Merge c829a82ff1 into 7cd82420c2

Merge branch 'doc/update_espnow_example_v4.4' into 'release/v4.4'
docs(wifi): change the magic varible from int to uint32_t on the receiving side (v4.4) See merge request espressif/esp-idf!30310
2024-04-23 12:32:18 -03:00 · 2024-04-22 10:44:27 +08:00 · 2024-04-22 10:43:57 +08:00 · 2024-04-19 12:19:08 +08:00 · 2024-04-18 14:52:26 +08:00 · 2024-04-18 14:52:18 +08:00
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -28,6 +28,10 @@ if(NOT BOOTLOADER_BUILD)
        list(APPEND compile_options "-O2")
    endif()

+    if(CONFIG_COMPILER_STACK_MIRROR)
+        list(APPEND compile_options "-finstrument-functions")
+    endif()
+
 else()  # BOOTLOADER_BUILD

    if(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_SIZE)
--- a/16
+++ b/16
@ -384,6 +384,22 @@ mainmenu "Espressif IoT Development Framework Configuration"
            help
                Stack smashing protection.

+        config COMPILER_STACK_MIRROR
+            prompt "Enable Stack Mirror"
+            bool
+            default "n"
+            help
+                Make corrupted backtraces much less likely by creating a dupliate copy of stack return 
+                addresses in heap memory. Requires about 100 bytes of memory per thread.
+
+        config COMPILER_STACK_MIRROR_DEPTH
+            prompt "Stack Mirror Depth"
+            int
+            default 26
+            depends on COMPILER_STACK_MIRROR
+            help
+                The maximum depth of the stack mirror. 4 bytes are needed per depth.
+
        config COMPILER_WARN_WRITE_STRINGS
            bool "Enable -Wwrite-strings warning flag"
            default "n"
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -25,10 +25,13 @@ if(CONFIG_BT_ENABLED)
    list(APPEND include_dirs
         common/api/include/api
         common/btc/profile/esp/blufi/include
-         common/btc/profile/esp/include)
+         common/btc/profile/esp/include
+         common/hci_log/include)
+

    list(APPEND srcs "common/btc/core/btc_alarm.c"
         "common/api/esp_blufi_api.c"
+         "common/hci_log/bt_hci_log.c"
         "common/btc/core/btc_manage.c"
         "common/btc/core/btc_task.c"
         "common/btc/profile/esp/blufi/blufi_prf.c"
--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@ -57,6 +57,31 @@ menu "Bluetooth"
        source "$IDF_PATH/components/bt/host/nimble/Kconfig.in"
    endmenu

+    config BT_HCI_LOG_DEBUG_EN
+        depends on BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED
+        bool "Enable Bluetooth HCI debug mode"
+        default n
+        help
+            This option is used to enable bluetooth debug mode, which saves the hci layer data stream.
+
+    config BT_HCI_LOG_DATA_BUFFER_SIZE
+        depends on BT_HCI_LOG_DEBUG_EN
+        int "Size of the cache used for HCI data in Bluetooth HCI debug mode (N*1024 bytes)"
+        range 1 100
+        default 5
+        help
+            This option is to configure the buffer size of the hci data steam cache in hci debug mode.
+            This is a ring buffer, the new data will overwrite the oldest data if the buffer is full.
+
+    config BT_HCI_LOG_ADV_BUFFER_SIZE
+        depends on BT_HCI_LOG_DEBUG_EN
+        int "Size of the cache used for adv report in Bluetooth HCI debug mode (N*1024 bytes)"
+        range 1 100
+        default 8
+        help
+            This option is to configure the buffer size of the hci adv report cache in hci debug mode.
+            This is a ring buffer, the new data will overwrite the oldest data if the buffer is full.
+
 endmenu

 menuconfig BLE_MESH
--- a/components/bt/common/hci_log/bt_hci_log.c
+++ b/components/bt/common/hci_log/bt_hci_log.c
@ -0,0 +1,334 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include "hci_log/bt_hci_log.h"
+#include "bt_common.h"
+#include "osi/mutex.h"
+#include "esp_attr.h"
+
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+#define BT_HCI_LOG_PRINT_TAG                     (1)
+#define BT_HCI_LOG_DATA_BUF_SIZE                 (1024 * HCI_LOG_DATA_BUFFER_SIZE)
+#define BT_HCI_LOG_ADV_BUF_SIZE                  (1024 * HCI_LOG_ADV_BUFFER_SIZE)
+
+typedef struct {
+    osi_mutex_t mutex_lock;
+    uint64_t log_record_in;
+    uint64_t log_record_out;
+    uint64_t buf_size;
+    uint8_t *p_hci_log_buffer;
+    uint8_t index;
+    bool overflow;
+} bt_hci_log_t;
+
+static const char s_hex_to_char_mapping[16] = {
+    '0', '1', '2', '3', '4', '5', '6', '7',
+    '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+};
+
+bt_hci_log_t g_bt_hci_log_data_ctl  = {0};
+bt_hci_log_t g_bt_hci_log_adv_ctl  = {0};
+
+esp_err_t bt_hci_log_init(void)
+{
+    uint8_t *g_bt_hci_log_data_buffer = NULL;
+    uint8_t *g_bt_hci_log_adv_buffer  = NULL;
+
+    g_bt_hci_log_data_buffer = malloc(BT_HCI_LOG_DATA_BUF_SIZE);
+    if (!g_bt_hci_log_data_buffer) {
+        return ESP_ERR_NO_MEM;
+    }
+    g_bt_hci_log_adv_buffer = malloc(BT_HCI_LOG_ADV_BUF_SIZE);
+    if (!g_bt_hci_log_adv_buffer) {
+        if (g_bt_hci_log_data_buffer) {
+            free(g_bt_hci_log_data_buffer);
+            g_bt_hci_log_data_buffer = NULL;
+        }
+        return ESP_ERR_NO_MEM;
+    }
+
+    memset(g_bt_hci_log_data_buffer, 0, BT_HCI_LOG_DATA_BUF_SIZE);
+    memset(g_bt_hci_log_adv_buffer, 0, BT_HCI_LOG_ADV_BUF_SIZE);
+
+    memset(&g_bt_hci_log_data_ctl, 0, sizeof(bt_hci_log_t));
+    g_bt_hci_log_data_ctl.buf_size = BT_HCI_LOG_DATA_BUF_SIZE;
+    g_bt_hci_log_data_ctl.p_hci_log_buffer = g_bt_hci_log_data_buffer;
+
+    memset(&g_bt_hci_log_adv_ctl, 0, sizeof(bt_hci_log_t));
+    g_bt_hci_log_adv_ctl.buf_size = BT_HCI_LOG_ADV_BUF_SIZE;
+    g_bt_hci_log_adv_ctl.p_hci_log_buffer = g_bt_hci_log_adv_buffer;
+
+    osi_mutex_new((osi_mutex_t *)&g_bt_hci_log_data_ctl.mutex_lock);
+    osi_mutex_new((osi_mutex_t *)&g_bt_hci_log_adv_ctl.mutex_lock);
+
+    return ESP_OK;
+}
+
+esp_err_t bt_hci_log_deinit(void)
+{
+    if (g_bt_hci_log_data_ctl.p_hci_log_buffer) {
+        free(g_bt_hci_log_data_ctl.p_hci_log_buffer);
+        g_bt_hci_log_data_ctl.p_hci_log_buffer = NULL;
+    }
+
+    if (g_bt_hci_log_adv_ctl.p_hci_log_buffer) {
+        free(g_bt_hci_log_adv_ctl.p_hci_log_buffer);
+        g_bt_hci_log_adv_ctl.p_hci_log_buffer = NULL;
+    }
+
+    osi_mutex_free((osi_mutex_t *)&g_bt_hci_log_data_ctl.mutex_lock);
+    osi_mutex_free((osi_mutex_t *)&g_bt_hci_log_adv_ctl.mutex_lock);
+
+    memset(&g_bt_hci_log_data_ctl, 0, sizeof(bt_hci_log_t));
+    memset(&g_bt_hci_log_adv_ctl, 0, sizeof(bt_hci_log_t));
+
+    return ESP_OK;
+}
+
+#if (BT_HCI_LOG_PRINT_TAG)
+static char IRAM_ATTR *bt_data_type_to_str(uint8_t data_type)
+{
+    char *tag = NULL;
+    switch (data_type)
+    {
+    case HCI_LOG_DATA_TYPE_COMMAND:
+        // hci cmd data
+        tag = "CMD";
+        break;
+    case HCI_LOG_DATA_TYPE_H2C_ACL:
+        // host to controller hci acl data
+        tag = "HAL";
+        break;
+    case HCI_LOG_DATA_TYPE_SCO:
+        // hci sco data
+        tag = "SCO";
+        break;
+    case HCI_LOG_DATA_TYPE_EVENT:
+        // hci event
+        tag = "EVT";
+        break;
+    case HCI_LOG_DATA_TYPE_ADV:
+        // controller adv report data
+        tag = "ADV";
+        break;
+    case HCI_LOG_DATA_TYPE_C2H_ACL:
+        // controller to host hci acl data
+        tag = "CAL";
+        break;
+    case HCI_LOG_DATA_TYPE_SELF_DEFINE:
+        // self-defining data
+        tag = "ST";
+        break;
+    default:
+        // unknown data type
+        tag = "UK";
+        break;
+    }
+
+    return tag;
+}
+#endif
+
+void bt_hci_log_record_hex(bt_hci_log_t *p_hci_log_ctl, uint8_t *hex, uint8_t hex_len)
+{
+    uint8_t hci_log_char;
+    uint8_t *g_hci_log_buffer;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    while (hex_len--)
+    {
+        hci_log_char = ((*hex) >> 4);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = s_hex_to_char_mapping [hci_log_char];
+
+        if (++ p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        hci_log_char = ((*hex) & 0x0f);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = s_hex_to_char_mapping [hci_log_char];
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = ' ';
+
+        if (++ p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        ++ hex;
+    }
+}
+
+void bt_hci_log_record_string(bt_hci_log_t *p_hci_log_ctl, char *string)
+{
+    uint8_t *g_hci_log_buffer;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    while (*string != '\0') {
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = *string;
+        ++string;
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+    }
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *str, uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    osi_mutex_t mutex_lock;
+    uint8_t *g_hci_log_buffer;
+
+    if (!p_hci_log_ctl->p_hci_log_buffer) {
+        return ESP_FAIL;
+    }
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    if (!g_hci_log_buffer) {
+        return ESP_FAIL;
+    }
+
+    mutex_lock = p_hci_log_ctl->mutex_lock;
+    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
+
+#if (1)
+    // Add hci data index
+    bt_hci_log_record_hex(p_hci_log_ctl, &p_hci_log_ctl->index, 1);
+#endif
+
+#if (BT_HCI_LOG_PRINT_TAG)
+    char *tag = NULL;
+    tag = bt_data_type_to_str(data_type);
+
+    if (tag) {
+        bt_hci_log_record_string(p_hci_log_ctl, tag);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = ':';
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+    }
+#endif
+
+    if (str) {
+        bt_hci_log_record_string(p_hci_log_ctl, str);
+    }
+
+    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+
+    g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';
+
+    if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+        p_hci_log_ctl->log_record_in = 0;
+    }
+
+    if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+        p_hci_log_ctl->overflow = true;
+    }
+
+    p_hci_log_ctl->index ++;
+
+    osi_mutex_unlock(&mutex_lock);
+
+    return ESP_OK;
+}
+
+void bt_hci_log_data_show(bt_hci_log_t *p_hci_log_ctl)
+{
+    volatile uint64_t log_record_in,log_record_out;
+    uint8_t *g_hci_log_buffer;
+
+    if (!p_hci_log_ctl->p_hci_log_buffer) {
+        return;
+    }
+
+    osi_mutex_t mutex_lock = p_hci_log_ctl->mutex_lock;
+
+    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
+
+    log_record_in  = p_hci_log_ctl->log_record_in;
+    log_record_out = p_hci_log_ctl->log_record_out;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    if (p_hci_log_ctl->overflow) {
+        log_record_out = log_record_in;
+        printf("%c",g_hci_log_buffer[log_record_out]);
+
+        if (++log_record_out >= p_hci_log_ctl->buf_size) {
+            log_record_out = 0;
+        }
+    }
+
+    while (log_record_in != log_record_out)
+    {
+        printf("%c",g_hci_log_buffer[log_record_out]);
+
+        if (++log_record_out >= p_hci_log_ctl->buf_size) {
+            log_record_out = 0;
+        }
+    }
+
+    p_hci_log_ctl->log_record_out = log_record_out;
+    p_hci_log_ctl->overflow = false;
+
+    osi_mutex_unlock(&mutex_lock);
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_hci_data(uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, NULL, data_type, data, data_len);
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_custom_data(char *string, uint8_t *data, uint8_t data_len)
+{
+    return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, string, HCI_LOG_DATA_TYPE_SELF_DEFINE, data, data_len);
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_hci_adv(uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    return bt_hci_log_record_data(&g_bt_hci_log_adv_ctl, NULL, data_type, data, data_len);
+}
+
+void bt_hci_log_hci_data_show(void)
+{
+    bt_hci_log_data_show(&g_bt_hci_log_data_ctl);
+}
+
+void bt_hci_log_hci_adv_show(void)
+{
+    bt_hci_log_data_show(&g_bt_hci_log_adv_ctl);
+}
+
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
--- a/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
+++ b/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
@ -0,0 +1,108 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef __ESP_BT_HCI_LOG_H__
+#define __ESP_BT_HCI_LOG_H__
+
+#include "esp_err.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define    HCI_LOG_DATA_TYPE_COMMAND         (1)
+#define    HCI_LOG_DATA_TYPE_H2C_ACL         (2)
+#define    HCI_LOG_DATA_TYPE_SCO             (3)
+#define    HCI_LOG_DATA_TYPE_EVENT           (4)
+#define    HCI_LOG_DATA_TYPE_ADV             (5)
+#define    HCI_LOG_DATA_TYPE_SELF_DEFINE     (6)
+#define    HCI_LOG_DATA_TYPE_C2H_ACL         (7)
+
+/**
+ *
+ * @brief            This function is called to record self-defining data
+ * @param string :   data identification
+ * @param data :     data
+ * @param data_len : the length of data
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_custom_data(char *string, uint8_t *data, uint8_t data_len);
+/**
+ *
+ * @brief           This function is called to print all hci data record
+ *
+ *
+ * @return          None
+ *
+ */
+void bt_hci_log_hci_data_show(void);
+
+/**
+ *
+ * @brief           This function is called to print all adv report
+ *
+ *
+ * @return          None
+ *
+ */
+void bt_hci_log_hci_adv_show(void);
+
+/**
+ *
+ * @brief           This function is called to init hci log env
+ *
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_init(void);
+
+/**
+ *
+ * @brief           This function is called to deinit hci debug mode,
+ *                  and can only be called internally by Bluetooth
+ *
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_deinit(void);
+
+/**
+ *
+ * @brief           This function is called to record hci data without adv report event,
+ *                  and can only be called internally by Bluetooth
+ *
+ * @param str :     data type, define in bt_data_type_to_str()
+ * @param data :    data
+ * @param data_len : the length of data
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_hci_data(uint8_t data_type, uint8_t *data, uint8_t data_len);
+
+/**
+ *
+ * @brief           This function is called to record hci adv report event only
+ *                  and can only be called internally by Bluetooth
+ *
+ * @param str :     data type, define in bt_data_type_to_str()
+ * @param data :    data
+ * @param data_len : the length of data
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_hci_adv(uint8_t data_type, uint8_t *data, uint8_t data_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ESP_BT_HCI_LOG_H__ */
--- a/components/bt/common/include/bt_common.h
+++ b/components/bt/common/include/bt_common.h
@ -72,6 +72,24 @@
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif

+#if UC_BT_HCI_LOG_DEBUG_EN
+#define BT_HCI_LOG_INCLUDED  UC_BT_HCI_LOG_DEBUG_EN
+#else
+#define BT_HCI_LOG_INCLUDED  FALSE
+#endif
+
+#if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
+#define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
+#else
+#define HCI_BUFFER_SIZE  (5)
+#endif
+
+#if UC_BT_HCI_ADV_BUFFER_SIZE
+#define HCI_LOG_ADV_BUFFER_SIZE  UC_BT_HCI_LOG_ADV_BUFFER_SIZE
+#else
+#define HCI_LOG_ADV_BUFFER_SIZE  (5)
+#endif
+
 /* OS Configuration from User config (eg: sdkconfig) */
 #define TASK_PINNED_TO_CORE         UC_TASK_PINNED_TO_CORE
 #define BT_TASK_MAX_PRIORITIES      configMAX_PRIORITIES
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -100,4 +100,22 @@
 #define UC_BT_BLUEDROID_MEM_DEBUG FALSE
 #endif

+#ifdef CONFIG_BT_HCI_LOG_DEBUG_EN
+#define UC_BT_HCI_LOG_DEBUG_EN  TRUE
+#else
+#define UC_BT_HCI_LOG_DEBUG_EN  FALSE
+#endif
+
+#ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
+#define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
+#else
+#define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  (5)
+#endif
+
+#ifdef CONFIG_BT_HCI_LOG_ADV_BUFFER_SIZE
+#define UC_BT_HCI_LOG_ADV_BUFFER_SIZE CONFIG_BT_HCI_LOG_ADV_BUFFER_SIZE
+#else
+#define UC_BT_HCI_LOG_ADV_BUFFER_SIZE  (5)
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@ -172,7 +172,7 @@ config BTDM_CTRL_PINNED_TO_CORE
 choice BTDM_CTRL_HCI_MODE_CHOICE
    prompt "HCI mode"
    help
-        Speicify HCI mode as VHCI or UART(H4)
+        Specify HCI mode as VHCI or UART(H4)

    config BTDM_CTRL_HCI_MODE_VHCI
        bool "VHCI"
@ -398,6 +398,14 @@ config BTDM_CTRL_FULL_SCAN_SUPPORTED
        The full scan function is mainly used to provide BLE scan performance.
        This is required for scenes with high scan performance requirements, such as BLE Mesh scenes.

+config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    bool "Disable active scan backoff"
+    default n
+    help
+        Disable active scan backoff. The bluetooth spec requires that scanners should run a backoff procedure to
+        minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
+        scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
+
 config BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
    bool "BLE adv report flow control supported"
    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@ -23,7 +23,7 @@ config BT_CTRL_BLE_STATIC_ACL_TX_BUF_NB
    default 0
    help
        BLE ACL buffer have two methods to be allocated. One is persistent allocating
-        (alloate when controller initialise, never free until controller de-initialise)
+        (allocate when controller initialise, never free until controller de-initialise)
        another is dynamically allocating (allocate before TX and free after TX).

 choice BT_CTRL_PINNED_TO_CORE_CHOICE
@ -72,11 +72,11 @@ config BT_CTRL_HCI_TL
        HCI mode as VHCI or UART(H4)

 config BT_CTRL_ADV_DUP_FILT_MAX
-    int "The maxinum number of 5.0 extend duplicate scan filter"
+    int "The maximum number of 5.0 extend duplicate scan filter"
    range 1 500
    default 30
    help
-        The maxinum number of suplicate scan filter
+        The maximum number of suplicate scan filter

 choice BT_BLE_CCA_MODE
    prompt "BLE CCA mode"
@ -475,3 +475,17 @@ config BT_BLE_ADV_DATA_LENGTH_ZERO_AUX
        When this option is enabled, auxiliary packets will be present in the events of
        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_CTRL_LE_PING_EN
+    bool "Enable LE Ping procedure"
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@ -64,6 +64,7 @@
 // wakeup request sources
 enum {
    BTDM_ASYNC_WAKEUP_SRC_VHCI = 0,
+    BTDM_ASYNC_WAKEUP_REQ_COEX,
    BTDM_ASYNC_WAKEUP_SRC_DISA,
    BTDM_ASYNC_WAKEUP_SRC_TMR,
    BTDM_ASYNC_WAKEUP_SRC_MAX,
@ -110,7 +111,7 @@ do{\
 } while(0)

 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010007
+#define OSI_VERSION              0x00010008
 #define OSI_MAGIC_VALUE          0xFADEBEAD

 /* Types definition
@ -185,8 +186,12 @@ struct osi_funcs_t {
    void (* _btdm_sleep_exit_phase3)(void);  /* called from task */
    void (* _coex_wifi_sleep_set)(bool sleep);
    int (* _coex_core_ble_conn_dyn_prio_get)(bool *low, bool *high);
+    int (* _coex_schm_register_btdm_callback)(void *callback);
    void (* _coex_schm_status_bit_set)(uint32_t type, uint32_t status);
    void (* _coex_schm_status_bit_clear)(uint32_t type, uint32_t status);
+    uint32_t (* _coex_schm_interval_get)(void);
+    uint8_t (* _coex_schm_curr_period_get)(void);
+    void *(* _coex_schm_curr_phase_get)(void);
    void (* _interrupt_on)(int intr_num);
    void (* _interrupt_off)(int intr_num);
    void (* _esp_hw_power_down)(void);
@ -194,6 +199,8 @@ struct osi_funcs_t {
    void (* _ets_backup_dma_copy)(uint32_t reg, uint32_t mem_addr, uint32_t num, bool to_rem);
    void (* _ets_delay_us)(uint32_t us);
    void (* _btdm_rom_table_ready)(void);
+    bool (* _coex_bt_wakeup_request)(void);
+    void (* _coex_bt_wakeup_request_end)(void);
 };


@ -241,6 +248,7 @@ extern int ble_txpwr_get(int power_type);
 extern uint16_t l2c_ble_link_get_tx_buf_num(void);
 extern int coex_core_ble_conn_dyn_prio_get(bool *low, bool *high);
 extern void coex_pti_v2(void);
+extern int coex_schm_register_btdm_callback(void *callback);

 extern bool btdm_deep_sleep_mem_init(void);
 extern void btdm_deep_sleep_mem_deinit(void);
@ -307,14 +315,20 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles);
 static void btdm_sleep_enter_phase2_wrapper(void);
 static void btdm_sleep_exit_phase3_wrapper(void);
 static void coex_wifi_sleep_set_hook(bool sleep);
+static int coex_schm_register_btdm_callback_wrapper(void *callback);
 static void coex_schm_status_bit_set_wrapper(uint32_t type, uint32_t status);
 static void coex_schm_status_bit_clear_wrapper(uint32_t type, uint32_t status);
+static uint32_t coex_schm_interval_get_wrapper(void);
+static uint8_t coex_schm_curr_period_get_wrapper(void);
+static void * coex_schm_curr_phase_get_wrapper(void);
 static void interrupt_on_wrapper(int intr_num);
 static void interrupt_off_wrapper(int intr_num);
 static void btdm_hw_mac_power_up_wrapper(void);
 static void btdm_hw_mac_power_down_wrapper(void);
 static void btdm_backup_dma_copy_wrapper(uint32_t reg, uint32_t mem_addr, uint32_t num,  bool to_mem);
 static void btdm_funcs_table_ready_wrapper(void);
+static bool coex_bt_wakeup_request(void);
+static void coex_bt_wakeup_request_end(void);

 static void btdm_slp_tmr_callback(void *arg);

@ -372,8 +386,12 @@ static const struct osi_funcs_t osi_funcs_ro = {
    ._btdm_sleep_exit_phase3 = btdm_sleep_exit_phase3_wrapper,
    ._coex_wifi_sleep_set = coex_wifi_sleep_set_hook,
    ._coex_core_ble_conn_dyn_prio_get = coex_core_ble_conn_dyn_prio_get,
+    ._coex_schm_register_btdm_callback = coex_schm_register_btdm_callback_wrapper,
    ._coex_schm_status_bit_set = coex_schm_status_bit_set_wrapper,
    ._coex_schm_status_bit_clear = coex_schm_status_bit_clear_wrapper,
+    ._coex_schm_interval_get = coex_schm_interval_get_wrapper,
+    ._coex_schm_curr_period_get = coex_schm_curr_period_get_wrapper,
+    ._coex_schm_curr_phase_get = coex_schm_curr_phase_get_wrapper,
    ._interrupt_on = interrupt_on_wrapper,
    ._interrupt_off = interrupt_off_wrapper,
    ._esp_hw_power_down = btdm_hw_mac_power_down_wrapper,
@ -381,6 +399,8 @@ static const struct osi_funcs_t osi_funcs_ro = {
    ._ets_backup_dma_copy = btdm_backup_dma_copy_wrapper,
    ._ets_delay_us = esp_rom_delay_us,
    ._btdm_rom_table_ready = btdm_funcs_table_ready_wrapper,
+    ._coex_bt_wakeup_request = coex_bt_wakeup_request,
+    ._coex_bt_wakeup_request_end = coex_bt_wakeup_request_end,
 };

 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;
@ -895,6 +915,22 @@ static bool async_wakeup_request(int event)
                semphr_take_wrapper(s_wakeup_req_sem, OSI_FUNCS_TIME_BLOCKING);
            }
            break;
+        case BTDM_ASYNC_WAKEUP_REQ_COEX:
+            if (!btdm_power_state_active()) {
+                do_wakeup_request = true;
+#if CONFIG_PM_ENABLE
+                if (s_lp_stat.pm_lock_released) {
+                    esp_pm_lock_acquire(s_pm_lock);
+                    s_lp_stat.pm_lock_released = 0;
+                }
+#endif
+                btdm_wakeup_request();
+
+                if (s_lp_cntl.wakeup_timer_required && s_lp_stat.wakeup_timer_started) {
+                    esp_timer_stop(s_btdm_slp_tmr);
+                    s_lp_stat.wakeup_timer_started = 0;
+                }
+            }
        default:
            break;
    }
@ -914,6 +950,9 @@ static void async_wakeup_request_end(int event)
        case BTDM_ASYNC_WAKEUP_SRC_DISA:
            allow_to_sleep = true;
            break;
+        case BTDM_ASYNC_WAKEUP_REQ_COEX:
+            allow_to_sleep = false;
+            break;
        default:
            allow_to_sleep = true;
            break;
@ -933,18 +972,25 @@ static void btdm_funcs_table_ready_wrapper(void)
 #endif
 }

-static void coex_schm_status_bit_set_wrapper(uint32_t type, uint32_t status)
+bool bt_async_wakeup_request(void)
 {
-#if CONFIG_SW_COEXIST_ENABLE
-    coex_schm_status_bit_set(type, status);
-#endif
+    return async_wakeup_request(BTDM_ASYNC_WAKEUP_SRC_VHCI);
 }

-static void coex_schm_status_bit_clear_wrapper(uint32_t type, uint32_t status)
+void bt_wakeup_request_end(void)
 {
-#if CONFIG_SW_COEXIST_ENABLE
-    coex_schm_status_bit_clear(type, status);
-#endif
+    async_wakeup_request_end(BTDM_ASYNC_WAKEUP_SRC_VHCI);
+}
+
+static bool coex_bt_wakeup_request(void)
+{
+    return async_wakeup_request(BTDM_ASYNC_WAKEUP_REQ_COEX);
+}
+
+static void coex_bt_wakeup_request_end(void)
+{
+    async_wakeup_request_end(BTDM_ASYNC_WAKEUP_REQ_COEX);
+    return;
 }

 bool esp_vhci_host_check_send_available(void)
@ -1739,4 +1785,55 @@ static void coex_wifi_sleep_set_hook(bool sleep)
 {

 }
+
+static int coex_schm_register_btdm_callback_wrapper(void *callback)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    return coex_schm_register_btdm_callback(callback);
+#else
+    return 0;
+#endif
+}
+
+static void coex_schm_status_bit_clear_wrapper(uint32_t type, uint32_t status)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    coex_schm_status_bit_clear(type, status);
+#endif
+}
+
+static void coex_schm_status_bit_set_wrapper(uint32_t type, uint32_t status)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    coex_schm_status_bit_set(type, status);
+#endif
+}
+
+static uint32_t coex_schm_interval_get_wrapper(void)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    return coex_schm_interval_get();
+#else
+    return 0;
+#endif
+}
+
+static uint8_t coex_schm_curr_period_get_wrapper(void)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    return coex_schm_curr_period_get();
+#else
+    return 1;
+#endif
+}
+
+static void * coex_schm_curr_phase_get_wrapper(void)
+{
+#if CONFIG_SW_COEXIST_ENABLE
+    return coex_schm_curr_phase_get();
+#else
+    return NULL;
+#endif
+}
+
 #endif /*  CONFIG_BT_ENABLED */
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
@ -1 +1 @@
-Subproject commit 889c1149140d330ad173b863a91b667d9f62b853
+Subproject commit 44341b15e58792946cc65ed8d4483929194d182f
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
@ -1 +1 @@
-Subproject commit e5c0f7256ecf5b5f8eb28c1793051a6b88f95124
+Subproject commit 76ed4114ee7d081435a3c65793b4c8eb1dfaf199
--- a/components/bt/host/bluedroid/api/esp_bt_main.c
+++ b/components/bt/host/bluedroid/api/esp_bt_main.c
@ -19,6 +19,10 @@
 #include "esp_bt.h"
 #include "osi/future.h"
 #include "osi/allocator.h"
+#include "bt_common.h"
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+#include "hci_log/bt_hci_log.h"
+#endif

 static bool bd_already_enable = false;
 static bool bd_already_init = false;
@ -165,6 +169,10 @@ esp_err_t esp_bluedroid_init(void)

    bd_already_init = true;

+#if (BT_HCI_LOG_INCLUDED == TRUE)
+    bt_hci_log_init();
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
+
    return ESP_OK;
 }

@ -207,6 +215,10 @@ esp_err_t esp_bluedroid_deinit(void)

    btc_deinit();

+#if (BT_HCI_LOG_INCLUDED == TRUE)
+    bt_hci_log_deinit();
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
+
    bd_already_init = false;

    return ESP_OK;
--- a/components/bt/host/bluedroid/api/esp_gap_ble_api.c
+++ b/components/bt/host/bluedroid/api/esp_gap_ble_api.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -299,6 +299,7 @@ esp_err_t esp_ble_gap_config_local_icon (uint16_t icon)
    case ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV:
    case ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD:
    case ESP_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV:
+    case ESP_BLE_APPEARANCE_STANDALONE_SPEAKER:
        msg.sig = BTC_SIG_API_CALL;
        msg.pid = BTC_PID_GAP_BLE;
        msg.act = BTC_GAP_BLE_ACT_CONFIG_LOCAL_ICON;
@ -839,6 +840,103 @@ esp_err_t esp_gap_ble_set_authorization(esp_bd_addr_t bd_addr, bool authorize)
    return ESP_FAIL;
 }

+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+esp_err_t esp_ble_dtm_tx_start(const esp_ble_dtm_tx_t *tx_params)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gap_args_t arg;
+
+    if (!tx_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_DTM_TX_START;
+
+    memcpy(&arg.dtm_tx_start, tx_params, sizeof(esp_ble_dtm_tx_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_dtm_rx_start(const esp_ble_dtm_rx_t *rx_params)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gap_args_t arg;
+
+    if (!rx_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_DTM_RX_START;
+
+    memcpy(&arg.dtm_rx_start, rx_params, sizeof(esp_ble_dtm_rx_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+esp_err_t esp_ble_dtm_enh_tx_start(const esp_ble_dtm_enh_tx_t *tx_params)
+{
+    btc_msg_t msg = {0};
+    btc_ble_5_gap_args_t arg;
+
+    if (!tx_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_DTM_ENH_TX_START;
+
+    memcpy(&arg.dtm_enh_tx_start, tx_params, sizeof(esp_ble_dtm_enh_tx_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_dtm_enh_rx_start(const esp_ble_dtm_enh_rx_t *rx_params)
+{
+    btc_msg_t msg = {0};
+    btc_ble_5_gap_args_t arg;
+
+    if (!rx_params) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_DTM_ENH_RX_START;
+
+    memcpy(&arg.dtm_enh_rx_start, rx_params, sizeof(esp_ble_dtm_enh_rx_t));
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+esp_err_t esp_ble_dtm_stop(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLUEDROID_STATUS_CHECK(ESP_BLUEDROID_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_DTM_STOP;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
 #if (BLE_50_FEATURE_SUPPORT == TRUE)

 esp_err_t esp_ble_gap_read_phy(esp_bd_addr_t bd_addr)
@ -1502,3 +1600,31 @@ esp_err_t esp_ble_gap_set_periodic_adv_sync_trans_params(esp_bd_addr_t addr, con
            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
+esp_err_t esp_ble_gap_vendor_command_send(esp_ble_vendor_cmd_params_t *vendor_cmd_param)
+{
+    btc_msg_t msg = {0};
+    btc_ble_gap_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (!vendor_cmd_param || !vendor_cmd_param->p_param_buf || !vendor_cmd_param->param_len) {
+        return ESP_ERR_INVALID_ARG;
+    }
+    // If command is not a VSC, return error
+    if ((vendor_cmd_param->opcode & VENDOR_HCI_CMD_MASK) != VENDOR_HCI_CMD_MASK) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT;
+    arg.vendor_cmd_send.opcode = vendor_cmd_param->opcode;
+    arg.vendor_cmd_send.param_len = vendor_cmd_param->param_len;
+    arg.vendor_cmd_send.p_param_buf = vendor_cmd_param->p_param_buf;
+
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gap_args_t), btc_gap_ble_arg_deep_copy, btc_gap_ble_arg_deep_free)
+                == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
--- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h
@ -104,6 +104,7 @@ typedef uint8_t   esp_ble_auth_req_t;         /*!< combination of the above bit
 #define ESP_BLE_APPEARANCE_CYCLING_CADENCE         0x0483 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_CADENCE in stack/btm_ble_api.h */
 #define ESP_BLE_APPEARANCE_CYCLING_POWER           0x0484 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_POWER in stack/btm_ble_api.h */
 #define ESP_BLE_APPEARANCE_CYCLING_SPEED_CADENCE   0x0485 /*!< relate to BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE in stack/btm_ble_api.h */
+#define ESP_BLE_APPEARANCE_STANDALONE_SPEAKER      0x0841 /*!< relate to BTM_BLE_APPEARANCE_STANDALONE_SPEAKER in stack/btm_ble_api.h */
 #define ESP_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER  0x0C40 /*!< relate to BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER in stack/btm_ble_api.h */
 #define ESP_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41 /*!< relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP in stack/btm_ble_api.h */
 #define ESP_BLE_APPEARANCE_PULSE_OXIMETER_WRIST    0x0C42 /*!< relate to BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST in stack/btm_ble_api.h */
@ -125,6 +126,18 @@ typedef uint8_t   esp_ble_auth_req_t;         /*!< combination of the above bit

 typedef uint8_t esp_ble_io_cap_t;               /*!< combination of the io capability */

+#define    BLE_DTM_PKT_PAYLOAD_0x00   0x00       /*!< PRBS9 sequence ‘11111111100000111101...’ (in transmission order) as described in [Vol 6] Part F, Section 4.1.5 */
+#define    BLE_DTM_PKT_PAYLOAD_0x01   0x01       /*!< Repeated ‘11110000’ (in transmission order) sequence as described in [Vol 6] Part F, Section 4.1.5 */
+#define    BLE_DTM_PKT_PAYLOAD_0x02   0x02       /*!< Repeated ‘10101010’ (in transmission order) sequence as described in [Vol 6] Part F, Section 4.1.5 */
+#define    BLE_DTM_PKT_PAYLOAD_0x03   0x03       /*!< PRBS15 sequence as described in [Vol 6] Part F, Section 4.1.5 */
+#define    BLE_DTM_PKT_PAYLOAD_0x04   0x04       /*!< Repeated ‘11111111’ (in transmission order) sequence */
+#define    BLE_DTM_PKT_PAYLOAD_0x05   0x05       /*!< Repeated ‘00000000’ (in transmission order) sequence */
+#define    BLE_DTM_PKT_PAYLOAD_0x06   0x06       /*!< Repeated ‘00001111’ (in transmission order) sequence */
+#define    BLE_DTM_PKT_PAYLOAD_0x07   0x07       /*!< Repeated ‘01010101’ (in transmission order) sequence */
+#define    BLE_DTM_PKT_PAYLOAD_MAX    0x08       /*!< 0x08 ~ 0xFF, Reserved for future use */
+
+typedef uint8_t esp_ble_dtm_pkt_payload_t;
+
 /// GAP BLE callback event type
 typedef enum {
    //BLE_42_FEATURE_SUPPORT
@ -208,8 +221,11 @@ typedef enum {
    ESP_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS_COMPLETE_EVT,        /*!< when periodic advertising set info transfer complete, the event comes */
    ESP_GAP_BLE_SET_PAST_PARAMS_COMPLETE_EVT,                    /*!< when set periodic advertising sync transfer params complete, the event comes */
    ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT,                /*!< when periodic advertising sync transfer received, the event comes */
+    // DTM
+    ESP_GAP_BLE_DTM_TEST_UPDATE_EVT,                             /*!< when direct test mode state changes, the event comes */
    // BLE_INCLUDED
    ESP_GAP_BLE_ADV_CLEAR_COMPLETE_EVT,                          /*!< When clear advertising complete, the event comes */
+    ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT,                          /*!< When vendor hci command complete, the event comes */
    ESP_GAP_BLE_EVT_MAX,                                         /*!< when maximum advertising event complete, the event comes */
 } esp_gap_ble_cb_event_t;

@ -224,6 +240,8 @@ typedef uint8_t esp_gap_ble_channels[ESP_GAP_BLE_CHANNELS_LEN];
 /// Scan response data maximum length
 #define ESP_BLE_SCAN_RSP_DATA_LEN_MAX          31

+#define VENDOR_HCI_CMD_MASK                    (0x3F << 10) /**!< 0xFC00 */
+
 /* relate to BTM_BLE_AD_TYPE_xxx in stack/btm_ble_api.h */
 /// The type of advertising data(not adv_type)
 typedef enum {
@ -341,7 +359,42 @@ typedef enum {
    ESP_BLE_SM_MAX_PARAM,
 } esp_ble_sm_param_t;

+typedef enum {
+    /// DTM TX start event
+    DTM_TX_START_EVT  = 0x00,
+    ///DTM RX start event
+    DTM_RX_START_EVT,
+    ///DTM test end event
+    DTM_TEST_STOP_EVT,
+} esp_ble_dtm_update_evt_t;
+
+/**
+ * @brief Vendor HCI command parameters
+ */
+typedef struct {
+    uint16_t opcode;                /*!< vendor hci command opcode */
+    uint8_t param_len;              /*!< the length of parameter */
+    uint8_t *p_param_buf;           /*!< the point of parameter buffer */
+} esp_ble_vendor_cmd_params_t;
+
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
+/**
+* @brief DTM TX parameters
+*/
+typedef struct
+{
+    uint8_t                         tx_channel;            /*!<  channel for sending test data, tx_channel = (Frequency -2402)/2, tx_channel range:0x00-0x27, Frequency range: 2402 MHz to 2480 MHz */
+    uint8_t                         len_of_data;           /*!<  length in bytes of payload data in each packet */
+    esp_ble_dtm_pkt_payload_t       pkt_payload;           /*!<  packet payload type. value range: 0x00-0x07 */
+} esp_ble_dtm_tx_t;
+/**
+* @brief DTM RX parameters
+*/
+typedef struct
+{
+    uint8_t          rx_channel;            /*!<  channel for test data reception, rx_channel = (Frequency -2402)/2, tx_channel range:0x00-0x27, Frequency range: 2402 MHz to 2480 MHz */
+} esp_ble_dtm_rx_t;
+
 /// Advertising parameters
 typedef struct {
    uint16_t                adv_int_min;        /*!< Minimum advertising interval for
@ -924,6 +977,27 @@ typedef struct {
    uint8_t adv_clk_accuracy;                     /*!< periodic advertising clock accuracy */
 } esp_ble_gap_periodic_adv_sync_estab_t;

+/**
+* @brief DTM TX parameters
+*/
+typedef struct
+{
+    uint8_t                     tx_channel;            /*!<  channel for sending test data, tx_channel = (Frequency -2402)/2, tx_channel range:0x00-0x27, Frequency range: 2402 MHz to 2480 MHz */
+    uint8_t                     len_of_data;           /*!<  length in bytes of payload data in each packet */
+    esp_ble_dtm_pkt_payload_t   pkt_payload;           /*!<  packet payload type. value range: 0x00-0x07 */
+    esp_ble_gap_phy_t           phy;                   /*!<  the phy type used by the transmitter, coded phy with S=2:0x04 */
+} esp_ble_dtm_enh_tx_t;
+
+/**
+* @brief DTM RX parameters
+*/
+typedef struct
+{
+    uint8_t             rx_channel;            /*!<  channel for test data reception, rx_channel = (Frequency -2402)/2, tx_channel range:0x00-0x27, Frequency range: 2402 MHz to 2480 MHz */
+    esp_ble_gap_phy_t   phy;                   /*!<  the phy type used by the receiver, 1M phy: 0x01, 2M phy:0x02, coded phy:0x03 */
+    uint8_t             modulation_idx;        /*!<  modulation index, 0x00:standard modulation index, 0x01:stable modulation index */
+} esp_ble_dtm_enh_rx_t;
+
 #endif //#if (BLE_50_FEATURE_SUPPORT == TRUE)

 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
@ -1393,6 +1467,22 @@ typedef union {
        uint8_t adv_clk_accuracy;           /*!< Periodic advertising clock accuracy */
    } past_received;                        /*!< Event parameter of ESP_GAP_BLE_PERIODIC_ADV_SYNC_TRANS_RECV_EVT */
 #endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+    /**
+     * @brief ESP_GAP_BLE_DTM_TEST_UPDATE_EVT
+     */
+    struct ble_dtm_state_update_evt_param {
+        esp_bt_status_t status;                     /*!< Indicate DTM operation success status */
+        esp_ble_dtm_update_evt_t update_evt;        /*!< DTM state change event, 0x00: DTM TX start, 0x01: DTM RX start, 0x02:DTM end */
+        uint16_t num_of_pkt;                        /*!< number of packets received, only valid if update_evt is DTM_TEST_STOP_EVT and shall be reported as 0 for a transmitter */
+    } dtm_state_update;                             /*!< Event parameter of ESP_GAP_BLE_DTM_TEST_UPDATE_EVT */
+    /**
+     * @brief ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT
+     */
+    struct vendor_cmd_cmpl_evt_param {
+        uint16_t        opcode;                     /*!< vendor hci command opcode */
+        uint16_t        param_len;                  /*!< The length of parameter buffer */
+        uint8_t         *p_param_buf;               /*!< The point of parameter buffer */
+    } vendor_cmd_cmpl;                              /*!< Event parameter of ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT */
 } esp_ble_gap_cb_param_t;

 /**
@ -2388,16 +2478,93 @@ esp_err_t esp_ble_gap_set_periodic_adv_sync_trans_params(esp_bd_addr_t addr,
                                                         const esp_ble_gap_past_params_t *params);
 #endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)

+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+
 /**
-* @brief           This function is used to clear legacy advertising
+* @brief           This function is used to start a test where the DUT generates reference packets
+*                  at a fixed interval.
+*
+* @param[in]       tx_params : DTM Transmitter parameters
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_dtm_tx_start(const esp_ble_dtm_tx_t *tx_params);
+
+/**
+* @brief           This function is used to start a test where the DUT receives test reference packets
+*                  at a fixed interval.
+*
+* @param[in]       rx_params : DTM Receiver parameters
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_dtm_rx_start(const esp_ble_dtm_rx_t *rx_params);
+#endif //#if (BLE_42_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+/**
+* @brief           This function is used to start a test where the DUT generates reference packets
+*                  at a fixed interval.
+*
+* @param[in]       tx_params : DTM Transmitter parameters
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_dtm_enh_tx_start(const esp_ble_dtm_enh_tx_t *tx_params);
+
+/**
+* @brief           This function is used to start a test where the DUT receives test reference packets
+*                  at a fixed interval.
+*
+* @param[in]       rx_params : DTM Receiver parameters
+*
+* @return            - ESP_OK : success
+*                    - other  : failed
+*
+*/
+esp_err_t esp_ble_dtm_enh_rx_start(const esp_ble_dtm_enh_rx_t *rx_params);
+#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+/**
+* @brief           This function is used to stop any test which is in progress
 *
 *
 * @return            - ESP_OK : success
 *                    - other  : failed
 *
 */
+esp_err_t esp_ble_dtm_stop(void);
+
+/**
+* @brief           This function is used to clear legacy advertising
+*
+*
+* @return           - ESP_OK : success
+*                   - other  : failed
+*
+*/
 esp_err_t esp_ble_gap_clear_advertising(void);

+/**
+ * @brief           This function is called to send vendor hci command.
+ *
+ *
+ *
+ * @param[in]       vendor_cmd_param: vendor hci command parameters
+ *
+ * @return
+ *                  - ESP_OK : success
+ *                  - other  : failed
+ */
+esp_err_t esp_ble_gap_vendor_command_send(esp_ble_vendor_cmd_params_t *vendor_cmd_param);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
@ -707,6 +707,14 @@ void bta_dm_get_dev_name (tBTA_DM_MSG *p_data)
    }
 }

+void bta_dm_send_vendor_hci(tBTA_DM_MSG *p_data)
+{
+    BTM_VendorSpecificCommand(p_data->vendor_hci_cmd.opcode,
+                              p_data->vendor_hci_cmd.param_len,
+                              p_data->vendor_hci_cmd.p_param_buf,
+                              p_data->vendor_hci_cmd.vendor_hci_cb);
+}
+
 /*******************************************************************************
 **
 ** Function         bta_dm_set_afh_channels
@ -5647,6 +5655,21 @@ void btm_dm_ble_multi_adv_disable(tBTA_DM_MSG *p_data)
    }
 }

+void bta_dm_ble_gap_dtm_tx_start(tBTA_DM_MSG *p_data)
+{
+    BTM_BleTransmitterTest(p_data->dtm_tx_start.tx_channel, p_data->dtm_tx_start.len_of_data, p_data->dtm_tx_start.pkt_payload, p_data->dtm_tx_start.p_dtm_cmpl_cback);
+}
+
+void bta_dm_ble_gap_dtm_rx_start(tBTA_DM_MSG *p_data)
+{
+    BTM_BleReceiverTest(p_data->dtm_rx_start.rx_channel, p_data->dtm_rx_start.p_dtm_cmpl_cback);
+}
+
+void bta_dm_ble_gap_dtm_stop(tBTA_DM_MSG *p_data)
+{
+    BTM_BleTestEnd(p_data->dtm_stop.p_dtm_cmpl_cback);
+}
+
 void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data)
 {
    if (BTM_BleClearAdv(p_data->ble_clear_adv.p_clear_adv_cback) == FALSE) {
@ -5657,6 +5680,18 @@ void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data)
 }

 #if (BLE_50_FEATURE_SUPPORT == TRUE)
+void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data)
+{
+    BTM_BleEnhancedTransmitterTest(p_data->dtm_enh_tx_start.tx_channel, p_data->dtm_enh_tx_start.len_of_data,
+                                    p_data->dtm_enh_tx_start.pkt_payload, p_data->dtm_enh_tx_start.phy, p_data->dtm_enh_tx_start.p_dtm_cmpl_cback);
+}
+
+void bta_dm_ble_gap_dtm_enhance_rx_start(tBTA_DM_MSG *p_data)
+{
+    BTM_BleEnhancedReceiverTest(p_data->dtm_enh_rx_start.rx_channel, p_data->dtm_enh_rx_start.phy,
+                                    p_data->dtm_enh_rx_start.modulation_index, p_data->dtm_enh_rx_start.p_dtm_cmpl_cback);
+}
+
 void bta_dm_ble_gap_read_phy(tBTA_DM_MSG *p_data)
 {
    //tBTM_STATUS btm_status = 0;
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c
@ -202,6 +202,21 @@ void BTA_DmGetDeviceName(tBTA_GET_DEV_NAME_CBACK *p_cback)
    }
 }

+void BTA_DmsendVendorHciCmd(UINT16 opcode, UINT8 param_len, UINT8 *p_param_buf, tBTA_SEND_VENDOR_HCI_CMPL_CBACK p_vendor_cmd_complete_cback)
+{
+    tBTA_DM_API_SEND_VENDOR_HCI_CMD *p_msg;
+    if ((p_msg = (tBTA_DM_API_SEND_VENDOR_HCI_CMD *)osi_malloc(sizeof(tBTA_DM_API_SEND_VENDOR_HCI_CMD) + param_len)) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SEND_VENDOR_HCI_CMD_EVT;
+        p_msg->opcode = opcode;
+        p_msg->param_len = param_len;
+        p_msg->p_param_buf = (UINT8 *)(p_msg + 1);
+        memcpy(p_msg->p_param_buf, p_param_buf, param_len);
+        p_msg->vendor_hci_cb = p_vendor_cmd_complete_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 #if (CLASSIC_BT_INCLUDED == TRUE)

 void BTA_DmConfigEir(tBTA_DM_EIR_CONF *eir_config)
@ -2501,6 +2516,49 @@ void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length, tBTA_S
    }
 }

+void BTA_DmBleDtmTxStart(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    tBTA_DM_API_BLE_DTM_TX_START *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_DTM_TX_START *)osi_malloc(sizeof(tBTA_DM_API_BLE_DTM_TX_START)))
+            != NULL) {
+        p_msg->hdr.event = BTA_DM_API_DTM_TX_START_EVT;
+        p_msg->tx_channel = tx_channel;
+        p_msg->len_of_data = len_of_data;
+        p_msg->pkt_payload = pkt_payload;
+        p_msg->p_dtm_cmpl_cback = p_dtm_cmpl_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
+void BTA_DmBleDtmRxStart(uint8_t rx_channel, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    tBTA_DM_API_BLE_DTM_RX_START *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_DTM_RX_START *)osi_malloc(sizeof(tBTA_DM_API_BLE_DTM_RX_START)))
+            != NULL) {
+        p_msg->hdr.event = BTA_DM_API_DTM_RX_START_EVT;
+        p_msg->rx_channel= rx_channel;
+        p_msg->p_dtm_cmpl_cback = p_dtm_cmpl_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
+void BTA_DmBleDtmStop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    tBTA_DM_API_BLE_DTM_STOP *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_DTM_STOP *)osi_malloc(sizeof(tBTA_DM_API_BLE_DTM_STOP)))
+            != NULL) {
+        p_msg->hdr.event = BTA_DM_API_DTM_STOP_EVT;
+        p_msg->p_dtm_cmpl_cback = p_dtm_cmpl_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 #endif

 /*******************************************************************************
@ -3181,6 +3239,39 @@ void BTA_DmBleGapExtConnect(tBLE_ADDR_TYPE own_addr_type, const BD_ADDR peer_add

 }

+void BTA_DmBleDtmEnhTxStart(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, uint8_t phy, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    tBTA_DM_API_BLE_DTM_ENH_TX_START *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_DTM_ENH_TX_START *)osi_malloc(sizeof(tBTA_DM_API_BLE_DTM_ENH_TX_START)))
+            != NULL) {
+        p_msg->hdr.event = BTA_DM_API_DTM_ENH_TX_START_EVT;
+        p_msg->tx_channel = tx_channel;
+        p_msg->len_of_data = len_of_data;
+        p_msg->pkt_payload = pkt_payload;
+        p_msg->phy = phy;
+        p_msg->p_dtm_cmpl_cback = p_dtm_cmpl_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
+void BTA_DmBleDtmEnhRxStart(uint8_t rx_channel, uint8_t phy, uint8_t modulation_index, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    tBTA_DM_API_BLE_DTM_ENH_RX_START *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_BLE_DTM_ENH_RX_START *)osi_malloc(sizeof(tBTA_DM_API_BLE_DTM_ENH_RX_START)))
+            != NULL) {
+        p_msg->hdr.event = BTA_DM_API_DTM_ENH_RX_START_EVT;
+        p_msg->rx_channel= rx_channel;
+        p_msg->phy = phy;
+        p_msg->modulation_index = modulation_index;
+        p_msg->p_dtm_cmpl_cback = p_dtm_cmpl_cback;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)

 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c
@ -58,6 +58,7 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_disable,                         /* BTA_DM_API_DISABLE_EVT */
    bta_dm_set_dev_name,                    /* BTA_DM_API_SET_NAME_EVT */
    bta_dm_get_dev_name,                    /* BTA_DM_API_GET_NAME_EVT */
+    bta_dm_send_vendor_hci,                 /* BTA_DM_API_SEND_VENDOR_HCI_CMD_EVT */
 #if (CLASSIC_BT_INCLUDED == TRUE)
    bta_dm_config_eir,                      /* BTA_DM_API_CONFIG_EIR_EVT */
 #endif
@ -202,6 +203,8 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_gap_ext_scan,                /* BTA_DM_API_START_EXT_SCAN_EVT */
    bta_dm_ble_gap_set_prefer_ext_conn_params, /* BTA_DM_API_SET_PERF_EXT_CONN_PARAMS_EVT */
    NULL,                                   /* BTA_DM_API_EXT_CONN_EVT */
+    bta_dm_ble_gap_dtm_enhance_tx_start,    /* BTA_DM_API_DTM_ENH_TX_START_EVT */
+    bta_dm_ble_gap_dtm_enhance_rx_start,    /* BTA_DM_API_DTM_ENH_RX_START_EVT */
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
    bta_dm_ble_gap_periodic_adv_recv_enable, /* BTA_DM_API_PERIODIC_ADV_RECV_ENABLE_EVT */
@ -210,6 +213,9 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
    bta_dm_ble_gap_set_periodic_adv_sync_trans_params, /* BTA_DM_API_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS_EVT */
 #endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 #if BLE_INCLUDED == TRUE
+    bta_dm_ble_gap_dtm_tx_start, /* BTA_DM_API_DTM_TX_START_EVT */
+    bta_dm_ble_gap_dtm_rx_start, /* BTA_DM_API_DTM_RX_START_EVT */
+    bta_dm_ble_gap_dtm_stop, /* BTA_DM_API_DTM_STOP_EVT */
    bta_dm_ble_gap_clear_adv, /* BTA_DM_API_BLE_CLEAR_ADV_EVT */
 #endif
 };
--- a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h
+++ b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h
@ -54,6 +54,7 @@ enum {
    BTA_DM_API_DISABLE_EVT,
    BTA_DM_API_SET_NAME_EVT,
    BTA_DM_API_GET_NAME_EVT,
+    BTA_DM_API_SEND_VENDOR_HCI_CMD_EVT,
 #if (CLASSIC_BT_INCLUDED == TRUE)
    BTA_DM_API_CONFIG_EIR_EVT,
 #endif
@ -199,6 +200,8 @@ enum {
    BTA_DM_API_START_EXT_SCAN_EVT,
    BTA_DM_API_SET_PERF_EXT_CONN_PARAMS_EVT,
    BTA_DM_API_EXT_CONN_EVT,
+    BTA_DM_API_DTM_ENH_TX_START_EVT,
+    BTA_DM_API_DTM_ENH_RX_START_EVT,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
    BTA_DM_API_PERIODIC_ADV_RECV_ENABLE_EVT,
@ -207,6 +210,9 @@ enum {
    BTA_DM_API_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS_EVT,
 #endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
 #if BLE_INCLUDED == TRUE
+    BTA_DM_API_DTM_TX_START_EVT,
+    BTA_DM_API_DTM_RX_START_EVT,
+    BTA_DM_API_DTM_STOP_EVT,
    BTA_DM_API_BLE_CLEAR_ADV_EVT,
 #endif
    BTA_DM_MAX_EVT
@ -245,6 +251,14 @@ typedef struct {
    tBTA_GET_DEV_NAME_CBACK *p_cback;
 } tBTA_DM_API_GET_NAME;

+typedef struct {
+    BT_HDR    hdr;
+    UINT16    opcode;
+    UINT8    param_len;
+    UINT8     *p_param_buf;
+    tBTA_SEND_VENDOR_HCI_CMPL_CBACK *vendor_hci_cb;
+}tBTA_DM_API_SEND_VENDOR_HCI_CMD;
+
 /* data type for BTA_DM_API_CONFIG_EIR_EVT */
 typedef struct {
    BT_HDR              hdr;
@ -845,6 +859,25 @@ typedef struct {
    BD_ADDR     remote_bda;
 } tBTA_DM_API_BLE_DISCONNECT;

+typedef struct {
+    BT_HDR      hdr;
+    UINT8      tx_channel;
+    UINT8      len_of_data;
+    UINT8      pkt_payload;
+    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
+} tBTA_DM_API_BLE_DTM_TX_START;
+
+typedef struct {
+    BT_HDR      hdr;
+    UINT8      rx_channel;
+    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
+} tBTA_DM_API_BLE_DTM_RX_START;
+
+typedef struct {
+    BT_HDR      hdr;
+    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
+} tBTA_DM_API_BLE_DTM_STOP;
+
 typedef struct {
    BT_HDR                  hdr;
    tBTA_CLEAR_ADV_CMPL_CBACK       *p_clear_adv_cback;
@ -906,6 +939,22 @@ typedef struct {
 #endif
 #if (BLE_50_FEATURE_SUPPORT == TRUE)

+typedef struct {
+    BT_HDR     hdr;
+    UINT8      tx_channel;
+    UINT8      len_of_data;
+    UINT8      pkt_payload;
+    UINT8      phy;
+    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
+} tBTA_DM_API_BLE_DTM_ENH_TX_START;
+typedef struct {
+    BT_HDR     hdr;
+    UINT8      rx_channel;
+    UINT8      phy;
+    UINT8      modulation_index;
+    tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback;
+} tBTA_DM_API_BLE_DTM_ENH_RX_START;
+
 #define BTA_PHY_1M_MASK                   (1 << 0)
 #define BTA_PHY_2M_MASK                   (1 << 1)
 #define BTAS_PHY_CODED_MASK               (1 << 2)
@ -1082,6 +1131,7 @@ typedef union {

    tBTA_DM_API_SET_NAME set_name;
    tBTA_DM_API_GET_NAME get_name;
+    tBTA_DM_API_SEND_VENDOR_HCI_CMD vendor_hci_cmd;
    tBTA_DM_API_CONFIG_EIR config_eir;

    tBTA_DM_API_SET_AFH_CHANNELS set_afh_channels;
@ -1213,6 +1263,8 @@ typedef union {
    tBTA_DM_API_SET_EXT_SCAN_PARAMS     ble_set_ext_scan_params;
    tBTA_DM_API_EXT_SCAN                ble_ext_scan;
    tBTA_DM_API_SET_PER_EXT_CONN_PARAMS ble_set_per_ext_conn_params;
+    tBTA_DM_API_BLE_DTM_ENH_TX_START    dtm_enh_tx_start;
+    tBTA_DM_API_BLE_DTM_ENH_RX_START    dtm_enh_rx_start;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
    tBTA_DM_API_PERIODIC_ADV_RECV_ENABLE ble_periodic_adv_recv_enable;
@ -1220,6 +1272,10 @@ typedef union {
    tBTA_DM_API_PERIODIC_ADV_SET_INFO_TRANS ble_periodic_adv_set_info_trans;
    tBTA_DM_API_SET_PAST_PARAMS ble_set_past_params;
 #endif // #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+
+    tBTA_DM_API_BLE_DTM_TX_START    dtm_tx_start;
+    tBTA_DM_API_BLE_DTM_RX_START    dtm_rx_start;
+    tBTA_DM_API_BLE_DTM_STOP        dtm_stop;
    tBTA_DM_API_CLEAR_ADV           ble_clear_adv;
 #endif

@ -1584,6 +1640,7 @@ extern void bta_dm_enable (tBTA_DM_MSG *p_data);
 extern void bta_dm_disable (tBTA_DM_MSG *p_data);
 extern void bta_dm_set_dev_name (tBTA_DM_MSG *p_data);
 extern void bta_dm_get_dev_name (tBTA_DM_MSG *p_data);
+extern void bta_dm_send_vendor_hci(tBTA_DM_MSG *p_data);
 #if (CLASSIC_BT_INCLUDED == TRUE)
 extern void bta_dm_config_eir (tBTA_DM_MSG *p_data);
 #endif
@ -1652,9 +1709,14 @@ extern void btm_dm_ble_multi_adv_disable(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_multi_adv_data(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_multi_adv_upd_param(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_multi_adv_enb(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_dtm_tx_start(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_dtm_rx_start(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_dtm_stop(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_clear_adv(tBTA_DM_MSG *p_data);

 #if (BLE_50_FEATURE_SUPPORT == TRUE)
+extern void bta_dm_ble_gap_dtm_enhance_tx_start(tBTA_DM_MSG *p_data);
+extern void bta_dm_ble_gap_dtm_enhance_rx_start(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_read_phy(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_set_prefer_default_phy(tBTA_DM_MSG *p_data);
 extern void bta_dm_ble_gap_set_prefer_phy(tBTA_DM_MSG *p_data);
--- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h
+++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h
@ -416,6 +416,8 @@ typedef void (tBTA_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTA_STATUS st

 typedef void (tBTA_SET_ADV_DATA_CMPL_CBACK) (tBTA_STATUS status);

+typedef tBTM_VSC_CMPL_CB tBTA_SEND_VENDOR_HCI_CMPL_CBACK;
+
 typedef tBTM_START_ADV_CMPL_CBACK tBTA_START_ADV_CMPL_CBACK;

 typedef tBTM_START_STOP_ADV_CMPL_CBACK tBTA_START_STOP_ADV_CMPL_CBACK;
@ -424,12 +426,16 @@ typedef tBTM_UPDATE_WHITELIST_CBACK tBTA_UPDATE_WHITELIST_CBACK;

 typedef tBTM_SET_PKT_DATA_LENGTH_CBACK tBTA_SET_PKT_DATA_LENGTH_CBACK;

+typedef tBTM_DTM_CMD_CMPL_CBACK tBTA_DTM_CMD_CMPL_CBACK;
+
 typedef tBTM_SET_RAND_ADDR_CBACK tBTA_SET_RAND_ADDR_CBACK;

 typedef tBTM_SET_LOCAL_PRIVACY_CBACK tBTA_SET_LOCAL_PRIVACY_CBACK;

 typedef tBTM_CMPL_CB tBTA_CMPL_CB;

+typedef tBTM_VSC_CMPL tBTA_VSC_CMPL;
+
 typedef tBTM_TX_POWER_RESULTS tBTA_TX_POWER_RESULTS;

 typedef tBTM_RSSI_RESULTS tBTA_RSSI_RESULTS;
@ -1711,6 +1717,8 @@ extern void BTA_DmSetDeviceName(const char *p_name);
 *******************************************************************************/
 extern void BTA_DmGetDeviceName(tBTA_GET_DEV_NAME_CBACK *p_cback);

+extern void BTA_DmsendVendorHciCmd(UINT16 opcode, UINT8 param_len, UINT8 *p_param_buf, tBTA_SEND_VENDOR_HCI_CMPL_CBACK p_vendor_cmd_complete_cback);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmGetRemoteName
@ -2789,6 +2797,10 @@ extern void BTA_DmBleDisconnect(BD_ADDR bd_addr);
 *******************************************************************************/
 extern void BTA_DmBleSetDataLength(BD_ADDR remote_device, UINT16 tx_data_length, tBTA_SET_PKT_DATA_LENGTH_CBACK *p_set_pkt_data_cback);

+extern void BTA_DmBleDtmTxStart(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback);
+extern void BTA_DmBleDtmRxStart(uint8_t rx_channel, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback);
+extern void BTA_DmBleDtmStop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback);
+
 /*******************************************************************************
 **
 ** Function         BTA_DmBleSetStorageParams
@ -3043,6 +3055,10 @@ extern void BTA_DmBleGapPreferExtConnectParamsSet(BD_ADDR bd_addr,
                                                  const tBTA_DM_BLE_CONN_PARAMS *phy_coded_conn_params);

 extern void BTA_DmBleGapExtConnect(tBLE_ADDR_TYPE own_addr_type, const BD_ADDR peer_addr);
+
+extern void BTA_DmBleDtmEnhTxStart(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, uint8_t phy, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback);
+
+extern void BTA_DmBleDtmEnhRxStart(uint8_t rx_channel, uint8_t phy, uint8_t modulation_index, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback);
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)

 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
--- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
+++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -1164,6 +1164,127 @@ static void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event,
    }
 }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+void btc_dtm_tx_start_callback(void *p1)
+{
+    UINT8 status;
+    UINT8 *p;
+    p = (UINT8*) p1;
+    if (p1) {
+        STREAM_TO_UINT8(status, p);
+        BTC_TRACE_DEBUG("DTM TX start, status 0x%x\n", status);
+        esp_ble_gap_cb_param_t param;
+        bt_status_t ret;
+        btc_msg_t msg = {0};
+        msg.sig = BTC_SIG_API_CB;
+        msg.pid = BTC_PID_GAP_BLE;
+        msg.act = ESP_GAP_BLE_DTM_TEST_UPDATE_EVT;
+        param.dtm_state_update.status = status;
+        param.dtm_state_update.update_evt = DTM_TX_START_EVT;
+        param.dtm_state_update.num_of_pkt = 0;
+
+        ret = btc_transfer_context(&msg, &param,
+                                sizeof(esp_ble_gap_cb_param_t), NULL, NULL);
+
+        if (ret != BT_STATUS_SUCCESS) {
+            BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        }
+    }
+}
+
+void btc_dtm_rx_start_callback(void *p1)
+{
+
+    UINT8 status;
+    UINT8 *p;
+    p = (UINT8*) p1;
+    if (p1) {
+        STREAM_TO_UINT8(status, p);
+        BTC_TRACE_DEBUG("DTM RX start, status 0x%x\n", status);
+        esp_ble_gap_cb_param_t param;
+        bt_status_t ret;
+        btc_msg_t msg = {0};
+        msg.sig = BTC_SIG_API_CB;
+        msg.pid = BTC_PID_GAP_BLE;
+        msg.act = ESP_GAP_BLE_DTM_TEST_UPDATE_EVT;
+        param.dtm_state_update.status = status;
+        param.dtm_state_update.update_evt = DTM_RX_START_EVT;
+        param.dtm_state_update.num_of_pkt = 0;
+
+        ret = btc_transfer_context(&msg, &param,
+                                sizeof(esp_ble_gap_cb_param_t), NULL, NULL);
+
+        if (ret != BT_STATUS_SUCCESS) {
+            BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        }
+    }
+}
+
+void btc_dtm_stop_callback(void *p1)
+{
+    UINT8 status;
+    UINT16 num_pkt;
+    UINT8 *p;
+    p = (UINT8*) p1;
+    if (p1) {
+        STREAM_TO_UINT8(status, p);
+        STREAM_TO_UINT16(num_pkt, p);
+        BTC_TRACE_DEBUG("DTM stop, status 0x%x num_pkt %d\n", status, num_pkt);
+        esp_ble_gap_cb_param_t param;
+        bt_status_t ret;
+        btc_msg_t msg = {0};
+        msg.sig = BTC_SIG_API_CB;
+        msg.pid = BTC_PID_GAP_BLE;
+        msg.act = ESP_GAP_BLE_DTM_TEST_UPDATE_EVT;
+        param.dtm_state_update.status = status;
+        param.dtm_state_update.update_evt = DTM_TEST_STOP_EVT;
+        param.dtm_state_update.num_of_pkt = num_pkt;
+
+        ret = btc_transfer_context(&msg, &param,
+                                sizeof(esp_ble_gap_cb_param_t), NULL, NULL);
+
+        if (ret != BT_STATUS_SUCCESS) {
+            BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+        }
+    }
+}
+
+static void btc_ble_vendor_hci_cmd_complete_callback(tBTA_VSC_CMPL *p_param)
+{
+    bool param_invalid = false;
+    if ((!p_param) || (!p_param->param_len) || (!p_param->p_param_buf)) {
+        BTC_TRACE_ERROR("%s param error\n", __func__);
+        param_invalid = true;
+    }
+
+    esp_ble_gap_cb_param_t param = {0};
+    bt_status_t ret;
+    btc_msg_t msg = {0};
+
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BLE;
+    msg.act = ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT;
+    if (!param_invalid) {
+        param.vendor_cmd_cmpl.opcode = p_param->opcode;
+        param.vendor_cmd_cmpl.param_len = p_param->param_len;
+        param.vendor_cmd_cmpl.p_param_buf = p_param->p_param_buf;
+    } else {
+        if (p_param) {
+            param.vendor_cmd_cmpl.opcode = p_param->opcode;
+        } else {
+            param.vendor_cmd_cmpl.opcode = 0;
+        }
+        param.vendor_cmd_cmpl.param_len = 0;
+        param.vendor_cmd_cmpl.p_param_buf = NULL;
+    }
+
+    ret = btc_transfer_context(&msg, &param, sizeof(esp_ble_gap_cb_param_t), btc_gap_ble_cb_deep_copy, btc_gap_ble_cb_deep_free);
+
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
 void btc_get_whitelist_size(uint16_t *length)
 {
    BTM_BleGetWhiteListSize(length);
@ -1297,6 +1418,38 @@ static void btc_gap_ble_set_channels(esp_gap_ble_channels channels)
    BTA_DmBleSetChannels(channels, btc_gap_ble_set_channels_cmpl_callback);
 }

+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+static void btc_ble_dtm_tx_start(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    BTA_DmBleDtmTxStart(tx_channel, len_of_data, pkt_payload, p_dtm_cmpl_cback);
+}
+
+static void btc_ble_dtm_rx_start(uint8_t rx_channel, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+
+    BTA_DmBleDtmRxStart(rx_channel, p_dtm_cmpl_cback);
+}
+#endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
+
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+static void btc_ble_dtm_enhance_tx_start(uint8_t tx_channel, uint8_t len_of_data, uint8_t pkt_payload, uint8_t phy, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+    BTA_DmBleDtmEnhTxStart(tx_channel, len_of_data, pkt_payload, phy, p_dtm_cmpl_cback);
+}
+
+static void btc_ble_dtm_enhance_rx_start(uint8_t rx_channel, uint8_t phy, uint8_t modulation_index, tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+
+    BTA_DmBleDtmEnhRxStart(rx_channel, phy, modulation_index, p_dtm_cmpl_cback);
+}
+#endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+
+static void btc_ble_dtm_stop(tBTA_DTM_CMD_CMPL_CBACK *p_dtm_cmpl_cback)
+{
+
+    BTA_DmBleDtmStop(p_dtm_cmpl_cback);
+}
+

 void btc_gap_ble_cb_handler(btc_msg_t *msg)
 {
@ -1474,6 +1627,19 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 	break;
    }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: {
+        btc_ble_gap_args_t *src = (btc_ble_gap_args_t *)p_src;
+        btc_ble_gap_args_t *dst = (btc_ble_gap_args_t *)p_dest;
+        if (src->vendor_cmd_send.param_len) {
+            dst->vendor_cmd_send.p_param_buf = osi_malloc(src->vendor_cmd_send.param_len);
+            if (dst->vendor_cmd_send.p_param_buf) {
+                memcpy(dst->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.p_param_buf, src->vendor_cmd_send.param_len);
+            } else {
+                BTC_TRACE_ERROR("%s %d no mem\n",__func__, msg->act);
+            }
+        }
+        break;
+    }
    default:
        BTC_TRACE_ERROR("Unhandled deep copy %d\n", msg->act);
        break;
@ -1482,7 +1648,22 @@ void btc_gap_ble_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)

 void btc_gap_ble_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
 {
+    esp_ble_gap_cb_param_t *src = (esp_ble_gap_cb_param_t *)p_src;
+    esp_ble_gap_cb_param_t  *dst = (esp_ble_gap_cb_param_t *) p_dest;
+
    switch (msg->act) {
+    case ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT: {
+        if (src->vendor_cmd_cmpl.param_len) {
+            dst->vendor_cmd_cmpl.p_param_buf = osi_malloc(src->vendor_cmd_cmpl.param_len);
+            if (dst->vendor_cmd_cmpl.p_param_buf) {
+                memcpy(dst->vendor_cmd_cmpl.p_param_buf, src->vendor_cmd_cmpl.p_param_buf,
+                   src->vendor_cmd_cmpl.param_len);
+            } else {
+                BTC_TRACE_ERROR("%s, malloc failed\n", __func__);
+            }
+        }
+        break;
+    }
    default:
       BTC_TRACE_ERROR("%s, Unhandled deep copy %d\n", __func__, msg->act);
       break;
@ -1580,6 +1761,13 @@ void btc_gap_ble_arg_deep_free(btc_msg_t *msg)
 	break;
    }
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT: {
+        uint8_t *p_param_buf = ((btc_ble_gap_args_t *)msg->arg)->vendor_cmd_send.p_param_buf;
+        if (p_param_buf) {
+            osi_free(p_param_buf);
+        }
+        break;
+    }
    default:
        BTC_TRACE_DEBUG("Unhandled deep free %d\n", msg->act);
        break;
@ -1597,6 +1785,13 @@ void btc_gap_ble_cb_deep_free(btc_msg_t *msg)
            }
            break;
        }
+        case ESP_GAP_BLE_VENDOR_CMD_COMPLETE_EVT: {
+            uint8_t *value = ((esp_ble_gap_cb_param_t *)msg->arg)->vendor_cmd_cmpl.p_param_buf;
+            if (value) {
+                osi_free(value);
+            }
+            break;
+        }
        default:
            BTC_TRACE_DEBUG("Unhandled deep free %d", msg->act);
            break;
@ -2045,6 +2240,31 @@ void btc_gap_ble_call_handler(btc_msg_t *msg)
                                                  (tBTA_DM_BLE_PAST_PARAMS *)&arg_5->set_periodic_adv_sync_trans_params.params);
        break;
 #endif
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_DTM_TX_START:
+        btc_ble_dtm_tx_start(arg->dtm_tx_start.tx_channel, arg->dtm_tx_start.len_of_data, arg->dtm_tx_start.pkt_payload, btc_dtm_tx_start_callback);
+        break;
+    case BTC_GAP_BLE_DTM_RX_START:
+        btc_ble_dtm_rx_start(arg->dtm_rx_start.rx_channel, btc_dtm_rx_start_callback);
+        break;
+#endif // if (BLE_42_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_DTM_STOP:
+        btc_ble_dtm_stop(btc_dtm_stop_callback);
+        break;
+#if (BLE_50_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_DTM_ENH_TX_START:
+        btc_ble_dtm_enhance_tx_start(arg_5->dtm_enh_tx_start.tx_channel, arg_5->dtm_enh_tx_start.len_of_data, arg_5->dtm_enh_tx_start.pkt_payload, arg_5->dtm_enh_tx_start.phy, btc_dtm_tx_start_callback);
+        break;
+    case BTC_GAP_BLE_DTM_ENH_RX_START:
+        btc_ble_dtm_enhance_rx_start(arg_5->dtm_enh_rx_start.rx_channel, arg_5->dtm_enh_rx_start.phy, arg_5->dtm_enh_rx_start.modulation_index, btc_dtm_rx_start_callback);
+        break;
+#endif // if (BLE_50_FEATURE_SUPPORT == TRUE)
+    case BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT:
+        BTA_DmsendVendorHciCmd(arg->vendor_cmd_send.opcode,
+                                arg->vendor_cmd_send.param_len,
+                                arg->vendor_cmd_send.p_param_buf,
+                                btc_ble_vendor_hci_cmd_complete_callback);
+        break;
    default:
        break;
    }
--- a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h
+++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -84,6 +84,8 @@ typedef enum {
    BTC_GAP_BLE_START_EXT_SCAN,
    BTC_GAP_BLE_STOP_EXT_SCAN,
    BTC_GAP_BLE_SET_EXT_PEFER_CONNET_PARAMS,
+    BTC_GAP_BLE_DTM_ENH_TX_START,
+    BTC_GAP_BLE_DTM_ENH_RX_START,
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
    BTC_GAP_BLE_ACT_GET_DEV_NAME,
 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
@ -92,9 +94,15 @@ typedef enum {
    BTC_GAP_BLE_PERIODIC_ADV_SET_INFO_TRANS,
    BTC_GAP_BLE_SET_PERIODIC_ADV_SYNC_TRANS_PARAMS,
 #endif //#if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+    BTC_GAP_BLE_DTM_TX_START,
+    BTC_GAP_BLE_DTM_RX_START,
+#endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
+    BTC_GAP_BLE_DTM_STOP,
 #if (BLE_42_FEATURE_SUPPORT == TRUE)
    BTC_GAP_BLE_ACT_CLEAR_ADV,
 #endif // #if (BLE_42_FEATURE_SUPPORT == TRUE)
+    BTC_GAP_BLE_ACT_VENDOR_HCI_CMD_EVT,
 } btc_gap_ble_act_t;

 /* btc_ble_gap_args_t */
@ -233,6 +241,20 @@ typedef union {
    struct set_channels_args {
       esp_gap_ble_channels channels;
    } set_channels;
+    struct dtm_tx_start_args {
+        uint8_t tx_channel;
+        uint8_t len_of_data;
+        uint8_t pkt_payload;
+    } dtm_tx_start;
+    struct dtm_rx_start_args {
+        uint8_t rx_channel;
+    } dtm_rx_start;
+    //BTC_DEV_VENDOR_HCI_CMD_EVT
+    struct vendor_cmd_send_args {
+        uint16_t  opcode;
+        uint8_t  param_len;
+        uint8_t *p_param_buf;
+    } vendor_cmd_send;
 } btc_ble_gap_args_t;
 #if (BLE_50_FEATURE_SUPPORT == TRUE)

@ -376,7 +398,17 @@ typedef union {
        esp_ble_gap_past_params_t params;
    } set_periodic_adv_sync_trans_params;
 #endif
-
+     struct dtm_enh_tx_start_args {
+        uint8_t tx_channel;
+        uint8_t len_of_data;
+        uint8_t pkt_payload;
+        uint8_t phy;
+    } dtm_enh_tx_start;
+    struct dtm_enh_rx_start_args {
+        uint8_t rx_channel;
+        uint8_t phy;
+        uint8_t modulation_index;
+    } dtm_enh_rx_start;
 } btc_ble_5_gap_args_t;
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)

--- a/components/bt/host/bluedroid/hci/hci_hal_h4.c
+++ b/components/bt/host/bluedroid/hci/hci_hal_h4.c
@ -35,6 +35,10 @@
 #include "l2c_int.h"
 #endif ///C2H_FLOW_CONTROL_INCLUDED == TRUE
 #include "stack/hcimsgs.h"
+#include "bt_common.h"
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+#include "hci_log/bt_hci_log.h"
+#endif

 #define HCI_BLE_EVENT 0x3e
 #define PACKET_TYPE_TO_INBOUND_INDEX(type) ((type) - 2)
@ -206,7 +210,9 @@ static uint16_t transmit_data(serial_data_type_t type,
    ++length;

    BTTRC_DUMP_BUFFER("Transmit Pkt", data, length);
-
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+    bt_hci_log_record_hci_data(data[0], data, length);
+#endif
    // TX Data to target
    esp_vhci_host_send_packet(data, length);

@ -433,7 +439,7 @@ static void hci_hal_h4_hdl_rx_packet(BT_HDR *packet)
        uint8_t len = 0;
        STREAM_TO_UINT8(len, stream);
 #endif
-        HCI_TRACE_ERROR("Workround stream corrupted during LE SCAN: pkt_len=%d ble_event_len=%d\n",
+        HCI_TRACE_ERROR("Workaround stream corrupted during LE SCAN: pkt_len=%d ble_event_len=%d\n",
                  packet->len, len);
        osi_free(packet);
        return;
@ -546,10 +552,14 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
    bool is_adv_rpt = host_recv_adv_packet(data);

    if (!is_adv_rpt) {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+        uint8_t data_type = ((data[0] == 2) ? HCI_LOG_DATA_TYPE_C2H_ACL : data[0]);
+        bt_hci_log_record_hci_data(data_type, data, len);
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
        pkt_size = BT_HDR_SIZE + len;
        pkt = (BT_HDR *) osi_calloc(pkt_size);
        if (!pkt) {
-            HCI_TRACE_ERROR("%s couldn't aquire memory for inbound data buffer.\n", __func__);
+            HCI_TRACE_ERROR("%s couldn't acquire memory for inbound data buffer.\n", __func__);
            assert(0);
        }

@ -559,6 +569,10 @@ static int host_recv_pkt_cb(uint8_t *data, uint16_t len)
        memcpy(pkt->data, data, len);
        fixed_queue_enqueue(hci_hal_env.rx_q, pkt, FIXED_QUEUE_MAX_TIMEOUT);
    } else {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+        // data type is adv report
+        bt_hci_log_record_hci_adv(HCI_LOG_DATA_TYPE_ADV, data, len);
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
 #if !BLE_ADV_REPORT_FLOW_CONTROL
        // drop the packets if pkt_queue length goes beyond upper limit
        if (pkt_queue_length(hci_hal_env.adv_rpt_q) > HCI_HAL_BLE_ADV_RPT_QUEUE_LEN_MAX) {
--- a/components/bt/host/bluedroid/hci/hci_layer.c
+++ b/components/bt/host/bluedroid/hci/hci_layer.c
@ -140,6 +140,10 @@ void hci_shut_down(void)

 bool hci_downstream_data_post(uint32_t timeout)
 {
+    if (hci_host_env.downstream_data_ready == NULL) {
+        HCI_TRACE_WARNING("%s downstream_data_ready event not created", __func__);
+        return false;
+    }
    return osi_thread_post_event(hci_host_env.downstream_data_ready, timeout);
 }

@ -259,7 +263,7 @@ static void transmit_command(
    // in case the upper layer didn't already
    command->event = MSG_STACK_TO_HC_HCI_CMD;

-    HCI_TRACE_DEBUG("HCI Enqueue Comamnd opcode=0x%x\n", metadata->opcode);
+    HCI_TRACE_DEBUG("HCI Enqueue Command opcode=0x%x\n", metadata->opcode);
    BTTRC_DUMP_BUFFER(NULL, command->data + command->offset, command->len);

    fixed_pkt_queue_enqueue(hci_host_env.command_queue, linked_pkt, FIXED_PKT_QUEUE_MAX_TIMEOUT);
--- a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c
@ -337,7 +337,7 @@ tBTM_STATUS BTM_BleSetExtendedAdvRandaddr(UINT8 instance, BD_ADDR rand_addr)
                        __func__, btm_ble_hci_status_to_str(err), err);
        status = BTM_ILLEGAL_VALUE;
    } else {
-        // set random address success, update address infor
+        // set random address success, update address info
        if(extend_adv_cb.inst[instance].configured && extend_adv_cb.inst[instance].connetable) {
            BTM_BleSetStaticAddr(rand_addr);
            BTM_UpdateAddrInfor(BLE_ADDR_RANDOM, rand_addr);
@ -421,7 +421,7 @@ end:
            BTM_TRACE_ERROR("LE EA SetParams: cmd err=0x%x", err);
            status = BTM_ILLEGAL_VALUE;
        } else {
-            // set addr success, update address infor
+            // set addr success, update address info
            BTM_UpdateAddrInfor(BLE_ADDR_RANDOM, rand_addr);
        }
    }
@ -597,12 +597,12 @@ tBTM_STATUS BTM_BleStartExtAdvRestart(uint8_t con_handle)
       }
    }

-    if((index >= MAX_BLE_ADV_INSTANCE) || (!adv_record[index].invalid) || (adv_record[index].retry_count > GATTC_CONNECT_RETRY_COUNT)) {
+    if((index >= MAX_BLE_ADV_INSTANCE) || (!adv_record[index].invalid)) {
        return BTM_WRONG_MODE;
    }

    adv_record[index].retry_count ++;
-    BTM_TRACE_DEBUG("remote device did not reveive aux connect response, retatrt the extend adv to reconnect, adv handle %d con_handle %d\n", index, con_handle);
+    BTM_TRACE_DEBUG("remote device did not receive aux connect response, retatrt the extend adv to reconnect, adv handle %d con_handle %d\n", index, con_handle);
    ext_adv.instance = adv_record[index].instance;
    ext_adv.duration = adv_record[index].duration;
    ext_adv.max_events = adv_record[index].max_events;
--- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
@ -3291,6 +3291,7 @@ static void btm_ble_appearance_to_cod(UINT16 appearance, UINT8 *dev_class)
    case BTM_BLE_APPEARANCE_CYCLING_CADENCE:
    case BTM_BLE_APPEARANCE_CYCLING_POWER:
    case BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE:
+    case BTM_BLE_APPEARANCE_STANDALONE_SPEAKER:
    case BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS:
    case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION:
    case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV:
--- a/components/bt/host/bluedroid/stack/btm/btm_devctl.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_devctl.c
@ -723,8 +723,9 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
            break;
        }
        default:
-        break;
+            break;
    }
+#endif // (BLE_INCLUDED == TRUE)
    tBTM_VSC_CMPL   vcs_cplt_params;

    /* If there was a callback address for vcs complete, call it */
@ -735,7 +736,7 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
        vcs_cplt_params.p_param_buf = p;
        (*p_vsc_cplt_cback)(&vcs_cplt_params);  /* Call the VSC complete callback function */
    }
-#endif
+
 }

 /*******************************************************************************
--- a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c
+++ b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c
@ -1190,7 +1190,9 @@ UINT8 btsnd_hcic_ble_enhand_rx_test(UINT8 rx_channel, UINT8 phy,
    UINT8_TO_STREAM(pp, phy);
    UINT8_TO_STREAM(pp, modulation_idx);

-    return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
+    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
+
+    return TRUE;
 }

 UINT8 btsnd_hcic_ble_enhand_tx_test(UINT8 tx_channel, UINT8 len,
@ -1212,7 +1214,9 @@ UINT8 btsnd_hcic_ble_enhand_tx_test(UINT8 tx_channel, UINT8 len,
    UINT8_TO_STREAM(pp, packect);
    UINT8_TO_STREAM(pp, phy);

-    return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p);
+    btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
+
+    return TRUE;
 }

 UINT8 btsnd_hcic_ble_set_extend_rand_address(UINT8 adv_handle, BD_ADDR rand_addr)
--- a/components/bt/host/bluedroid/stack/include/stack/btm_api.h
+++ b/components/bt/host/bluedroid/stack/include/stack/btm_api.h
@ -189,6 +189,8 @@ typedef void (tBTM_UPDATE_CONN_PARAM_CBACK) (UINT8 status, BD_ADDR bd_addr, tBTM

 typedef void (tBTM_SET_PKT_DATA_LENGTH_CBACK) (UINT8 status, tBTM_LE_SET_PKT_DATA_LENGTH_PARAMS *data_length_params);

+typedef void (tBTM_DTM_CMD_CMPL_CBACK) (void *p1);
+
 typedef void (tBTM_SET_RAND_ADDR_CBACK) (UINT8 status);

 typedef void (tBTM_UPDATE_WHITELIST_CBACK) (UINT8 status, tBTM_WL_OPERATION wl_opration);
--- a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h
+++ b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h
@ -254,6 +254,7 @@ typedef UINT8 BLE_SIGNATURE[BTM_BLE_AUTH_SIGN_LEN];         /* Device address */
 #define BTM_BLE_APPEARANCE_CYCLING_CADENCE         0x0483
 #define BTM_BLE_APPEARANCE_CYCLING_POWER           0x0484
 #define BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE   0x0485
+#define BTM_BLE_APPEARANCE_STANDALONE_SPEAKER      0x0841
 #define BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER  0x0C40
 #define BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41
 #define BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST    0x0C42
@ -2700,6 +2701,11 @@ tBTM_STATUS BTM_BleSetExtendedScanParams(tBTM_BLE_EXT_SCAN_PARAMS *params);
 tBTM_STATUS BTM_BleExtendedScan(BOOLEAN enable, UINT16 duration, UINT16 period);

 void BTM_BleSetPreferExtenedConnParams(BD_ADDR bd_addr, tBTM_EXT_CONN_PARAMS *params);
+
+void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+
+void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len, UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback);
+
 #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)

 #if (BLE_FEAT_PERIODIC_ADV_SYNC_TRANSFER == TRUE)
--- a/components/bt/host/bluedroid/stack/l2cap/l2c_link.c
+++ b/components/bt/host/bluedroid/stack/l2cap/l2c_link.c
@ -367,6 +367,11 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
        if (reason != HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT) {
            BTM_Recovery_Pre_State();
        }
+        #if (BLE_50_FEATURE_SUPPORT == TRUE)
+        if(btm_ble_inter_get() && reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT) {
+            BTM_BleStartExtAdvRestart(handle);
+        }
+        #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)
 #endif  ///BLE_INCLUDED == TRUE
        status = FALSE;
    } else {
@ -438,7 +443,7 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
 #endif
            {
 #if (L2CAP_NUM_FIXED_CHNLS > 0)
-                /* If we are going to re-use the LCB without dropping it, release all fixed channels
+                /* If we are going to reuse the LCB without dropping it, release all fixed channels
                here */
                int xx;
                for (xx = 0; xx < L2CAP_NUM_FIXED_CHNLS; xx++) {
@ -463,9 +468,9 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
        }

        p_lcb->p_pending_ccb = NULL;
-#if (BLE_INCLUDED == TRUE && GATTC_CONNECT_RETRY_EN == TRUE)
+#if (BLE_INCLUDED == TRUE)
        if(reason == HCI_ERR_CONN_FAILED_ESTABLISHMENT && p_lcb->transport == BT_TRANSPORT_LE) {
-
+            #if (GATTC_CONNECT_RETRY_EN == TRUE)
            if(p_lcb->link_role == HCI_ROLE_MASTER && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) {
                L2CAP_TRACE_DEBUG("master retry connect, retry count %d reason 0x%x\n",  p_lcb->retry_create_con, reason);
                p_lcb->retry_create_con ++;
@ -475,9 +480,10 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
                    lcb_is_free = FALSE;    /* still using this lcb */
                }
            }
+            #endif // (GATTC_CONNECT_RETRY_EN == TRUE)

            #if (BLE_50_FEATURE_SUPPORT == TRUE)
-            if(btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) {
+            if(btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) {
                p_lcb->retry_create_con ++;
                L2CAP_TRACE_DEBUG("slave restart extend adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason);
                BTM_BleStartExtAdvRestart(handle);
@ -485,7 +491,7 @@ BOOLEAN l2c_link_hci_disc_comp (UINT16 handle, UINT8 reason)
            #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE)

            #if (BLE_42_FEATURE_SUPPORT == TRUE)
-            if(!btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE && p_lcb->retry_create_con < GATTC_CONNECT_RETRY_COUNT) {
+            if(!btm_ble_inter_get() && p_lcb->link_role == HCI_ROLE_SLAVE) {
                p_lcb->retry_create_con ++;
                L2CAP_TRACE_DEBUG("slave resatrt adv, retry count %d reason 0x%x\n", p_lcb->retry_create_con, reason);
                btm_ble_start_adv();
@ -909,7 +915,7 @@ UINT8 l2c_link_pkts_rcvd (UINT16 *num_pkts, UINT16 *handles)
 **
 ** Function         l2c_link_role_changed
 **
-** Description      This function is called whan a link's master/slave role change
+** Description      This function is called when a link's master/slave role change
 **                  event is received. It simply updates the link control block.
 **
 ** Returns          void
@ -947,7 +953,7 @@ void l2c_link_role_changed (BD_ADDR bd_addr, UINT8 new_role, UINT8 hci_status)
 **
 ** Function         l2c_pin_code_request
 **
-** Description      This function is called whan a pin-code request is received
+** Description      This function is called when a pin-code request is received
 **                  on a connection. If there are no channels active yet on the
 **                  link, it extends the link first connection timer.  Make sure
 **                  that inactivity timer is not extended if PIN code happens
--- a/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c
+++ b/components/bt/host/nimble/esp-hci/src/esp_nimble_hci.c
@ -30,6 +30,11 @@
 #include "esp_bt.h"
 #include "freertos/semphr.h"
 #include "esp_compiler.h"
+#include "soc/soc_caps.h"
+#include "bt_common.h"
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+#include "hci_log/bt_hci_log.h"
+#endif

 #define NIMBLE_VHCI_TIMEOUT_MS  2000
 #define BLE_HCI_EVENT_HDR_LEN               (2)
@ -95,6 +100,9 @@ int ble_hci_trans_hs_cmd_tx(uint8_t *cmd)
    }

    if (xSemaphoreTake(vhci_send_sem, NIMBLE_VHCI_TIMEOUT_MS / portTICK_PERIOD_MS) == pdTRUE) {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+        bt_hci_log_record_hci_data(cmd[0], cmd, len);
+#endif
        esp_vhci_host_send_packet(cmd, len);
    } else {
        rc = BLE_HS_ETIMEOUT_HCI;
@ -134,6 +142,9 @@ int ble_hci_trans_hs_acl_tx(struct os_mbuf *om)
    len += OS_MBUF_PKTLEN(om);

    if (xSemaphoreTake(vhci_send_sem, NIMBLE_VHCI_TIMEOUT_MS / portTICK_PERIOD_MS) == pdTRUE) {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+        bt_hci_log_record_hci_data(data[0], data, len);
+#endif
        esp_vhci_host_send_packet(data, len);
    } else {
        rc = BLE_HS_ETIMEOUT_HCI;
@ -368,12 +379,18 @@ static int host_rcv_pkt(uint8_t *data, uint16_t len)

        /* Allocate LE Advertising Report Event from lo pool only */
        if ((data[1] == BLE_HCI_EVCODE_LE_META) && (data[3] == BLE_HCI_LE_SUBEV_ADV_RPT)) {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+            bt_hci_log_record_hci_adv(HCI_LOG_DATA_TYPE_ADV, data, len);
+#endif
            evbuf = ble_hci_trans_buf_alloc(BLE_HCI_TRANS_BUF_EVT_LO);
            /* Skip advertising report if we're out of memory */
            if (!evbuf) {
                return 0;
            }
        } else {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+            bt_hci_log_record_hci_data(data[0], data, len);
+#endif
            evbuf = ble_hci_trans_buf_alloc(BLE_HCI_TRANS_BUF_EVT_HI);
            assert(evbuf != NULL);
        }
@ -384,6 +401,9 @@ static int host_rcv_pkt(uint8_t *data, uint16_t len)
        rc = ble_hci_trans_ll_evt_tx(evbuf);
        assert(rc == 0);
    } else if (data[0] == BLE_HCI_UART_H4_ACL) {
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+        bt_hci_log_record_hci_data(HCI_LOG_DATA_TYPE_C2H_ACL, data, len);
+#endif
        ble_hci_rx_acl(data + 1, len - 1);
    }
    return 0;
@ -456,6 +476,10 @@ esp_err_t esp_nimble_hci_init(void)
        goto err;
    }

+#if (BT_HCI_LOG_INCLUDED == TRUE)
+    bt_hci_log_init();
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
+
    xSemaphoreGive(vhci_send_sem);

    return ret;
@ -511,6 +535,11 @@ esp_err_t esp_nimble_hci_deinit(void)
        vSemaphoreDelete(vhci_send_sem);
        vhci_send_sem = NULL;
    }
+
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+    bt_hci_log_deinit();
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
+
    esp_err_t ret = ble_hci_transport_deinit();
    if (ret != ESP_OK) {
        return ret;
--- a/components/bt/include/esp32/include/esp_bt.h
+++ b/components/bt/include/esp32/include/esp_bt.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -50,7 +50,7 @@ extern "C" {

 #endif //CONFIG_BT_ENABLED

-#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20221207
+#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20240315

 /**
 * @brief Bluetooth mode for controller enable/disable
@ -167,6 +167,12 @@ the adv packet will be discarded until the memory is restored. */
 #define BTDM_CONTROLLER_SCO_DATA_PATH_HCI           0   // SCO data is routed to HCI
 #define BTDM_CONTROLLER_SCO_DATA_PATH_PCM           1   // SCO data path is PCM

+#ifdef CONFIG_BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#define BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX CONFIG_BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+#else
+#define BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX  0
+#endif
+
 #define BT_CONTROLLER_INIT_CONFIG_DEFAULT() {                              \
    .controller_task_stack_size = ESP_TASK_BT_CONTROLLER_STACK,            \
    .controller_task_prio = ESP_TASK_BT_CONTROLLER_PRIO,                   \
@ -190,6 +196,7 @@ the adv packet will be discarded until the memory is restored. */
    .pcm_polar = CONFIG_BTDM_CTRL_PCM_POLAR_EFF,                           \
    .hli = BTDM_CTRL_HLI,                                                  \
    .dup_list_refresh_period = SCAN_DUPL_CACHE_REFRESH_PERIOD,             \
+    .ble_scan_backoff = BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,              \
    .magic = ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL,                           \
 }

@ -233,6 +240,7 @@ typedef struct {
    uint8_t pcm_polar;                      /*!< PCM polar trig (falling clk edge & rising clk edge) */
    bool hli;                               /*!< Using high level interrupt or not */
    uint16_t dup_list_refresh_period;       /*!< Duplicate scan list refresh period */
+    bool ble_scan_backoff;                  /*!< BLE scan backoff */
    uint32_t magic;                         /*!< Magic number */
 } esp_bt_controller_config_t;

--- a/components/bt/include/esp32c3/include/esp_bt.h
+++ b/components/bt/include/esp32c3/include/esp_bt.h
@ -19,7 +19,7 @@ extern "C" {
 #endif

 #define ESP_BT_CTRL_CONFIG_MAGIC_VAL    0x5A5AA5A5
-#define ESP_BT_CTRL_CONFIG_VERSION      0x02401120
+#define ESP_BT_CTRL_CONFIG_VERSION      0x02404010

 #define ESP_BT_HCI_TL_MAGIC_VALUE   0xfadebead
 #define ESP_BT_HCI_TL_VERSION       0x00010000
@ -194,6 +194,18 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
 #define BT_BLE_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif

+#if defined(CONFIG_BT_CTRL_CHAN_ASS_EN)
+#define BT_CTRL_CHAN_ASS_EN (CONFIG_BT_CTRL_CHAN_ASS_EN)
+#else
+#define BT_CTRL_CHAN_ASS_EN (0)
+#endif
+
+#if defined(CONFIG_BT_CTRL_LE_PING_EN)
+#define BT_CTRL_LE_PING_EN (CONFIG_BT_CTRL_LE_PING_EN)
+#else
+#define BT_CTRL_LE_PING_EN (0)
+#endif
+
 #define AGC_RECORRECT_EN       ((BT_CTRL_AGC_RECORRECT_EN << 0) | (BT_CTRL_CODED_AGC_RECORRECT <<1) | (BT_CTRL_AGC_RECORRECT_NEW << 2))

 #define CFG_MASK_BIT_SCAN_DUPLICATE_OPTION    (1<<0)
@ -241,6 +253,8 @@ typedef void (* esp_bt_hci_tl_callback_t) (void *arg, uint8_t status);
    .ble_50_feat_supp  = BT_CTRL_50_FEATURE_SUPPORT,                       \
    .ble_cca_mode = BT_BLE_CCA_MODE,                                       \
    .ble_data_lenth_zero_aux = BT_BLE_ADV_DATA_LENGTH_ZERO_AUX,            \
+    .ble_chan_ass_en = BT_CTRL_CHAN_ASS_EN,                                \
+    .ble_ping_en = BT_CTRL_LE_PING_EN,                                     \
 }

 #else
@ -312,7 +326,9 @@ typedef struct {
    uint16_t dup_list_refresh_period;       /*!< duplicate scan list refresh time */
    bool ble_50_feat_supp;                  /*!< BLE 5.0 feature support */
    uint8_t ble_cca_mode;                   /*!< BLE CCA mode */
-    uint8_t ble_data_lenth_zero_aux;        /*!< Config ext adv aux option*/
+    uint8_t ble_data_lenth_zero_aux;        /*!< Config ext adv aux option */
+    uint8_t ble_chan_ass_en;                /*!< BLE channel assessment enable */
+    uint8_t ble_ping_en;                    /*!< BLE ping procedure enable */
 } esp_bt_controller_config_t;

 /**
--- a/components/esp_hw_support/include/soc/spinlock.h
+++ b/components/esp_hw_support/include/soc/spinlock.h
@ -64,6 +64,7 @@ static inline void __attribute__((always_inline)) spinlock_initialize(spinlock_t
 * @param lock - target spinlock object
 * @param timeout - cycles to wait, passing SPINLOCK_WAIT_FOREVER blocs indefinitely
 */
+
 static inline bool __attribute__((always_inline)) spinlock_acquire(spinlock_t *lock, int32_t timeout)
 {
 #if !CONFIG_FREERTOS_UNICORE && !BOOTLOADER_BUILD
--- a/components/esp_rom/esp32c3/ld/esp32c3.rom.eco3.ld
+++ b/components/esp_rom/esp32c3/ld/esp32c3.rom.eco3.ld
@ -65,7 +65,6 @@ r_lld_con_tx_prog_new_packet_coex = 0x40001b70;
 r_lld_per_adv_dynamic_pti_get = 0x40001b78;
 r_lld_per_adv_evt_start_chm_upd = 0x40001b7c;
 r_lld_ext_scan_dynamic_pti_get = 0x40001b80;
-r_lld_scan_try_sched = 0x40001b84;
 r_lld_sync_insert = 0x40001b88;
 r_sch_prog_ble_push = 0x40001b8c;
 r_sch_prog_bt_push = 0x40001b90;
--- a/components/esp_rom/esp32c3/ld/esp32c3.rom.eco7.ld
+++ b/components/esp_rom/esp32c3/ld/esp32c3.rom.eco7.ld
@ -113,7 +113,6 @@ r_lld_con_start_eco = 0x40001d10;
 r_lld_con_frm_isr_eco = 0x40001d14;
 r_lld_con_tx_eco = 0x40001d18;
 r_lld_scan_evt_start_cbk_eco = 0x40001d20;
-r_lld_scan_start_eco = 0x40001d24;
 r_lld_ext_scan_dynamic_pti_process_eco = 0x40001d28;
 r_lld_scan_frm_eof_isr_eco = 0x40001d2c;
 r_lld_sync_start_eco = 0x40001d30;
@ -138,15 +137,9 @@ r_sch_plan_conflict_check = 0x40001d7c;
 r_rwble_isr_hw_fixed = 0x40001d80;
 r_bt_bb_recorrect_is_dead = 0x40001d84;
 r_bt_bb_restart_hw_recorrect = 0x40001d88;
-r_btdm_task_post_impl = 0x40001d8c;
-r_btdm_task_post_from_isr_impl = 0x40001d90;
-r_btdm_vnd_offload_post_from_isr = 0x40001d94;
-r_btdm_vnd_offload_post = 0x40001d98;
-r_btdm_vnd_offload_process = 0x40001d9c;
 r_ke_task_handler_pre = 0x40001da0;
 r_ke_task_handler_end = 0x40001da4;
 r_ke_task_handler_get_overwrite = 0x40001da8;
-r_lld_scan_try_sched_eco = 0x40001dac;
 r_lld_scan_frm_skip_isr_eco = 0x40001db0;
 r_lld_ext_scan_dynamic_pti_reset = 0x40001db4;
 r_llc_rem_phy_upd_proc_continue_eco = 0x40001db8;
@ -217,6 +210,8 @@ r_lld_adv_ext_chain_none_construct = 0x40001b50;
 r_llc_llcp_send_eco = 0x40001cf4;
 r_llc_llcp_channel_map_ind_ack = 0x40001d68;
 r_rwble_isr = 0x40001464;
+r_lld_scan_start_eco = 0x40001d24;
+r_lld_scan_try_sched_eco = 0x40001dac;
 */


--- a/components/esp_rom/esp32c3/ld/esp32c3.rom.ld
+++ b/components/esp_rom/esp32c3/ld/esp32c3.rom.ld
@ -922,7 +922,7 @@ r_llc_init_term_proc = 0x40000f1c;
 r_llc_iv_skd_rand_gen = 0x40000f20;
 r_llc_le_ping_proc_continue = 0x40000f24;
 r_llc_le_ping_proc_err_cb = 0x40000f28;
-r_llc_le_ping_restart = 0x40000f2c;
+/* r_llc_le_ping_restart = 0x40000f2c; */
 r_llc_le_ping_set = 0x40000f30;
 r_llc_ll_pause_enc_rsp_ack_handler = 0x40000f34;
 r_llc_ll_reject_ind_ack_handler = 0x40000f38;
--- a/components/esp_rom/esp32s3/ld/esp32s3.rom.ld
+++ b/components/esp_rom/esp32s3/ld/esp32s3.rom.ld
@ -1195,7 +1195,7 @@ r_llc_init_term_proc = 0x40003d38;
 r_llc_iv_skd_rand_gen = 0x40003d44;
 r_llc_le_ping_proc_continue = 0x40003d50;
 r_llc_le_ping_proc_err_cb = 0x40003d5c;
-r_llc_le_ping_restart = 0x40003d68;
+/* r_llc_le_ping_restart = 0x40003d68; */
 r_llc_le_ping_set = 0x40003d74;
 r_llc_ll_pause_enc_rsp_ack_handler = 0x40003d80;
 r_llc_ll_reject_ind_ack_handler = 0x40003d8c;
@ -1609,7 +1609,6 @@ r_lld_con_tx_prog_new_packet_coex = 0x4000519c;
 r_lld_per_adv_dynamic_pti_get = 0x400051b4;
 r_lld_per_adv_evt_start_chm_upd = 0x400051c0;
 r_lld_ext_scan_dynamic_pti_get = 0x400051cc;
-r_lld_scan_try_sched = 0x400051d8;
 r_lld_sync_insert = 0x400051e4;
 r_sch_prog_ble_push = 0x400051f0;
 r_sch_prog_bt_push = 0x400051fc;
--- a/components/esp_system/CMakeLists.txt
+++ b/components/esp_system/CMakeLists.txt
@ -20,6 +20,7 @@ else()
            "startup.c"
            "system_time.c"
            "stack_check.c"
+            "stack_mirror.c"
            "task_wdt.c"
            "ubsan.c"
            "xt_wdt.c"
--- a/components/esp_system/include/esp_private/stack_mirror.h
+++ b/components/esp_system/include/esp_private/stack_mirror.h
@ -0,0 +1,10 @@
+/*
+ * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#if CONFIG_COMPILER_STACK_MIRROR
+void stack_mirror_enable();
+void stack_mirror_print_backtrace(bool panic);
+#endif
--- a/components/esp_system/port/arch/xtensa/debug_helpers.c
+++ b/components/esp_system/port/arch/xtensa/debug_helpers.c
@ -22,6 +22,7 @@
 #include "soc/soc_memory_layout.h"
 #include "soc/cpu.h"
 #include "esp_private/panic_internal.h"
+#include "esp_private/stack_mirror.h"

 #include "xtensa/xtensa_context.h"

@ -94,6 +95,9 @@ esp_err_t IRAM_ATTR esp_backtrace_print_from_frame(int depth, const esp_backtrac
    esp_err_t ret = ESP_OK;
    if (corrupted) {
        print_str(" |<-CORRUPTED", panic);
+#ifndef CONFIG_COMPILER_STACK_MIRROR
+        print_str("\r\nTurn on Stack Mirroring to avoid corruption", panic);
+#endif
        ret =  ESP_FAIL;
    } else if (stk_frame.next_pc != 0) {    //Backtrace continues
        print_str(" |<-CONTINUES", panic);
@ -107,5 +111,12 @@ esp_err_t IRAM_ATTR esp_backtrace_print(int depth)
    //Initialize stk_frame with first frame of stack
    esp_backtrace_frame_t start = { 0 };
    esp_backtrace_get_start(&(start.pc), &(start.sp), &(start.next_pc));
-    return esp_backtrace_print_from_frame(depth, &start, false);
+    esp_err_t err = esp_backtrace_print_from_frame(depth, &start, false);
+#if CONFIG_COMPILER_STACK_MIRROR
+    if (err != ESP_OK) {
+        stack_mirror_print_backtrace(false);
+    }
+#endif
+    return err;
 }
+
--- a/components/esp_system/port/arch/xtensa/panic_arch.c
+++ b/components/esp_system/port/arch/xtensa/panic_arch.c
@ -11,6 +11,7 @@
 #include "esp_debug_helpers.h"

 #include "esp_private/panic_internal.h"
+#include "esp_private/stack_mirror.h"
 #include "esp_private/panic_reason.h"
 #include "soc/soc.h"

@ -467,5 +468,9 @@ void panic_print_backtrace(const void *f, int core)
 {
    XtExcFrame *xt_frame = (XtExcFrame *) f;
    esp_backtrace_frame_t frame = {.pc = xt_frame->pc, .sp = xt_frame->a1, .next_pc = xt_frame->a0, .exc_frame = xt_frame};
-    esp_backtrace_print_from_frame(100, &frame, true);
+    if (esp_backtrace_print_from_frame(100, &frame, true) != ESP_OK) {
+#if CONFIG_COMPILER_STACK_MIRROR
+        stack_mirror_print_backtrace(true);
+#endif
+    }
 }
--- a/components/esp_system/stack_mirror.c
+++ b/components/esp_system/stack_mirror.c
@ -0,0 +1,128 @@
+/*
+ * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <stdlib.h>
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "esp_heap_caps.h"
+#include "esp_private/panic_internal.h"
+#include "soc/soc_memory_types.h"
+
+#if CONFIG_COMPILER_STACK_MIRROR
+
+#define STACK_MIRROR_MAGIC 139871234
+
+/* __cyg_profile_func_enter - gcc inserts a call to this function at the start of every function
+ * __cyg_profile_func_exit  - gcc inserts a call to this function at the end of every function
+ * no_instrument_function   - This tells GCC to not insert instrumentation calls (would cause an infinite loop) */
+void IRAM_ATTR __cyg_profile_func_enter(void *func, void *caller) __attribute__((no_instrument_function));
+void IRAM_ATTR __cyg_profile_func_exit(void *func, void *caller) __attribute__((no_instrument_function));
+static void IRAM_ATTR print_str(const char* str, bool panic) __attribute__((no_instrument_function));
+static void IRAM_ATTR print_entry(uint32_t pc, bool panic) __attribute__((no_instrument_function));
+
+static uint32_t enabled;
+
+static void IRAM_ATTR print_str(const char* str, bool panic)
+{
+    if (panic) {
+        panic_print_str(str);
+    } else {
+        esp_rom_printf(str);
+    }
+}
+
+static void IRAM_ATTR print_entry(uint32_t pc, bool panic)
+{
+    if (panic) {
+        panic_print_str(" 0x");
+        panic_print_hex(pc);
+    } else {
+        esp_rom_printf(" 0x%08X", pc);
+    }
+}
+
+extern void xt_unhandled_exception(XtExcFrame *frame);
+
+void IRAM_ATTR __cyg_profile_func_enter(void *func, void *callsite)
+{
+    if (enabled == STACK_MIRROR_MAGIC) {
+        esp_stack_mirror_t *m = pvTaskGetStackMirrorPointer();
+        if (func == xt_unhandled_exception) {
+            // dont add to the stack trace after we already hit panic.
+            m->panicing = true;
+        }
+        if (!m->panicing) {
+            if (m->depth < CONFIG_COMPILER_STACK_MIRROR_DEPTH) {
+                m->backtrace[m->depth] = (uint32_t) func;
+            }
+            m->depth++;
+        }
+    }
+}
+
+void IRAM_ATTR __cyg_profile_func_exit(void *func, void *callsite)
+{
+    if (enabled == STACK_MIRROR_MAGIC) {
+        esp_stack_mirror_t *m = pvTaskGetStackMirrorPointer();
+        if (!m->panicing && m->depth > 0) {
+            m->depth--;
+        }
+    }
+}
+
+void IRAM_ATTR stack_mirror_print_backtrace(bool panic)
+{
+    esp_stack_mirror_t *m = pvTaskGetStackMirrorPointer();
+
+    print_str("\r\nBacktrace (Mirror):", panic);
+
+    if (m == NULL) {
+
+        print_str("\r\nNot Set", panic);
+
+    } else if (esp_ptr_internal(m) == false) {
+
+        print_str("\r\nInvalid Ptr", panic);
+
+    } else if (m->depth == 0) {
+
+        print_str("\r\nEmpty", panic);
+
+    } else {
+
+        uint32_t depth = m->depth;
+
+        if (depth >= CONFIG_COMPILER_STACK_MIRROR_DEPTH) {
+            print_str("\r\nBACKTRACE INCOMPLETE", panic);
+            depth = CONFIG_COMPILER_STACK_MIRROR_DEPTH;
+        }
+
+        for (int i = depth - 1; i >= 0; i--) {
+
+            uint32_t pc = m->backtrace[i];
+
+            print_entry(pc, panic);
+
+            bool corrupted = !esp_ptr_executable((void *)esp_cpu_process_stack_pc(pc));
+
+            if (corrupted) {
+                print_str(" |<-CORRUPTED", panic);
+                break;
+            }
+        }
+    }
+
+    print_str("\r\n\r\n", panic);
+
+    return;
+}
+
+void stack_mirror_enable()
+{
+    enabled = STACK_MIRROR_MAGIC;
+}
+
+#endif // CONFIG_COMPILER_STACK_MIRROR
--- a/components/freertos/Kconfig
+++ b/components/freertos/Kconfig
@ -173,8 +173,10 @@ menu "FreeRTOS"
            FreeRTOS has the ability to store per-thread pointers in the task
            control block. This controls the number of pointers available.

-            This value must be at least 1. Index 0 is reserved for use by the pthreads API
-            thread-local-storage. Other indexes can be used for any desired purpose.
+            This value must be at least 1. Index 0 is reserved for use by the pthreads API thread-local-storage. 
+            
+            Other indexes can be used for any desired purpose.
+

    choice FREERTOS_ASSERT
        prompt "FreeRTOS assertions"
--- a/components/freertos/include/freertos/FreeRTOS.h
+++ b/components/freertos/include/freertos/FreeRTOS.h
@ -1254,6 +1254,12 @@ typedef struct xSTATIC_TCB
    #if ( configUSE_POSIX_ERRNO == 1 )
        int iDummy22;
    #endif
+    #if CONFIG_COMPILER_STACK_MIRROR
+        uint32_t uDummy23;
+        uint32_t uDummy24;
+        uint32_t uDummy25[CONFIG_COMPILER_STACK_MIRROR_DEPTH];
+    #endif
+
 } StaticTask_t;

 /*
--- a/components/freertos/include/freertos/task.h
+++ b/components/freertos/include/freertos/task.h
@ -1818,6 +1818,16 @@ configSTACK_DEPTH_TYPE uxTaskGetStackHighWaterMark2( TaskHandle_t xTask ) PRIVIL
 */
 uint8_t* pxTaskGetStackStart( TaskHandle_t xTask) PRIVILEGED_FUNCTION;

+#if CONFIG_COMPILER_STACK_MIRROR
+typedef struct {
+    uint32_t panicing;
+    uint32_t depth;
+    uint32_t backtrace[CONFIG_COMPILER_STACK_MIRROR_DEPTH];
+} esp_stack_mirror_t;
+
+esp_stack_mirror_t *pvTaskGetStackMirrorPointer();
+#endif // CONFIG_COMPILER_STACK_MIRROR
+
 /* When using trace macros it is sometimes necessary to include task.h before
 * FreeRTOS.h.  When this is done TaskHookFunction_t will not yet have been defined,
 * so the following two prototypes will cause a compilation error.  This can be
--- a/components/freertos/port/port_common.c
+++ b/components/freertos/port/port_common.c
@ -15,6 +15,7 @@
 #include "esp_task.h"
 #include "esp_private/crosscore_int.h"
 #include "esp_private/startup_internal.h"    /* Required by g_spiram_ok. [refactor-todo] for g_spiram_ok */
+#include "esp_private/stack_mirror.h"
 #include "esp_log.h"
 #include "soc/soc_memory_types.h"
 #include "soc/dport_access.h"
@ -138,6 +139,11 @@ static void main_task(void* args)
    }
 #endif

+// Todo: this could be initialized sooner, but not sure where exactly...
+#if CONFIG_COMPILER_STACK_MIRROR
+    stack_mirror_enable();
+#endif
+
    app_main();
    vTaskDelete(NULL);
 }
--- a/components/freertos/port/xtensa/include/freertos/portmacro.h
+++ b/components/freertos/port/xtensa/include/freertos/portmacro.h
@ -558,6 +558,9 @@ static inline void __attribute__((always_inline)) uxPortCompareSetExtram(volatil

 // --------------------- Interrupts ------------------------

+#if CONFIG_COMPILER_STACK_MIRROR
+    IRAM_ATTR __attribute__((no_instrument_function))
+#endif
 static inline UBaseType_t __attribute__((always_inline)) xPortSetInterruptMaskFromISR(void)
 {
    UBaseType_t prev_int_level = XTOS_SET_INTLEVEL(XCHAL_EXCM_LEVEL);
@ -565,6 +568,9 @@ static inline UBaseType_t __attribute__((always_inline)) xPortSetInterruptMaskFr
    return prev_int_level;
 }

+#if CONFIG_COMPILER_STACK_MIRROR
+    IRAM_ATTR __attribute__((no_instrument_function))
+#endif
 static inline void __attribute__((always_inline)) vPortClearInterruptMaskFromISR(UBaseType_t prev_level)
 {
    portbenchmarkINTERRUPT_RESTORE(prev_level);
@ -629,6 +635,9 @@ static inline bool IRAM_ATTR xPortCanYield(void)

 // ----------------------- System --------------------------

+#if CONFIG_COMPILER_STACK_MIRROR
+    __attribute__((no_instrument_function))
+#endif
 static inline BaseType_t IRAM_ATTR xPortGetCoreID(void)
 {
    return (uint32_t) cpu_hal_get_core_id();
--- a/components/freertos/tasks.c
+++ b/components/freertos/tasks.c
@ -270,6 +270,7 @@
    #define taskEVENT_LIST_ITEM_VALUE_IN_USE    0x80000000UL
 #endif

+
 /*
 * Task control block.  A task control block (TCB) is allocated for each task,
 * and stores task state information, including a pointer to the task's context
@ -356,6 +357,11 @@ typedef struct tskTaskControlBlock       /* The old naming convention is used to
    #if ( configUSE_POSIX_ERRNO == 1 )
        int iTaskErrno;
    #endif
+
+    #if CONFIG_COMPILER_STACK_MIRROR
+        esp_stack_mirror_t stackMirror;
+    #endif
+
 } tskTCB;

 /* The old tskTCB name is maintained above then typedefed to the new TCB_t name
@ -996,6 +1002,11 @@ static void prvInitialiseNewTask( TaskFunction_t pxTaskCode,
        }
    #endif /* portSTACK_GROWTH */

+    #if CONFIG_COMPILER_STACK_MIRROR
+        pxNewTCB->stackMirror.panicing = false;
+        pxNewTCB->stackMirror.depth = 0;
+    #endif
+
    /* Store the task name in the TCB. */
    if( pcName != NULL )
    {
@ -4209,6 +4220,16 @@ static portTASK_FUNCTION( prvIdleTask, pvParameters )
 #endif /* configUSE_TICKLESS_IDLE */
 /*-----------------------------------------------------------*/

+
+#if CONFIG_COMPILER_STACK_MIRROR
+    IRAM_ATTR __attribute__((no_instrument_function))
+    esp_stack_mirror_t * pvTaskGetStackMirrorPointer()
+    {
+        TCB_t *pxTCB = xTaskGetCurrentTaskHandle();
+        return &pxTCB->stackMirror;
+    }
+#endif
+
 #if ( configNUM_THREAD_LOCAL_STORAGE_POINTERS != 0 )

 #if ( configTHREAD_LOCAL_STORAGE_DELETE_CALLBACKS )
@ -4758,6 +4779,9 @@ static void prvResetNextTaskUnblockTime( void )

 #if ( ( INCLUDE_xTaskGetCurrentTaskHandle == 1 ) || ( configUSE_MUTEXES == 1 ) || (configNUM_CORES > 1) )

+#if CONFIG_COMPILER_STACK_MIRROR
+    IRAM_ATTR __attribute__((no_instrument_function))
+#endif
    TaskHandle_t xTaskGetCurrentTaskHandle( void )
    {
        TaskHandle_t xReturn;
--- a/components/hal/esp32/include/hal/cpu_ll.h
+++ b/components/hal/esp32/include/hal/cpu_ll.h
@ -29,6 +29,9 @@
 extern "C" {
 #endif

+#if CONFIG_COMPILER_STACK_MIRROR
+    IRAM_ATTR __attribute__((no_instrument_function))
+#endif
 static inline uint32_t IRAM_ATTR cpu_ll_get_core_id(void)
 {
    uint32_t id;
--- a/components/hal/esp32s3/include/hal/cpu_ll.h
+++ b/components/hal/esp32s3/include/hal/cpu_ll.h
@ -28,6 +28,9 @@
 extern "C" {
 #endif

+#if CONFIG_COMPILER_STACK_MIRROR
+    __attribute__((no_instrument_function))
+#endif
 static inline uint32_t IRAM_ATTR cpu_ll_get_core_id(void)
 {
    uint32_t id;
--- a/components/mbedtls/CMakeLists.txt
+++ b/components/mbedtls/CMakeLists.txt
@ -3,6 +3,10 @@ idf_build_get_property(python PYTHON)

 set(priv_requires soc esp_hw_support)

+# Variable DISABLE_PACKAGE_CONFIG_AND_INSTALL is set to true to use old policy for mbedtls/pkgconfig.
+# if set to false, we need to set policy in mbedtls/mbedtls/pkgconfig.CMakeLists
+set(DISABLE_PACKAGE_CONFIG_AND_INSTALL true)
+
 if(NOT BOOTLOADER_BUILD)
    list(APPEND priv_requires esp_pm)
 endif()
--- a/components/mbedtls/mbedtls
+++ b/components/mbedtls/mbedtls
@ -1 +1 @@
-Subproject commit 2b8e772fc1cb0732cda3bae7d1e9d6f4cfaf63d9
+Subproject commit 4cfd2256ee068ba931a6e332ad7b55639812d225
--- a/docs/en/api-guides/wifi.rst
+++ b/docs/en/api-guides/wifi.rst
@ -1860,7 +1860,7 @@ The following packets will **NOT** be dumped to the application:

 - 802.11 error frame, such as the frame with a CRC error, etc.

-For frames that the sniffer **can** dump, the application can additionally decide which specific type of packets can be filtered to the application by using :cpp:func:`esp_wifi_set_promiscuous_filter()` and :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()`. By default, it will filter all 802.11 data and management frames to the application.
+For frames that the sniffer **can** dump, the application can additionally decide which specific type of packets can be filtered to the application by using :cpp:func:`esp_wifi_set_promiscuous_filter()` and :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()`. By default, it will filter all 802.11 data and management frames to the application. If you want to filter the 802.11 control frames, the filter parameter in :cpp:func:`esp_wifi_set_promiscuous_filter()` should include `WIFI_PROMIS_FILTER_MASK_CTRL` type, and if you want to differentiate control frames further, then call :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()`.

 The Wi-Fi sniffer mode can be enabled in the Wi-Fi mode of WIFI_MODE_NULL, or WIFI_MODE_STA, or WIFI_MODE_AP, or WIFI_MODE_APSTA. In other words, the sniffer mode is active when the station is connected to the AP, or when the AP has a Wi-Fi connection. Please note that the sniffer has a **great impact** on the throughput of the station or AP Wi-Fi connection. Generally, we should **NOT** enable the sniffer, when the station/AP Wi-Fi connection experiences heavy traffic unless we have special reasons.

--- a/docs/en/api-reference/storage/spi_flash_concurrency.rst
+++ b/docs/en/api-reference/storage/spi_flash_concurrency.rst
@ -9,7 +9,7 @@ The SPI0/1 bus is shared between the instruction & data cache (for firmware exec

 .. only:: esp32c3

-    On {IDF_TARGET_NAME}, the config option :ref:`CONFIG_SPI_FLASH_AUTO_SUSPEND` (enabled by default) allows the cache to read flash & PSRAM concurrently with SPI1 operations. See :ref:`auto-suspend` for more details.
+    On {IDF_TARGET_NAME}, the config option :ref:`CONFIG_SPI_FLASH_AUTO_SUSPEND` allows the cache to read flash concurrently with SPI1 operations. This is an optional feature that depends on special SPI Flash models, hence disabled by default. See :ref:`auto-suspend` for more details.

    If this option is disabled, the caches must be disabled while reading/writing/erasing operations. There are some constraints using driver on the SPI1 bus, see :ref:`impact_disabled_cache`. This constraints will cause more IRAM/DRAM usages.

--- a/docs/zh_CN/api-guides/wifi.rst
+++ b/docs/zh_CN/api-guides/wifi.rst
@ -1792,7 +1792,7 @@ Wi-Fi Sniffer 模式可以通过 :cpp:func:`esp_wifi_set_promiscuous()` 使能

 - 802.11 错误帧，如有 CRC 错误的帧等。

-对于Sniffer 模式 **可以** 转储的帧，应用程序可以另外使用 :cpp:func:`esp_wifi_set_promiscuous_filter()` 和 :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()` 决定筛选哪些特定类型的数据包。应用程序默认筛选所有 802.11 数据和管理帧。
+对于 Sniffer 模式 **可以** 转储的帧，应用程序可以另外使用 :cpp:func:`esp_wifi_set_promiscuous_filter()` 和 :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()` 决定筛选哪些特定类型的数据包。应用程序默认筛选所有 802.11 数据和管理帧。如果你想要筛选 802.11 控制帧，:cpp:func:`esp_wifi_set_promiscuous_filter()` 中的 filter 参数需要包含 “WIFI_PROMIS_FILTER_MASK_CTRL” 类型， 如果你想进一步区分 802.11 控制帧，那么调用 :cpp:func:`esp_wifi_set_promiscuous_ctrl_filter()`。

 可以在 WIFI_MODE_NULL、WIFI_MODE_STA、WIFI_MODE_AP、WIFI_MODE_APSTA 等Wi-Fi 模式下使能 Wi-Fi Sniffer 模式。也就是说，当 station 连接到 AP，或者 AP 有 Wi-Fi 连接时，就可以使能。请注意，Sniffer 模式对 station/AP Wi-Fi 连接的吞吐量有 **很大影响**。通常，除非有特别原因，当 station/AP Wi-Fi 连接出现大量流量，不应使能。

--- a/docs/zh_CN/api-reference/storage/spi_flash_concurrency.rst
+++ b/docs/zh_CN/api-reference/storage/spi_flash_concurrency.rst
@ -9,7 +9,7 @@ SPI1 Flash 并发约束

 .. only:: esp32c3

-    在 {IDF_TARGET_NAME} 上，默认启用的配置选项 :ref:`CONFIG_SPI_FLASH_AUTO_SUSPEND` 允许 flash / PSRAM 的 cache 访问和 SPI1 的操作存并发地执行。更多详情，参见 :ref:`auto-suspend` 。
+    在 {IDF_TARGET_NAME} 上，配置选项 :ref:`CONFIG_SPI_FLASH_AUTO_SUSPEND` 允许 Flash 的 cache 访问和 SPI1 的操作存并发地执行。该选项是可选的，依赖于特定的 SPI Flash 型号，因此默认是关闭的。请参阅 :ref:`auto-suspend`，查看详细信息。

    然而当该选项被禁用时，读取/写入/擦除 flash 时， cache 必须被禁用。使用驱动访问 SPI1 的相关约束参见 :ref:`impact_disabled_cache` 。这些约束会带来更多的 IRAM / DRAM 消耗。

--- a/examples/wifi/espnow/main/espnow_example_main.c
+++ b/examples/wifi/espnow/main/espnow_example_main.c
@ -104,7 +104,7 @@ static void example_espnow_recv_cb(const uint8_t *mac_addr, const uint8_t *data,
 }

 /* Parse received ESPNOW data. */
-int example_espnow_data_parse(uint8_t *data, uint16_t data_len, uint8_t *state, uint16_t *seq, int *magic)
+int example_espnow_data_parse(uint8_t *data, uint16_t data_len, uint8_t *state, uint16_t *seq, uint32_t *magic)
 {
    example_espnow_data_t *buf = (example_espnow_data_t *)data;
    uint16_t crc, crc_cal = 0;
@ -150,7 +150,7 @@ static void example_espnow_task(void *pvParameter)
    example_espnow_event_t evt;
    uint8_t recv_state = 0;
    uint16_t recv_seq = 0;
-    int recv_magic = 0;
+    uint32_t recv_magic = 0;
    bool is_broadcast = false;
    int ret;

--- a/tools/ci/check_public_headers_exceptions.txt
+++ b/tools/ci/check_public_headers_exceptions.txt
@ -48,6 +48,7 @@ components/wpa_supplicant/esp_supplicant/include/
 components/mbedtls/port/include/
 components/mbedtls/mbedtls/include/mbedtls/
 components/mbedtls/mbedtls/include/psa/
+components/mbedtls/mbedtls/3rdparty/everest/include/

 components/coap/
 components/nghttp/
--- a/tools/tools.json
+++ b/tools/tools.json
@ -696,46 +696,46 @@
      "versions": [
        {
          "linux-amd64": {
-            "sha256": "61e38e0a13a5c1664624ec1c397d7f7d6868554b0d345d3fb1f7294cce38cc4b",
-            "size": 2193783,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-linux-amd64-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "cf26c5cef4f6b04aa23cd2778675604e5a74a4ce4d8d17b854d05fbcb782d52c",
+            "size": 2252682,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-linux-amd64-0.12.0-esp32-20240318.tar.gz"
          },
          "linux-arm64": {
-            "sha256": "6430315dc1b926541c93cef63d2b08982543ad3f9fe6e0d7107c8a518ef20432",
-            "size": 2062058,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-linux-arm64-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "9b97a37aa2cab94424a778c25c0b4aa0f90d6ef9cda764a1d9289d061305f4b7",
+            "size": 2132904,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-linux-arm64-0.12.0-esp32-20240318.tar.gz"
          },
          "linux-armel": {
-            "sha256": "5df16d8a91f013a547f6b3b914c655a9d267996a3b6503031b335ac04a4f8d15",
-            "size": 2206666,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-linux-armel-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "b7e82776ec374983807d3389df09c632ad9bc8341f2075690b6b500319dfeaf4",
+            "size": 2271761,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-linux-armel-0.12.0-esp32-20240318.tar.gz"
          },
          "linux-armhf": {
-            "sha256": "1b1b80a71b77e5c715aa59e994db97c64454e613904a85d5d2970b2e60b81eec",
-            "size": 2056000,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-linux-armhf-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "16f8f65f12e5ba034d328cda2567d6851a2aceb3c957d577f89401c2e1d3f93a",
+            "size": 2121312,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-linux-armhf-0.12.0-esp32-20240318.tar.gz"
          },
          "macos": {
-            "sha256": "0a4f764934f488af18cdac2a0d152dd36b4870f3bec1a2d4e25b6b3b7a5258a0",
-            "size": 2305832,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-macos-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "b16c3082c94df1079367c44d99f7a8605534cd48aabc18898e46e94a2c8c57e7",
+            "size": 2365588,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-macos-0.12.0-esp32-20240318.tar.gz"
          },
          "macos-arm64": {
-            "sha256": "6dce89048f642eb0559a915b6e514f90feb2a95afe21b84f0b0ebf2b27824816",
-            "size": 2341406,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-macos-arm64-0.12.0-esp32-20230921.tar.gz"
+            "sha256": "534ec925ae6e35e869e4e4e6e4d2c4a1eb081f97ebcc2dd5efdc52d12f4c2f86",
+            "size": 2406377,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-macos-arm64-0.12.0-esp32-20240318.tar.gz"
          },
-          "name": "v0.12.0-esp32-20230921",
+          "name": "v0.12.0-esp32-20240318",
          "status": "recommended",
          "win32": {
-            "sha256": "ac9d522a63b0816f64d921547bd55c031788035ced85c067d8e7c2862cb1bd0d",
-            "size": 2710475,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-win32-0.12.0-esp32-20230921.zip"
+            "sha256": "d379329eba052435173ab0d69c9b15bc164a6ce489e2a67cd11169d2dabff633",
+            "size": 2783915,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-win32-0.12.0-esp32-20240318.zip"
          },
          "win64": {
-            "sha256": "ac9d522a63b0816f64d921547bd55c031788035ced85c067d8e7c2862cb1bd0d",
-            "size": 2710475,
-            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20230921/openocd-esp32-win32-0.12.0-esp32-20230921.zip"
+            "sha256": "d379329eba052435173ab0d69c9b15bc164a6ce489e2a67cd11169d2dabff633",
+            "size": 2783915,
+            "url": "https://github.com/espressif/openocd-esp32/releases/download/v0.12.0-esp32-20240318/openocd-esp32-win32-0.12.0-esp32-20240318.zip"
          }
        }
      ]
Autor	SHA1	Wiadomość	Data
Chip Weinberger	ba1a5810e1	Merge `c829a82ff1` into `7cd82420c2`	2024-04-23 12:32:18 -03:00
Jiang Jiang Jian	7cd82420c2	Merge branch 'doc/update_espnow_example_v4.4' into 'release/v4.4' docs(wifi): change the magic varible from int to uint32_t on the receiving side (v4.4) See merge request espressif/esp-idf!30310	2024-04-22 10:44:27 +08:00
Jiang Jiang Jian	a4eb486982	Merge branch 'bugfix/fix_some_ble_bugs_cjh_v4.4' into 'release/v4.4' Fixed some BT and BLE bugs 2404 (backport v4.4) See merge request espressif/esp-idf!30261	2024-04-22 10:43:57 +08:00
Wang Meng Yang	0f651657c1	Merge branch 'bugfix/crash_after_bluedroid_deinit_v4.4' into 'release/v4.4' fix(bt/bluedroid): Fixed controller using null pointer after bluedroid deinit(v4.4) See merge request espressif/esp-idf!30330	2024-04-19 12:19:08 +08:00
chenjianhua	b30aa8f087	feat(bt): Update bt lib for ESP32-C3 and ESP32-S3(c23ab4c) - Support QA test vendor HCI command and event	2024-04-18 14:52:26 +08:00
baohongde	fd2122886a	fix(ble/controller): Fixed LoadProhibited after bluetooth deinit	2024-04-18 14:52:18 +08:00
chenjianhua	cae9f68eff	fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(5274796) - Fixed extended uncoded and coded scan scheduling - Add config for channel assessment and ping procedure - Clear random address for extended advertising - Add periodic advertising list check - Fixed periodic advertising data setting with zero length	2024-04-18 14:52:12 +08:00
baohongde	02bfd5749f	feat(ble/controller): Add coexist schm for BLE	2024-04-18 14:49:56 +08:00
chenjianhua	fe1299e5da	feat(bt): Update bt lib for ESP32(e314148) - Support QA test vendor HCI command and event	2024-04-18 14:47:53 +08:00
zhanghaipeng	b01187b472	fix(bt/controller): Update bt lib for ESP32(5838b68) - Fixed BLE scan assert - Fixed assert(10,0) in lld_pdu - Add BLE scan backoff in menuconfig	2024-04-18 14:47:53 +08:00
Jin Cheng	4bbb3c9203	fix(bt/controller): Use embedded assembly to get access to DPORT registers	2024-04-18 14:47:53 +08:00
xiongweichao	0e31aae24d	fix(bt/bluedroid): Fixed crash after bluedroid deinit hci_host_env.downstream_data_ready is set to NULL during bluedroid deinit, causing the controller to use a null pointer when calling callback.	2024-04-18 10:58:35 +08:00
Island	d1f549f670	Merge branch 'bugfix/fix_ble_appearance_v4.4' into 'release/v4.4' Fixed BLE appearance category ranges (v4.4) See merge request espressif/esp-idf!30288	2024-04-18 10:44:04 +08:00
zhanghaipeng	54205481df	fix(ble/bluedroid): Fixed set BLE appearance value	2024-04-17 20:39:36 +08:00
zhangyanjiao	f7fe5728ce	docs(wifi): update the docmentation for sniffer API Closes https://github.com/espressif/esp-idf/issues/10740	2024-04-17 16:22:08 +08:00
zhangyanjiao	4d7478002d	docs(wifi): change the magic varible from int to uint32_t on the receiving side Closes https://github.com/espressif/esp-idf/issues/10912	2024-04-17 16:20:51 +08:00
Jiang Jiang Jian	6b60008e50	Merge branch 'feature/update_mbedtls_version_to_2.28.8' into 'release/v4.4' feat(mbedtls): updated mbedtls version from 2.28.7 to 2.28.8 See merge request espressif/esp-idf!30018	2024-04-17 10:43:56 +08:00
Jiang Jiang Jian	c902eacbe9	Merge branch 'feature/update-openocd-to-v0.12.0-esp32-20240318_v4.4' into 'release/v4.4' feat(tools): update openocd version to v0.12.0-esp32-20240318 (v4.4) See merge request espressif/esp-idf!30048	2024-04-17 10:43:39 +08:00
morris	0036aaac89	Merge branch 'doc/auto_suspend_disabled_by_default_v4.4' into 'release/v4.4' doc(flash): fix auto suspend enabled by default issue (v4.4) See merge request espressif/esp-idf!30269	2024-04-17 10:05:49 +08:00
Xiao Xufeng	21ece5e0ed	doc(flash): fix auto suspend enabled by default issue	2024-04-16 23:15:24 +08:00
Wang Meng Yang	5c8b63c773	Merge branch 'feature/add_api_to_send_vendor_hci_cmd_v4.4' into 'release/v4.4' Feature/add api to send vendor hci cmd (backport v4.4) See merge request espressif/esp-idf!30228	2024-04-16 17:45:44 +08:00
zhiweijian	8d7c759e11	fix(ble/bluedroid): Fixed adv not restart due to disconnection reason 0x3e	2024-04-13 18:25:20 +08:00
zhiweijian	9a7b3f80b2	feat(bt/common): Add bluerooth hci layer data stream record	2024-04-13 18:25:08 +08:00
zhiweijian	db9ba9378f	feat(bt/bluedroid): add api to setnd vendor hci command	2024-04-13 15:06:25 +08:00
zhiweijian	60d757c5a4	fix(ble/bluedroid): fixed bluedroid host DTM API	2024-04-13 15:06:11 +08:00
zhiweijian	f837394d59	feat(ble/bluedroid): Add APIs for BLE direct test mode on bluedroid host	2024-04-13 15:05:56 +08:00
Alexey Gerenkov	79f0dfeafa	feat(tools): update openocd version to v0.12.0-esp32-20240318	2024-04-08 03:34:40 +08:00
nilesh.kale	a5350112fb	feat(mbedtls): updated mbedtls version from 2.28.7 to 2.28.8 This MR updated MbedTLS version to 2.28.8.	2024-04-05 15:17:03 +05:30
Chip Weinberger	c829a82ff1	[Stack Mirror][v4.4] make corrupt backtraces not happen nearly as often	2023-05-26 19:33:35 -07:00