        evq->eventq = bt_osi_mem_malloc_internal(sizeof(struct ble_npl_eventq_freertos));
         eventq = (struct ble_npl_eventq_freertos*)evq->eventq;
         BLE_LL_ASSERT(eventq);
         memset(eventq, 0, sizeof(*eventq));
@@ -167,7 +168,7 @@ npl_freertos_eventq_deinit(struct ble_npl_eventq *evq)
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_evq_pool,eventq);
 #else
-    free((void *)eventq);
+    bt_osi_mem_free((void *)eventq);
 #endif
     evq->eventq = NULL;
 }
@@ -357,7 +358,7 @@ npl_freertos_mutex_init(struct ble_npl_mutex *mu)
     }
 #else
     if(!mu->mutex) {
-        mu->mutex = malloc(sizeof(struct ble_npl_mutex_freertos));
+        mu->mutex = bt_osi_mem_malloc_internal(sizeof(struct ble_npl_mutex_freertos));
         mutex = (struct ble_npl_mutex_freertos *)mu->mutex;
 
         if (!mutex) {
@@ -388,7 +389,7 @@ npl_freertos_mutex_deinit(struct ble_npl_mutex *mu)
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_mutex_pool,mutex);
 #else
-    free((void *)mutex);
+    bt_osi_mem_free((void *)mutex);
 #endif
     mu->mutex = NULL;
 
@@ -494,7 +495,7 @@ npl_freertos_sem_init(struct ble_npl_sem *sem, uint16_t tokens)
     }
 #else
     if(!sem->sem) {
-        sem->sem = malloc(sizeof(struct ble_npl_sem_freertos));
+        sem->sem = bt_osi_mem_malloc_internal(sizeof(struct ble_npl_sem_freertos));
         semaphore = (struct ble_npl_sem_freertos *)sem->sem;
 
         if (!semaphore) {
@@ -525,7 +526,7 @@ npl_freertos_sem_deinit(struct ble_npl_sem *sem)
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_sem_pool,semaphore);
 #else
-    free((void *)semaphore);
+    bt_osi_mem_free((void *)semaphore);
 #endif
     sem->sem = NULL;
 
@@ -684,7 +685,7 @@ npl_freertos_callout_init(struct ble_npl_callout *co, struct ble_npl_eventq *evq
 #else
 
     if(!co->co) {
-        co->co = malloc(sizeof(struct ble_npl_callout_freertos));
+        co->co = bt_osi_mem_malloc_internal(sizeof(struct ble_npl_callout_freertos));
         callout = (struct ble_npl_callout_freertos *)co->co;
         if (!callout) {
             return -1;
@@ -704,7 +705,7 @@ npl_freertos_callout_init(struct ble_npl_callout *co, struct ble_npl_eventq *evq
 
         if (esp_timer_create(&create_args, &callout->handle) != ESP_OK) {
             ble_npl_event_deinit(&callout->ev);
-            free((void *)callout);
+            bt_osi_mem_free((void *)callout);
             co->co = NULL;
             return -1;
         }
@@ -713,7 +714,7 @@ npl_freertos_callout_init(struct ble_npl_callout *co, struct ble_npl_eventq *evq
 
         if (!callout->handle) {
             ble_npl_event_deinit(&callout->ev);
-            free((void *)callout);
+            bt_osi_mem_free((void *)callout);
             co->co = NULL;
             return -1;
         }
@@ -761,7 +762,7 @@ npl_freertos_callout_deinit(struct ble_npl_callout *co)
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_co_pool,callout);
 #else
-    free((void *)callout);
+    bt_osi_mem_free((void *)callout);
 #endif // OS_MEM_ALLOC
     co->co = NULL;
     memset(co, 0, sizeof(struct ble_npl_callout));
@@ -1089,7 +1090,7 @@ struct npl_funcs_t * npl_freertos_funcs_get(void)
 
 void npl_freertos_funcs_init(void)
 {
-    npl_funcs = (struct npl_funcs_t *)malloc(sizeof(struct npl_funcs_t));
+    npl_funcs = (struct npl_funcs_t *)bt_osi_mem_malloc_internal(sizeof(struct npl_funcs_t));
     if(!npl_funcs) {
         printf("npl funcs init failed\n");
         assert(0);
@@ -1123,7 +1124,7 @@ int npl_freertos_mempool_init(void)
     ble_freertos_total_event_cnt = ble_total_evt_count;
 
     if (ble_total_evt_count) {
-        ble_freertos_ev_buf  = malloc(OS_MEMPOOL_SIZE(ble_total_evt_count,
+        ble_freertos_ev_buf  = bt_osi_mem_malloc_internal(OS_MEMPOOL_SIZE(ble_total_evt_count,
                                       sizeof (struct ble_npl_event_freertos)) *
                                       sizeof(os_membuf_t));
         if (!ble_freertos_ev_buf) {
@@ -1138,7 +1139,7 @@ int npl_freertos_mempool_init(void)
     }
 
     if (ble_total_evtq_count) {
-        ble_freertos_evq_buf  = malloc(OS_MEMPOOL_SIZE(ble_total_evtq_count,
+        ble_freertos_evq_buf  = bt_osi_mem_malloc_internal(OS_MEMPOOL_SIZE(ble_total_evtq_count,
                                        sizeof (struct ble_npl_eventq_freertos)) *
                                        sizeof(os_membuf_t));
         if (!ble_freertos_evq_buf) {
@@ -1153,7 +1154,7 @@ int npl_freertos_mempool_init(void)
     }
 
     if (ble_total_co_count) {
-        ble_freertos_co_buf  = malloc(OS_MEMPOOL_SIZE(ble_total_co_count,
+        ble_freertos_co_buf  = bt_osi_mem_malloc_internal(OS_MEMPOOL_SIZE(ble_total_co_count,
                                       sizeof (struct ble_npl_callout_freertos)) *
                                       sizeof(os_membuf_t));
         if (!ble_freertos_co_buf) {
@@ -1168,7 +1169,7 @@ int npl_freertos_mempool_init(void)
     }
 
     if (ble_total_sem_count) {
-        ble_freertos_sem_buf  = malloc(OS_MEMPOOL_SIZE(ble_total_sem_count,
+        ble_freertos_sem_buf  = bt_osi_mem_malloc_internal(OS_MEMPOOL_SIZE(ble_total_sem_count,
                                        sizeof (struct ble_npl_sem_freertos)) *
                                        sizeof(os_membuf_t));
         if (!ble_freertos_sem_buf) {
@@ -1183,7 +1184,7 @@ int npl_freertos_mempool_init(void)
     }
 
     if (ble_total_mutex_count) {
-        ble_freertos_mutex_buf  = malloc(OS_MEMPOOL_SIZE(ble_total_mutex_count,
+        ble_freertos_mutex_buf  = bt_osi_mem_malloc_internal(OS_MEMPOOL_SIZE(ble_total_mutex_count,
                                          sizeof (struct ble_npl_mutex_freertos)) *
                                          sizeof(os_membuf_t));
         if (!ble_freertos_mutex_buf) {
@@ -1200,27 +1201,27 @@ int npl_freertos_mempool_init(void)
     return 0;
 _error:
     if (ble_freertos_ev_buf) {
-        free(ble_freertos_ev_buf);
+        bt_osi_mem_free(ble_freertos_ev_buf);
         ble_freertos_ev_buf = NULL;
     }
 
     if (ble_freertos_evq_buf) {
-        free(ble_freertos_evq_buf);
+        bt_osi_mem_free(ble_freertos_evq_buf);
         ble_freertos_evq_buf = NULL;
     }
 
     if (ble_freertos_co_buf) {
-        free(ble_freertos_co_buf);
+        bt_osi_mem_free(ble_freertos_co_buf);
         ble_freertos_co_buf = NULL;
     }
 
     if (ble_freertos_sem_buf) {
-        free(ble_freertos_sem_buf);
+        bt_osi_mem_free(ble_freertos_sem_buf);
         ble_freertos_sem_buf = NULL;
     }
 
     if (ble_freertos_mutex_buf) {
-        free(ble_freertos_mutex_buf);
+        bt_osi_mem_free(ble_freertos_mutex_buf);
         ble_freertos_mutex_buf = NULL;
     }
     return -1;
@@ -1229,23 +1230,23 @@ _error:
 void npl_freertos_mempool_deinit(void)
 {
     if (ble_freertos_ev_buf) {
-        free(ble_freertos_ev_buf);
+        bt_osi_mem_free(ble_freertos_ev_buf);
         ble_freertos_ev_buf = NULL;
     }
     if (ble_freertos_evq_buf) {
-        free(ble_freertos_evq_buf);
+        bt_osi_mem_free(ble_freertos_evq_buf);
         ble_freertos_evq_buf = NULL;
     }
     if (ble_freertos_co_buf) {
-        free(ble_freertos_co_buf);
+        bt_osi_mem_free(ble_freertos_co_buf);
         ble_freertos_co_buf = NULL;
     }
     if (ble_freertos_sem_buf) {
-        free(ble_freertos_sem_buf);
+        bt_osi_mem_free(ble_freertos_sem_buf);
         ble_freertos_sem_buf = NULL;
     }
     if (ble_freertos_mutex_buf) {
-        free(ble_freertos_mutex_buf);
+        bt_osi_mem_free(ble_freertos_mutex_buf);
         ble_freertos_mutex_buf = NULL;
     }
 }
@@ -1253,7 +1254,7 @@ void npl_freertos_mempool_deinit(void)
 void npl_freertos_funcs_deinit(void)
 {
     if (npl_funcs) {
-        free(npl_funcs);
+        bt_osi_mem_free(npl_funcs);
     }
     npl_funcs = NULL;
 }

components/bt/porting/transport/driver/uart/hci_driver_uart.c

@@ -154,7 +154,7 @@ hci_driver_uart_deinit(void)
 
     ESP_ERROR_CHECK(uart_driver_delete(s_hci_driver_uart_env.hci_uart_params->hci_uart_port));
 
-    if (!s_hci_driver_uart_env.tx_sem) {
+    if (s_hci_driver_uart_env.tx_sem) {
         vSemaphoreDelete(s_hci_driver_uart_env.tx_sem);
     }
 

components/driver/i2c/i2c.c

@@ -653,7 +653,10 @@ static esp_err_t i2c_master_clear_bus(i2c_port_t i2c_num)
     gpio_set_level(sda_io, 1); // STOP, SDA low -> high while SCL is HIGH
     i2c_set_pin(i2c_num, sda_io, scl_io, 1, 1, I2C_MODE_MASTER);
 #else
-    i2c_ll_master_clr_bus(i2c_context[i2c_num].hal.dev, I2C_CLR_BUS_SCL_NUM);
+    i2c_ll_master_clr_bus(i2c_context[i2c_num].hal.dev, I2C_CLR_BUS_SCL_NUM, true);
+    while (i2c_ll_master_is_bus_clear_done(i2c_context[i2c_num].hal.dev)) {
+    }
+    i2c_ll_update(i2c_context[i2c_num].hal.dev);
 #endif
     return ESP_OK;
 }

components/driver/i2c/i2c_master.c

@@ -40,8 +40,11 @@ static const char *TAG = "i2c.master";
 #define I2C_ADDRESS_TRANS_WRITE(device_address)    (((device_address) << 1) | 0)
 #define I2C_ADDRESS_TRANS_READ(device_address)    (((device_address) << 1) | 1)
 
+#define I2C_CLR_BUS_TIMEOUT_MS        (50)  // 50ms is sufficient for clearing the bus
+
 static esp_err_t s_i2c_master_clear_bus(i2c_bus_handle_t handle)
 {
+    esp_err_t ret = ESP_OK;
 #if !SOC_I2C_SUPPORT_HW_CLR_BUS
     const int scl_half_period = 5; // use standard 100kHz data rate
     int i = 0;
@@ -68,9 +71,23 @@ static esp_err_t s_i2c_master_clear_bus(i2c_bus_handle_t handle)
     i2c_common_set_pins(handle);
 #else
     i2c_hal_context_t *hal = &handle->hal;
-    i2c_ll_master_clr_bus(hal->dev, I2C_LL_RESET_SLV_SCL_PULSE_NUM_DEFAULT);
+    i2c_ll_master_clr_bus(hal->dev, I2C_LL_RESET_SLV_SCL_PULSE_NUM_DEFAULT, true);
+    // If the i2c master clear bus state machine got disturbed when its work, it would go into error state.
+    // The solution here is to use freertos tick counter to set time threshold. If its not return on time,
+    // return invalid state and turn off the state machine for avoiding its always wrong.
+    TickType_t start_tick = xTaskGetTickCount();
+    const TickType_t timeout_ticks = pdMS_TO_TICKS(I2C_CLR_BUS_TIMEOUT_MS);
+    while (i2c_ll_master_is_bus_clear_done(hal->dev)) {
+        if ((xTaskGetTickCount() - start_tick) > timeout_ticks) {
+            ESP_LOGE(TAG, "clear bus failed.");
+            i2c_ll_master_clr_bus(hal->dev, 0, false);
+            ret = ESP_ERR_INVALID_STATE;
+            break;
+        }
+    }
+    i2c_ll_update(hal->dev);
 #endif
-    return ESP_OK;
+    return ret;
 }
 
 /**
@@ -82,6 +99,7 @@ static esp_err_t s_i2c_master_clear_bus(i2c_bus_handle_t handle)
  */
 static esp_err_t s_i2c_hw_fsm_reset(i2c_master_bus_handle_t i2c_master)
 {
+    esp_err_t ret = ESP_OK;
     i2c_hal_context_t *hal = &i2c_master->base->hal;
 #if !SOC_I2C_SUPPORT_HW_FSM_RST
     i2c_hal_timing_config_t timing_config;
@@ -91,7 +109,7 @@ static esp_err_t s_i2c_hw_fsm_reset(i2c_master_bus_handle_t i2c_master)
     i2c_ll_master_get_filter(hal->dev, &filter_cfg);
 
     //to reset the I2C hw module, we need re-enable the hw
-    s_i2c_master_clear_bus(i2c_master->base);
+    ret = s_i2c_master_clear_bus(i2c_master->base);
     I2C_RCC_ATOMIC() {
         i2c_ll_reset_register(i2c_master->base->port_num);
     }
@@ -103,9 +121,9 @@ static esp_err_t s_i2c_hw_fsm_reset(i2c_master_bus_handle_t i2c_master)
     i2c_ll_master_set_filter(hal->dev, filter_cfg);
 #else
     i2c_ll_master_fsm_rst(hal->dev);
-    s_i2c_master_clear_bus(i2c_master->base);
+    ret = s_i2c_master_clear_bus(i2c_master->base);
 #endif
-    return ESP_OK;
+    return ret;
 }
 
 static void s_i2c_err_log_print(i2c_master_event_t event, bool bypass_nack_log)
@@ -534,7 +552,7 @@ static esp_err_t s_i2c_transaction_start(i2c_master_dev_handle_t i2c_dev, int xf
     // Sometimes when the FSM get stuck, the ACK_ERR interrupt will occur endlessly until we reset the FSM and clear bus.
     esp_err_t ret = ESP_OK;
     if (i2c_master->status == I2C_STATUS_TIMEOUT || i2c_ll_is_bus_busy(hal->dev)) {
-        s_i2c_hw_fsm_reset(i2c_master);
+        ESP_RETURN_ON_ERROR(s_i2c_hw_fsm_reset(i2c_master), TAG, "reset hardware failed");
     }
 
     if (i2c_master->base->pm_lock) {
@@ -548,12 +566,13 @@ static esp_err_t s_i2c_transaction_start(i2c_master_dev_handle_t i2c_dev, int xf
     i2c_master->rx_cnt = 0;
     i2c_master->read_len_static = 0;
 
-    i2c_hal_master_set_scl_timeout_val(hal, i2c_dev->scl_wait_us, i2c_master->base->clk_src_freq_hz);
-
     I2C_CLOCK_SRC_ATOMIC() {
-        i2c_ll_set_source_clk(hal->dev, i2c_master->base->clk_src);
         i2c_hal_set_bus_timing(hal, i2c_dev->scl_speed_hz, i2c_master->base->clk_src, i2c_master->base->clk_src_freq_hz);
     }
+
+    // Set the timeout value
+    i2c_hal_master_set_scl_timeout_val(hal, i2c_dev->scl_wait_us, i2c_master->base->clk_src_freq_hz);
+
     i2c_ll_master_set_fractional_divider(hal->dev, 0, 0);
     i2c_ll_update(hal->dev);
 
@@ -891,6 +910,10 @@ esp_err_t i2c_new_master_bus(const i2c_master_bus_config_t *bus_config, i2c_mast
     }
     ESP_GOTO_ON_ERROR(i2c_param_master_config(i2c_master->base, bus_config), err, TAG, "i2c configure parameter failed");
 
+    I2C_CLOCK_SRC_ATOMIC() {
+        i2c_ll_set_source_clk(hal->dev, i2c_master->base->clk_src);
+    }
+
     i2c_master->bus_lock_mux = xSemaphoreCreateBinaryWithCaps(I2C_MEM_ALLOC_CAPS);
     ESP_GOTO_ON_FALSE(i2c_master->bus_lock_mux, ESP_ERR_NO_MEM, err, TAG, "No memory for binary semaphore");
     xSemaphoreGive(i2c_master->bus_lock_mux);

components/driver/parlio/parlio_tx.c

@@ -270,6 +270,8 @@ static esp_err_t parlio_select_periph_clock(parlio_tx_unit_t *tx_unit, const par
     tx_unit->out_clk_freq_hz = hal_utils_calc_clk_div_integer(&clk_info, &clk_div.integer);
 #endif
     PARLIO_CLOCK_SRC_ATOMIC() {
+        // turn on the tx module clock to sync the register configuration to the module
+        parlio_ll_tx_enable_clock(hal->regs, true);
         parlio_ll_tx_set_clock_source(hal->regs, clk_src);
         // set clock division
         parlio_ll_tx_set_clock_div(hal->regs, &clk_div);
@@ -371,8 +373,8 @@ esp_err_t parlio_new_tx_unit(const parlio_tx_unit_config_t *config, parlio_tx_un
     parlio_ll_tx_set_sample_clock_edge(hal->regs, config->sample_edge);
 
 #if SOC_PARLIO_TX_SIZE_BY_DMA
-    // Always use DMA EOF as the Parlio TX EOF
-    parlio_ll_tx_set_eof_condition(hal->regs, PARLIO_LL_TX_EOF_COND_DMA_EOF);
+    // Always use DATA LEN EOF as the Parlio TX EOF
+    parlio_ll_tx_set_eof_condition(hal->regs, PARLIO_LL_TX_EOF_COND_DATA_LEN);
 #endif  // SOC_PARLIO_TX_SIZE_BY_DMA
 
     // clear any pending interrupt

components/esp_common/include/esp_idf_version.h

@@ -15,7 +15,7 @@ extern "C" {
 /** Minor version number (x.X.x) */
 #define ESP_IDF_VERSION_MINOR   2
 /** Patch version number (x.x.X) */
-#define ESP_IDF_VERSION_PATCH   2
+#define ESP_IDF_VERSION_PATCH   3
 
 /**
  * Macro to convert IDF version number into an integer

components/esp_common/test_apps/.build-test-rules.yml

@@ -6,3 +6,7 @@ components/esp_common/test_apps/esp_common:
     - if: CONFIG_NAME == "psram" and IDF_TARGET in ["esp32p4"]
       temporary: true
       reason: esp32p4 is not supported yet # TODO: IDF-7557
+    - if: CONFIG_NAME == "psram_noinit" and SOC_SPIRAM_SUPPORTED != 1
+    - if: CONFIG_NAME == "psram_noinit" and IDF_TARGET in ["esp32p4"]
+      temporary: true
+      reason: esp32p4 is not supported yet

components/esp_common/test_apps/esp_common/main/CMakeLists.txt

@@ -1,4 +1,4 @@
 idf_component_register(SRCS "test_app_main.c" "test_attr.c"
                        INCLUDE_DIRS "."
-                       PRIV_REQUIRES unity esp_psram
+                       PRIV_REQUIRES unity esp_mm esp_psram
                        WHOLE_ARCHIVE)

components/esp_common/test_apps/esp_common/main/test_attr.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -10,10 +10,17 @@
 #include "esp_log.h"
 #include "soc/soc.h"
 #include "esp_system.h"
+#include "hal/cache_ll.h"
+#include "hal/cache_hal.h"
+#include "esp_cache.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp_private/esp_psram_extram.h"
 #endif
 
+#define ALIGN_UP(num, align)    (((num) + ((align) - 1)) & ~((align) - 1))
+
+static const char *TAG = "attr_test";
+
 extern int _rtc_noinit_start;
 extern int _rtc_noinit_end;
 extern int _rtc_data_start;
@@ -45,6 +52,7 @@ static EXT_RAM_NOINIT_ATTR uint32_t s_noinit_ext;
 
 static bool data_in_segment(void *ptr, int *seg_start, int *seg_end)
 {
+    ESP_LOGV(TAG, "ptr:%p seg_start:%p seg_end:%p", ptr, seg_start, seg_end);
     return ((intptr_t)ptr < (intptr_t)seg_end) && \
            ((intptr_t)ptr >= (intptr_t)seg_start);
 }
@@ -95,7 +103,13 @@ static void write_spiram_and_reset(void)
     }
     printf("Flushing cache\n");
     // Flush the cache out to SPIRAM before resetting.
+#if CONFIG_IDF_TARGET_ESP32
     esp_psram_extram_writeback_cache();
+#else
+    size_t psram_alignment = cache_hal_get_cache_line_size(CACHE_LL_LEVEL_EXT_MEM, CACHE_TYPE_DATA);
+    uint32_t ext_noinit_size = sizeof(s_noinit_buffer);
+    TEST_ESP_OK(esp_cache_msync(&s_noinit_buffer, ALIGN_UP(ext_noinit_size, psram_alignment), ESP_CACHE_MSYNC_FLAG_DIR_C2M));
+#endif
 
     printf("Restarting\n");
     // Reset to test that noinit memory is left intact.

components/esp_common/test_apps/esp_common/pytest_esp_common.py

@@ -1,5 +1,6 @@
-# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
 # SPDX-License-Identifier: CC0-1.0
+from typing import Any
 
 import pytest
 from pytest_embedded import Dut
@@ -20,6 +21,8 @@ def test_esp_common(dut: Dut) -> None:
 
 # psram noinit attr tests with psram enabled
 @pytest.mark.esp32
+@pytest.mark.esp32s2
+@pytest.mark.esp32s3
 @pytest.mark.generic
 @pytest.mark.parametrize(
     'config',
@@ -34,6 +37,8 @@ def test_esp_attr_psram_noinit(dut: Dut) -> None:
 
 # psram noinit memory tests with psram enabled
 @pytest.mark.esp32
+@pytest.mark.esp32s2
+@pytest.mark.esp32s3
 @pytest.mark.generic
 @pytest.mark.supported_targets
 @pytest.mark.parametrize(
@@ -43,8 +48,8 @@ def test_esp_attr_psram_noinit(dut: Dut) -> None:
     ],
     indirect=True,
 )
-def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
-    dut.run_all_single_board_cases()
+def test_esp_attr_psram_noinit_multiple_stages(case_tester: Any) -> None:
+    case_tester.run_all_multi_stage_cases()
 
 
 # psram attr tests with psram enabled

components/esp_common/test_apps/esp_common/sdkconfig.ci.psram_noinit

@@ -1,6 +1,5 @@
 # For EXT_RAM_NOINIT_ATTR
 
-CONFIG_IDF_TARGET="esp32"
 CONFIG_SPIRAM=y
 CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY=y
 CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY=y

components/esp_common/test_apps/esp_common/sdkconfig.ci.xip_psram_esp32s2

@@ -3,5 +3,6 @@
 CONFIG_IDF_TARGET="esp32s2"
 CONFIG_SPIRAM=y
 CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY=y
+CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY=y
 CONFIG_SPIRAM_RODATA=y
 CONFIG_SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY=y

components/esp_common/test_apps/esp_common/sdkconfig.ci.xip_psram_esp32s3

@@ -3,5 +3,6 @@
 CONFIG_IDF_TARGET="esp32s3"
 CONFIG_SPIRAM=y
 CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY=y
+CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY=y
 CONFIG_SPIRAM_RODATA=y
 CONFIG_SPIRAM_ALLOW_STACK_EXTERNAL_MEMORY=y

components/esp_eth/Kconfig

@@ -59,13 +59,11 @@ menu "Ethernet"
                 bool "Output RMII clock from GPIO0 (Experimental!)"
                 default n
                 help
-                    GPIO0 can be set to output a pre-divided PLL clock (test only!).
-                    Enabling this option will configure GPIO0 to output a 50MHz clock.
-                    In fact this clock doesn't have directly relationship with EMAC peripheral.
-                    Sometimes this clock won't work well with your PHY chip. You might need to
-                    add some extra devices after GPIO0 (e.g. inverter).
-                    Note that outputting RMII clock on GPIO0 is an experimental practice.
-                    If you want the Ethernet to work with WiFi, don't select GPIO0 output mode for stability.
+                    GPIO0 can be set to output a pre-divided PLL clock. Enabling this option will configure
+                    GPIO0 to output a 50MHz clock. In fact this clock doesn't have directly relationship with
+                    EMAC peripheral. Sometimes this clock may not work well with your PHY chip.
+                    WARNING: If you want the Ethernet to work with WiFi, don’t select ESP32 as RMII CLK output
+                    as it would result in clock instability!
 
             if !ETH_RMII_CLK_OUTPUT_GPIO0
                 config ETH_RMII_CLK_OUT_GPIO
@@ -74,6 +72,8 @@ menu "Ethernet"
                     default 17
                     help
                         Set the GPIO number to output RMII Clock.
+                        WARNING: If you want the Ethernet to work with WiFi, don’t select ESP32 as RMII CLK output
+                        as it would result in clock instability!
             endif # !ETH_RMII_CLK_OUTPUT_GPIO0
         endif # ETH_RMII_CLK_OUTPUT
 

components/esp_eth/include/esp_eth_mac.h

@@ -349,6 +349,8 @@ typedef enum {
 /**
  * @brief RMII Clock GPIO number Options
  *
+ * @warning If you want the Ethernet to work with WiFi, don’t select ESP32 as RMII CLK output as it would result in clock instability.
+ *
  */
 typedef enum {
     /**
@@ -362,10 +364,8 @@ typedef enum {
     /**
      * @brief Output RMII Clock from internal APLL Clock available at GPIO0
      *
-     * @note GPIO0 can be set to output a pre-divided PLL clock (test only!). Enabling this option will configure GPIO0 to output a 50MHz clock.
-     * In fact this clock doesn’t have directly relationship with EMAC peripheral. Sometimes this clock won’t work well with your PHY chip.
-     * You might need to add some extra devices after GPIO0 (e.g. inverter). Note that outputting RMII clock on GPIO0 is an experimental practice.
-     * If you want the Ethernet to work with WiFi, don’t select GPIO0 output mode for stability.
+     * @note GPIO0 can be set to output a pre-divided PLL clock. Enabling this option will configure GPIO0 to output a 50MHz clock.
+     * In fact this clock doesn’t have directly relationship with EMAC peripheral. Sometimes this clock may not work well with your PHY chip.
      *
      */
     EMAC_APPL_CLK_OUT_GPIO = 0,

components/esp_hid/include/esp_hid_common.h

@@ -23,6 +23,11 @@ extern "C" {
 #include <stdbool.h>
 #include <stdio.h>
 
+/* HID BT Task Size Def */
+#ifndef BT_HID_DEVICE_TASK_SIZE
+#define BT_HID_DEVICE_TASK_SIZE 4096
+#endif
+
 /* HID Report Map Values */
 #define HID_RM_INPUT                        0x80
 #define HID_RM_OUTPUT                       0x90

components/esp_hid/src/ble_hidd.c

@@ -976,7 +976,7 @@ esp_err_t esp_ble_hidd_dev_init(esp_hidd_dev_t *dev_p, const esp_hid_device_conf
         .queue_size = 5,
         .task_name = "ble_hidd_events",
         .task_priority = uxTaskPriorityGet(NULL),
-        .task_stack_size = 4096,
+        .task_stack_size = BT_HID_DEVICE_TASK_SIZE,
         .task_core_id = tskNO_AFFINITY
     };
     ret = esp_event_loop_create(&event_task_args, &s_dev->event_loop_handle);

components/esp_hid/src/bt_hidd.c

@@ -282,6 +282,12 @@ static void bt_hidd_init_app(void)
     s_hidd_param.app_param.subclass = get_subclass_by_appearance(s_hidd_param.dev->appearance);
     s_hidd_param.app_param.desc_list = (uint8_t *)s_hidd_param.dev->devices[0].reports_map.data;
     s_hidd_param.app_param.desc_list_len = s_hidd_param.dev->devices[0].reports_map.len;
+
+    // Information SDP 
+    s_hidd_param.app_param.vendor_id = p_config->vendor_id;
+    s_hidd_param.app_param.product_id = p_config->product_id;
+    s_hidd_param.app_param.version = p_config->version;
+    s_hidd_param.app_param.vendor_id_source = s_hidd_param.app_param.vendor_id_source;
 }
 
 static void bt_hidd_init_qos(void)
@@ -637,7 +643,7 @@ void bt_hidd_cb(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)
         p_rpt = get_report_by_id_and_type(s_hidd_param.dev, param->get_report.report_id, param->get_report.report_type,
                                           &map_index);
         if (p_rpt == NULL) {
-            ESP_LOGE(TAG, "Can not find report!");
+            ESP_LOGE(TAG, "Can not find report EVT: %d", param->get_report.report_id);
             esp_bt_hid_device_report_error(ESP_HID_PAR_HANDSHAKE_RSP_ERR_INVALID_REP_ID);
             break;
         }
@@ -678,7 +684,7 @@ void bt_hidd_cb(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)
         p_rpt = get_report_by_id_and_type(s_hidd_param.dev, param->set_report.report_id, param->set_report.report_type,
                                           &map_index);
         if (p_rpt == NULL) {
-            ESP_LOGE(TAG, "Can not find report!");
+            ESP_LOGE(TAG, "Can not find report SET: %d", param->set_report.report_type);
             esp_bt_hid_device_report_error(ESP_HID_PAR_HANDSHAKE_RSP_ERR_INVALID_REP_ID);
             break;
         }
@@ -715,16 +721,17 @@ void bt_hidd_cb(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)
         break;
     }
     case ESP_HIDD_SET_PROTOCOL_EVT: {
+        ESP_LOGI(TAG, "Ignoring protocol mode change.");
+        break;
+        
         if (param->set_protocol.protocol_mode != ESP_HIDD_UNSUPPORTED_MODE) {
-            if (s_hidd_param.dev->protocol_mode == param->set_protocol.protocol_mode) {
-                break;
-            }
             osi_mutex_lock(&s_hidd_param.mutex, OSI_MUTEX_MAX_TIMEOUT);
-            s_hidd_param.dev->protocol_mode = param->set_protocol.protocol_mode;
+            s_hidd_param.dev->protocol_mode =
+                param->set_protocol.protocol_mode ? ESP_HID_PROTOCOL_MODE_BOOT : ESP_HID_PROTOCOL_MODE_REPORT;
             osi_mutex_unlock(&s_hidd_param.mutex);
             cb_param.protocol_mode.dev = s_hidd_param.dev->dev;
             cb_param.protocol_mode.protocol_mode = s_hidd_param.dev->protocol_mode;
-            cb_param.protocol_mode.map_index = 0;
+            //cb_param.protocol_mode.map_index = 0;
             esp_event_post_to(s_hidd_param.dev->event_loop_handle, ESP_HIDD_EVENTS, ESP_HIDD_PROTOCOL_MODE_EVENT,
                               &cb_param, sizeof(esp_hidd_event_data_t), portMAX_DELAY);
         } else {
@@ -737,7 +744,7 @@ void bt_hidd_cb(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)
         p_rpt = get_report_by_id_and_type(s_hidd_param.dev, param->intr_data.report_id, ESP_HID_REPORT_TYPE_OUTPUT,
                                           &map_index);
         if (p_rpt == NULL) {
-            ESP_LOGE(TAG, "Can not find report!");
+            ESP_LOGE(TAG, "Can not find report INTR: %d", param->intr_data.report_id);
             break;
         }
 
@@ -812,7 +819,7 @@ esp_err_t esp_bt_hidd_dev_init(esp_hidd_dev_t *dev_p, const esp_hid_device_confi
         .queue_size = 5,
         .task_name = "bt_hidd_events",
         .task_priority = uxTaskPriorityGet(NULL),
-        .task_stack_size = 2048,
+        .task_stack_size = BT_HID_DEVICE_TASK_SIZE,
         .task_core_id = tskNO_AFFINITY
     };
     ret = esp_event_loop_create(&event_task_args, &s_hidd_param.dev->event_loop_handle);

components/esp_https_ota/include/esp_https_ota.h

@@ -235,6 +235,21 @@ esp_err_t esp_https_ota_get_img_desc(esp_https_ota_handle_t https_ota_handle, es
 int esp_https_ota_get_image_len_read(esp_https_ota_handle_t https_ota_handle);
 
 
+/**
+ * @brief  This function returns the HTTP status code of the last HTTP response.
+ *
+ * @note   This API should be called only after esp_https_ota_begin() has been called.
+ *         This can be used to check the HTTP status code of the OTA download process.
+ *
+ * @param[in]   https_ota_handle   pointer to esp_https_ota_handle_t structure
+ *
+ * @return
+ *    - -1    On failure
+ *    - HTTP status code
+ */
+int esp_https_ota_get_status_code(esp_https_ota_handle_t https_ota_handle);
+
+
 /**
 * @brief  This function returns OTA image total size.
 *

components/esp_https_ota/src/esp_https_ota.c

@@ -714,6 +714,15 @@ esp_err_t esp_https_ota_abort(esp_https_ota_handle_t https_ota_handle)
     return err;
 }
 
+int esp_https_ota_get_status_code(esp_https_ota_handle_t https_ota_handle)
+{
+    esp_https_ota_t *handle = (esp_https_ota_t *) https_ota_handle;
+    if (handle == NULL || handle->http_client == NULL) {
+        return -1;
+    }
+    return esp_http_client_get_status_code(handle->http_client);
+}
+
 int esp_https_ota_get_image_len_read(esp_https_ota_handle_t https_ota_handle)
 {
     esp_https_ota_t *handle = (esp_https_ota_t *)https_ota_handle;

components/esp_hw_support/include/spinlock.h

@@ -132,7 +132,7 @@ static inline bool __attribute__((always_inline)) spinlock_acquire(spinlock_t *l
             break;
         }
         // Keep looping if we are waiting forever, or check if we have timed out
-    } while ((timeout == SPINLOCK_WAIT_FOREVER) || (esp_cpu_get_cycle_count() - start_count) <= timeout);
+    } while ((timeout == SPINLOCK_WAIT_FOREVER) || (esp_cpu_get_cycle_count() - start_count) <= (esp_cpu_cycle_count_t)timeout);
 
 exit:
     if (lock_set) {

components/esp_hw_support/port/esp32c2/Kconfig.hw_support

@@ -13,12 +13,15 @@ choice ESP32C2_REV_MIN
         bool "Rev v1.0 (ECO1)"
     config ESP32C2_REV_MIN_1_1
         bool "Rev v1.1 (ECO2)"
+    config ESP32C2_REV_MIN_200
+        bool "Rev v2.0 (ECO4)"
 endchoice
 
 config ESP32C2_REV_MIN_FULL
     int
     default 100 if ESP32C2_REV_MIN_1
     default 101 if ESP32C2_REV_MIN_1_1
+    default 200 if ESP32C2_REV_MIN_200
 
 config ESP_REV_MIN_FULL
     int

components/esp_hw_support/sleep_clock.c

@@ -37,7 +37,12 @@ static esp_err_t sleep_clock_system_retention_init(void *arg)
     #define N_REGS_PCR()    (((PCR_PWDET_SAR_CLK_CONF_REG - DR_REG_PCR_BASE) / 4) + 1)
 #endif
     const static sleep_retention_entries_config_t pcr_regs_retention[] = {
-        [0] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0), DR_REG_PCR_BASE, DR_REG_PCR_BASE, N_REGS_PCR(), 0, 0), .owner = ENTRY(0) | ENTRY(2) }  /* pcr */
+        [0] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0),   DR_REG_PCR_BASE,            DR_REG_PCR_BASE,            N_REGS_PCR(),           0, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [1] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(1),   PCR_RESET_EVENT_BYPASS_REG, PCR_RESET_EVENT_BYPASS_REG, 1,                      0, 0), .owner = ENTRY(0) | ENTRY(2) },
+#if CONFIG_IDF_TARGET_ESP32H2
+        [2] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(2),   PCR_BUS_CLK_UPDATE_REG,     PCR_BUS_CLOCK_UPDATE,       PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [3] = { .config = REGDMA_LINK_WAIT_INIT      (REGDMA_PCR_LINK(3),   PCR_BUS_CLK_UPDATE_REG,     0x0,                        PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+#endif
     };
 
     esp_err_t err = sleep_retention_entries_create(pcr_regs_retention, ARRAY_SIZE(pcr_regs_retention), REGDMA_LINK_PRI_SYS_CLK, SLEEP_RETENTION_MODULE_CLOCK_SYSTEM);

components/esp_hw_support/sleep_modes.c

@@ -1220,8 +1220,21 @@ esp_err_t esp_light_sleep_start(void)
 
 #if CONFIG_ESP_SLEEP_CACHE_SAFE_ASSERTION && CONFIG_PM_SLP_IRAM_OPT
     /* Cache Suspend 0: if CONFIG_PM_SLP_IRAM_OPT is enabled, suspend cache here so that the access to flash
-       during the sleep process can be explicitly exposed. */
-    suspend_cache();
+     * during the sleep process can be explicitly exposed.
+     *
+     * If we use EXTx wakeup, we must put related codes in IRAM, but The `rtc_io_desc` table
+     * consumes a significant amount of memory. For example, on the ESP32, its size is 1008
+     * bytes. Therefore, when EXTx wakeup is enabled, we do not perform cache access checks here */
+    uint32_t ignore_check_wakeup_triggers = 0;
+#if SOC_PM_SUPPORT_EXT0_WAKEUP
+    ignore_check_wakeup_triggers |= RTC_EXT0_TRIG_EN;
+#endif
+#if SOC_PM_SUPPORT_EXT1_WAKEUP
+    ignore_check_wakeup_triggers |= RTC_EXT1_TRIG_EN;
+#endif
+    if (!(s_config.wakeup_triggers & ignore_check_wakeup_triggers)) {
+        suspend_cache();
+    }
 #endif
 
     // Decide which power domains can be powered down
@@ -1356,7 +1369,9 @@ esp_err_t esp_light_sleep_start(void)
 
 #if CONFIG_ESP_SLEEP_CACHE_SAFE_ASSERTION && CONFIG_PM_SLP_IRAM_OPT
     /* Cache Resume 0: sleep process done, resume cache for continue running */
-    resume_cache();
+    if (!(s_config.wakeup_triggers & ignore_check_wakeup_triggers)) {
+        resume_cache();
+    }
 #endif
 
     esp_ipc_isr_release_other_cpu();

components/esp_psram/Kconfig.spiram.common

@@ -23,7 +23,8 @@ config SPIRAM_IGNORE_NOTFOUND
         ESP_WIFI_CACHE_TX_BUFFER_NUM and use static WiFi Tx buffer may cause potential memory exhaustion issues.
         Suggest disable SPIRAM_TRY_ALLOCATE_WIFI_LWIP.
         Suggest disable ESP_WIFI_AMSDU_TX_ENABLED.
-        Suggest disable ESP_WIFI_CACHE_TX_BUFFER_NUM, need clear CONFIG_FEATURE_CACHE_TX_BUF_BIT of config->feature_caps.
+        Suggest disable ESP_WIFI_CACHE_TX_BUFFER_NUM,
+        need clear CONFIG_FEATURE_CACHE_TX_BUF_BIT of config->feature_caps.
         Suggest change ESP_WIFI_TX_BUFFER from static to dynamic. Also suggest to adjust some buffer numbers to the
         values used without PSRAM case. Such as, ESP_WIFI_STATIC_TX_BUFFER_NUM, ESP_WIFI_DYNAMIC_TX_BUFFER_NUM.
 
@@ -109,7 +110,7 @@ config SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY
 config SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY
     bool "Allow .noinit segment placed in external memory"
     default n
-    depends on SPIRAM && IDF_TARGET_ESP32
+    depends on SPIRAM
     help
         If enabled, noinit variables can be placed in PSRAM using EXT_RAM_NOINIT_ATTR.
 

components/esp_rom/CMakeLists.txt

@@ -239,8 +239,16 @@ else() # Regular app build
         rom_linker_script("newlib")
         rom_linker_script("version")
 
+        if(CONFIG_ESP32C2_REV_MIN_FULL GREATER_EQUAL 200)
+            rom_linker_script("eco4")
+        endif()
+
         if(CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL)
             rom_linker_script("mbedtls")
+            # For ESP32C2(ECO4), mbedTLS in ROM has been updated to v3.6.0-LTS
+            if(CONFIG_ESP32C2_REV_MIN_FULL GREATER_EQUAL 200)
+                rom_linker_script("mbedtls.eco4")
+            endif()
         endif()
 
         if(CONFIG_NEWLIB_NANO_FORMAT)

components/esp_rom/esp32c2/ld/esp32c2.rom.eco4.ld

@@ -0,0 +1,537 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/***************************************
+ Group bluetooth
+ ***************************************/
+
+/* Functions */
+r__os_msys_find_pool = 0x40000ac0;
+r_ble_hci_ram_hs_acl_tx = 0x40000ac8;
+r_ble_hci_ram_hs_cmd_tx = 0x40000acc;
+r_ble_hci_ram_ll_acl_tx = 0x40000ad0;
+r_ble_hci_ram_ll_evt_tx = 0x40000ad4;
+r_ble_hci_trans_deinit = 0x40000af4;
+r_ble_hci_trans_env_init = 0x40000af8;
+r_ble_hci_uart_hs_acl_tx = 0x40000b10;
+r_ble_hci_uart_hs_cmd_tx = 0x40000b14;
+r_ble_hci_uart_ll_acl_tx = 0x40000b18;
+r_ble_hci_uart_ll_evt_tx = 0x40000b1c;
+r_ble_hw_driver_deinit = 0x40000b60;
+r_ble_hw_driver_env_init = 0x40000b64;
+r_ble_hw_resolv_list_get_cur_entry = 0x40000b84;
+r_ble_hw_whitelist_clear = 0x40000ba4;
+r_ble_hw_whitelist_rmv = 0x40000bb0;
+r_ble_ll_adv_deinit = 0x40000c00;
+r_ble_ll_adv_env_init = 0x40000c08;
+r_ble_ll_adv_ext_set_enable = 0x40000c10;
+r_ble_ll_adv_ext_set_param = 0x40000c14;
+r_ble_ll_adv_legacy_pdu_make = 0x40000c40;
+r_ble_ll_adv_periodic_enable = 0x40000c50;
+r_ble_ll_adv_periodic_set_data = 0x40000c5c;
+r_ble_ll_adv_remove = 0x40000c84;
+r_ble_ll_adv_reset = 0x40000c88;
+r_ble_ll_adv_rx_pkt_in = 0x40000c94;
+r_ble_ll_adv_send_conn_comp_ev = 0x40000ca8;
+r_ble_ll_adv_set_adv_data = 0x40000cac;
+r_ble_ll_adv_set_scan_rsp_data = 0x40000cbc;
+r_ble_ll_adv_set_sched = 0x40000cc0;
+r_ble_ll_adv_sm_init = 0x40000cd4;
+r_ble_ll_adv_sync_calculate = 0x40000cf4;
+r_ble_ll_adv_sync_pdu_make = 0x40000cfc;
+r_ble_ll_arr_pool_init = 0x40000d10;
+r_ble_ll_check_scan_params = 0x40000d24;
+r_ble_ll_conn_connect_ind_pdu_make = 0x40000d54;
+r_ble_ll_conn_create = 0x40000d58;
+r_ble_ll_conn_created = 0x40000d60;
+r_ble_ll_conn_enqueue_pkt = 0x40000d7c;
+r_ble_ll_conn_env_init = 0x40000d80;
+r_ble_ll_conn_hci_le_set_phy = 0x40000db4;
+r_ble_ll_conn_hci_set_chan_class = 0x40000dd8;
+r_ble_ll_conn_is_dev_connected = 0x40000dec;
+r_ble_ll_conn_module_deinit = 0x40000dfc;
+r_ble_ll_conn_module_init = 0x40000e00;
+r_ble_ll_conn_next_event = 0x40000e08;
+r_ble_ll_conn_prepare_tx_pdu = 0x40000e10;
+r_ble_ll_conn_rx_data_pdu = 0x40000e1c;
+r_ble_ll_conn_slave_start = 0x40000e38;
+r_ble_ll_conn_sm_new = 0x40000e40;
+r_ble_ll_conn_sm_npl_deinit = 0x40000e44;
+r_ble_ll_conn_sm_npl_init = 0x40000e48;
+r_ble_ll_ctrl_chk_proc_start = 0x40000e58;
+r_ble_ll_ctrl_conn_upd_make = 0x40000e68;
+r_ble_ll_ctrl_enc_allowed_pdu_tx = 0x40000e78;
+r_ble_ll_ctrl_proc_init = 0x40000ea8;
+r_ble_ll_ctrl_proc_start = 0x40000eb0;
+r_ble_ll_ctrl_proc_unk_rsp = 0x40000eb8;
+r_ble_ll_ctrl_rx_feature_rsp = 0x40000ee4;
+r_ble_ll_ctrl_rx_pdu = 0x40000ef0;
+r_ble_ll_ctrl_tx_done = 0x40000f30;
+r_ble_ll_deinit = 0x40000f40;
+r_ble_ll_env_init = 0x40000f48;
+r_ble_ll_ext_conn_create = 0x40000f60;
+r_ble_ll_generic_data_init = 0x40000f78;
+r_ble_ll_get_chan_to_scan = 0x40000f80;
+r_ble_ll_hci_cb_host_buf_size = 0x40000f98;
+r_ble_ll_hci_cmd_proc = 0x40000fac;
+r_ble_ll_hci_ctlr_bb_cmd_proc = 0x40000fb4;
+r_ble_ll_hci_deinit = 0x40000fb8;
+r_ble_ll_hci_env_init = 0x40000fc0;
+r_ble_ll_hci_event_send = 0x40001004;
+r_ble_ll_hci_le_cmd_proc = 0x40001024;
+r_ble_ll_hci_le_read_local_features = 0x40001040;
+r_ble_ll_hci_send_legacy_ext_adv_report = 0x40001080;
+r_ble_ll_init = 0x400010a8;
+r_ble_ll_init_rx_pkt_in = 0x400010b4;
+r_ble_ll_mbuf_init = 0x400010dc;
+r_ble_ll_modify_sca_action = 0x400010e8;
+r_ble_ll_rand = 0x400010fc;
+r_ble_ll_rand_deinit = 0x40001104;
+r_ble_ll_rand_env_init = 0x40001108;
+r_ble_ll_read_tx_power = 0x4000112c;
+r_ble_ll_reset = 0x40001130;
+r_ble_ll_resolv_deinit = 0x4000113c;
+r_ble_ll_resolv_env_init = 0x40001148;
+r_ble_ll_resolv_gen_priv_addr = 0x4000114c;
+r_ble_ll_resolv_init = 0x4000116c;
+r_ble_ll_resolv_list_rmv = 0x4000118c;
+r_ble_ll_scan_deinit = 0x400011e4;
+r_ble_ll_scan_env_init = 0x40001208;
+r_ble_ll_scan_init = 0x40001230;
+r_ble_ll_scan_pre_process = 0x4000124c;
+r_ble_ll_scan_rx_pkt_in_on_aux = 0x40001260;
+r_ble_ll_scan_rx_pkt_in_on_legacy = 0x40001264;
+r_ble_ll_scan_send_adv_report = 0x40001270;
+r_ble_ll_scan_set_enable = 0x40001278;
+r_ble_ll_scan_set_scan_params = 0x40001284;
+r_ble_ll_set_ext_scan_params = 0x400012a4;
+r_ble_ll_set_host_feat = 0x400012a8;
+r_ble_ll_sync_create = 0x400012d4;
+r_ble_ll_sync_deinit = 0x400012d8;
+r_ble_ll_sync_env_init = 0x400012e0;
+r_ble_ll_sync_est_event_failed = 0x400012e4;
+r_ble_ll_sync_est_event_success = 0x400012e8;
+r_ble_ll_sync_parse_ext_hdr = 0x40001334;
+r_ble_ll_sync_put_syncinfo = 0x40001344;
+r_ble_ll_sync_receive_enable = 0x40001348;
+r_ble_ll_sync_rx_pkt_in = 0x40001358;
+r_ble_ll_task = 0x4000137c;
+r_ble_ll_trace_set_func = 0x40001380;
+r_ble_ll_tx_mbuf_pducb = 0x40001394;
+r_ble_ll_tx_pkt_in = 0x40001398;
+r_ble_ll_whitelist_clear = 0x400013c8;
+r_ble_ll_whitelist_rmv = 0x400013d0;
+r_ble_ll_whitelist_search = 0x400013d4;
+r_ble_lll_adv_aux_scannable_pdu_payload_len = 0x400013dc;
+r_ble_lll_adv_drop_event = 0x40001420;
+r_ble_lll_adv_ext_estimate_data_itvl = 0x4000142c;
+r_ble_lll_adv_halt = 0x40001434;
+r_ble_lll_adv_periodic_schedule_next = 0x4000144c;
+r_ble_lll_adv_periodic_start = 0x40001450;
+r_ble_lll_adv_periodic_stop = 0x40001454;
+r_ble_lll_adv_rx_pkt_isr = 0x40001464;
+r_ble_lll_adv_sec_done = 0x40001468;
+r_ble_lll_conn_append_tx_buffer = 0x400014c8;
+r_ble_lll_conn_cth_flow_free_credit = 0x400014f0;
+r_ble_lll_conn_end = 0x400014f8;
+r_ble_lll_conn_env_deinit = 0x400014fc;
+r_ble_lll_conn_env_init = 0x40001500;
+r_ble_lll_conn_event_end = 0x40001504;
+r_ble_lll_conn_event_end_timer_cb = 0x40001508;
+r_ble_lll_conn_event_halt = 0x4000150c;
+r_ble_lll_conn_get_rx_mbuf = 0x40001528;
+r_ble_lll_conn_halt = 0x4000152c;
+r_ble_lll_conn_module_deinit = 0x40001538;
+r_ble_lll_conn_module_init = 0x4000153c;
+r_ble_lll_conn_no_mem_evt_pre_cb = 0x40001544;
+r_ble_lll_conn_process_acked_pdu = 0x4000154c;
+r_ble_lll_conn_process_in_isr = 0x40001550;
+r_ble_lll_conn_rx_pkt_isr = 0x40001560;
+r_ble_lll_conn_set_slave_flow_control = 0x4000156c;
+r_ble_lll_conn_slave_new = 0x40001570;
+r_ble_lll_conn_update_encryption = 0x40001590;
+r_ble_lll_dtm_deinit = 0x400015a4;
+r_ble_lll_dtm_init = 0x400015b4;
+r_ble_lll_dtm_tx_create_ctx = 0x400015dc;
+r_ble_lll_init_rx_pkt_isr = 0x40001624;
+r_ble_lll_reset = 0x40001644;
+r_ble_lll_rfmgmt_controller_sleep_en = 0x40001648;
+r_ble_lll_rfmgmt_deinit = 0x4000164c;
+r_ble_lll_rfmgmt_disable = 0x40001650;
+r_ble_lll_rfmgmt_enable = 0x40001654;
+r_ble_lll_rfmgmt_enable_now = 0x40001658;
+r_ble_lll_rfmgmt_init = 0x4000165c;
+r_ble_lll_rfmgmt_release_ev = 0x40001668;
+r_ble_lll_rfmgmt_reset = 0x4000166c;
+r_ble_lll_rfmgmt_timer_exp = 0x40001680;
+r_ble_lll_rfmgmt_timer_reschedule = 0x40001684;
+r_ble_lll_scan_aux_data_free = 0x40001698;
+r_ble_lll_scan_halt = 0x400016c4;
+r_ble_lll_scan_init = 0x400016cc;
+r_ble_lll_scan_npl_init = 0x400016d0;
+r_ble_lll_scan_process_rsp_in_isr = 0x400016e8;
+r_ble_lll_scan_restart = 0x400016f0;
+r_ble_lll_scan_rx_isr_on_aux = 0x400016f4;
+r_ble_lll_scan_rx_isr_on_legacy = 0x400016f8;
+r_ble_lll_scan_rx_pkt_isr = 0x400016fc;
+r_ble_lll_scan_stop = 0x40001710;
+r_ble_lll_scan_targeta_is_matched = 0x40001714;
+r_ble_lll_sched_conn_reschedule = 0x40001730;
+r_ble_lll_sched_deinit = 0x40001734;
+r_ble_lll_sched_env_init = 0x4000173c;
+r_ble_lll_sched_execute_check = 0x40001740;
+r_ble_lll_sched_init = 0x40001748;
+r_ble_lll_sched_sync_reschedule = 0x40001784;
+r_ble_lll_sync_event_end = 0x400017a0;
+r_ble_lll_sync_event_start_cb = 0x400017a8;
+r_ble_lll_sync_halt = 0x400017b0;
+r_ble_lll_sync_rx_pkt_isr = 0x400017c8;
+r_ble_phy_config_access_addr = 0x400017f0;
+r_ble_phy_env_init = 0x4000180c;
+r_ble_phy_init = 0x40001828;
+r_ble_phy_isr = 0x4000182c;
+r_ble_phy_module_deinit = 0x40001840;
+r_ble_phy_monitor_bb_sync = 0x40001848;
+r_ble_phy_set_adv_mode = 0x40001888;
+r_ble_phy_set_rxhdr = 0x400018a0;
+r_ble_phy_set_scan_mode = 0x400018a4;
+r_ble_phy_set_sequence_mode = 0x400018a8;
+r_ble_phy_txpower_round = 0x400018d8;
+r_ble_phy_update_conn_sequence = 0x400018e0;
+r_ble_phy_update_encryption = 0x400018e4;
+r_hal_rtc_intr_init = 0x40001960;
+r_hal_rtc_irq_handler = 0x40001964;
+r_hal_timer_deinit = 0x40001968;
+r_hal_timer_env_init = 0x40001970;
+r_hal_timer_init = 0x40001974;
+r_hal_timer_set_exp_tick = 0x40001988;
+r_hal_timer_start_at = 0x40001990;
+r_hal_timer_stop = 0x40001994;
+r_mem_split_frag = 0x400019bc;
+r_os_mbuf_append = 0x400019e0;
+r_os_memblock_put = 0x40001a48;
+r_os_mempool_init_internal = 0x40001a64;
+r_os_mempool_module_init = 0x40001a6c;
+/* Data (.data, .bss, .rodata) */
+g_ble_ll_ctrl_pkt_lengths_ro = 0x3ff4fd8c;
+
+
+/***************************************
+ Group rom_pp
+ ***************************************/
+
+/* Functions */
+esf_buf_alloc = 0x40001ae0;
+esf_buf_alloc_dynamic = 0x40001ae4;
+esf_buf_recycle = 0x40001ae8;
+hal_mac_tx_set_ppdu = 0x40001af8;
+ic_mac_deinit = 0x40001b00;
+lmacAdjustTimestamp = 0x40001b10;
+lmacDiscardMSDU = 0x40001b18;
+lmacEndFrameExchangeSequence = 0x40001b1c;
+lmacMSDUAged = 0x40001b28;
+lmacSetTxFrame = 0x40001b4c;
+pm_check_state = 0x40001b6c;
+pm_dream = 0x40001b78;
+pm_on_beacon_rx = 0x40001ba0;
+pm_parse_beacon = 0x40001bac;
+pm_process_tim = 0x40001bb0;
+pm_rx_beacon_process = 0x40001bb4;
+pm_rx_data_process = 0x40001bb8;
+pm_sleep = 0x40001bbc;
+pm_tbtt_process = 0x40001bc4;
+ppAssembleAMPDU = 0x40001bcc;
+ppCalTxAMPDULength = 0x40001bd8;
+ppRxFragmentProc = 0x40001c28;
+ppRxPkt = 0x40001c2c;
+pp_coex_tx_request = 0x40001c54;
+rcGetSched = 0x40001c88;
+rcTxUpdatePer = 0x40001c94;
+rcUpdateRate = 0x40001c9c;
+wDev_AppendRxBlocks = 0x40001cdc;
+wDev_IndicateFrame = 0x40001cec;
+wDev_ProcessFiq = 0x40001d08;
+wDev_ProcessRxSucData = 0x40001d0c;
+ppProcTxDone = 0x40001d1c;
+pm_tx_data_done_process = 0x40001d20;
+ppMapWaitTxq = 0x40001d28;
+lmacDiscardFrameExchangeSequence = 0x40001d70;
+lmacDisableTransmit = 0x40001d74;
+lmacProcessTxTimeout = 0x40001d78;
+lmacProcessTxSuccess = 0x40001d7c;
+lmacProcessTxComplete = 0x40001d8c;
+lmacProcessTxopQComplete = 0x40001dc0;
+lmacInit = 0x40001dc8;
+hal_init = 0x40001dd0;
+mac_txrx_init = 0x40001de0;
+lmac_stop_hw_txq = 0x40001df8;
+ppTxFragmentProc = 0x40001e08;
+esf_buf_setup = 0x40001e0c;
+hal_crypto_set_key_entry = 0x40001e18;
+pm_start = 0x40001e34;
+pm_stop = 0x40001e38;
+hal_set_sta_tbtt = 0x40001e4c;
+pm_update_next_tbtt = 0x40001e50;
+pm_set_sleep_type = 0x40001e54;
+pm_tx_null_data_done_process = 0x40001eb0;
+pm_tx_data_process = 0x40001eb4;
+pm_attach = 0x40001eb8;
+pm_coex_schm_process = 0x40001ebc;
+pm_on_probe_resp_rx = 0x40001ecc;
+pm_send_probe_stop = 0x40001edc;
+hal_sniffer_rx_set_promis = 0x40001ef4;
+hal_sniffer_set_promis_misc_pkt = 0x40001efc;
+tsf_hal_set_tbtt_start_time = 0x40001f38;
+
+
+/***************************************
+ Group rom_net80211
+ ***************************************/
+
+/* Functions */
+ieee80211_ampdu_reorder = 0x40001fb0;
+ieee80211_encap_esfbuf = 0x40001fb8;
+ieee80211_output_process = 0x40001fc4;
+sta_input = 0x40001fcc;
+ieee80211_classify = 0x40001fe0;
+ieee80211_crypto_decap = 0x40001ff8;
+ieee80211_ccmp_decrypt = 0x4000200c;
+ieee80211_ccmp_encrypt = 0x40002010;
+ieee80211_send_action_vendor_spec = 0x40002034;
+ieee80211_send_mgmt = 0x40002038;
+ieee80211_auth_construct = 0x4000203c;
+ieee80211_deauth_construct = 0x40002040;
+ieee80211_disassoc_construct = 0x40002044;
+ieee80211_add_xrates = 0x40002058;
+ieee80211_assoc_req_construct = 0x40002060;
+ieee80211_assoc_resp_construct = 0x40002064;
+ieee80211_timer_process = 0x4000208c;
+cnx_coexist_timeout = 0x40002090;
+sta_recv_mgmt = 0x40002094;
+ieee80211_send_probereq = 0x4000209c;
+sta_auth_open = 0x400020a0;
+sta_auth_sae = 0x400020a8;
+cnx_coexist_timeout_process = 0x400020ac;
+ieee80211_add_extcap = 0x400020cc;
+ieee80211_alloc_proberesp = 0x400020d8;
+esp_wifi_80211_tx = 0x400020f8;
+ieee80211_crypto_aes_128_cmac_decrypt = 0x40002104;
+ieee80211_output_do = 0x4000210c;
+ieee80211_send_nulldata = 0x40002110;
+ieee80211_setup_robust_mgmtframe = 0x40002114;
+ieee80211_mgmt_output = 0x40002118;
+ieee80211_send_deauth = 0x40002120;
+ieee80211_tx_mgt_cb = 0x4000212c;
+sta_rx_csa = 0x40002134;
+sta_send_sa_query_req = 0x40002138;
+sta_send_sa_query_resp = 0x4000213c;
+sta_recv_sa_query_req = 0x40002140;
+sta_recv_sa_query_resp = 0x40002144;
+ieee80211_parse_beacon = 0x40002148;
+ieee80211_match_security = 0x40002154;
+ieee80211_parse_rsn = 0x4000215c;
+/* Data (.data, .bss, .rodata) */
+s_sa_query_retries = 0x3fcdfad8;
+s_sa_query_success = 0x3fcdfad5;
+s_trans_id = 0x3fcdfac4;
+
+
+/***************************************
+ Group rom_coexist
+ ***************************************/
+
+/* Functions */
+coex_core_event_duration_get = 0x40002178;
+coex_core_timer_idx_get = 0x4000218c;
+coex_hw_timer_tick_get = 0x400021b8;
+
+
+/***************************************
+ Group rom_phy
+ ***************************************/
+
+/* Functions */
+phy_xpd_tsens = 0x400021e8;
+bt_track_pll_cap = 0x40002534;
+tx_pwctrl_background = 0x40002548;
+
+
+/***************************************
+ Group eco4_systimer_hal
+ ***************************************/
+
+/* Functions */
+systimer_hal_init = 0x400002a8;
+systimer_hal_get_time = 0x400002b0;
+systimer_hal_set_alarm_target = 0x400002b4;
+systimer_hal_set_alarm_period = 0x400002b8;
+systimer_hal_counter_value_advance = 0x400002c8;
+systimer_hal_deinit = 0x40002ea8;
+systimer_hal_set_tick_rate_ops = 0x40002eac;
+
+
+/***************************************
+ Group eco4_bluetooth
+ ***************************************/
+
+/* Functions */
+r_ble_ll_adv_ext_pdu_tx_len = 0x40002eb0;
+r_ble_ll_adv_ext_estimate_data_itvl = 0x40002eb4;
+r_ble_ll_adv_ext_check_data_itvl = 0x40002eb8;
+r_ble_ll_ctrl_channel_status_report_timer_cb = 0x40002ebc;
+r_ble_ll_ctrl_channel_class_enable_make = 0x40002ec0;
+r_ble_ll_ctrl_channel_class_reporting_make = 0x40002ec4;
+r_ble_ll_ctrl_rx_channel_reporting_ind = 0x40002ec8;
+r_ble_ll_ctrl_rx_channel_status_ind = 0x40002ecc;
+r_ble_ll_ctrl_channel_class_info_update = 0x40002ed0;
+r_ble_ll_adv_set_data_related_addr_change = 0x40002ed4;
+r_ble_ll_misc_additional_options_set = 0x40002ed8;
+r_ble_phy_get_txdbm_by_level = 0x40002edc;
+r_hal_timer_disable_intr = 0x40002ee0;
+r_hal_timer_enable_intr = 0x40002ee4;
+r_hal_timer_task_stop = 0x40002ee8;
+r_ble_lll_rfmgmt_env_init = 0x40002eec;
+r_ble_ll_scan_set_aux_ll_flag = 0x40002ef0;
+r_ble_ll_rf_temp_calibration = 0x40002ef4;
+r_ble_ll_adv_env_deinit = 0x40002ef8;
+r_ble_ll_conn_env_deinit = 0x40002efc;
+r_ble_ll_hci_env_deinit = 0x40002f00;
+r_ble_ll_rand_env_deinit = 0x40002f04;
+r_ble_ll_resolv_env_deinit = 0x40002f08;
+r_ble_ll_scan_env_deinit = 0x40002f0c;
+r_ble_ll_sync_env_deinit = 0x40002f10;
+r_ble_lll_rfmgmt_env_deinit = 0x40002f14;
+r_hal_timer_env_deinit = 0x40002f18;
+r_ble_ll_env_deinit = 0x40002f1c;
+r_ble_ll_generic_data_deinit = 0x40002f20;
+r_ble_hci_trans_env_deinit = 0x40002f24;
+r_ble_ll_conn_callout_env_init = 0x40002f28;
+r_ble_ll_conn_callout_env_deinit = 0x40002f2c;
+r_ble_ll_scan_callout_env_init = 0x40002f30;
+r_ble_ll_scan_callout_env_deinit = 0x40002f34;
+r_ble_ll_callout_env_init = 0x40002f38;
+r_ble_ll_callout_env_deinit = 0x40002f3c;
+r_ble_ll_resolv_callout_env_init = 0x40002f40;
+r_ble_ll_resolv_callout_env_deinit = 0x40002f44;
+r_ble_ll_get_npl_element_info = 0x40002f48;
+r_ble_rtc_wake_up_cpu_clr = 0x40002f4c;
+r_ble_ll_scan_hci_set_adv_report_flow_ctrl = 0x40002f50;
+r_ble_ll_scan_hci_update_adv_report_flow_ctrl = 0x40002f54;
+r_ble_ll_scan_send_adv_lost_report = 0x40002f58;
+r_ble_ll_scan_adv_report_cth_flow_is_enabled = 0x40002f5c;
+r_ble_ll_scan_adv_report_cth_flow_alloc_credit = 0x40002f60;
+r_ble_ll_scan_adv_report_cth_flow_free_credit = 0x40002f64;
+r_ble_ll_scan_adv_report_cth_flow_have_credit = 0x40002f68;
+r_ble_ll_scan_adv_report_lost_cnt_threshold_arrived = 0x40002f6c;
+r_ble_ll_scan_adv_report_lost_cnt_clear = 0x40002f70;
+r_ble_ll_scan_adv_report_lost_cnt_add = 0x40002f74;
+r_ble_ll_trace_hex = 0x40002f78;
+r_ble_ll_conn_calc_closest_event_cntr = 0x40002f7c;
+r_ble_ll_trace_buffer_select = 0x40002f80;
+r_ble_ll_adv_vendor_hci_legacy_adv_clear = 0x40002f84;
+r_ble_ll_conn_is_lru_compare_with_sync = 0x40002f88;
+r_ble_ll_conn_rollback_last_unmapped_chan = 0x40002f8c;
+r_ble_ll_hci_vs_csa_set = 0x40002f90;
+r_ble_ll_hci_reset = 0x40002f94;
+r_ble_ll_adv_status_check = 0x40002f98;
+r_ble_ll_conn_status_check = 0x40002f9c;
+r_ble_ll_scan_status_check = 0x40002fa0;
+r_ble_ll_sync_status_check = 0x40002fa4;
+r_ble_ll_resolv_status_check = 0x40002fa8;
+r_ble_ll_whitelist_status_check = 0x40002fac;
+r_ble_ll_adv_delay_get = 0x40002fb0;
+r_ble_ll_scan_continue_status_get = 0x40002fb4;
+r_ble_ll_default_privacy_mode_get = 0x40002fb8;
+r_ble_ll_adv_periodic_status_check = 0x40002fbc;
+r_ble_ll_sync_list_status_check = 0x40002fc0;
+r_ble_lll_rfmgmt_wake_up_ev = 0x40002fc4;
+r_ble_lll_sched_env_deinit = 0x40002fc8;
+r_ble_phy_env_deinit = 0x40002fcc;
+r_ble_hw_driver_env_deinit = 0x40002fd0;
+r_ble_lll_dtm_env_init = 0x40002fd4;
+r_ble_lll_dtm_env_deinit = 0x40002fd8;
+r_ble_lll_scan_callout_env_init = 0x40002fdc;
+r_ble_lll_scan_callout_env_deinit = 0x40002fe0;
+r_ble_lll_scan_env_init = 0x40002fe4;
+r_ble_lll_scan_env_deinit = 0x40002fe8;
+r_ble_lll_get_npl_element_info = 0x40002fec;
+r_ble_lll_conn_rxpdu_alloc = 0x40002ff0;
+r_ble_lll_scan_filter_out_useless_adv = 0x40002ff4;
+r_ble_hw_whitelist_check_in_wl = 0x40002ff8;
+r_ble_phy_stats_reset = 0x40002ffc;
+r_ble_phy_ramup_time_set = 0x40003000;
+r_ble_lll_rfmgmt_should_skip_light_sleep_check = 0x40003004;
+r_ble_phy_rx_err_record = 0x40003008;
+r_ble_lll_rfmgmt_wake_up_overhead_set = 0x4000300c;
+r_ble_lll_conn_event_delete_and_reschedule = 0x40003010;
+r_ble_lll_conn_should_reschedule = 0x40003014;
+r_ble_lll_adv_ext_event_rmvd_from_sched = 0x40003018;
+r_ble_lll_conn_process_rx_data_after_halt = 0x4000301c;
+r_ble_phy_global_rxbuf_get = 0x40003020;
+/* Data (.data, .bss, .rodata) */
+priv_config_additional_opts_ptr = 0x3fcdfa70;
+g_ble_ll_ctrl_pkt_lengths_eco4_ro = 0x3ff4fbac;
+
+
+/***************************************
+ Group eco4_rom_net80211
+ ***************************************/
+
+/* Functions */
+sta_reset_beacon_timeout = 0x40003024;
+ieee80211_post_hmac_tx = 0x40003028;
+sta_rx_eapol = 0x4000302c;
+/* Data (.data, .bss, .rodata) */
+len_dh_ie_ptr = 0x3fcdfa6c;
+g_authmode_threshold_failure_ptr = 0x3fcdfa68;
+
+
+/***************************************
+ Group eco4_rom_pp
+ ***************************************/
+
+/* Functions */
+pm_enable_dream_timer = 0x40003030;
+pm_handle_tbtt_interval = 0x40003034;
+hal_set_sta_light_sleep_wake_ahead_time = 0x40003038;
+hal_get_time_to_sta_next_tbtt = 0x4000303c;
+pm_scale_listen_interval = 0x40003040;
+pm_beacon_monitor_tbtt_start = 0x40003044;
+pm_beacon_monitor_tbtt_stop = 0x40003048;
+pm_beacon_monitor_timeout_process = 0x4000304c;
+pm_beacon_monitor_tbtt_timeout_process = 0x40003050;
+pm_on_tsf_timer = 0x40003054;
+pp_coex_tx_release = 0x40003058;
+ppRegressAmpdu = 0x4000305c;
+trc_onPPTxDone = 0x40003060;
+is_fragmented_pkt = 0x40003064;
+pm_tx_null_data_done_quick_wake_process = 0x40003068;
+pm_enable_beacon_monitor_timer = 0x4000306c;
+pm_disable_beacon_monitor_timer = 0x40003070;
+pm_beacon_offset_get_average = 0x40003074;
+pm_beacon_offset_get_expect = 0x40003078;
+pm_beacon_offset_get_params = 0x4000307c;
+pm_beacon_offset_sample_start = 0x40003080;
+pm_beacon_offset_sample = 0x40003084;
+pm_beacon_offset_reset = 0x40003088;
+pm_beacon_offset_is_sampling = 0x4000308c;
+pm_beacon_offset_is_enabled = 0x40003090;
+pm_beacon_offset_configure = 0x40003094;
+pm_beacon_offset_resample_timeout_process = 0x40003098;
+pm_beacon_offset_set_rx_beacon_standard = 0x4000309c;
+pm_beacon_offset_get_rx_beacon_success_rate = 0x400030a0;
+pm_beacon_offset_add_total_counter = 0x400030a4;
+pm_beacon_offset_add_loss_counter = 0x400030a8;
+pm_beacon_offset_check = 0x400030ac;
+pm_beacon_offset_init = 0x400030b0;
+pm_beacon_offset_deinit = 0x400030b4;
+pm_get_tbtt_count = 0x400030b8;
+pm_coex_schm_overall_period_get = 0x400030bc;
+pm_coex_pwr_update = 0x400030c0;
+/* Data (.data, .bss, .rodata) */
+s_pm_beacon_offset_ptr = 0x3fcdfa64;
+s_pm_beacon_offset_config_ptr = 0x3fcdfa60;
+s_tbttstart_ptr = 0x3fcdfa5c;

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.eco4.ld

@@ -0,0 +1,221 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/***************************************
+ Group eco4_rom_mbedtls
+ ***************************************/
+
+/* Functions */
+mbedtls_mpi_init = 0x400026dc;
+mbedtls_mpi_free = 0x400026e0;
+mbedtls_mpi_grow = 0x400026e4;
+mbedtls_mpi_shrink = 0x400026e8;
+mbedtls_mpi_copy = 0x400026ec;
+mbedtls_mpi_safe_cond_assign = 0x400026f0;
+mbedtls_mpi_safe_cond_swap = 0x400026f4;
+mbedtls_mpi_lset = 0x400026f8;
+mbedtls_mpi_get_bit = 0x400026fc;
+mbedtls_mpi_set_bit = 0x40002700;
+mbedtls_mpi_lsb = 0x40002704;
+mbedtls_mpi_bitlen = 0x40002708;
+mbedtls_mpi_size = 0x4000270c;
+mbedtls_mpi_read_binary = 0x40002710;
+mbedtls_mpi_write_binary = 0x40002714;
+mbedtls_mpi_shift_l = 0x40002718;
+mbedtls_mpi_shift_r = 0x4000271c;
+mbedtls_mpi_cmp_abs = 0x40002720;
+mbedtls_mpi_cmp_mpi = 0x40002724;
+mbedtls_mpi_lt_mpi_ct = 0x40002728;
+mbedtls_mpi_cmp_int = 0x4000272c;
+mbedtls_mpi_add_abs = 0x40002730;
+mbedtls_mpi_sub_abs = 0x40002734;
+mbedtls_mpi_add_mpi = 0x40002738;
+mbedtls_mpi_sub_mpi = 0x4000273c;
+mbedtls_mpi_add_int = 0x40002740;
+mbedtls_mpi_sub_int = 0x40002744;
+mbedtls_mpi_mul_mpi = 0x40002748;
+mbedtls_mpi_mul_int = 0x4000274c;
+mbedtls_mpi_div_mpi = 0x40002750;
+mbedtls_mpi_div_int = 0x40002754;
+mbedtls_mpi_mod_mpi = 0x40002758;
+mbedtls_mpi_mod_int = 0x4000275c;
+mbedtls_mpi_exp_mod = 0x40002760;
+mbedtls_mpi_fill_random = 0x40002764;
+mbedtls_mpi_gcd = 0x40002768;
+mbedtls_mpi_inv_mod = 0x4000276c;
+mbedtls_mpi_is_prime_ext = 0x40002770;
+
+/***************************************
+ Group eco4_rom_mbedtls
+ ***************************************/
+
+/* Functions */
+rom_mbedtls_threading_set_alt = 0x40002c0c;
+mbedtls_aes_crypt_cfb8 = 0x40002c10;
+mbedtls_mpi_swap = 0x40002c14;
+mbedtls_mpi_read_string = 0x40002c18;
+mbedtls_mpi_write_string = 0x40002c1c;
+mbedtls_mpi_read_binary_le = 0x40002c20;
+mbedtls_mpi_write_binary_le = 0x40002c24;
+mbedtls_mpi_random = 0x40002c28;
+mbedtls_mpi_gen_prime = 0x40002c2c;
+mbedtls_ecp_check_budget = 0x40002c30;
+mbedtls_ecp_set_max_ops = 0x40002c34;
+mbedtls_ecp_restart_is_enabled = 0x40002c38;
+mbedtls_ecp_get_type = 0x40002c3c;
+mbedtls_ecp_curve_list = 0x40002c40;
+mbedtls_ecp_grp_id_list = 0x40002c44;
+mbedtls_ecp_curve_info_from_grp_id = 0x40002c48;
+mbedtls_ecp_curve_info_from_tls_id = 0x40002c4c;
+mbedtls_ecp_curve_info_from_name = 0x40002c50;
+mbedtls_ecp_point_init = 0x40002c54;
+mbedtls_ecp_group_init = 0x40002c58;
+mbedtls_ecp_keypair_init = 0x40002c5c;
+mbedtls_ecp_point_free = 0x40002c60;
+mbedtls_ecp_group_free = 0x40002c64;
+mbedtls_ecp_keypair_free = 0x40002c68;
+mbedtls_ecp_restart_init = 0x40002c6c;
+mbedtls_ecp_restart_free = 0x40002c70;
+mbedtls_ecp_copy = 0x40002c74;
+mbedtls_ecp_group_copy = 0x40002c78;
+mbedtls_ecp_set_zero = 0x40002c7c;
+mbedtls_ecp_is_zero = 0x40002c80;
+mbedtls_ecp_point_cmp = 0x40002c84;
+mbedtls_ecp_point_read_string = 0x40002c88;
+mbedtls_ecp_point_write_binary = 0x40002c8c;
+mbedtls_ecp_point_read_binary = 0x40002c90;
+mbedtls_ecp_tls_read_point = 0x40002c94;
+mbedtls_ecp_tls_write_point = 0x40002c98;
+mbedtls_ecp_group_load = 0x40002c9c;
+mbedtls_ecp_tls_read_group = 0x40002ca0;
+mbedtls_ecp_tls_read_group_id = 0x40002ca4;
+mbedtls_ecp_tls_write_group = 0x40002ca8;
+mbedtls_ecp_mul = 0x40002cac;
+mbedtls_ecp_mul_restartable = 0x40002cb0;
+mbedtls_ecp_muladd = 0x40002cb4;
+mbedtls_ecp_muladd_restartable = 0x40002cb8;
+mbedtls_ecp_check_pubkey = 0x40002cbc;
+mbedtls_ecp_check_privkey = 0x40002cc0;
+mbedtls_ecp_gen_privkey = 0x40002cc4;
+mbedtls_ecp_gen_keypair_base = 0x40002cc8;
+mbedtls_ecp_gen_keypair = 0x40002ccc;
+mbedtls_ecp_gen_key = 0x40002cd0;
+mbedtls_ecp_read_key = 0x40002cd4;
+mbedtls_ecp_write_key_ext = 0x40002cd8;
+mbedtls_ecp_check_pub_priv = 0x40002cdc;
+mbedtls_ecp_export = 0x40002ce0;
+mbedtls_asn1_get_enum = 0x40002ce4;
+mbedtls_asn1_sequence_free = 0x40002ce8;
+mbedtls_asn1_traverse_sequence_of = 0x40002cec;
+mbedtls_asn1_find_named_data = 0x40002cf0;
+mbedtls_asn1_free_named_data_list = 0x40002cf4;
+mbedtls_asn1_free_named_data_list_shallow = 0x40002cf8;
+mbedtls_asn1_write_raw_buffer = 0x40002cfc;
+mbedtls_asn1_write_null = 0x40002d00;
+mbedtls_asn1_write_oid = 0x40002d04;
+mbedtls_asn1_write_algorithm_identifier = 0x40002d08;
+mbedtls_asn1_write_bool = 0x40002d0c;
+mbedtls_asn1_write_int = 0x40002d10;
+mbedtls_asn1_write_enum = 0x40002d14;
+mbedtls_asn1_write_tagged_string = 0x40002d18;
+mbedtls_asn1_write_printable_string = 0x40002d1c;
+mbedtls_asn1_write_utf8_string = 0x40002d20;
+mbedtls_asn1_write_ia5_string = 0x40002d24;
+mbedtls_asn1_write_bitstring = 0x40002d28;
+mbedtls_asn1_write_named_bitstring = 0x40002d2c;
+mbedtls_asn1_write_octet_string = 0x40002d30;
+mbedtls_asn1_store_named_data = 0x40002d34;
+mbedtls_ccm_starts = 0x40002d38;
+mbedtls_ccm_set_lengths = 0x40002d3c;
+mbedtls_ccm_update_ad = 0x40002d40;
+mbedtls_ccm_update = 0x40002d44;
+mbedtls_ccm_finish = 0x40002d48;
+mbedtls_cipher_list = 0x40002d4c;
+mbedtls_cipher_info_from_string = 0x40002d50;
+mbedtls_cipher_info_from_type = 0x40002d54;
+mbedtls_cipher_info_from_values = 0x40002d58;
+mbedtls_cipher_free = 0x40002d5c;
+mbedtls_cipher_setup = 0x40002d60;
+mbedtls_cipher_setkey = 0x40002d64;
+mbedtls_cipher_set_iv = 0x40002d68;
+mbedtls_cipher_update_ad = 0x40002d6c;
+mbedtls_cipher_update = 0x40002d70;
+mbedtls_cipher_write_tag = 0x40002d74;
+mbedtls_cipher_check_tag = 0x40002d78;
+mbedtls_cipher_auth_encrypt_ext = 0x40002d7c;
+mbedtls_cipher_auth_decrypt_ext = 0x40002d80;
+mbedtls_cipher_cmac_reset = 0x40002d84;
+mbedtls_cipher_cmac = 0x40002d88;
+mbedtls_aes_cmac_prf_128 = 0x40002d8c;
+mbedtls_ctr_drbg_set_prediction_resistance = 0x40002d90;
+mbedtls_ctr_drbg_set_entropy_len = 0x40002d94;
+mbedtls_ctr_drbg_set_nonce_len = 0x40002d98;
+mbedtls_ctr_drbg_set_reseed_interval = 0x40002d9c;
+mbedtls_ctr_drbg_update = 0x40002da0;
+mbedtls_base64_encode = 0x40002da4;
+mbedtls_rsa_init = 0x40002da8;
+mbedtls_rsa_set_padding = 0x40002dac;
+mbedtls_rsa_get_padding_mode = 0x40002db0;
+mbedtls_rsa_get_md_alg = 0x40002db4;
+mbedtls_rsa_import = 0x40002db8;
+mbedtls_rsa_import_raw = 0x40002dbc;
+mbedtls_rsa_complete = 0x40002dc0;
+mbedtls_rsa_export = 0x40002dc4;
+mbedtls_rsa_export_raw = 0x40002dc8;
+mbedtls_rsa_export_crt = 0x40002dcc;
+mbedtls_rsa_get_len = 0x40002dd0;
+mbedtls_rsa_gen_key = 0x40002dd4;
+mbedtls_rsa_check_pubkey = 0x40002dd8;
+mbedtls_rsa_check_privkey = 0x40002ddc;
+mbedtls_rsa_check_pub_priv = 0x40002de0;
+mbedtls_rsa_public = 0x40002de4;
+mbedtls_rsa_private = 0x40002de8;
+mbedtls_rsa_pkcs1_encrypt = 0x40002dec;
+mbedtls_rsa_rsaes_pkcs1_v15_encrypt = 0x40002df0;
+mbedtls_rsa_rsaes_oaep_encrypt = 0x40002df4;
+mbedtls_rsa_pkcs1_decrypt = 0x40002df8;
+mbedtls_rsa_rsaes_pkcs1_v15_decrypt = 0x40002dfc;
+mbedtls_rsa_rsaes_oaep_decrypt = 0x40002e00;
+mbedtls_rsa_pkcs1_sign = 0x40002e04;
+mbedtls_rsa_rsassa_pkcs1_v15_sign = 0x40002e08;
+mbedtls_rsa_rsassa_pss_sign_ext = 0x40002e0c;
+mbedtls_rsa_rsassa_pss_sign = 0x40002e10;
+mbedtls_rsa_pkcs1_verify = 0x40002e14;
+mbedtls_rsa_rsassa_pkcs1_v15_verify = 0x40002e18;
+mbedtls_rsa_rsassa_pss_verify = 0x40002e1c;
+mbedtls_rsa_rsassa_pss_verify_ext = 0x40002e20;
+mbedtls_rsa_copy = 0x40002e24;
+mbedtls_rsa_free = 0x40002e28;
+mbedtls_ecdh_can_do = 0x40002e2c;
+mbedtls_ecdh_gen_public = 0x40002e30;
+mbedtls_ecdh_compute_shared = 0x40002e34;
+mbedtls_ecdh_init = 0x40002e38;
+mbedtls_ecdh_setup = 0x40002e3c;
+mbedtls_ecdh_free = 0x40002e40;
+mbedtls_ecdh_make_params = 0x40002e44;
+mbedtls_ecdh_read_params = 0x40002e48;
+mbedtls_ecdh_get_params = 0x40002e4c;
+mbedtls_ecdh_make_public = 0x40002e50;
+mbedtls_ecdh_read_public = 0x40002e54;
+mbedtls_ecdh_calc_secret = 0x40002e58;
+mbedtls_ecdh_enable_restart = 0x40002e5c;
+mbedtls_ecdsa_can_do = 0x40002e60;
+mbedtls_ecdsa_sign = 0x40002e64;
+mbedtls_ecdsa_sign_det_ext = 0x40002e68;
+mbedtls_ecdsa_sign_restartable = 0x40002e6c;
+mbedtls_ecdsa_sign_det_restartable = 0x40002e70;
+mbedtls_ecdsa_verify = 0x40002e74;
+mbedtls_ecdsa_verify_restartable = 0x40002e78;
+mbedtls_ecdsa_write_signature = 0x40002e7c;
+mbedtls_ecdsa_write_signature_restartable = 0x40002e80;
+mbedtls_ecdsa_read_signature = 0x40002e84;
+mbedtls_ecdsa_read_signature_restartable = 0x40002e88;
+mbedtls_ecdsa_genkey = 0x40002e8c;
+mbedtls_ecdsa_from_keypair = 0x40002e90;
+mbedtls_ecdsa_init = 0x40002e94;
+mbedtls_ecdsa_free = 0x40002e98;
+mbedtls_ecdsa_restart_init = 0x40002e9c;
+mbedtls_ecdsa_restart_free = 0x40002ea0;

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.ld

@@ -74,7 +74,7 @@ mbedtls_sha512_clone = 0x40002a50;
 mbedtls_sha512_starts = 0x40002a54;
 mbedtls_sha512_update = 0x40002a58;
 mbedtls_sha512_finish = 0x40002a5c;
-mbedtls_internal_sha512_process = 0x40002a60;
+/*mbedtls_internal_sha512_process = 0x40002a60;*/
 mbedtls_sha512 = 0x40002a64;
 mbedtls_aes_xts_init = 0x40002b68;
 mbedtls_aes_xts_free = 0x40002b6c;
@@ -95,7 +95,7 @@ mbedtls_md5_clone = 0x40002be0;
 mbedtls_md5_starts = 0x40002be4;
 mbedtls_md5_update = 0x40002be8;
 mbedtls_md5_finish = 0x40002bec;
-mbedtls_internal_md5_process = 0x40002bf0;
+/*mbedtls_internal_md5_process = 0x40002bf0;*/
 mbedtls_md5 = 0x40002bf4;
 mbedtls_sha1 = 0x40002c08;
 /* Data (.data, .bss, .rodata) */

components/esp_rom/patches/esp_rom_systimer.c

@@ -11,7 +11,7 @@
 
 #if CONFIG_HAL_SYSTIMER_USE_ROM_IMPL
 
-#if CONFIG_IDF_TARGET_ESP32C2
+#if CONFIG_IDF_TARGET_ESP32C2 && (CONFIG_ESP32C2_REV_MIN_FULL < 200)
 void systimer_hal_init(systimer_hal_context_t *hal)
 {
     hal->dev = &SYSTIMER;
@@ -62,7 +62,7 @@ void systimer_hal_counter_value_advance(systimer_hal_context_t *hal, uint32_t co
     systimer_ll_set_counter_value(hal->dev, counter_id, new_count.val);
     systimer_ll_apply_counter_value(hal->dev, counter_id);
 }
-#endif // CONFIG_IDF_TARGET_ESP32C2
+#endif // CONFIG_IDF_TARGET_ESP32C2 && (CONFIG_ESP32C2_REV_MIN_FULL < 200)
 
 #if CONFIG_IDF_TARGET_ESP32C6 || CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32P4
 void systimer_hal_init(systimer_hal_context_t *hal)

components/esp_system/ld/esp32s2/memory.ld.in

@@ -127,8 +127,7 @@ _data_seg_org = ORIGIN(rtc_data_seg);
 
 /* The lines below define location alias for .rtc.data section based on Kconfig option.
    When the option is not defined then use slow memory segment
-   else the data will be placed in fast memory segment
-   TODO: check whether the rtc_data_location is correct for esp32s2 - IDF-761 */
+   else the data will be placed in fast memory segment */
 #ifndef CONFIG_ESP32S2_RTCDATA_IN_FAST_MEM
 REGION_ALIAS("rtc_data_location", rtc_slow_seg );
 #else

components/esp_system/ld/esp32s2/sections.ld.in

@@ -250,7 +250,8 @@ SECTIONS
     _noinit_end = ABSOLUTE(.);
   } > dram0_0_seg
 
-   /* external memory bss, from any global variable with EXT_RAM_BSS_ATTR attribute*/
+#if CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY
+  /* External Memory BSS. (Variables with EXT_RAM_BSS_ATTR attribute). */
   .ext_ram.bss (NOLOAD) :
   {
     _ext_ram_bss_start = ABSOLUTE(.);
@@ -260,6 +261,23 @@ SECTIONS
     . = ALIGN(4);
     _ext_ram_bss_end = ABSOLUTE(.);
   } > extern_ram_seg
+#endif //CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY
+
+#if CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY
+  /**
+   * This section holds data that won't be initialised when startup.
+   * This section locates in External RAM region.
+   */
+  .ext_ram_noinit (NOLOAD) :
+  {
+    _ext_ram_noinit_start = ABSOLUTE(.);
+
+    *(.ext_ram_noinit*)
+
+    . = ALIGN(4);
+    _ext_ram_noinit_end = ABSOLUTE(.);
+  } > extern_ram_seg
+#endif //CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY
 
   /* Shared RAM */
   .dram0.bss (NOLOAD) :

components/esp_system/ld/esp32s3/sections.ld.in

@@ -418,6 +418,7 @@ SECTIONS
     . = ALIGN (0x10000);
   } > extern_ram_seg
 
+#if CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY
   /* This section holds .ext_ram.bss data, and will be put in PSRAM */
   .ext_ram.bss (NOLOAD) :
   {
@@ -426,6 +427,23 @@ SECTIONS
     . = ALIGN(4);
     _ext_ram_bss_end = ABSOLUTE(.);
   } > extern_ram_seg
+#endif //CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY
+
+#if CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY
+  /**
+   * This section holds data that won't be initialised when startup.
+   * This section locates in External RAM region.
+   */
+  .ext_ram_noinit (NOLOAD) :
+  {
+    _ext_ram_noinit_start = ABSOLUTE(.);
+
+    *(.ext_ram_noinit*)
+
+    . = ALIGN(4);
+    _ext_ram_noinit_end = ABSOLUTE(.);
+  } > extern_ram_seg
+#endif //CONFIG_SPIRAM_ALLOW_NOINIT_SEG_EXTERNAL_MEMORY
 
   /* Marks the end of IRAM code segment */
   .iram0.text_end (NOLOAD) :

components/esp_wifi/lib

@@ -1 +1 @@
-Subproject commit 3f6fba9d0a1f21e9187278ad5e27d2f05befa9a7
+Subproject commit 81688730aa34a2f4114a9b4786f55f4d4fc8abf8

components/esptool_py/CMakeLists.txt

@@ -66,10 +66,19 @@ consist of two ota app without factory or test partitions.")
 endif()  # NOT BOOTLOADER_BUILD
 
 if(BOOTLOADER_BUILD)
-  # Generate bootloader post-build check of the bootloader size against the offset
-  partition_table_add_check_bootloader_size_target(bootloader_check_size
-      DEPENDS gen_project_binary
-      BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
-      RESULT bootloader_check_size_command)
-  add_dependencies(app bootloader_check_size)  # note: in the subproject, so the target is 'app'...
+    # Generate bootloader post-build check of the bootloader size against the offset
+    partition_table_add_check_bootloader_size_target(bootloader_check_size
+        DEPENDS gen_project_binary
+        BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
+        RESULT bootloader_check_size_command)
+    add_dependencies(app bootloader_check_size)  # note: in the subproject, so the target is 'app'...
+
+    if(CONFIG_SECURE_BOOT_V2_ENABLED AND CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
+        # Check the size of the bootloader + signature block.
+        partition_table_add_check_bootloader_size_target(bootloader_check_size_signed
+            DEPENDS gen_signed_bootloader
+            BOOTLOADER_BINARY_PATH "${build_dir}/${PROJECT_BIN}"
+            RESULT bootloader_check_size_signed_command)
+        add_dependencies(app bootloader_check_size_signed)  # note: in the subproject, so the target is 'app'...
+    endif()
 endif()

components/freertos/FreeRTOS-Kernel-SMP/include/freertos/task.h

@@ -486,7 +486,7 @@ typedef enum
  *      xHandle = xTaskCreateStatic(
  *                    vTaskCode,       // Function that implements the task.
  *                    "NAME",          // Text name for the task.
- *                    STACK_SIZE,      // Stack size in words, not bytes.
+ *                    STACK_SIZE,      // Stack size in b
  *                    ( void * ) 1,    // Parameter passed into the task.
  *                    tskIDLE_PRIORITY,// Priority at which the task is created.
  *                    xStack,          // Array to use as the task's stack.

components/freertos/FreeRTOS-Kernel-SMP/portable/linux/port.c

@@ -712,7 +712,7 @@ void vApplicationGetIdleTaskMemory( StaticTask_t ** ppxIdleTaskTCBBuffer,
 
     /* Pass out the size of the array pointed to by *ppxIdleTaskStackBuffer.
      * Note that, as the array is necessarily of type StackType_t,
-     * configMINIMAL_STACK_SIZE is specified in words, not bytes. */
+     * configMINIMAL_STACK_SIZE is specified in bytes. */
     *pulIdleTaskStackSize = configMINIMAL_STACK_SIZE;
 }
 #endif // configSUPPORT_STATIC_ALLOCATION == 1
@@ -749,7 +749,7 @@ void vApplicationGetTimerTaskMemory( StaticTask_t ** ppxTimerTaskTCBBuffer,
 
     /* Pass out the size of the array pointed to by *ppxTimerTaskStackBuffer.
      * Note that, as the array is necessarily of type StackType_t,
-     * configMINIMAL_STACK_SIZE is specified in words, not bytes. */
+     * configMINIMAL_STACK_SIZE is specified in bytes. */
     *pulTimerTaskStackSize = configTIMER_TASK_STACK_DEPTH;
 }
 #endif // configSUPPORT_STATIC_ALLOCATION == 1 && (configUSE_TIMERS == 1)

components/freertos/FreeRTOS-Kernel/include/freertos/task.h

@@ -6,7 +6,7 @@
  *
  * SPDX-License-Identifier: MIT
  *
- * SPDX-FileContributor: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2023-2024 Espressif Systems (Shanghai) CO LTD
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy of
  * this software and associated documentation files (the "Software"), to deal in
@@ -452,10 +452,9 @@ typedef enum
  * Example usage:
  * @code{c}
  *
- *  // Dimensions of the buffer that the task being created will use as its stack.
- *  // NOTE:  This is the number of words the stack will hold, not the number of
- *  // bytes.  For example, if each stack item is 32-bits, and this is set to 100,
- *  // then 400 bytes (100 * 32-bits) will be allocated.
+ *  // Dimensions the buffer that the task being created will use as its stack.
+ *  // NOTE:  This is the number of bytes the stack will hold, not the number of
+ *  // words as found in vanilla FreeRTOS.
  #define STACK_SIZE 200
  *
  *  // Structure that will hold the TCB of the task being created.
@@ -488,7 +487,7 @@ typedef enum
  *      xHandle = xTaskCreateStatic(
  *                    vTaskCode,       // Function that implements the task.
  *                    "NAME",          // Text name for the task.
- *                    STACK_SIZE,      // Stack size in words, not bytes.
+ *                    STACK_SIZE,      // Stack size in bytes.
  *                    ( void * ) 1,    // Parameter passed into the task.
  *                    tskIDLE_PRIORITY,// Priority at which the task is created.
  *                    xStack,          // Array to use as the task's stack.
@@ -574,7 +573,7 @@ typedef enum
  * {
  *  vATask,     // pvTaskCode - the function that implements the task.
  *  "ATask",    // pcName - just a text name for the task to assist debugging.
- *  100,        // usStackDepth - the stack size DEFINED IN WORDS.
+ *  100,        // usStackDepth - the stack size DEFINED IN BYTES.
  *  NULL,       // pvParameters - passed into the task function as the function parameters.
  *  ( 1UL | portPRIVILEGE_BIT ),// uxPriority - task priority, set the portPRIVILEGE_BIT if the task should run in a privileged state.
  *  cStackBuffer,// puxStackBuffer - the buffer to be used as the task stack.
@@ -657,7 +656,7 @@ typedef enum
  * {
  *  vATask,     // pvTaskCode - the function that implements the task.
  *  "ATask",    // pcName - just a text name for the task to assist debugging.
- *  100,        // usStackDepth - the stack size DEFINED IN WORDS.
+ *  100,        // usStackDepth - the stack size DEFINED IN BYTES.
  *  NULL,       // pvParameters - passed into the task function as the function parameters.
  *  ( 1UL | portPRIVILEGE_BIT ),// uxPriority - task priority, set the portPRIVILEGE_BIT if the task should run in a privileged state.
  *  cStackBuffer,// puxStackBuffer - the buffer to be used as the task stack.

components/freertos/FreeRTOS-Kernel/portable/linux/port_idf.c

@@ -112,7 +112,7 @@ void vApplicationGetIdleTaskMemory( StaticTask_t ** ppxIdleTaskTCBBuffer,
 
     /* Pass out the size of the array pointed to by *ppxIdleTaskStackBuffer.
      * Note that, as the array is necessarily of type StackType_t,
-     * configMINIMAL_STACK_SIZE is specified in words, not bytes. */
+     * configMINIMAL_STACK_SIZE is specified in bytes. */
     *pulIdleTaskStackSize = configMINIMAL_STACK_SIZE;
 }
 #endif // configSUPPORT_STATIC_ALLOCATION == 1
@@ -148,7 +148,7 @@ void vApplicationGetTimerTaskMemory( StaticTask_t ** ppxTimerTaskTCBBuffer,
 
     /* Pass out the size of the array pointed to by *ppxTimerTaskStackBuffer.
      * Note that, as the array is necessarily of type StackType_t,
-     * configMINIMAL_STACK_SIZE is specified in words, not bytes. */
+     * configMINIMAL_STACK_SIZE is specified in bytes. */
     *pulTimerTaskStackSize = configTIMER_TASK_STACK_DEPTH;
 }
 #endif // (configSUPPORT_STATIC_ALLOCATION == 1) && (configUSE_TIMERS == 1)

components/hal/Kconfig

@@ -103,4 +103,13 @@ menu "Hardware Abstraction Layer (HAL) and Low Level (LL)"
         help
             Enable this option to place SPI slave hal layer functions into IRAM.
 
+    config HAL_ECDSA_GEN_SIG_CM
+        bool "Enable countermeasure for ECDSA signature generation"
+        default n
+        # ToDo - IDF-11051
+        help
+            Enable this option to apply the countermeasure for ECDSA signature operation
+            This countermeasure masks the real ECDSA sign operation
+            under dummy sign operations to add randomness in the generated power signature.
+
 endmenu

components/hal/ecdsa_hal.c

@@ -13,6 +13,11 @@
 #include "soc/keymng_reg.h" // TODO: IDF-7901
 #endif
 
+#if CONFIG_HAL_ECDSA_GEN_SIG_CM
+#include "esp_fault.h"
+#include "esp_random.h"
+#endif
+
 #define ECDSA_HAL_P192_COMPONENT_LEN        24
 #define ECDSA_HAL_P256_COMPONENT_LEN        32
 
@@ -39,23 +44,9 @@ bool ecdsa_hal_get_operation_result(void)
     return ecdsa_ll_get_operation_result();
 }
 
-void ecdsa_hal_gen_signature(ecdsa_hal_config_t *conf, const uint8_t *hash,
-                            uint8_t *r_out, uint8_t *s_out, uint16_t len)
+static void ecdsa_hal_gen_signature_inner(const uint8_t *hash, uint8_t *r_out,
+                              uint8_t *s_out, uint16_t len)
 {
-    if (len != ECDSA_HAL_P192_COMPONENT_LEN && len != ECDSA_HAL_P256_COMPONENT_LEN) {
-        HAL_ASSERT(false && "Incorrect length");
-    }
-
-    if (conf->sha_mode == ECDSA_Z_USER_PROVIDED && hash == NULL) {
-        HAL_ASSERT(false && "Mismatch in SHA configuration");
-    }
-
-    if (ecdsa_ll_get_state() != ECDSA_STATE_IDLE) {
-        HAL_ASSERT(false && "Incorrect ECDSA state");
-    }
-
-    configure_ecdsa_periph(conf);
-
     ecdsa_ll_set_stage(ECDSA_STAGE_START_CALC);
 
     while(ecdsa_ll_get_state() != ECDSA_STATE_LOAD) {
@@ -80,6 +71,63 @@ void ecdsa_hal_gen_signature(ecdsa_hal_config_t *conf, const uint8_t *hash,
     }
 }
 
+#if CONFIG_HAL_ECDSA_GEN_SIG_CM
+__attribute__((optimize("O0"))) static void ecdsa_hal_gen_signature_with_countermeasure(const uint8_t *hash, uint8_t *r_out,
+                       uint8_t *s_out, uint16_t len)
+{
+    uint8_t tmp_r_out[32] = {};
+    uint8_t tmp_s_out[32] = {};
+    uint8_t tmp_hash[64] = {};
+
+    uint8_t dummy_op_count_prior = esp_random() % ECDSA_SIGN_MAX_DUMMY_OP_COUNT;
+    uint8_t dummy_op_count_later = ECDSA_SIGN_MAX_DUMMY_OP_COUNT - dummy_op_count_prior;
+    ESP_FAULT_ASSERT((dummy_op_count_prior != 0) || (dummy_op_count_later != 0));
+    ESP_FAULT_ASSERT(dummy_op_count_prior + dummy_op_count_later == ECDSA_SIGN_MAX_DUMMY_OP_COUNT);
+
+    esp_fill_random(tmp_hash, 64);
+    /* Dummy ecdsa signature operations prior to the actual one */
+    for (int i = 0; i < dummy_op_count_prior; i++) {
+        ecdsa_hal_gen_signature_inner(tmp_hash + ((6 * i) % 32), (uint8_t *) tmp_r_out, (uint8_t *) tmp_s_out, len);
+    }
+
+    /* Actual ecdsa signature operation */
+    ecdsa_hal_gen_signature_inner(hash, r_out, s_out, len);
+
+    /* Dummy ecdsa signature operations after the actual one */
+    for (int i = 0; i < dummy_op_count_later; i++) {
+        ecdsa_hal_gen_signature_inner(tmp_hash + ((6 * i) % 32), (uint8_t *)tmp_r_out, (uint8_t *)tmp_s_out, len);
+    }
+
+}
+#endif /* CONFIG_HAL_ECDSA_GEN_SIG_CM */
+
+
+
+void ecdsa_hal_gen_signature(ecdsa_hal_config_t *conf, const uint8_t *hash,
+                        uint8_t *r_out, uint8_t *s_out, uint16_t len)
+{
+    if (len != ECDSA_HAL_P192_COMPONENT_LEN && len != ECDSA_HAL_P256_COMPONENT_LEN) {
+        HAL_ASSERT(false && "Incorrect length");
+    }
+
+    if (conf->sha_mode == ECDSA_Z_USER_PROVIDED && hash == NULL) {
+        HAL_ASSERT(false && "Mismatch in SHA configuration");
+    }
+
+    if (ecdsa_ll_get_state() != ECDSA_STATE_IDLE) {
+        HAL_ASSERT(false && "Incorrect ECDSA state");
+    }
+
+    configure_ecdsa_periph(conf);
+
+#if CONFIG_HAL_ECDSA_GEN_SIG_CM
+    ecdsa_hal_gen_signature_with_countermeasure(hash, r_out, s_out, len);
+#else /* CONFIG_HAL_ECDSA_GEN_SIG_CM */
+    ecdsa_hal_gen_signature_inner(hash, r_out, s_out, len);
+#endif /* !CONFIG_HAL_ECDSA_GEN_SIG_CM */
+
+}
+
 int ecdsa_hal_verify_signature(ecdsa_hal_config_t *conf, const uint8_t *hash, const uint8_t *r, const uint8_t *s,
                                const uint8_t *pub_x, const uint8_t *pub_y, uint16_t len)
 {

components/hal/esp32/include/hal/i2c_ll.h

@@ -106,7 +106,7 @@ static inline void i2c_ll_master_set_bus_timing(i2c_dev_t *hw, i2c_hal_clk_confi
     /* SCL period. According to the TRM, we should always subtract 1 to SCL low period */
     HAL_ASSERT(bus_cfg->scl_low > 0);
     hw->scl_low_period.period = bus_cfg->scl_low - 1;
-    /* Still according to the TRM, if filter is not enbled, we have to subtract 7,
+    /* Still according to the TRM, if filter is not enabled, we have to subtract 7,
      * if SCL filter is enabled, we have to subtract:
      *   8 if SCL filter is between 0 and 2 (included)
      *   6 + SCL threshold if SCL filter is between 3 and 7 (included)
@@ -547,7 +547,7 @@ static inline void i2c_ll_get_stop_timing(i2c_dev_t *hw, int *setup_time, int *h
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  *
  * @return None.
  */
@@ -612,7 +612,7 @@ static inline void i2c_ll_master_get_filter(i2c_dev_t *hw, uint8_t *filter_conf)
 }
 
 /**
- * @brief Reste I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
+ * @brief Reset I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
  *
  * @param  hw Beginning address of the peripheral registers
  *
@@ -633,11 +633,23 @@ static inline void i2c_ll_master_fsm_rst(i2c_dev_t *hw)
  *
  * @return None
  */
-static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses)
+static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses, bool enable)
 {
     ;//ESP32 do not support
 }
 
+/**
+ * @brief Get the clear bus state
+ *
+ * @param hw Beginning address of the peripheral registers
+ *
+ * @return true: the clear bus not finish, otherwise, false.
+ */
+static inline bool i2c_ll_master_is_bus_clear_done(i2c_dev_t *hw)
+{
+    return false;
+}
+
 /**
  * @brief Set I2C source clock
  *
@@ -861,7 +873,7 @@ static inline void i2c_ll_get_scl_clk_timing(i2c_dev_t *hw, int *high_period, in
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  high_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  high_period The I2C SCL high period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  * @param  wait_high_period The I2C SCL wait rising edge period.
  *
@@ -1044,7 +1056,7 @@ static inline uint32_t i2c_ll_get_hw_version(i2c_dev_t *hw)
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  hight_period The I2C SCL hight period (in APB cycle)
+ * @param  hight_period The I2C SCL high period (in APB cycle)
  * @param  low_period The I2C SCL low period (in APB cycle)
  *
  * @return None.

components/hal/esp32c2/include/hal/i2c_ll.h

@@ -583,7 +583,7 @@ static inline void i2c_ll_get_stop_timing(i2c_dev_t *hw, int *setup_time, int *h
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  *
  * @return None.
  */
@@ -647,7 +647,7 @@ static inline void i2c_ll_master_get_filter(i2c_dev_t *hw, uint8_t *filter_conf)
 }
 
 /**
- * @brief Reste I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
+ * @brief reset I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
  *
  * @param  hw Beginning address of the peripheral registers
  *
@@ -667,18 +667,29 @@ static inline void i2c_ll_master_fsm_rst(i2c_dev_t *hw)
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  slave_pulses When I2C master is IDLE, the number of pulses will be sent out.
+ * @param  enable True to start the state machine, otherwise, false
  *
  * @return None
  */
-static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses)
+static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses, bool enable)
 {
     hw->scl_sp_conf.scl_rst_slv_num = slave_pulses;
-    hw->scl_sp_conf.scl_rst_slv_en = 1;
-    hw->ctr.conf_upgate = 1;
-    // hardward will clear scl_rst_slv_en after sending SCL pulses,
-    // and we should set conf_upgate bit to synchronize register value.
-    while (hw->scl_sp_conf.scl_rst_slv_en);
+    hw->scl_sp_conf.scl_rst_slv_en = enable;
     hw->ctr.conf_upgate = 1;
+    // hardware will clear scl_rst_slv_en after sending SCL pulses,
+    // and we should set conf_upgate bit to synchronize register value after this function.
+}
+
+/**
+ * @brief Get the clear bus state
+ *
+ * @param hw Beginning address of the peripheral registers
+ *
+ * @return true: the clear bus not finish, otherwise, false.
+ */
+static inline bool i2c_ll_master_is_bus_clear_done(i2c_dev_t *hw)
+{
+    return hw->scl_sp_conf.scl_rst_slv_en;
 }
 
 /**
@@ -742,7 +753,8 @@ static inline volatile void *i2c_ll_get_interrupt_status_reg(i2c_dev_t *dev)
 static inline uint32_t i2c_ll_calculate_timeout_us_to_reg_val(uint32_t src_clk_hz, uint32_t timeout_us)
 {
     uint32_t clk_cycle_num_per_us = src_clk_hz / (1 * 1000 * 1000);
-    return 31 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
+    // round up to an integer
+    return 32 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
 }
 
 //////////////////////////////////////////Deprecated Functions//////////////////////////////////////////////////////////
@@ -777,7 +789,7 @@ typedef enum {
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  high_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  high_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  * @param  wait_high_period The I2C SCL wait rising edge period.
  *
@@ -892,7 +904,7 @@ static inline void i2c_ll_master_disable_rx_it(i2c_dev_t *hw)
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  hight_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  hight_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  *
  * @return None.

components/hal/esp32c3/include/hal/i2c_ll.h

@@ -663,7 +663,7 @@ static inline void i2c_ll_get_stop_timing(i2c_dev_t *hw, int *setup_time, int *h
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  *
  * @return None.
  */
@@ -698,7 +698,7 @@ static inline void i2c_ll_read_rxfifo(i2c_dev_t *hw, uint8_t *ptr, uint8_t len)
  * @param  hw Beginning address of the peripheral registers
  * @param  ram_offset Offset value of I2C RAM.
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  */
 static inline void i2c_ll_write_by_nonfifo(i2c_dev_t *hw, uint8_t ram_offset, const uint8_t *ptr, uint8_t len)
 {
@@ -770,7 +770,7 @@ static inline void i2c_ll_master_get_filter(i2c_dev_t *hw, uint8_t *filter_conf)
 }
 
 /**
- * @brief Reste I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
+ * @brief reset I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
  *
  * @param  hw Beginning address of the peripheral registers
  *
@@ -790,18 +790,29 @@ static inline void i2c_ll_master_fsm_rst(i2c_dev_t *hw)
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  slave_pulses When I2C master is IDLE, the number of pulses will be sent out.
+ * @param  enable True to start the state machine, otherwise, false
  *
  * @return None
  */
-static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses)
+static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses, bool enable)
 {
     hw->scl_sp_conf.scl_rst_slv_num = slave_pulses;
-    hw->scl_sp_conf.scl_rst_slv_en = 1;
-    hw->ctr.conf_upgate = 1;
-    // hardward will clear scl_rst_slv_en after sending SCL pulses,
-    // and we should set conf_upgate bit to synchronize register value.
-    while (hw->scl_sp_conf.scl_rst_slv_en);
+    hw->scl_sp_conf.scl_rst_slv_en = enable;
     hw->ctr.conf_upgate = 1;
+    // hardware will clear scl_rst_slv_en after sending SCL pulses,
+    // and we should set conf_upgate bit to synchronize register value after this function.
+}
+
+/**
+ * @brief Get the clear bus state
+ *
+ * @param hw Beginning address of the peripheral registers
+ *
+ * @return true: the clear bus not finish, otherwise, false.
+ */
+static inline bool i2c_ll_master_is_bus_clear_done(i2c_dev_t *hw)
+{
+    return hw->scl_sp_conf.scl_rst_slv_en;
 }
 
 /**
@@ -915,7 +926,8 @@ static inline void i2c_ll_slave_clear_stretch(i2c_dev_t *dev)
 static inline uint32_t i2c_ll_calculate_timeout_us_to_reg_val(uint32_t src_clk_hz, uint32_t timeout_us)
 {
     uint32_t clk_cycle_num_per_us = src_clk_hz / (1 * 1000 * 1000);
-    return 31 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
+    // round up to an integer
+    return 32 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
 }
 
 //////////////////////////////////////////Deprecated Functions//////////////////////////////////////////////////////////
@@ -954,7 +966,7 @@ typedef enum {
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  high_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  high_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  * @param  wait_high_period The I2C SCL wait rising edge period.
  *
@@ -1141,7 +1153,7 @@ static inline void i2c_ll_slave_disable_rx_it(i2c_dev_t *hw)
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  hight_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  hight_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  *
  * @return None.

components/hal/esp32c6/include/hal/i2c_ll.h

@@ -723,7 +723,7 @@ static inline void i2c_ll_master_get_filter(i2c_dev_t *hw, uint8_t *filter_conf)
 }
 
 /**
- * @brief Reste I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
+ * @brief reset I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
  *
  * @param  hw Beginning address of the peripheral registers
  *
@@ -743,18 +743,29 @@ static inline void i2c_ll_master_fsm_rst(i2c_dev_t *hw)
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  slave_pulses When I2C master is IDLE, the number of pulses will be sent out.
+ * @param  enable True to start the state machine, otherwise, false
  *
  * @return None
  */
-static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses)
+static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses, bool enable)
 {
     hw->scl_sp_conf.scl_rst_slv_num = slave_pulses;
-    hw->scl_sp_conf.scl_rst_slv_en = 1;
-    hw->ctr.conf_upgate = 1;
-    // hardward will clear scl_rst_slv_en after sending SCL pulses,
-    // and we should set conf_upgate bit to synchronize register value.
-    while (hw->scl_sp_conf.scl_rst_slv_en);
+    hw->scl_sp_conf.scl_rst_slv_en = enable;
     hw->ctr.conf_upgate = 1;
+    // hardware will clear scl_rst_slv_en after sending SCL pulses,
+    // and we should set conf_upgate bit to synchronize register value after this function.
+}
+
+/**
+ * @brief Get the clear bus state
+ *
+ * @param hw Beginning address of the peripheral registers
+ *
+ * @return true: the clear bus not finish, otherwise, false.
+ */
+static inline bool i2c_ll_master_is_bus_clear_done(i2c_dev_t *hw)
+{
+    return hw->scl_sp_conf.scl_rst_slv_en;
 }
 
 /**
@@ -874,8 +885,8 @@ static inline void i2c_ll_master_init(i2c_dev_t *hw)
     typeof(hw->ctr) ctrl_reg;
     ctrl_reg.val = 0;
     ctrl_reg.ms_mode = 1;
-    ctrl_reg.sda_force_out = 1;
-    ctrl_reg.scl_force_out = 1;
+    ctrl_reg.sda_force_out = 0;
+    ctrl_reg.scl_force_out = 0;
     hw->ctr.val = ctrl_reg.val;
 }
 
@@ -890,8 +901,8 @@ static inline void i2c_ll_slave_init(i2c_dev_t *hw)
 {
     typeof(hw->ctr) ctrl_reg;
     ctrl_reg.val = 0;
-    ctrl_reg.sda_force_out = 1;
-    ctrl_reg.scl_force_out = 1;
+    ctrl_reg.sda_force_out = 0;
+    ctrl_reg.scl_force_out = 0;
     hw->ctr.val = ctrl_reg.val;
     hw->fifo_conf.fifo_addr_cfg_en = 0;
 }
@@ -947,7 +958,8 @@ static inline void i2c_ll_slave_clear_stretch(i2c_dev_t *dev)
 static inline uint32_t i2c_ll_calculate_timeout_us_to_reg_val(uint32_t src_clk_hz, uint32_t timeout_us)
 {
     uint32_t clk_cycle_num_per_us = src_clk_hz / (1 * 1000 * 1000);
-    return 31 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
+    // round up to an integer
+    return 32 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
 }
 
 //////////////////////////////////////////Deprecated Functions//////////////////////////////////////////////////////////

components/hal/esp32h2/include/hal/i2c_ll.h

@@ -610,7 +610,7 @@ static inline void i2c_ll_get_stop_timing(i2c_dev_t *hw, int *setup_time, int *h
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  *
  * @return None.
  */
@@ -645,7 +645,7 @@ static inline void i2c_ll_read_rxfifo(i2c_dev_t *hw, uint8_t *ptr, uint8_t len)
  * @param  hw Beginning address of the peripheral registers
  * @param  ram_offset Offset value of I2C RAM.
  * @param  ptr Pointer to data buffer
- * @param  len Amount of data needs to be writen
+ * @param  len Amount of data needs to be written
  */
 static inline void i2c_ll_write_by_nonfifo(i2c_dev_t *hw, uint8_t ram_offset, const uint8_t *ptr, uint8_t len)
 {
@@ -717,7 +717,7 @@ static inline void i2c_ll_master_get_filter(i2c_dev_t *hw, uint8_t *filter_conf)
 }
 
 /**
- * @brief Reste I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
+ * @brief reset I2C master FSM. When the master FSM is stuck, call this function to reset the FSM
  *
  * @param  hw Beginning address of the peripheral registers
  *
@@ -737,18 +737,29 @@ static inline void i2c_ll_master_fsm_rst(i2c_dev_t *hw)
  *
  * @param  hw Beginning address of the peripheral registers
  * @param  slave_pulses When I2C master is IDLE, the number of pulses will be sent out.
+ * @param  enable True to start the state machine, otherwise, false
  *
  * @return None
  */
-static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses)
+static inline void i2c_ll_master_clr_bus(i2c_dev_t *hw, uint32_t slave_pulses, bool enable)
 {
     hw->scl_sp_conf.scl_rst_slv_num = slave_pulses;
-    hw->scl_sp_conf.scl_rst_slv_en = 1;
-    hw->ctr.conf_upgate = 1;
-    // hardward will clear scl_rst_slv_en after sending SCL pulses,
-    // and we should set conf_upgate bit to synchronize register value.
-    while (hw->scl_sp_conf.scl_rst_slv_en);
+    hw->scl_sp_conf.scl_rst_slv_en = enable;
     hw->ctr.conf_upgate = 1;
+    // hardware will clear scl_rst_slv_en after sending SCL pulses,
+    // and we should set conf_upgate bit to synchronize register value after this function.
+}
+
+/**
+ * @brief Get the clear bus state
+ *
+ * @param hw Beginning address of the peripheral registers
+ *
+ * @return true: the clear bus not finish, otherwise, false.
+ */
+static inline bool i2c_ll_master_is_bus_clear_done(i2c_dev_t *hw)
+{
+    return hw->scl_sp_conf.scl_rst_slv_en;
 }
 
 /**
@@ -789,8 +800,8 @@ static inline void i2c_ll_master_init(i2c_dev_t *hw)
     typeof(hw->ctr) ctrl_reg;
     ctrl_reg.val = 0;
     ctrl_reg.ms_mode = 1;
-    ctrl_reg.sda_force_out = 1;
-    ctrl_reg.scl_force_out = 1;
+    ctrl_reg.sda_force_out = 0;
+    ctrl_reg.scl_force_out = 0;
     hw->ctr.val = ctrl_reg.val;
 }
 
@@ -805,8 +816,8 @@ static inline void i2c_ll_slave_init(i2c_dev_t *hw)
 {
     typeof(hw->ctr) ctrl_reg;
     ctrl_reg.val = 0;
-    ctrl_reg.sda_force_out = 1;
-    ctrl_reg.scl_force_out = 1;
+    ctrl_reg.sda_force_out = 0;
+    ctrl_reg.scl_force_out = 0;
     hw->ctr.val = ctrl_reg.val;
     hw->fifo_conf.fifo_addr_cfg_en = 0;
 }
@@ -862,7 +873,8 @@ static inline void i2c_ll_slave_clear_stretch(i2c_dev_t *dev)
 static inline uint32_t i2c_ll_calculate_timeout_us_to_reg_val(uint32_t src_clk_hz, uint32_t timeout_us)
 {
     uint32_t clk_cycle_num_per_us = src_clk_hz / (1 * 1000 * 1000);
-    return 31 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
+    // round up to an integer
+    return 32 - __builtin_clz(clk_cycle_num_per_us * timeout_us);
 }
 
 //////////////////////////////////////////Deprecated Functions//////////////////////////////////////////////////////////
@@ -901,7 +913,7 @@ typedef enum {
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  high_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  high_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  * @param  wait_high_period The I2C SCL wait rising edge period.
  *
@@ -1089,7 +1101,7 @@ static inline void i2c_ll_slave_disable_rx_it(i2c_dev_t *hw)
  * @brief  Configure I2C SCL timing
  *
  * @param  hw Beginning address of the peripheral registers
- * @param  hight_period The I2C SCL hight period (in core clock cycle, hight_period > 2)
+ * @param  hight_period The I2C SCL height period (in core clock cycle, hight_period > 2)
  * @param  low_period The I2C SCL low period (in core clock cycle, low_period > 1)
  *
  * @return None.