fix(bt): Update bt lib for ESP32-C3 and ESP32-S3(2f683593)

- Fixed read remote feature timeout when using coded phy
- Fixed disconnection issue(0x08) when using 125k coded phy
- Fixed disconnection issue(0x08) when updating connection param
- Fixed disconnection issue(0x08) when using multi connection
- Avoid error when adding duplicate device to whitelist
- Support disable channel assessment by vendor hci
- Support smaller connection interval (3.75 ms)
- Support duplicate exception list in EVT ADV


(cherry picked from commit 658ff8730b)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>

components/bt/controller/esp32c3/Kconfig.in

@@ -561,6 +561,31 @@ config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
         This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
         If disabled, only basic checks are applied, improving compatibility.
 
+config BT_CTRL_BLE_MIN_CONN_INTERVAL_ENABLE
+    bool "Allow BLE connection interval below the spec minimum"
+    default y
+    select BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT if BT_BLUEDROID_ENABLED
+    help
+        Enabling this option allows the BLE controller to use a connection interval
+        smaller than the Bluetooth Core specification minimum of 7.5 ms. On
+        ESP32-C3/S3, when this option is enabled, the connection interval can go as
+        low as 3 * 1.25 ms = 3.75 ms.
+
+        Note: Because the connection interval is very short, the time available within
+        a single connection event is also very limited. It is best not to send or
+        receive long payloads (e.g. large ATT MTU, Data Length Extension with large
+        Tx/Rx octets) when this lower interval is used.
+
+        This option is enabled by default. Disable it to stay compliant with the BLE
+        specification (minimum connection interval 7.5 ms).
+
+        Host stack: When Bluedroid is the BLE host, enabling this option also selects
+        BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT so the host accepts connection
+        intervals below the spec minimum. NimBLE host does not provide equivalent
+        support yet; it is planned for a future release. Until then, use Bluedroid
+        if you need coordinated host and controller behavior for sub-minimum
+        intervals.
+
 menu "Controller debug log Options (Experimental)"
     config BT_CTRL_LE_LOG_EN
         depends on BT_CTRL_RUN_IN_FLASH_ONLY

components/bt/controller/esp32c3/bt.c

@@ -309,6 +309,7 @@ extern void ets_backup_dma_copy(uint32_t reg, uint32_t mem_addr, uint32_t num, b
 
 extern void btdm_cca_feature_enable(void);
 extern void btdm_aa_check_enhance_enable(void);
+extern void ble_min_conn_interval_enable(uint16_t min_interval);
 
 #if (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)
 extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
@@ -1349,6 +1350,9 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
     btdm_aa_check_enhance_enable();
 #endif
+#if CONFIG_BT_CTRL_BLE_MIN_CONN_INTERVAL_ENABLE
+    ble_min_conn_interval_enable(3); // 3 * 1.25 = 3.75ms
+#endif
 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
     // do nothing
 #else

components/bt/host/bluedroid/Kconfig.in

@@ -1309,6 +1309,23 @@ config BT_BLE_RPA_TIMEOUT
         This set RPA timeout of Controller and Host.
         Default is 900 s (15 minutes). Range is 1 s to 1 hour (3600 s).
 
+config BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT
+    bool "Allow BLE connection interval below Bluetooth Core Spec minimum (disable host check)"
+    depends on BT_BLE_ENABLED
+    default n
+    help
+        When enabled, the Bluedroid host skips the minimum BLE connection
+        interval validation (Bluetooth Core Spec minimum is 0x0006 / 7.5 ms)
+        and accepts any non-zero interval value from the application. The
+        BLE controller then enforces what is actually allowed; how small the
+        connection interval may be depends on controller capability and its
+        own configuration, not on this host option text.
+
+        End users should NOT set this option directly. In typical IDF builds it
+        follows the active Controller integration when that Controller supports
+        this mode; use the Controller's own configuration (menu entries and symbol
+        names differ by chip) instead of toggling this host symbol manually.
+
 menuconfig BT_BLE_50_FEATURES_SUPPORTED
     bool "Enable BLE 5.0 and above features(please disable BLE 4.2 if enable BLE 5.0)"
     depends on (BT_BLE_ENABLED && ((BT_CONTROLLER_ENABLED && SOC_BLE_50_SUPPORTED) || BT_CONTROLLER_DISABLED))

components/bt/host/bluedroid/api/include/api/esp_bt_defs.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -9,6 +9,7 @@
 
 #include <stdint.h>
 #include <stdbool.h>
+#include "sdkconfig.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -215,7 +216,12 @@ typedef uint8_t esp_link_key[ESP_BT_OCTET16_LEN];      /* Link Key */
 #define ESP_BLE_PRIM_ADV_INT_MIN            0x000020     /*!< Minimum advertising interval for undirected and low duty cycle directed advertising */
 #endif
 #define ESP_BLE_PRIM_ADV_INT_MAX            0xFFFFFF     /*!< Maximum advertising interval for undirected and low duty cycle directed advertising */
-#define ESP_BLE_CONN_INT_MIN                0x0006       /*!< relate to BTM_BLE_CONN_INT_MIN in stack/btm_ble_api.h */
+/* Lower bound (1.25 ms units) for host-side connection interval checks.*/
+#if defined(CONFIG_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT) && (CONFIG_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT)
+#define ESP_BLE_CONN_INT_MIN                0x0001
+#else
+#define ESP_BLE_CONN_INT_MIN                0x0006
+#endif
 #define ESP_BLE_CONN_INT_MAX                0x0C80       /*!< relate to BTM_BLE_CONN_INT_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_LATENCY_MAX            499          /*!< relate to ESP_BLE_CONN_LATENCY_MAX in stack/btm_ble_api.h */
 #define ESP_BLE_CONN_SUP_TOUT_MIN           0x000A       /*!< relate to BTM_BLE_CONN_SUP_TOUT_MIN in stack/btm_ble_api.h */
@@ -232,8 +238,8 @@ typedef uint8_t esp_ble_phy_mask_t;
 typedef struct {
     uint16_t scan_interval;       /*!< Initial scan interval, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
     uint16_t scan_window;         /*!< Initial scan window, in units of 0.625ms, the range is 0x0004(2.5ms) to 0xFFFF(10.24s). */
-    uint16_t interval_min;        /*!< Minimum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t interval_min;        /*!< Minimum connection interval, in units of 1.25 ms. Host validation uses ESP_BLE_CONN_INT_MIN as the lower bound; the interval the controller ultimately allows may be higher depending on its capability. Upper bound 0x0C80 (4 s). */
-    uint16_t interval_max;        /*!< Maximum connection interval, in units of 1.25ms, the range is 0x0006(7.5ms) to 0x0C80(4s). */
+    uint16_t interval_max;        /*!< Maximum connection interval, in units of 1.25 ms. Same bounds as interval_min. */
     uint16_t latency;             /*!< Connection latency, the range is 0x0000(0) to 0x01F3(499). */
     uint16_t supervision_timeout; /*!< Connection supervision timeout, in units of 10ms, the range is from 0x000A(100ms) to 0x0C80(32s). */
     uint16_t min_ce_len;          /*!< Minimum connection event length, in units of 0.625ms, setting to 0 for no preferred parameters. */

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -382,6 +382,25 @@
 #define UC_BT_BLE_HIGH_DUTY_ADV_INTERVAL FALSE
 #endif
 
+/* Controls whether the Bluedroid host enforces the Bluetooth Core
+ * specification minimum BLE connection interval (0x0006 / 7.5 ms) during
+ * host-side parameter validation.
+ *
+ *   - 1 : host-side lower bound is relaxed to 0x0001 (1.25 ms). The real
+ *         lower bound is then enforced solely by the BLE controller.
+ *   - 0 : host enforces the Bluetooth Core spec minimum (0x0006).
+ *
+ * Do not turn this on manually in menuconfig unless you know the implications.
+ * In normal IDF builds it follows the active Controller integration. The
+ * actual minimum connection interval is defined by the Controller, not by the
+ * Host; Controller configuration option names differ by chip and stack.
+ * See common/bt_target.h (BLE_CONN_INT_MIN_HW). */
+#ifdef CONFIG_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT
+#define UC_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT      1
+#else
+#define UC_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT      0
+#endif
+
 //GATTS
 #ifdef CONFIG_BT_GATTS_ENABLE
 #define UC_BT_GATTS_ENABLE                  CONFIG_BT_GATTS_ENABLE

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -437,6 +437,31 @@
 #define BLE_HIGH_DUTY_ADV_INTERVAL FALSE
 #endif
 
+/* Minimum BLE connection interval (in 1.25 ms units) enforced by the Bluedroid
+ * host parameter validation.
+ *
+ *   - When host-side validation keeps the Core Spec floor: 0x0006 (7.5 ms).
+ *   - When validation is relaxed for sub-spec intervals: 0x0001 (1.25 ms) so
+ *     host-side checks no longer enforce the Core Spec minimum; whether a
+ *     smaller connection interval is allowed and the real lower limit depend
+ *     entirely on Controller capability and its own configuration (option
+ *     names differ by Controller). Whether the relaxed mode is used is
+ *     determined by how the Host is integrated with the Controller for each
+ *     product, not documented here.
+ *
+ * Note: the relaxed lower bound is 0x0001 rather than 0x0000 so that all
+ * existing `uint16_t < MIN` / `uint16_t >= MIN` range checks in the stack
+ * remain well-defined under GCC `-Wtype-limits`. Since 0 is not a valid HCI
+ * connection interval anyway, this is functionally equivalent to disabling
+ * the host-side minimum check. */
+#ifndef BLE_CONN_INT_MIN_HW
+#if (UC_BT_BLE_HOST_ALLOW_SUB_SPEC_MIN_CONN_INT == 1)
+#define BLE_CONN_INT_MIN_HW             0x0001
+#else
+#define BLE_CONN_INT_MIN_HW             0x0006
+#endif
+#endif
+
 #if (UC_BT_BLE_RPA_SUPPORTED  == TRUE)
 #define CONTROLLER_RPA_LIST_ENABLE   TRUE
 #else

components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h

@@ -122,7 +122,7 @@ typedef UINT8   tBTM_BLE_SFP;
 #define BTM_BLE_SCAN_INT_MAX            0x4000
 #define BTM_BLE_SCAN_WIN_MIN            0x0004
 #define BTM_BLE_SCAN_WIN_MAX            0x4000
-#define BTM_BLE_CONN_INT_MIN            0x0006
+#define BTM_BLE_CONN_INT_MIN            BLE_CONN_INT_MIN_HW   /* host-side check limit; see BLE_CONN_INT_MIN_HW in common/bt_target.h */
 #define BTM_BLE_CONN_INT_MAX            0x0C80
 #define BTM_BLE_CONN_LATENCY_MAX        499
 #define BTM_BLE_CONN_SUP_TOUT_MIN       0x000A

components/esp_rom/esp32c3/ld/esp32c3.rom.eco7_bt_funcs.ld

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -21,10 +21,7 @@ r_llc_rem_encrypt_proc_continue_eco = 0x40001cf0;
 r_lld_ext_adv_dynamic_aux_pti_process_eco = 0x40001cfc;
 r_lld_adv_start_eco = 0x40001d04;
 r_lld_con_evt_canceled_cbk_eco = 0x40001d08;
-r_lld_con_evt_time_update_eco = 0x40001d0c;
 r_lld_con_start_eco = 0x40001d10;
-r_lld_con_frm_isr_eco = 0x40001d14;
-r_lld_con_tx_eco = 0x40001d18;
 r_lld_ext_scan_dynamic_pti_process_eco = 0x40001d28;
 r_lld_scan_frm_eof_isr_eco = 0x40001d2c;
 r_lld_sync_start_eco = 0x40001d30;
@@ -110,7 +107,6 @@ r_lld_adv_frm_isr_eco = 0x40001d00;
 r_lld_res_list_clear = 0x40004638;
 r_lld_res_list_rem = 0x40004680;
 r_lld_adv_start_hook = 0x40001c80;
-r_lld_con_evt_start_cbk_eco = 0x40001d1c;
 r_lld_con_tx_prog_new_packet = 0x40001b74;
 r_lld_adv_ext_chain_none_construct = 0x40001b50;
 r_llc_llcp_send_eco = 0x40001cf4;
@@ -127,4 +123,8 @@ r_lld_scan_process_pkt_rx_adv_rep = 0x40001284;
 r_register_esp_vendor_cmd_handler = 0x40001400;
 r_llc_llcp_pdu_handler_get_overwrite = 0x40001d5c;
 r_llc_start_eco = 0x40001cf8;
+r_lld_con_tx_eco = 0x40001d18;
+r_lld_con_evt_time_update_eco = 0x40001d0c;
+r_lld_con_evt_start_cbk_eco = 0x40001d1c;
+r_lld_con_frm_isr_eco = 0x40001d14;
 */