Merge branch 'bugfix/sdp_uuid16_match_err_v5.2' into 'release/v5.2'

fix(bt): Fix the incorrect record found using uuid16 search(v5.2)

See merge request espressif/esp-idf!36851

components/bt/controller/esp32/bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -446,7 +446,11 @@ static DRAM_ATTR uint8_t btdm_lpcycle_us_frac = 0; // number of fractional bit f
 
 #if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
 // used low power clock
-static DRAM_ATTR uint8_t btdm_lpclk_sel;
+#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL;
+#else
+static DRAM_ATTR uint8_t btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL;
+#endif /* CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL */
 #endif /* #ifdef CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG */
 
 static DRAM_ATTR QueueHandle_t s_wakeup_req_sem = NULL;
@@ -1488,6 +1492,117 @@ static void hli_queue_setup_pinned_to_core(int core_id)
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */
 
+// init low-power control resources
+static esp_err_t btdm_low_power_mode_init(void)
+{
+    esp_err_t err = ESP_OK;
+
+#ifdef CONFIG_PM_ENABLE
+    s_btdm_allow_light_sleep = false;
+#endif
+
+    // set default sleep clock cycle and its fractional bits
+    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        // check whether or not EXT_CRYS is working
+        if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
+#ifdef CONFIG_PM_ENABLE
+            s_btdm_allow_light_sleep = true;
+#endif
+        } else {
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
+                    "light sleep mode will not be able to apply when bluetooth is enabled");
+            btdm_lpclk_sel = ESP_BT_SLEEP_CLOCK_MAIN_XTAL; // set default value
+        }
+    } else if (btdm_lpclk_sel != ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        assert(0);
+    }
+
+    bool select_src_ret __attribute__((unused));
+    bool set_div_ret __attribute__((unused));
+    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
+        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
+        set_div_ret = btdm_lpclk_set_div(0);
+        assert(select_src_ret && set_div_ret);
+        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
+        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
+            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
+        assert(btdm_lpcycle_us != 0);
+    }
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
+
+#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
+#else
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+#endif
+
+#ifdef CONFIG_PM_ENABLE
+    if (!s_btdm_allow_light_sleep) {
+        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+            return err;
+        }
+    }
+    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
+        return err;
+    }
+    esp_timer_create_args_t create_args = {
+        .callback = btdm_slp_tmr_callback,
+        .arg = NULL,
+        .name = "btSlp"
+    };
+    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
+        return err;
+    }
+
+    s_pm_lock_acquired = true;
+#endif
+
+    return err;
+}
+
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_INITED &&
+            btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return ESP_BT_SLEEP_CLOCK_NONE;
+    }
+    return btdm_lpclk_sel;
+#else
+    return ESP_BT_SLEEP_CLOCK_NONE;
+#endif
+}
+
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk)
+{
+#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
+    if (lpclk < ESP_BT_SLEEP_CLOCK_MAIN_XTAL || lpclk > ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (btdm_controller_status == ESP_BT_CONTROLLER_STATUS_INITED ||
+            btdm_controller_status == ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        ESP_LOGW(BTDM_LOG_TAG, "Please set the Bluetooth sleep clock source before Bluetooth initialization");
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    btdm_lpclk_sel = lpclk;
+    return ESP_OK;
+#else
+    return ESP_ERR_NOT_SUPPORTED;
+#endif
+}
+
 esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 {
     esp_err_t err;
@@ -1552,84 +1667,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
-#ifdef CONFIG_PM_ENABLE
-    s_btdm_allow_light_sleep = false;
-#endif
-
-    // set default sleep clock cycle and its fractional bits
-    btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-    btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-
-#if CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_ORIG
-
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#if CONFIG_BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-    // check whether or not EXT_CRYS is working
-    if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_XTAL32K) {
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32kHz XTAL
-#ifdef CONFIG_PM_ENABLE
-        s_btdm_allow_light_sleep = true;
-#endif
-    } else {
-        ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
-        btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-    }
-#else
-    btdm_lpclk_sel = BTDM_LPCLK_SEL_XTAL; // set default value
-#endif
-
-    bool select_src_ret __attribute__((unused));
-    bool set_div_ret __attribute__((unused));
-    if (btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
-    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
-        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
-        set_div_ret = btdm_lpclk_set_div(0);
-        assert(select_src_ret && set_div_ret);
-        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-        btdm_lpcycle_us = (RTC_CLK_CAL_FRACT > 15) ? (1000000 << (RTC_CLK_CAL_FRACT - 15)) :
-            (1000000 >> (15 - RTC_CLK_CAL_FRACT));
-        assert(btdm_lpcycle_us != 0);
-    }
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_ORIG);
-
-#elif CONFIG_BTDM_CTRL_MODEM_SLEEP_MODE_EVED
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_EVED);
-#else
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-#endif
-
 #if CONFIG_BTDM_CTRL_HCI_UART_FLOW_CTRL_EN
     sdk_config_set_uart_flow_ctrl_enable(true);
 #else
     sdk_config_set_uart_flow_ctrl_enable(false);
 #endif
 
-#ifdef CONFIG_PM_ENABLE
-    if (!s_btdm_allow_light_sleep) {
-        if ((err = esp_pm_lock_create(ESP_PM_NO_LIGHT_SLEEP, 0, "btLS", &s_light_sleep_pm_lock)) != ESP_OK) {
+    if ((err = btdm_low_power_mode_init()) != ESP_OK) {
+        ESP_LOGE(BTDM_LOG_TAG, "Low power module initialization failed");
         goto error;
     }
-    }
-    if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
-        goto error;
-    }
-    esp_timer_create_args_t create_args = {
-        .callback = btdm_slp_tmr_callback,
-        .arg = NULL,
-        .name = "btSlp"
-    };
-    if ((err = esp_timer_create(&create_args, &s_btdm_slp_tmr)) != ESP_OK) {
-        goto error;
-    }
-
-    s_pm_lock_acquired = true;
-#endif
 
 #if CONFIG_SW_COEXIST_ENABLE
     coex_init();
@@ -1669,10 +1716,9 @@ esp_err_t esp_bt_controller_deinit(void)
     return ESP_OK;
 }
 
-static void bt_controller_deinit_internal(void)
+// deinit low power control resources
+static void btdm_low_power_mode_deinit(void)
 {
-    periph_module_disable(PERIPH_BT_MODULE);
-
 #ifdef CONFIG_PM_ENABLE
     if (!s_btdm_allow_light_sleep) {
         esp_pm_lock_delete(s_light_sleep_pm_lock);
@@ -1693,6 +1739,16 @@ static void bt_controller_deinit_internal(void)
     s_pm_lock_acquired = false;
 #endif
 
+    btdm_lpcycle_us = 0;
+    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
+}
+
+static void bt_controller_deinit_internal(void)
+{
+    periph_module_disable(PERIPH_BT_MODULE);
+
+    btdm_low_power_mode_deinit();
+
     if (s_wakeup_req_sem) {
         semphr_delete_wrapper(s_wakeup_req_sem);
         s_wakeup_req_sem = NULL;
@@ -1705,9 +1761,6 @@ static void bt_controller_deinit_internal(void)
 
     btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
 
-    btdm_lpcycle_us = 0;
-    btdm_controller_set_sleep_mode(BTDM_MODEM_SLEEP_MODE_NONE);
-
     esp_bt_power_domain_off();
 
     esp_phy_modem_deinit();

components/bt/host/bluedroid/Kconfig.in

@@ -43,7 +43,8 @@ config BT_BLUEDROID_MEM_DEBUG
 config BT_BLUEDROID_ESP_COEX_VSC
     bool "Enable Espressif Vendor-specific HCI commands for coexist status configuration"
     depends on BT_BLUEDROID_ENABLED
-    default y
+    default y if (ESP_COEX_SW_COEXIST_ENABLE || BT_CONTROLLER_DISABLED)
+    default n
     help
         Enable Espressif Vendor-specific HCI commands for coexist status configuration
 

components/bt/host/bluedroid/api/esp_sdp_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -20,6 +20,27 @@ static bool esp_sdp_record_integrity_check(esp_bluetooth_sdp_record_t *record)
     bool ret = true;
 
     if (record != NULL) {
+        if (record->hdr.type < ESP_SDP_TYPE_RAW || record->hdr.type > ESP_SDP_TYPE_SAP_SERVER) {
+            LOG_ERROR("Invalid type!\n");
+            return false;
+        }
+        switch (record->hdr.type) {
+        case ESP_SDP_TYPE_MAP_MAS:
+            if ((record->mas.mas_instance_id >> 8) || (record->mas.supported_message_types >> 8)) {
+                LOG_ERROR("mas_instance_id and supported_message_types are defined as uint8_t in the spec!\n");
+               ret = false;
+            }
+            break;
+        case ESP_SDP_TYPE_PBAP_PSE:
+            if (record->pse.supported_repositories >> 8) {
+                LOG_ERROR("supported_repositories is defined in the spec as uint8_t!\n");
+               ret = false;
+            }
+            break;
+
+        default:
+            break;
+        }
         if (record->hdr.service_name_length > ESP_SDP_SERVER_NAME_MAX ||
             strlen(record->hdr.service_name) + 1 != record->hdr.service_name_length) {
             LOG_ERROR("Invalid server name!\n");

components/bt/host/bluedroid/bta/sdp/bta_sdp_act.c

@@ -40,31 +40,6 @@
 
 #if (SDP_INCLUDED == TRUE)
 
-/*****************************************************************************
-**  Constants
-*****************************************************************************/
-
-static const uint8_t  UUID_OBEX_OBJECT_PUSH[] = {0x00, 0x00, 0x11, 0x05, 0x00, 0x00, 0x10, 0x00,
-                                                 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                                };
-static const uint8_t  UUID_PBAP_PSE[] = {0x00, 0x00, 0x11, 0x2F, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_PBAP_PCE[] = {0x00, 0x00, 0x11, 0x2E, 0x00, 0x00, 0x10, 0x00,
-                                         0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                        };
-static const uint8_t  UUID_MAP_MAS[] = {0x00, 0x00, 0x11, 0x32, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_MAP_MNS[] = {0x00, 0x00, 0x11, 0x33, 0x00, 0x00, 0x10, 0x00,
-                                        0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                       };
-static const uint8_t  UUID_SPP[] = {0x00, 0x00, 0x11, 0x01, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
-static const uint8_t  UUID_SAP[] = {0x00, 0x00, 0x11, 0x2D, 0x00, 0x00, 0x10, 0x00,
-                                    0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB
-                                   };
 // TODO:
 // Both the fact that the UUIDs are declared in multiple places, plus the fact
 // that there is a mess of UUID comparison and shortening methods will have to
@@ -328,7 +303,7 @@ static void bta_create_sap_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     tSDP_PROTOCOL_ELEM pe;
     UINT16 pversion = -1;
 
-    record->sap.hdr.type = SDP_TYPE_MAP_MAS;
+    record->sap.hdr.type = SDP_TYPE_SAP_SERVER;
     record->sap.hdr.service_name_length = 0;
     record->sap.hdr.service_name = NULL;
     record->sap.hdr.rfcomm_channel_number = 0;
@@ -379,6 +354,15 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record *record, tSDP_DISC_RE
     record->hdr.user1_ptr = p_bta_sdp_cfg->p_sdp_db->raw_data;
 }
 
+static bool check_if_uuid16_match(UINT16 uuid16, tBT_UUID *uuid)
+{
+    // Because it is converted to a short UUID, only uuid16 needs to be checked.
+    if (uuid->len == 2 && uuid->uu.uuid16 == uuid16) {
+        return TRUE;
+    } else {
+        return FALSE;
+    }
+}
 
 /*******************************************************************************
 **
@@ -415,22 +399,22 @@ static void bta_sdp_search_cback(UINT16 result, void *user_data)
             /* generate the matching record data pointer */
             if (p_rec != NULL) {
                 status = BTA_SDP_SUCCESS;
-                if (IS_UUID(UUID_MAP_MAS, uuid->uu.uuid128)) {
+                if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_ACCESS, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MAS) uuid\n", __func__);
                     bta_create_mas_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_MAP_MNS, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_MESSAGE_NOTIFICATION, &su)) {
                     APPL_TRACE_DEBUG("%s() - found MAP (MNS) uuid\n", __func__);
                     bta_create_mns_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PSE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PSE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PSE) uuid\n", __func__);
                     bta_create_pse_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_PBAP_PCE, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_PBAP_PCE, &su)) {
                     APPL_TRACE_DEBUG("%s() - found PBAP (PCE) uuid\n", __func__);
                     bta_create_pce_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_OBEX_OBJECT_PUSH, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_OBEX_OBJECT_PUSH, &su)) {
                     APPL_TRACE_DEBUG("%s() - found Object Push Server (OPS) uuid\n", __func__);
                     bta_create_ops_sdp_record(&evt_data.records[count], p_rec);
-                } else if (IS_UUID(UUID_SAP, uuid->uu.uuid128)) {
+                } else if (check_if_uuid16_match(UUID_SERVCLASS_SAP, &su)) {
                     APPL_TRACE_DEBUG("%s() - found SAP uuid\n", __func__);
                     bta_create_sap_sdp_record(&evt_data.records[count], p_rec);
                 } else {

components/bt/host/bluedroid/stack/btm/btm_acl.c

@@ -335,7 +335,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
 #if (CLASSIC_BT_INCLUDED == TRUE)
                         const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #endif  ///CLASSIC_BT_INCLUDED == TRUE
-                        /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+                        /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
 #if (SMP_INCLUDED == TRUE)
                         btm_sec_set_peer_sec_caps(p, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
@@ -350,7 +350,7 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
                         return;
                     }
                 } else {
-                    /* If remote features indicated secure connection (SC) mode, check the remote feautres again*/
+                    /* If remote features indicated secure connection (SC) mode, check the remote features again*/
                     /* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
                     btm_read_remote_features (p->hci_handle);
                 }
@@ -474,7 +474,7 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
                     BTM_TRACE_DEBUG("Bonded\n");
                 }
             } else {
-                BTM_TRACE_DEBUG("Bletooth link down\n");
+                BTM_TRACE_DEBUG("Bluetooth link down\n");
                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
                                           | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
             }
@@ -1016,7 +1016,7 @@ void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
 
     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 #if (SMP_INCLUDED == TRUE)
-    /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
+    /* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
     btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
 #endif  ///SMP_INCLUDED == TRUE
     BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
@@ -1455,7 +1455,7 @@ void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
 **
 ** Function         btm_acl_role_changed
 **
-** Description      This function is called whan a link's master/slave role change
+** Description      This function is called when a link's master/slave role change
 **                  event or command status event (with error) is received.
 **                  It updates the link control block, and calls
 **                  the registered callback with status and role (if registered).
@@ -2705,7 +2705,7 @@ void btm_acl_connected(BD_ADDR bda, UINT16 handle, UINT8 link_type, UINT8 enc_mo
         l2c_link_hci_conn_comp(status, handle, bda);
     }
 #if BTM_SCO_INCLUDED == TRUE
-    else {
+    else if (link_type == HCI_LINK_TYPE_SCO) {
         memset(&esco_data, 0, sizeof(tBTM_ESCO_DATA));
         esco_data.link_type = HCI_LINK_TYPE_SCO;
         memcpy (esco_data.bd_addr, bda, BD_ADDR_LEN);

components/bt/host/bluedroid/stack/btm/btm_sco.c

@@ -117,8 +117,6 @@ void btm_sco_init (void)
     }
 #endif
     /* Initialize nonzero defaults */
-    btm_cb.sco_cb.sco_disc_reason  = BTM_INVALID_SCO_DISC_REASON;
-
     btm_cb.sco_cb.def_esco_parms = btm_esco_defaults; /* Initialize with defaults */
     btm_cb.sco_cb.desired_sco_mode = BTM_DEFAULT_SCO_MODE;
 }
@@ -1048,7 +1046,6 @@ void btm_sco_connected (UINT8 hci_status, BD_ADDR bda, UINT16 hci_handle,
     tBTM_CHG_ESCO_PARAMS parms;
 #endif
 
-    btm_cb.sco_cb.sco_disc_reason = hci_status;
     BTM_TRACE_API("%s, handle %x", __FUNCTION__, hci_handle);
 #if (BTM_MAX_SCO_LINKS>0)
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
@@ -1224,16 +1221,11 @@ void btm_sco_removed (UINT16 hci_handle, UINT8 reason)
 #if (BTM_MAX_SCO_LINKS>0)
     tSCO_CONN   *p = &btm_cb.sco_cb.sco_db[0];
     UINT16      xx;
-#endif
 
-    btm_cb.sco_cb.sco_disc_reason = reason;
-
-#if (BTM_MAX_SCO_LINKS>0)
     p = &btm_cb.sco_cb.sco_db[0];
     for (xx = 0; xx < BTM_MAX_SCO_LINKS; xx++, p++) {
         if ((p->state != SCO_ST_UNUSED) && (p->state != SCO_ST_LISTENING) && (p->hci_handle == hci_handle)) {
             btm_sco_flush_sco_data(xx);
-
             p->state = SCO_ST_UNUSED;
 #if BTM_SCO_HCI_INCLUDED == TRUE
             btm_cb.sco_cb.xmit_window_size += p->sent_not_acked;
@@ -1375,24 +1367,6 @@ UINT16 BTM_ReadScoPacketTypes (UINT16 sco_inx)
 #endif
 }
 
-/*******************************************************************************
-**
-** Function         BTM_ReadScoDiscReason
-**
-** Description      This function is returns the reason why an (e)SCO connection
-**                  has been removed. It contains the value until read, or until
-**                  another (e)SCO connection has disconnected.
-**
-** Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
-**
-*******************************************************************************/
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    UINT16 res = btm_cb.sco_cb.sco_disc_reason;
-    btm_cb.sco_cb.sco_disc_reason = BTM_INVALID_SCO_DISC_REASON;
-    return (res);
-}
-
 /*******************************************************************************
 **
 ** Function         BTM_ReadDeviceScoPacketTypes
@@ -1894,10 +1868,6 @@ UINT8 *BTM_ReadScoBdAddr(UINT16 sco_inx)
 {
     return ((UINT8 *) NULL);
 }
-UINT16 BTM_ReadScoDiscReason (void)
-{
-    return (BTM_INVALID_SCO_DISC_REASON);
-}
 tBTM_STATUS BTM_SetEScoMode (tBTM_SCO_TYPE sco_mode, tBTM_ESCO_PARAMS *p_parms)
 {
     return (BTM_MODE_UNSUPPORTED);

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -468,7 +468,6 @@ typedef struct {
     tSCO_CONN            sco_db[BTM_MAX_SCO_LINKS];
     tBTM_ESCO_PARAMS     def_esco_parms;
     BD_ADDR              xfer_addr;
-    UINT16               sco_disc_reason;
     BOOLEAN              esco_supported;    /* TRUE if 1.2 cntlr AND supports eSCO links */
     tBTM_SCO_TYPE        desired_sco_mode;
     tBTM_SCO_TYPE        xfer_sco_type;

components/bt/host/bluedroid/stack/include/stack/btm_api.h

@@ -1019,9 +1019,6 @@ typedef void (tBTM_ACL_DB_CHANGE_CB) (BD_ADDR p_bda, DEV_CLASS p_dc,
 #define BTM_INVALID_SCO_INDEX       0xFFFF
 #define BTM_INVALID_HCI_HANDLE      0xFFFF
 
-/* Define an invalid SCO disconnect reason */
-#define BTM_INVALID_SCO_DISC_REASON 0xFFFF
-
 /* Define first active SCO index */
 #define BTM_FIRST_ACTIVE_SCO_INDEX  BTM_MAX_SCO_LINKS
 
@@ -3236,21 +3233,6 @@ UINT16 BTM_ReadScoHandle (UINT16 sco_inx);
 UINT8 *BTM_ReadScoBdAddr (UINT16 sco_inx);
 
 
-/*******************************************************************************
-**
-** Function         BTM_ReadScoDiscReason
-**
-** Description      This function is returns the reason why an (e)SCO connection
-**                  has been removed. It contains the value until read, or until
-**                  another (e)SCO connection has disconnected.
-**
-** Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
-**
-*******************************************************************************/
-//extern
-UINT16 BTM_ReadScoDiscReason (void);
-
-
 /*******************************************************************************
 **
 ** Function         BTM_SetEScoMode

components/bt/include/esp32/include/esp_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -393,6 +393,15 @@ typedef enum {
     ESP_SCO_DATA_PATH_PCM = 1,            /*!< data over PCM interface */
 } esp_sco_data_path_t;
 
+/**
+ * @brief Bluetooth sleep clock
+ */
+typedef enum {
+    ESP_BT_SLEEP_CLOCK_NONE            = 0,   /*!< Sleep clock not configured */
+    ESP_BT_SLEEP_CLOCK_MAIN_XTAL       = 1,   /*!< SoC main crystal */
+    ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL    = 2,   /*!< External 32.768kHz crystal/oscillator */
+} esp_bt_sleep_clock_t;
+
 /**
  * @brief       Initialize the Bluetooth Controller to allocate tasks and other resources
  *
@@ -705,6 +714,29 @@ void esp_wifi_bt_power_domain_on(void);
 */
 void esp_wifi_bt_power_domain_off(void);
 
+/**
+ * @brief Get the Bluetooth module sleep clock source.
+ *
+ * @note This function should be called after `esp_bt_controller_init()`
+ *
+ * @return
+ *      - Clock source used in Bluetooth low power mode
+ */
+esp_bt_sleep_clock_t esp_bt_get_lpclk_src(void);
+
+/**
+ * @brief Set the Bluetooth module sleep clock source.
+ *
+ * @note This function should be called before `esp_bt_controller_init()`
+ *
+ * @param[in] lpclk Bluetooth sleep clock source
+ *
+ * @return
+ *       - ESP_OK: Success
+ *       - ESP_ERR_INVALID_ARG: Invalid argument
+ */
+esp_err_t esp_bt_set_lpclk_src(esp_bt_sleep_clock_t lpclk);
+
 #ifdef __cplusplus
 }
 #endif

components/esp_coex/lib

@@ -1 +1 @@
-Subproject commit 78de591727b5400ed62108e7e70ad27e404f5325
+Subproject commit f0f3731698d172c987ac3d22aff1e82c105169ea

components/esp_hw_support/port/esp32c6/pmu_sleep.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -112,19 +112,22 @@ uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_pe
     /* LP core hardware wait time, microsecond */
     const int lp_wakeup_wait_time_us        = rtc_time_slowclk_to_us(mc->lp.wakeup_wait_cycle, slowclk_period);
     const int lp_clk_switch_time_us         = rtc_time_slowclk_to_us(mc->lp.clk_switch_cycle, slowclk_period);
-    const int lp_clk_power_on_wait_time_us  = (pd_flags & PMU_SLEEP_PD_XTAL) ? mc->lp.xtal_wait_stable_time_us \
-                            : rtc_time_slowclk_to_us(mc->lp.clk_power_on_wait_cycle, slowclk_period);
-
+    /* If XTAL is used as RTC_FAST clock source, it is started in LP_SLEEP -> LP_ACTIVE stage and the clock waiting time is counted into lp_hw_wait_time */
+    const int lp_clk_power_on_wait_time_us  = mc->lp.xtal_wait_stable_time_us;
     const int lp_hw_wait_time_us = mc->lp.min_slp_time_us + mc->lp.analog_wait_time_us + lp_clk_power_on_wait_time_us \
                             + lp_wakeup_wait_time_us + lp_clk_switch_time_us + mc->lp.power_supply_wait_time_us \
                                 + mc->lp.power_up_wait_time_us;
 
     /* HP core hardware wait time, microsecond */
     const int hp_digital_power_up_wait_time_us = mc->hp.power_supply_wait_time_us + mc->hp.power_up_wait_time_us;
-    const int hp_regdma_wait_time_us = MAX(mc->hp.regdma_s2m_work_time_us + mc->hp.regdma_m2a_work_time_us, mc->hp.regdma_s2a_work_time_us);
-    const int hp_clock_wait_time_us = mc->hp.xtal_wait_stable_time_us + mc->hp.pll_wait_stable_time_us;
+    const int hp_regdma_wait_time_us = s_pmu_sleep_regdma_backup_enabled \
+                                    ? MAX(mc->hp.regdma_s2m_work_time_us + mc->hp.regdma_m2a_work_time_us, mc->hp.regdma_s2a_work_time_us) \
+                                    : 0;
+    /* If XTAL is not used as RTC_FAST clock source, it is started in HP_SLEEP -> HP_ACTIVE stage and the clock waiting time is counted into hp_hw_wait_time */
+    const int hp_clock_wait_time_us = (pd_flags & PMU_SLEEP_PD_XTAL) ? mc->hp.xtal_wait_stable_time_us + mc->hp.pll_wait_stable_time_us \
+                                    : mc->hp.pll_wait_stable_time_us;
 
-    const int hp_hw_wait_time_us = mc->hp.analog_wait_time_us + MAX(hp_digital_power_up_wait_time_us + hp_regdma_wait_time_us, hp_clock_wait_time_us);
+    const int hp_hw_wait_time_us = mc->hp.analog_wait_time_us + hp_digital_power_up_wait_time_us + hp_regdma_wait_time_us + hp_clock_wait_time_us;
 
     /* When the SOC wakeup (lp timer or GPIO wakeup) and Modem wakeup (Beacon wakeup) complete, the soc
      * wakeup will be delayed until the RF is turned on in Modem state.

components/esp_hw_support/port/esp32c6/private_include/pmu_param.h

@@ -474,7 +474,7 @@ typedef struct pmu_sleep_machine_constant {
         .regdma_rf_on_work_time_us      = 70,   \
         .regdma_rf_off_work_time_us     = 23,   \
         .xtal_wait_stable_time_us       = 250,  \
-        .pll_wait_stable_time_us        = 1     \
+        .pll_wait_stable_time_us        = 50    \
     }                                           \
 }
 

components/esp_hw_support/port/esp32h2/pmu_sleep.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -69,9 +69,8 @@ uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_pe
 
     /* LP core hardware wait time, microsecond */
     const int lp_clk_switch_time_us         = rtc_time_slowclk_to_us(mc->lp.clk_switch_cycle, slowclk_period);
-    const int lp_clk_power_on_wait_time_us  = (pd_flags & PMU_SLEEP_PD_XTAL) ? mc->lp.xtal_wait_stable_time_us \
-                            : rtc_time_slowclk_to_us(mc->lp.clk_power_on_wait_cycle, slowclk_period);
-
+    /* If XTAL is used as RTC_FAST clock source, it is started in LP_SLEEP -> LP_ACTIVE stage and the clock waiting time is counted into lp_hw_wait_time */
+    const int lp_clk_power_on_wait_time_us  = mc->lp.xtal_wait_stable_time_us;
     const int lp_hw_wait_time_us = mc->lp.min_slp_time_us + mc->lp.analog_wait_time_us + lp_clk_power_on_wait_time_us \
                                  + lp_clk_switch_time_us + mc->lp.power_supply_wait_time_us + mc->lp.power_up_wait_time_us;
 
@@ -83,9 +82,10 @@ uint32_t pmu_sleep_calculate_hw_wait_time(uint32_t pd_flags, uint32_t slowclk_pe
         mc->hp.regdma_s2a_work_time_us = PMU_REGDMA_S2A_WORK_TIME_PU_TOP_US;
     }
     const int hp_regdma_wait_time_us = mc->hp.regdma_s2a_work_time_us;
-    const int hp_clock_wait_time_us = mc->hp.xtal_wait_stable_time_us + mc->hp.pll_wait_stable_time_us;
-
-    const int hp_hw_wait_time_us = mc->hp.analog_wait_time_us + MAX(hp_digital_power_up_wait_time_us + hp_regdma_wait_time_us, hp_clock_wait_time_us);
+    /* If XTAL is not used as RTC_FAST clock source, it is started in HP_SLEEP -> HP_ACTIVE stage and the clock waiting time is counted into hp_hw_wait_time */
+    const int hp_clock_wait_time_us = (pd_flags & PMU_SLEEP_PD_XTAL) ? mc->hp.xtal_wait_stable_time_us + mc->hp.pll_wait_stable_time_us \
+                                    : mc->hp.pll_wait_stable_time_us;
+    const int hp_hw_wait_time_us = mc->hp.analog_wait_time_us + hp_digital_power_up_wait_time_us + hp_regdma_wait_time_us + hp_clock_wait_time_us;
 
     const int rf_on_protect_time_us = 0;
     const int total_hw_wait_time_us = lp_hw_wait_time_us + hp_hw_wait_time_us;

components/esp_hw_support/port/esp32h2/private_include/pmu_param.h

@@ -447,7 +447,7 @@ typedef struct pmu_sleep_machine_constant {
         .regdma_s2a_work_time_us        = PMU_REGDMA_S2A_WORK_TIME_PD_TOP_US, \
         .regdma_a2s_work_time_us        = 0,    \
         .xtal_wait_stable_time_us       = 250,  \
-        .pll_wait_stable_time_us        = 1     \
+        .pll_wait_stable_time_us        = 50    \
     }                                           \
 }
 

components/esp_hw_support/sleep_clock.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -10,6 +10,11 @@
 
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#include "soc/i2c_ana_mst_reg.h"
+#include "soc/regi2c_defs.h"
+#include "soc/pcr_reg.h"
+#include "modem/modem_syscon_reg.h"
+#include "modem/modem_lpcon_reg.h"
 
 #include "esp_err.h"
 #include "esp_log.h"
@@ -20,12 +25,6 @@
 #include "esp_private/sleep_retention.h"
 #include "esp_private/sleep_clock.h"
 
-#include "soc/pcr_reg.h"
-#include "modem/modem_syscon_reg.h"
-
-#if SOC_PM_RETENTION_SW_TRIGGER_REGDMA
-#include "modem/modem_lpcon_reg.h"
-#endif
 
 static __attribute__((unused)) const char *TAG = "sleep_clock";
 
@@ -37,11 +36,22 @@ static esp_err_t sleep_clock_system_retention_init(void *arg)
     #define N_REGS_PCR()    (((PCR_PWDET_SAR_CLK_CONF_REG - DR_REG_PCR_BASE) / 4) + 1)
 #endif
     const static sleep_retention_entries_config_t pcr_regs_retention[] = {
-        [0] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0),   DR_REG_PCR_BASE,            DR_REG_PCR_BASE,            N_REGS_PCR(),           0, 0), .owner = ENTRY(0) | ENTRY(2) },
-        [1] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(1),   PCR_RESET_EVENT_BYPASS_REG, PCR_RESET_EVENT_BYPASS_REG, 1,                      0, 0), .owner = ENTRY(0) | ENTRY(2) },
+        /* Enable i2c master clock */
+        [0] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(0),   MODEM_LPCON_CLK_CONF_REG,   MODEM_LPCON_CLK_I2C_MST_EN,     MODEM_LPCON_CLK_I2C_MST_EN_M,   1, 0), .owner = ENTRY(0) },
+        /* Start BBPLL self-calibration */
+        [1] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(1),   I2C_MST_ANA_CONF0_REG,      0,                              I2C_MST_BBPLL_STOP_FORCE_HIGH,  1, 0), .owner = ENTRY(0) },
+        [2] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(2),   I2C_MST_ANA_CONF0_REG,      I2C_MST_BBPLL_STOP_FORCE_LOW,   I2C_MST_BBPLL_STOP_FORCE_LOW,   1, 0), .owner = ENTRY(0) },
+        /* Wait calibration done */
+        [3] = { .config = REGDMA_LINK_WAIT_INIT      (REGDMA_PCR_LINK(3),   I2C_MST_ANA_CONF0_REG,      I2C_MST_BBPLL_CAL_DONE,         I2C_MST_BBPLL_CAL_DONE,         1, 0), .owner = ENTRY(0) },
+        /* Stop BBPLL self-calibration */
+        [4] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(4),   I2C_MST_ANA_CONF0_REG,      0,                              I2C_MST_BBPLL_STOP_FORCE_LOW,   1, 0), .owner = ENTRY(0) },
+        [5] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(5),   I2C_MST_ANA_CONF0_REG,      I2C_MST_BBPLL_STOP_FORCE_HIGH,  I2C_MST_BBPLL_STOP_FORCE_HIGH,  1, 0), .owner = ENTRY(0) },
+        /* Clock configuration retention */
+        [6] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(0),   DR_REG_PCR_BASE,            DR_REG_PCR_BASE,            N_REGS_PCR(),           0, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [7] = { .config = REGDMA_LINK_CONTINUOUS_INIT(REGDMA_PCR_LINK(1),   PCR_RESET_EVENT_BYPASS_REG, PCR_RESET_EVENT_BYPASS_REG, 1,                      0, 0), .owner = ENTRY(0) | ENTRY(2) },
 #if CONFIG_IDF_TARGET_ESP32H2
-        [2] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(2),   PCR_BUS_CLK_UPDATE_REG,     PCR_BUS_CLOCK_UPDATE,       PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
-        [3] = { .config = REGDMA_LINK_WAIT_INIT      (REGDMA_PCR_LINK(3),   PCR_BUS_CLK_UPDATE_REG,     0x0,                        PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [8] = { .config = REGDMA_LINK_WRITE_INIT     (REGDMA_PCR_LINK(2),   PCR_BUS_CLK_UPDATE_REG,     PCR_BUS_CLOCK_UPDATE,       PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
+        [9] = { .config = REGDMA_LINK_WAIT_INIT      (REGDMA_PCR_LINK(3),   PCR_BUS_CLK_UPDATE_REG,     0x0,                        PCR_BUS_CLOCK_UPDATE_M, 1, 0), .owner = ENTRY(0) | ENTRY(2) },
 #endif
     };
 

components/esp_wifi/lib

@@ -1 +1 @@
-Subproject commit 51c7952fc0050a283d40dcbdb7d97a823758c213
+Subproject commit 7d365e96bafc85d2d2a8ddbfe2a022907d81c5fe

components/wpa_supplicant/esp_supplicant/src/esp_common.c

@@ -782,15 +782,16 @@ int wpa_drv_send_action(struct wpa_supplicant *wpa_s,
 			const u8 *data, size_t data_len,
 			int no_cck)
 {
-	int ret = 0;
-	wifi_mgmt_frm_req_t *req = os_zalloc(sizeof(*req) + data_len);;
-	if (!req)
-		return -1;
+	int ret = -1;
+	wifi_mgmt_frm_req_t *req;
 
 	if (!wpa_s->current_bss) {
-		wpa_printf(MSG_ERROR, "STA not associated, return");
-		ret = -1;
-		goto cleanup;
+		return ret;
+	}
+
+	req = os_zalloc(sizeof(*req) + data_len);
+	if (!req) {
+		return ret;
 	}
 
 	req->ifx = WIFI_IF_STA;
@@ -798,14 +799,14 @@ int wpa_drv_send_action(struct wpa_supplicant *wpa_s,
 	req->data_len = data_len;
 	os_memcpy(req->data, data, req->data_len);
 
-	if (esp_wifi_send_mgmt_frm_internal(req) != 0) {
-		wpa_printf(MSG_ERROR, "action frame sending failed");
-		ret = -1;
-		goto cleanup;
-	}
-	wpa_printf(MSG_INFO, "action frame sent");
+	ret = esp_wifi_send_mgmt_frm_internal(req);
+
+	if (ret != 0) {
+		wpa_printf(MSG_ERROR, "action frame sending failed");
+	} else {
+		wpa_printf(MSG_INFO, "action frame sent");
+	}
 
-cleanup:
 	os_free(req);
 	return ret;
 }

components/wpa_supplicant/esp_supplicant/src/esp_hostap.c

@@ -308,8 +308,7 @@ u16 esp_send_assoc_resp(struct hostapd_data *hapd, const u8 *addr,
     reply = os_zalloc(sizeof(wifi_mgmt_frm_req_t) + sizeof(uint16_t));
     if (!reply) {
         wpa_printf(MSG_ERROR, "failed to allocate memory for assoc response");
-        res = WLAN_STATUS_UNSPECIFIED_FAILURE;
-        goto done;
+        return WLAN_STATUS_UNSPECIFIED_FAILURE;
     }
     reply->ifx = WIFI_IF_AP;
     reply->subtype = subtype;
@@ -322,7 +321,6 @@ u16 esp_send_assoc_resp(struct hostapd_data *hapd, const u8 *addr,
         wpa_printf(MSG_INFO, "esp_send_assoc_resp_failed: send failed");
     }
 #undef ASSOC_RESP_LENGTH
-done:
     os_free(reply);
     return res;
 }

components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -673,32 +673,39 @@ int esp_send_sae_auth_reply(struct hostapd_data *hapd,
                             u16 auth_alg, u16 auth_transaction, u16 resp,
                             const u8 *ies, size_t ies_len)
 {
-    int reply_res = ESP_FAIL;
-    ies_len += 3 * sizeof(uint16_t);
+    int status = ESP_FAIL;
+    /* Calculate total frame data length (auth_alg + transaction + resp + IEs) */
+    size_t data_len = ies_len + 3 * sizeof(uint16_t);
 
-    wifi_mgmt_frm_req_t *req = os_zalloc(sizeof(*req) + ies_len);
+    wifi_mgmt_frm_req_t *req = os_zalloc(sizeof(*req) + data_len);
     if (!req) {
-        wpa_printf(MSG_ERROR, "failed to send sae auth reply");
-        return reply_res;
+        wpa_printf(MSG_ERROR, "Failed to allocate SAE authentication reply");
+        return status;
+    }
+
+    /* Populate the frame data */
+    ((uint16_t *)req->data)[0] = htole16(auth_alg); /* Authentication algorithm */
+    ((uint16_t *)req->data)[1] = htole16(auth_transaction); /* Transaction number */
+    ((uint16_t *)req->data)[2] = htole16(resp); /* Response code */
+
+    if (ies && ies_len) {
+        os_memcpy(&((uint16_t *)req->data)[3], ies, ies_len);
     }
-    ((uint16_t *)req->data)[0] = htole16(auth_alg);
-    ((uint16_t *)req->data)[1] = htole16(auth_transaction);
-    ((uint16_t *)req->data)[2] = htole16(resp);
-    os_memcpy(&((uint16_t *)req->data)[3], ies, ies_len - 3 * sizeof(uint16_t));
 
     req->ifx = WIFI_IF_AP;
     req->subtype = (WLAN_FC_STYPE_AUTH << 4);
-    req->data_len = ies_len;
+    req->data_len = data_len;
     os_memcpy(req->da, bssid, ETH_ALEN);
 
     if (esp_wifi_send_mgmt_frm_internal(req) != 0) {
-        wpa_printf(MSG_INFO, "%s: send failed", __func__);
+        wpa_printf(MSG_INFO, "%s: SAE authentication reply send failed", __func__);
     } else {
-        reply_res = ESP_OK;
+        status = ESP_OK;
     }
 
     os_free(req);
-    return reply_res;
+
+    return status;
 }
 
 void esp_wifi_register_wpa3_ap_cb(struct wpa_funcs *wpa_cb)

components/wpa_supplicant/esp_supplicant/src/esp_wps.c

@@ -1637,7 +1637,7 @@ wifi_wps_scan_done(void *arg, ETS_STATUS status)
             sm->ignore_sel_reg = true;
         }
         eloop_cancel_timeout(wifi_wps_scan, NULL, NULL);
-        eloop_register_timeout(0, 100*1000, wifi_wps_scan, NULL, NULL);
+        eloop_register_timeout(2, 0, wifi_wps_scan, NULL, NULL);
     } else {
         return;
     }

components/wpa_supplicant/esp_supplicant/src/esp_wps_i.h

@@ -50,7 +50,7 @@ enum wps_sm_state{
 };
 #endif /* ESP_SUPPLICANT */
 
-#define WPS_IGNORE_SEL_REG_MAX_CNT	4
+#define WPS_IGNORE_SEL_REG_MAX_CNT  10
 
 #define WPS_MAX_DIS_AP_NUM	10
 

components/wpa_supplicant/src/common/sae_pk.c

@@ -620,6 +620,7 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	int group;
 	struct wpa_supplicant *wpa_s = &g_wpa_supp;
 	struct sae_pk_elems elems;
+	int ret = 0;
 
 	if (!tmp) {
 		return -1;
@@ -650,7 +651,8 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	if (!elems.fils_pk || !elems.fils_key_confirm || !elems.sae_pk) {
 		wpa_printf(MSG_INFO,
 				   "SAE-PK: Not all mandatory IEs included in confirm");
-		return -1;
+		ret = -1;
+		goto done;
 	}
 
 	/* TODO: Fragment reassembly */
@@ -658,7 +660,8 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	if (elems.sae_pk_len < SAE_PK_M_LEN + AES_BLOCK_SIZE) {
 		wpa_printf(MSG_INFO,
 				   "SAE-PK: No room for EncryptedModifier in SAE-PK element");
-		return -1;
+		ret = -1;
+		goto done;
 	}
 
 	wpa_hexdump(MSG_DEBUG, "SAE-PK: EncryptedModifier",
@@ -669,14 +672,16 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 						0, NULL, NULL, m) < 0) {
 		wpa_printf(MSG_INFO,
 				   "SAE-PK: Failed to decrypt EncryptedModifier");
-		return -1;
+		ret = -1;
+		goto done;
 	}
 	wpa_hexdump_key(MSG_DEBUG, "SAE-PK: Modifier M", m, SAE_PK_M_LEN);
 
 	if (elems.fils_pk[0] != 2) {
 		wpa_printf(MSG_INFO, "SAE-PK: Unsupported public key type %u",
 				   elems.fils_pk[0]);
-		return -1;
+		ret = -1;
+		goto done;
 	}
 	k_ap_len = elems.fils_pk_len - 1;
 	k_ap = elems.fils_pk + 1;
@@ -686,13 +691,15 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	key = crypto_ec_key_parse_pub(k_ap, k_ap_len);
 	if (!key) {
 		wpa_printf(MSG_INFO, "SAE-PK: Failed to parse K_AP");
-		return -1;
+		ret = -1;
+		goto done;
 	}
 	group = crypto_ec_key_group(key);
 	if (!sae_pk_valid_fingerprint(sae, m, SAE_PK_M_LEN, k_ap, k_ap_len,
 								  group)) {
 		crypto_ec_key_deinit(key);
-		return -1;
+		ret = -1;
+		goto done;
 	}
 
 	wpa_hexdump(MSG_DEBUG, "SAE-PK: Received KeyAuth",
@@ -702,7 +709,8 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	if (sae_pk_hash_sig_data(sae, hash_len, false, m, SAE_PK_M_LEN,
 							 k_ap, k_ap_len, hash) < 0) {
 		crypto_ec_key_deinit(key);
-		return -1;
+		ret = -1;
+		goto done;
 	}
 
 	res = crypto_ec_key_verify_signature(key, hash, hash_len,
@@ -713,12 +721,25 @@ int sae_check_confirm_pk(struct sae_data *sae, const u8 *ies, size_t ies_len)
 	if (res != 1) {
 		wpa_printf(MSG_INFO,
 				   "SAE-PK: Invalid or incorrect signature in KeyAuth");
-		return -1;
+		ret = -1;
+		goto done;
 	}
 
 	wpa_printf(MSG_DEBUG, "SAE-PK: Valid KeyAuth signature received");
 
 	/* TODO: Store validated public key into network profile */
-	return 0;
+done:
+	if (wpa_s->sae_pk_elems.fils_pk) {
+		os_free(wpa_s->sae_pk_elems.fils_pk);
+	}
+	if (wpa_s->sae_pk_elems.sae_pk) {
+		os_free(wpa_s->sae_pk_elems.sae_pk);
+	}
+	if (wpa_s->sae_pk_elems.fils_key_confirm) {
+		os_free(wpa_s->sae_pk_elems.fils_key_confirm);
+	}
+	os_memset(&wpa_s->sae_pk_elems, 0, sizeof(wpa_s->sae_pk_elems));
+
+	return ret;
 }
 #endif /* CONFIG_SAE_PK */

components/wpa_supplicant/src/rsn_supp/wpa.c

@@ -188,21 +188,9 @@ static bool is_wpa2_enterprise_connection(void)
 }
 #endif
 
-/**
- * get_bssid - Get the current BSSID
- * @priv: private driver interface data
- * @bssid: buffer for BSSID (ETH_ALEN = 6 bytes)
- *
- * Returns: 0 on success, -1 on failure
- *
- * Query kernel driver for the current BSSID and copy it to bssid.
- * Setting bssid to 00:00:00:00:00:00 is recommended if the STA is not
- * associated.
- */
-static inline int   wpa_sm_get_bssid(struct wpa_sm *sm, u8 *bssid)
+const u8 * wpa_sm_get_auth_addr(struct wpa_sm *sm)
 {
-    memcpy(bssid, sm->bssid, ETH_ALEN);
-    return 0;
+    return sm->bssid;
 }
 
  /*
@@ -232,11 +220,13 @@ static inline int wpa_sm_ether_send(struct wpa_sm *sm, const u8 *dest, u16 proto
  * @msg_len: Length of message
  * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
  */
-void wpa_eapol_key_send(struct wpa_sm *sm, const u8 *kck, size_t kck_len,
+int  wpa_eapol_key_send(struct wpa_sm *sm, const u8 *kck, size_t kck_len,
                         int ver, const u8 *dest, u16 proto,
                         u8 *msg, size_t msg_len, u8 *key_mic)
 {
+    int ret = -1;
     if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
+#ifndef ESP_SUPPLICANT
         /*
          * Association event was not yet received; try to fetch
          * BSSID from the driver.
@@ -250,6 +240,9 @@ void wpa_eapol_key_send(struct wpa_sm *sm, const u8 *kck, size_t kck_len,
                    ") as the destination for EAPOL-Key",
                    MAC2STR(dest));
         }
+#else
+        return ret;
+#endif
     }
     if (key_mic &&
         wpa_eapol_key_mic(kck, kck_len, sm->key_mgmt, ver, msg, msg_len,
@@ -262,9 +255,9 @@ void wpa_eapol_key_send(struct wpa_sm *sm, const u8 *kck, size_t kck_len,
     wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", kck, kck_len);
     wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC", key_mic, wpa_mic_len(sm->key_mgmt, sm->pmk_len));
     wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
-    wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
+    return wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
 out:
-    return;
+    return ret;
 }
 
 /**
@@ -283,7 +276,7 @@ static void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
     struct wpa_eapol_key *reply;
     struct wpa_eapol_key_192 *reply192;
     int key_info, ver;
-    u8 bssid[ETH_ALEN], *rbuf, *key_mic;
+    u8 *rbuf, *key_mic;
 
     if (sm->key_mgmt == WPA_KEY_MGMT_OSEN || wpa_key_mgmt_suite_b(sm->key_mgmt))
         ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
@@ -296,12 +289,6 @@ static void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
     else
         ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
 
-    if (wpa_sm_get_bssid(sm, bssid) < 0) {
-        wpa_printf(MSG_DEBUG, "Failed to read BSSID for EAPOL-Key "
-               "request");
-        return;
-    }
-
     mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
     hdrlen = mic_len == 24 ? sizeof(*reply192) : sizeof(*reply);
     rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
@@ -343,7 +330,7 @@ static void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
     wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key Request (error=%d "
            "pairwise=%d ptk_set=%d len=%lu)",
            error, pairwise, sm->ptk_set, (unsigned long) rlen);
-    wpa_eapol_key_send(sm, sm->ptk.kck, sm->ptk.kck_len, ver, bssid,
+    wpa_eapol_key_send(sm, sm->ptk.kck, sm->ptk.kck_len, ver, wpa_sm_get_auth_addr(sm),
                        ETH_P_EAPOL, rbuf, rlen, key_mic);
     wpa_sm_free_eapol(rbuf);
 }

docs/en/api-guides/coexist.rst

@@ -6,7 +6,7 @@ RF Coexistence
 Overview
 ---------------
 
-ESP boards now support three modules: Bluetooth (BT & BLE), IEEE802.15.4, and Wi-Fi. Each type of board has only one 2.4 GHz ISM band RF module, shared by two or three modules. Consequently, a module cannot receive or transmit data while another module is engaged in data transmission or reception. In such scenarios, {IDF_TARGET_NAME} employs the time-division multiplexing method to manage the reception and transmission of packets.
+ESP boards now support three modules: Bluetooth (BT & BLE), IEEE 802.15.4 (Thread / Zigbee), and Wi-Fi. Each type of board has only one 2.4 GHz ISM band RF module, shared by two or three modules. Consequently, a module cannot receive or transmit data while another module is engaged in data transmission or reception. In such scenarios, {IDF_TARGET_NAME} employs the time-division multiplexing method to manage the reception and transmission of packets.
 
 
 Supported Coexistence Scenario for {IDF_TARGET_NAME}
@@ -16,32 +16,32 @@ Supported Coexistence Scenario for {IDF_TARGET_NAME}
 
   .. table:: Supported Features of Wi-Fi and BLE Coexistence
 
-      +-------+--------+-----------+-----+------------+-----------+----------+
+      +-------+--------+-----------+-----+------------+----------+
       |                            |BLE                          |
-      +                            +-----+------------+-----------+----------+
-      |                            |Scan |Advertising |Connecting |Connected |
-      +-------+--------+-----------+-----+------------+-----------+----------+
-      | Wi-Fi |STA     |Scan       |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connecting |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connected  |Y    |Y           |Y          |Y         |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |SOFTAP  |TX Beacon  |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connecting |C1   |C1          |C1         |C1        |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connected  |C1   |C1          |C1         |C1        |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |Sniffer |RX         |C1   |C1          |C1         |C1        |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |ESP-NOW |RX         |S    |S           |S          |S         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |TX         |Y    |Y           |Y          |Y         |
-      +-------+--------+-----------+-----+------------+-----------+----------+
+      +                            +-----+------------+----------+
+      |                            |Scan |Advertising |Connected |
+      +-------+--------+-----------+-----+------------+----------+
+      | Wi-Fi |STA     |Scan       |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connecting |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connected  |Y    |Y           |Y         |
+      +       +--------+-----------+-----+------------+----------+
+      |       |SOFTAP  |TX Beacon  |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connecting |C1   |C1          |C1        |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connected  |C1   |C1          |C1        |
+      +       +--------+-----------+-----+------------+----------+
+      |       |Sniffer |RX         |C1   |C1          |C1        |
+      +       +--------+-----------+-----+------------+----------+
+      |       |ESP-NOW |RX         |S    |S           |S         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |TX         |Y    |Y           |Y         |
+      +-------+--------+-----------+-----+------------+----------+
 
 
-.. only:: esp32
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED
 
   .. table:: Supported Features of Wi-Fi and Classic Bluetooth (BT) Coexistence
 
@@ -69,31 +69,62 @@ Supported Coexistence Scenario for {IDF_TARGET_NAME}
       |       |        |TX         |Y       |Y            |Y    |Y         |Y          |
       +-------+--------+-----------+--------+-------------+-----+----------+-----------+
 
-.. only:: SOC_IEEE802154_SUPPORTED
+.. only:: SOC_WIFI_SUPPORTED and SOC_IEEE802154_SUPPORTED
 
-  .. table:: Supported Features of Thread (IEEE802.15.4) and BLE Coexistence
+  .. table:: Supported Features of Wi-Fi and IEEE 802.15.4 (Thread / Zigbee) Coexistence
 
-      +--------+-----------------+-----+------------+-----------+----------+
+      +-------+--------+-----------+--------+---------+-----------+
+      |                            |Thread / Zigbee               |
+      +                            +--------+---------+-----------+
+      |                            |Scan    |Router   |End Device |
+      +-------+--------+-----------+--------+---------+-----------+
+      | Wi-Fi |STA     |Scan       |C1      |C1       |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connecting |C1      |C1       |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connected  |C1      |C1       |Y          |
+      +       +--------+-----------+--------+---------+-----------+
+      |       |SOFTAP  |TX Beacon  |Y       |X        |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connecting |C1      |X        |C1         |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connected  |C1      |X        |C1         |
+      +       +--------+-----------+--------+---------+-----------+
+      |       |Sniffer |RX         |C1      |X        |C1         |
+      +-------+--------+-----------+--------+---------+-----------+
+
+.. only:: SOC_BLE_SUPPORTED and SOC_IEEE802154_SUPPORTED
+
+  .. table:: Supported Features of IEEE 802.15.4 (Thread / Zigbee) and BLE Coexistence
+
+      +-----------------+-------------+-----+------------+----------+
       |                               |BLE                          |
-      +                          +-----+------------+-----------+----------+
-      |                          |Scan |Advertising |Connecting |Connected |
-      +--------+-----------------+-----+------------+-----------+----------+
-      | Thread |Scan             |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connecting       |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connected        |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connected        |     |            |           |          |
-      |        |(high throughput)|X    |C1          |C1         |C1        |
-      +--------+-----------------+-----+------------+-----------+----------+
+      +                               +-----+------------+----------+
+      |                               |Scan |Advertising |Connected |
+      +-----------------+-------------+-----+------------+----------+
+      | Thread / Zigbee |Scan         |X    |Y           |Y         |
+      +                 +-------------+-----+------------+----------+
+      |                 |Router       |X    |Y           |Y         |
+      +                 +-------------+-----+------------+----------+
+      |                 |End Device   |C1   |Y           |Y         |
+      +-----------------+-------------+-----+------------+----------+
 
 .. note::
 
-  Y: supported and performance is stable
-  C1: supported but the performance is unstable
-  X: not supported
-  S: supported and performance is stable in STA mode, otherwise not supported
+  .. list::
+
+    - Y: supported and the performance is stable
+    - C1: supported but the performance is unstable
+    - X: not supported
+    :SOC_WIFI_SUPPORTED: - S: supported and the performance is stable in STA mode, otherwise not supported
+
+.. only:: SOC_IEEE802154_SUPPORTED
+
+  .. note::
+
+    Routers in Thread and Zigbee networks maintain unsynchronized links with their neighbors, requiring continuous signal reception. With only a single RF path, increased Wi-Fi or BLE traffic may lead to higher packet loss rates for Thread and Zigbee communications.
+
+    To build a Wi-Fi based Thread Border Router or Zigbee Gateway product, we recommend using a dual-SoC solution (e.g., ESP32-S3 + ESP32-H2) with separate antennas. This setup enables simultaneous reception of Wi-Fi and 802.15.4 signals, ensuring optimal performance.
 
 
 Coexistence Mechanism and Policy
@@ -102,7 +133,7 @@ Coexistence Mechanism and Policy
 Coexistence Mechanism
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-The RF resource allocation mechanism is based on priority. As shown below, both Bluetooth module and Wi-Fi module request RF resources from the coexistence module, and the coexistence module decides who will use the RF resource based on their priority.
+The RF resource allocation mechanism is based on priority. As shown below, Wi-Fi, Bluetooth and 802.15.4 modules request RF resources from the coexistence module, and the coexistence module decides who will use the RF resource based on their priority.
 
 .. blockdiag::
     :scale: 100%
@@ -122,12 +153,14 @@ The RF resource allocation mechanism is based on priority. As shown below, both
       # node labels
        Wi-Fi [shape = box];
        Bluetooth [shape = box];
+       802.15.4 [shape = box];
        Coexistence [shape = box, label = 'Coexistence module'];
        RF [shape = box, label = 'RF module'];
 
       # node connections
        Wi-Fi -> Coexistence;
        Bluetooth  -> Coexistence;
+       802.15.4  -> Coexistence;
        Coexistence -> RF;
     }
 
@@ -137,26 +170,24 @@ The RF resource allocation mechanism is based on priority. As shown below, both
 Coexistence Policy
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_SUPPORTED
+
   Coexistence Period and Time Slice
   """"""""""""""""""""""""""""""""""""""""
 
-.. only:: esp32
+  .. only:: SOC_BLE_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED
 
     Wi-Fi, BT, and BLE have their fixed time slice to use the RF. A coexistence period is divided into 3 time slices in the order of Wi-Fi, BT, and BLE. In the Wi-Fi slice, Wi-Fi's request to the coexistence arbitration module will have higher priority. Similarly, BT/BLE can enjoy higher priority at their own time slices. The duration of the coexistence period and the proportion of each time slice are divided into four categories according to the Wi-Fi status:
 
 
-.. only:: SOC_WIFI_SUPPORTED and SOC_BLE_SUPPORTED and not esp32
+  .. only:: not SOC_BT_CLASSIC_SUPPORTED
 
     Wi-Fi and BLE have their fixed time slice to use the RF. In the Wi-Fi time slice, Wi-Fi will send a higher priority request to the coexistence arbitration module. Similarly, BLE can enjoy higher priority at their own time slice. The duration of the coexistence period and the proportion of each time slice are divided into four categories according to the Wi-Fi status:
 
-.. only:: SOC_IEEE802154_SUPPORTED
-
-  Currently, the only supported strategy ensures that the priority of BLE always takes precedence over IEEE802.15.4.
-
   .. list::
 
-  :esp32: 1) IDLE status: the coexistence of BT and BLE is controlled by Bluetooth module.
-  :SOC_WIFI_SUPPORTED and SOC_BLE_SUPPORTED and not esp32: 1) IDLE status: RF module is controlled by Bluetooth module.
+    :SOC_BLE_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED: 1) IDLE status: the coexistence of BT and BLE is controlled by Bluetooth module.
+    :not SOC_BT_CLASSIC_SUPPORTED: 1) IDLE status: RF module is controlled by Bluetooth module.
     #) CONNECTED status: the coexistence period starts at the Target Beacon Transmission Time (TBTT) and is more than 100 ms.
     #) SCAN status: Wi-Fi slice and coexistence period are longer than in the CONNECTED status. To ensure Bluetooth performance, the Bluetooth time slice will also be adjusted accordingly.
     #) CONNECTING status: Wi-Fi slice is longer than in the CONNECTED status. To ensure Bluetooth performance, the Bluetooth time slice will also be adjusted accordingly.
@@ -171,6 +202,11 @@ According to the coexistence logic, different coexistence periods and time slice
 
       Time Slice Under the Status of Wi-Fi CONNECTED and BLE CONNECTED
 
+.. only:: SOC_IEEE802154_SUPPORTED
+
+  The IEEE 802.15.4 module requests RF resources based on pre-assigned priorities. Normal receive operations are assigned the lowest priority, meaning Wi-Fi and BLE will take over the RF whenever needed, while 802.15.4 can only receive during the remaining time. Other 802.15.4 operations, such as transmitting or receiving ACKs and transmitting or receiving at given time, are assigned higher priorities. However, their access to RF ultimately depends on the priorities of Wi-Fi and BLE operations at that moment.
+
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_SUPPORTED
 
   Dynamic Priority
   """"""""""""""""""""""""""""

docs/zh_CN/api-guides/coexist.rst

@@ -6,7 +6,7 @@ RF 共存
 概览
 -----
 
-ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）, IEEE802.15.4 和 Wi-Fi, 而每款芯片只支持一路被多个射频收发模块共享的 RF，不同模块无法同时使用 RF 收发数据，因此采用时分复用的方法调节不同模块的数据包收发。
+ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）, IEEE 802.15.4 (Thread / Zigbee) 和 Wi-Fi, 而每款芯片只支持一路被多个射频收发模块共享的 RF，不同模块无法同时使用 RF 收发数据，因此采用时分复用的方法调节不同模块的数据包收发。
 
 
 {IDF_TARGET_NAME} 支持的共存场景
@@ -14,36 +14,36 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
 
 .. only:: SOC_WIFI_SUPPORTED and SOC_BLE_SUPPORTED
 
-  .. table:: 表 1  Wi-Fi 和 BLE 共存支持功能
+  .. table:: Wi-Fi 和 BLE 共存支持功能
 
-      +-------+--------+-----------+-----+------------+-----------+----------+
+      +-------+--------+-----------+-----+------------+----------+
       |                            |BLE                          |
-      +                            +-----+------------+-----------+----------+
-      |                            |Scan |Advertising |Connecting |Connected |
-      +-------+--------+-----------+-----+------------+-----------+----------+
-      | Wi-Fi |STA     |Scan       |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connecting |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connected  |Y    |Y           |Y          |Y         |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |SOFTAP  |TX Beacon  |Y    |Y           |Y          |Y         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connecting |C1   |C1          |C1         |C1        |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |Connected  |C1   |C1          |C1         |C1        |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |Sniffer |RX         |C1   |C1          |C1         |C1        |
-      +       +--------+-----------+-----+------------+-----------+----------+
-      |       |ESP-NOW |RX         |S    |S           |S          |S         |
-      +       +        +-----------+-----+------------+-----------+----------+
-      |       |        |TX         |Y    |Y           |Y          |Y         |
-      +-------+--------+-----------+-----+------------+-----------+----------+
+      +                            +-----+------------+----------+
+      |                            |Scan |Advertising |Connected |
+      +-------+--------+-----------+-----+------------+----------+
+      | Wi-Fi |STA     |Scan       |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connecting |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connected  |Y    |Y           |Y         |
+      +       +--------+-----------+-----+------------+----------+
+      |       |SOFTAP  |TX Beacon  |Y    |Y           |Y         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connecting |C1   |C1          |C1        |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |Connected  |C1   |C1          |C1        |
+      +       +--------+-----------+-----+------------+----------+
+      |       |Sniffer |RX         |C1   |C1          |C1        |
+      +       +--------+-----------+-----+------------+----------+
+      |       |ESP-NOW |RX         |S    |S           |S         |
+      +       +        +-----------+-----+------------+----------+
+      |       |        |TX         |Y    |Y           |Y         |
+      +-------+--------+-----------+-----+------------+----------+
 
 
-.. only:: esp32
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED
 
-  .. table:: 表 2  Wi-Fi 和经典蓝牙 (BT) 共存支持功能
+  .. table:: Wi-Fi 和经典蓝牙 (BT) 共存支持功能
 
       +-------+--------+-----------+--------+-------------+-----+----------+-----------+
       |                            |BR/EDR                                             |
@@ -69,31 +69,62 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
       |       |        |TX         |Y       |Y            |Y    |Y         |Y          |
       +-------+--------+-----------+--------+-------------+-----+----------+-----------+
 
-.. only:: SOC_IEEE802154_SUPPORTED
+.. only:: SOC_WIFI_SUPPORTED and SOC_IEEE802154_SUPPORTED
 
-  .. table:: 表 3  Thread (IEEE802.15.4) 和 BLE 共存支持功能
+  .. table:: Wi-Fi 和 IEEE 802.15.4 (Thread / Zigbee) 共存支持功能
 
-      +--------+-----------------+-----+------------+-----------+----------+
+      +-------+--------+-----------+--------+---------+-----------+
+      |                            |Thread / Zigbee               |
+      +                            +--------+---------+-----------+
+      |                            |Scan    |Router   |End Device |
+      +-------+--------+-----------+--------+---------+-----------+
+      | Wi-Fi |STA     |Scan       |C1      |C1       |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connecting |C1      |C1       |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connected  |C1      |C1       |Y          |
+      +       +--------+-----------+--------+---------+-----------+
+      |       |SOFTAP  |TX Beacon  |Y       |X        |Y          |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connecting |C1      |X        |C1         |
+      +       +        +-----------+--------+---------+-----------+
+      |       |        |Connected  |C1      |X        |C1         |
+      +       +--------+-----------+--------+---------+-----------+
+      |       |Sniffer |RX         |C1      |X        |C1         |
+      +-------+--------+-----------+--------+---------+-----------+
+
+.. only:: SOC_BLE_SUPPORTED and SOC_IEEE802154_SUPPORTED
+
+  .. table:: IEEE 802.15.4 (Thread / Zigbee) 和 BLE 共存支持功能
+
+      +-----------------+-------------+-----+------------+----------+
       |                               |BLE                          |
-      +                          +-----+------------+-----------+----------+
-      |                          |Scan |Advertising |Connecting |Connected |
-      +--------+-----------------+-----+------------+-----------+----------+
-      | Thread |Scan             |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connecting       |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connected        |X    |Y           |Y          |Y         |
-      +        +-----------------+-----+------------+-----------+----------+
-      |        |Connected        |     |            |           |          |
-      |        |(high throughput)|X    |C1          |C1         |C1        |
-      +--------+-----------------+-----+------------+-----------+----------+
+      +                               +-----+------------+----------+
+      |                               |Scan |Advertising |Connected |
+      +-----------------+-------------+-----+------------+----------+
+      | Thread / Zigbee |Scan         |X    |Y           |Y         |
+      +                 +-------------+-----+------------+----------+
+      |                 |Router       |X    |Y           |Y         |
+      +                 +-------------+-----+------------+----------+
+      |                 |End Device   |C1   |Y           |Y         |
+      +-----------------+-------------+-----+------------+----------+
 
 .. note::
 
-  Y：支持且性能稳定。
-  C1：不能保证性能处于稳定状态。
-  X：不支持。
-  S：在 STA 模式下支持且性能稳定，否则不支持。
+  .. list::
+
+    - Y：支持且性能稳定。
+    - C1：不能保证性能处于稳定状态。
+    - X：不支持。
+    :SOC_WIFI_SUPPORTED: - S：在 STA 模式下支持且性能稳定，否则不支持。
+
+.. only:: SOC_IEEE802154_SUPPORTED
+
+  .. note::
+
+    Thread 和 Zigbee 网络中的路由节点与其邻居保持非同步连接，因此需要持续接收信号。在仅有单一 RF 通路的情况下，Wi-Fi 或 BLE 流量的增加可能导致 Thread 和 Zigbee 通信的丢包率上升。
+
+    为了构建基于 Wi-Fi 的 Thread 边界路由器或 Zigbee 网关产品，我们推荐采用双 SoC 方案（例如 ESP32-S3 + ESP32-H2），使用独立的 RF。这种配置能够同时接收 Wi-Fi 和 802.15.4 信号，确保最佳性能。
 
 
 共存机制与策略
@@ -102,7 +133,7 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
 共存机制
 ^^^^^^^^^^^^^^
 
-基于优先级抢占的 RF 资源分配机制，如下图所示，Bluetooth 模块和 Wi-Fi 模块向共存模块申请 RF 资源，共存模块根据二者的优先级高低裁决 RF 归谁使用。
+基于优先级抢占的 RF 资源分配机制，如下图所示，Bluetooth，Wi-Fi 和 802.15.4 模块向共存模块申请 RF 资源，共存模块根据三者的优先级高低裁决 RF 归谁使用。
 
 .. blockdiag::
     :scale: 100%
@@ -122,12 +153,14 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
       # node labels
       Wi-Fi [shape = box];
       Bluetooth [shape = box];
+      802.15.4 [shape = box];
       Coexistence [shape = box, label = 'Coexistence module'];
       RF [shape = box, label = 'RF module'];
 
       # node connections
       Wi-Fi -> Coexistence;
       Bluetooth  -> Coexistence;
+      802.15.4  -> Coexistence;
       Coexistence -> RF;
     }
 
@@ -137,26 +170,24 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
 共存策略
 ^^^^^^^^^^^^^^
 
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_SUPPORTED
+
   共存周期和时间片
   """""""""""""""""""
 
-.. only:: esp32
+  .. only:: SOC_BLE_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED
 
     Wi-Fi、BT、BLE 三者对于 RF 的使用，主要是按照时间片来划分的。在一个共存周期内，按照 Wi-Fi、BT、BLE 的顺序划分时间片。在 Wi-Fi 的时间片内，Wi-Fi 会向共存仲裁模块发出较高优先级的请求，同理，BT/BLE 在自己的时间片内会具有较高优先级。共存周期大小和各个时间片占比根据 Wi-Fi 的状态分成四类：
 
 
-.. only:: SOC_WIFI_SUPPORTED and SOC_BLE_SUPPORTED and not esp32
+  .. only:: not SOC_BT_CLASSIC_SUPPORTED
 
     Wi-Fi、BLE 二者对于 RF 的使用，主要是按照时间片来划分的。在 Wi-Fi 的时间片内，Wi-Fi 会向共存仲裁模块发出较高优先级的请求，在 Bluetooth 的时间片内，BLE 会具有较高优先级。共存周期大小和各个时间片占比根据 Wi-Fi 的状态分成四类：
 
-.. only:: SOC_IEEE802154_SUPPORTED
-
-  目前, 当 BLE 与 IEEE802.15.4 共存时, ESP 芯片使用的策略为 BLE 优先级始终优先于 IEEE802.15.4。
-
   .. list::
 
-  :esp32: 1) IDLE 状态：BT 和 BLE 共存由 Bluetooth 模块控制。
-  :SOC_WIFI_SUPPORTED and SOC_BLE_SUPPORTED and not esp32: 1) IDLE 状态：RF 模块由 Bluetooth 模块控制。
+    :SOC_BLE_SUPPORTED and SOC_BT_CLASSIC_SUPPORTED: 1) IDLE 状态：BT 和 BLE 共存由 Bluetooth 模块控制。
+    :not SOC_BT_CLASSIC_SUPPORTED: 1) IDLE 状态：RF 模块由 Bluetooth 模块控制。
     #) CONNECTED 状态：共存周期以目标信标传输时间 (Target Beacon Transmission Time, TBTT) 点为起始点，周期大于 100 ms。
     #) SCAN 状态：Wi-Fi 时间片以及共存周期都比在 CONNECTED 状态下的长。为了确保蓝牙的性能，蓝牙的时间片也会做相应的调整。
     #) CONNECTING 状态：Wi-Fi 时间片比在 CONNECTED 状态下的长。为了确保蓝牙的性能，蓝牙的时间片也会做相应的调整。
@@ -171,6 +202,11 @@ ESP系列芯片最多支持三种射频收发模块: Bluetooth（BT 和 BLE）,
 
       Wi-Fi CONNECTED 和 BLE CONNECTED 共存状态下时间片划分图
 
+.. only:: SOC_IEEE802154_SUPPORTED
+
+  IEEE 802.15.4 模块根据预先分配的优先级请求 RF 资源。普通的接收操作被分配为最低优先级，这意味着 Wi-Fi 和 BLE 在需要时会优先占用 RF，而 802.15.4 只能在剩余时间内进行接收。其他 802.15.4 操作，例如发送和接收 ACK 以及在指定时间内的发送和接收，被分配了更高的优先级。然而，它们能否实际获得 RF 资源最终取决于当时 Wi-Fi 和 BLE 操作的优先级。
+
+.. only:: SOC_WIFI_SUPPORTED and SOC_BT_SUPPORTED
 
   动态优先级
   """""""""""""""""""

examples/bluetooth/bluedroid/classic_bt/a2dp_sink/main/main.c

@@ -84,12 +84,12 @@ static void bt_app_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 #if (CONFIG_EXAMPLE_A2DP_SINK_SSP_ENABLED == true)
     /* when Security Simple Pairing user confirmation requested, this event comes */
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     /* when Security Simple Pairing passkey notified, this event comes */
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %06"PRIu32, param->key_notif.passkey);
         break;
     /* when Security Simple Pairing passkey requested, this event comes */
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/bluedroid/classic_bt/a2dp_source/main/main.c

@@ -271,12 +271,12 @@ static void bt_app_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     /* when Security Simple Pairing user confirmation requested, this event comes */
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     /* when Security Simple Pairing passkey notified, this event comes */
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %06"PRIu32, param->key_notif.passkey);
         break;
     /* when Security Simple Pairing passkey requested, this event comes */
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/bluedroid/classic_bt/bt_hid_mouse_device/main/main.c

@@ -205,11 +205,11 @@ void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *param)
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(TAG, "ESP_BT_GAP_KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/bluedroid/classic_bt/bt_l2cap_client/main/main.c

@@ -179,12 +179,12 @@ static void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     /* when Security Simple Pairing user confirmation requested, this event comes */
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     /* when Security Simple Pairing passkey notified, this event comes */
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %06"PRIu32, param->key_notif.passkey);
         break;
     /* when Security Simple Pairing passkey requested, this event comes */
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/bluedroid/classic_bt/bt_l2cap_server/main/main.c

@@ -93,12 +93,12 @@ static void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     /* when Security Simple Pairing user confirmation requested, this event comes */
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     /* when Security Simple Pairing passkey notified, this event comes */
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(L2CAP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     /* when Security Simple Pairing passkey requested, this event comes */
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/bluedroid/classic_bt/bt_spp_acceptor/main/main.c

@@ -176,11 +176,11 @@ void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *param)
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/bluedroid/classic_bt/bt_spp_initiator/main/main.c

@@ -305,11 +305,11 @@ static void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         ESP_LOGW(SPP_TAG, "To confirm the value, type `spp ok;`");
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         ESP_LOGW(SPP_TAG, "Waiting response...");
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/bluedroid/classic_bt/bt_spp_vfs_acceptor/main/main.c

@@ -188,11 +188,11 @@ void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *param)
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/bluedroid/classic_bt/bt_spp_vfs_initiator/main/main.c

@@ -267,11 +267,11 @@ static void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(SPP_TAG, "ESP_BT_GAP_KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/bluedroid/classic_bt/hfp_hf/main/main.c

@@ -129,11 +129,11 @@ void esp_bt_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *param)
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(BT_HF_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(BT_HF_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(BT_HF_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(BT_HF_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(BT_HF_TAG, "ESP_BT_GAP_KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/bluedroid/coex/a2dp_gatts_coex/main/main.c

@@ -635,12 +635,12 @@ static void bt_app_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 #if (CONFIG_EXAMPLE_A2DP_SINK_SSP_ENABLED == true)
     /* when Security Simple Pairing user confirmation requested, this event comes */
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(BT_BLE_COEX_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(BT_BLE_COEX_TAG, "ESP_BT_GAP_CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     /* when Security Simple Pairing passkey notified, this event comes */
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(BT_BLE_COEX_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(BT_BLE_COEX_TAG, "ESP_BT_GAP_KEY_NOTIF_EVT passkey: %06"PRIu32, param->key_notif.passkey);
         break;
     /* when Security Simple Pairing passkey requested, this event comes */
     case ESP_BT_GAP_KEY_REQ_EVT:

examples/bluetooth/esp_hid_device/main/esp_hid_gap.c

@@ -448,12 +448,12 @@ static void bt_gap_event_handler(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_para
 
 #if (CONFIG_EXAMPLE_SSP_ENABLED == true)
     case ESP_BT_GAP_CFM_REQ_EVT:
-        ESP_LOGI(TAG, "BT GAP CFM_REQ_EVT Please compare the numeric value: %" PRIu32,
+        ESP_LOGI(TAG, "BT GAP CFM_REQ_EVT Please compare the numeric value: %06" PRIu32,
                  param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(TAG, "BT GAP KEY_NOTIF_EVT passkey:%" PRIu32, param->key_notif.passkey);
+        ESP_LOGI(TAG, "BT GAP KEY_NOTIF_EVT passkey:%06" PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_KEY_REQ_EVT:
         ESP_LOGI(TAG, "BT GAP KEY_REQ_EVT Please enter passkey!");

examples/bluetooth/esp_hid_host/main/esp_hid_gap.c

@@ -477,10 +477,10 @@ static void bt_gap_event_handler(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_para
     }
 #if (CONFIG_EXAMPLE_SSP_ENABLED)
     case ESP_BT_GAP_KEY_NOTIF_EVT:
-        ESP_LOGI(TAG, "BT GAP KEY_NOTIF passkey:%"PRIu32, param->key_notif.passkey);
+        ESP_LOGI(TAG, "BT GAP KEY_NOTIF passkey:%06"PRIu32, param->key_notif.passkey);
         break;
     case ESP_BT_GAP_CFM_REQ_EVT: {
-        ESP_LOGI(TAG, "BT GAP CFM_REQ_EVT Please compare the numeric value: %"PRIu32, param->cfm_req.num_val);
+        ESP_LOGI(TAG, "BT GAP CFM_REQ_EVT Please compare the numeric value: %06"PRIu32, param->cfm_req.num_val);
         esp_bt_gap_ssp_confirm_reply(param->cfm_req.bda, true);
         break;
     }

examples/wifi/espnow/main/espnow_example_main.c

@@ -34,7 +34,7 @@
 
 static const char *TAG = "espnow_example";
 
-static QueueHandle_t s_example_espnow_queue;
+static QueueHandle_t s_example_espnow_queue = NULL;
 
 static uint8_t s_example_broadcast_mac[ESP_NOW_ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 static uint16_t s_example_espnow_seq[EXAMPLE_ESPNOW_DATA_MAX] = { 0, 0 };
@@ -302,7 +302,7 @@ static esp_err_t example_espnow_init(void)
 
     s_example_espnow_queue = xQueueCreate(ESPNOW_QUEUE_SIZE, sizeof(example_espnow_event_t));
     if (s_example_espnow_queue == NULL) {
-        ESP_LOGE(TAG, "Create mutex fail");
+        ESP_LOGE(TAG, "Create queue fail");
         return ESP_FAIL;
     }
 
@@ -321,7 +321,8 @@ static esp_err_t example_espnow_init(void)
     esp_now_peer_info_t *peer = malloc(sizeof(esp_now_peer_info_t));
     if (peer == NULL) {
         ESP_LOGE(TAG, "Malloc peer information fail");
-        vSemaphoreDelete(s_example_espnow_queue);
+        vQueueDelete(s_example_espnow_queue);
+        s_example_espnow_queue = NULL;
         esp_now_deinit();
         return ESP_FAIL;
     }
@@ -337,7 +338,8 @@ static esp_err_t example_espnow_init(void)
     send_param = malloc(sizeof(example_espnow_send_param_t));
     if (send_param == NULL) {
         ESP_LOGE(TAG, "Malloc send parameter fail");
-        vSemaphoreDelete(s_example_espnow_queue);
+        vQueueDelete(s_example_espnow_queue);
+        s_example_espnow_queue = NULL;
         esp_now_deinit();
         return ESP_FAIL;
     }
@@ -353,7 +355,8 @@ static esp_err_t example_espnow_init(void)
     if (send_param->buffer == NULL) {
         ESP_LOGE(TAG, "Malloc send buffer fail");
         free(send_param);
-        vSemaphoreDelete(s_example_espnow_queue);
+        vQueueDelete(s_example_espnow_queue);
+        s_example_espnow_queue = NULL;
         esp_now_deinit();
         return ESP_FAIL;
     }
@@ -369,7 +372,8 @@ static void example_espnow_deinit(example_espnow_send_param_t *send_param)
 {
     free(send_param->buffer);
     free(send_param);
-    vSemaphoreDelete(s_example_espnow_queue);
+    vQueueDelete(s_example_espnow_queue);
+    s_example_espnow_queue = NULL;
     esp_now_deinit();
 }