diff --git a/components/bt/common/Kconfig.in b/components/bt/common/Kconfig.in
index fb17bbb9ff..0f466d798d 100644
--- a/components/bt/common/Kconfig.in
+++ b/components/bt/common/Kconfig.in
@@ -9,7 +9,6 @@ config BT_ALARM_MAX_NUM
 config BT_BLE_LOG_SPI_OUT_ENABLED
     bool "Output ble logs to SPI bus (Experimental)"
     default n
-    select SPI_MASTER_IN_IRAM
     help
         Output ble logs to SPI bus
 
diff --git a/components/bt/common/ble_log/ble_log_spi_out.c b/components/bt/common/ble_log/ble_log_spi_out.c
index 992df1cb7c..9dd114cf03 100644
--- a/components/bt/common/ble_log/ble_log_spi_out.c
+++ b/components/bt/common/ble_log/ble_log_spi_out.c
@@ -140,14 +140,16 @@ static int spi_out_init_trans(spi_out_trans_cb_t **trans_cb, uint16_t buf_size)
     if (!(*trans_cb)) {
         return -1;
     }
+    memset(*trans_cb, 0, sizeof(spi_out_trans_cb_t));
+
     uint8_t *buf = (uint8_t *)spi_bus_dma_memory_alloc(SPI_OUT_BUS, (size_t)buf_size, 0);
     if (!buf) {
         free(*trans_cb);
+        *trans_cb = NULL;
         return -1;
     }
 
     // Initialization
-    memset(*trans_cb, 0, sizeof(spi_out_trans_cb_t));
     (*trans_cb)->buf_size = buf_size;
     (*trans_cb)->trans.tx_buffer = buf;
     return 0;
@@ -158,8 +160,13 @@ static void spi_out_deinit_trans(spi_out_trans_cb_t **trans_cb)
     if (!(*trans_cb)) {
         return;
     }
+    if ((*trans_cb)->trans.tx_buffer) {
+        // Do not free buffer until recycled
+        while ((*trans_cb)->flag == SPI_OUT_TRANS_CB_FLAG_IN_QUEUE) {}
+        free((uint8_t *)(*trans_cb)->trans.tx_buffer);
+        (*trans_cb)->trans.tx_buffer = NULL;
+    }
 
-    free((uint8_t *)(*trans_cb)->trans.tx_buffer);
     free(*trans_cb);
     *trans_cb = NULL;
     return;
@@ -174,7 +181,7 @@ IRAM_ATTR static void spi_out_tx_done_cb(spi_transaction_t *ret_trans)
 
 IRAM_ATTR static inline int spi_out_append_trans(spi_out_trans_cb_t *trans_cb)
 {
-    if (trans_cb->flag != SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE) {
+    if (trans_cb->flag != SPI_OUT_TRANS_CB_FLAG_NEED_QUEUE || !trans_cb->length) {
         return -1;
     }
 
@@ -185,6 +192,8 @@ IRAM_ATTR static inline int spi_out_append_trans(spi_out_trans_cb_t *trans_cb)
         trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_IN_QUEUE;
         return 0;
     } else {
+        trans_cb->length = 0;
+        trans_cb->flag = SPI_OUT_TRANS_CB_FLAG_AVAILABLE;
         return -1;
     }
 }
@@ -224,6 +233,7 @@ static void spi_out_log_cb_deinit(spi_out_log_cb_t **log_cb)
         }
     }
     free(*log_cb);
+    *log_cb = NULL;
     return;
 }
 
@@ -578,7 +588,7 @@ static void spi_out_ts_sync_deinit(void)
 }
 
 // CRITICAL: This function is called in ESP Timer task
-IRAM_ATTR static void esp_timer_cb_ts_sync(void)
+static void esp_timer_cb_ts_sync(void)
 {
     // Initialize variables
     uint32_t lc_ts = 0;
@@ -627,7 +637,9 @@ int ble_log_spi_out_init(void)
         .quadwp_io_num = -1,
         .quadhd_io_num = -1,
         .max_transfer_sz = SPI_OUT_MAX_TRANSFER_SIZE,
+#if CONFIG_SPI_MASTER_ISR_IN_IRAM
         .intr_flags = ESP_INTR_FLAG_IRAM
+#endif // CONFIG_SPI_MASTER_ISR_IN_IRAM
     };
     spi_device_interface_config_t dev_config = {
         .clock_speed_hz = SPI_MASTER_FREQ_20M,
@@ -782,7 +794,7 @@ IRAM_ATTR void ble_log_spi_out_ll_log_ev_proc(void)
 }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_LL_ENABLED
 
-IRAM_ATTR int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len)
 {
     if (!ul_log_inited) {
         return -1;
@@ -798,7 +810,7 @@ IRAM_ATTR int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_
     return ret;
 }
 
-IRAM_ATTR int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
+int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
 {
     if (!ul_log_inited) {
         return -1;
@@ -845,7 +857,7 @@ IRAM_ATTR int ble_log_spi_out_printf(uint8_t source, const char *format, ...)
     return ret;
 }
 
-IRAM_ATTR int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...)
+int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...)
 {
     if (!ul_log_inited) {
         return -1;
@@ -897,7 +909,7 @@ IRAM_ATTR int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const ch
     return ret;
 }
 
-IRAM_ATTR int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len)
+int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len)
 {
     if (!ul_log_inited) {
         return -1;
diff --git a/components/bt/controller/esp32c2/Kconfig.in b/components/bt/controller/esp32c2/Kconfig.in
index 00ea9b04bb..f4417f16a0 100644
--- a/components/bt/controller/esp32c2/Kconfig.in
+++ b/components/bt/controller/esp32c2/Kconfig.in
@@ -682,6 +682,11 @@ config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
     depends on BT_CTRL_RUN_IN_FLASH_ONLY
     default n
 
+config BT_LE_PLACE_SLEEP_RELATED_INTO_IRAM
+    bool
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY && BT_LE_SLEEP_ENABLE
+    default y
+
 config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
     default n
diff --git a/components/bt/controller/esp32c2/bt.c b/components/bt/controller/esp32c2/bt.c
index 2364eeb3a0..bd2cc4425e 100644
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@@ -592,13 +592,6 @@ static int esp_intr_free_wrapper(void **ret_handle)
     return rc;
 }
 
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-void sleep_modem_light_sleep_overhead_set(uint32_t overhead)
-{
-    esp_ble_set_wakeup_overhead(overhead);
-}
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
-
 modem_clock_lpclk_src_t esp_bt_get_lpclk_src(void)
 {
     return s_bt_lpclk_src;
@@ -613,7 +606,7 @@ void esp_bt_set_lpclk_src(modem_clock_lpclk_src_t clk_src)
     s_bt_lpclk_src = clk_src;
 }
 
-IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
+void controller_sleep_cb(uint32_t enable_tick, void *arg)
 {
     if (!s_ble_active) {
         return;
@@ -626,7 +619,7 @@ IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
     s_ble_active = false;
 }
 
-IRAM_ATTR void controller_wakeup_cb(void *arg)
+void controller_wakeup_cb(void *arg)
 {
     if (s_ble_active) {
         return;
@@ -666,7 +659,7 @@ esp_err_t controller_sleep_init(modem_clock_lpclk_src_t slow_clk_src)
     esp_sleep_enable_bt_wakeup();
     ESP_LOGW(NIMBLE_PORT_LOG_TAG, "Enable light sleep, the wake up source is BLE timer");
 
-    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    rc = esp_pm_register_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
     if (rc != ESP_OK) {
         goto error;
     }
@@ -676,7 +669,7 @@ esp_err_t controller_sleep_init(modem_clock_lpclk_src_t slow_clk_src)
 error:
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
     esp_sleep_disable_bt_wakeup();
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
     /*lock should release first and then delete*/
     if (s_pm_lock != NULL) {
@@ -693,7 +686,7 @@ void controller_sleep_deinit(void)
     r_ble_rtc_wake_up_state_clr();
     esp_sleep_disable_bt_wakeup();
     esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_AUTO);
-    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
+    esp_pm_unregister_inform_out_light_sleep_overhead_callback(esp_ble_set_wakeup_overhead);
 #endif // CONFIG_FREERTOS_USE_TICKLESS_IDLE
 #ifdef CONFIG_PM_ENABLE
     /*lock should release first and then delete*/
diff --git a/components/bt/controller/esp32c6/Kconfig.in b/components/bt/controller/esp32c6/Kconfig.in
index a9e59ae032..d0120d6f82 100644
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@@ -818,3 +818,7 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
         When this option is enabled, auxiliary packets will be present in the events of
         'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
         If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_LE_RXBUF_OPT_ENABLED
+    bool "Enable rxbuf optimization feature"
+    default y
diff --git a/components/bt/controller/esp32c6/ble.c b/components/bt/controller/esp32c6/ble.c
index f93f15e9b8..a1eb137489 100644
--- a/components/bt/controller/esp32c6/ble.c
+++ b/components/bt/controller/esp32c6/ble.c
@@ -47,6 +47,9 @@ void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
 void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+extern void mmgmt_enableRxbufOptFeature(void);
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
 
 /* Local functions definition
  ***************************************************************************
@@ -143,6 +146,10 @@ int ble_stack_enable(void)
     ble_stack_enableVsEvents(true);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+    mmgmt_enableRxbufOptFeature();
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
+
     return 0;
 }
 
diff --git a/components/bt/controller/esp32h2/Kconfig.in b/components/bt/controller/esp32h2/Kconfig.in
index b07e4783a8..524785e45f 100644
--- a/components/bt/controller/esp32h2/Kconfig.in
+++ b/components/bt/controller/esp32h2/Kconfig.in
@@ -822,3 +822,7 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
         When this option is enabled, auxiliary packets will be present in the events of
         'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
         If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_LE_RXBUF_OPT_ENABLED
+    bool "Enable rxbuf optimization feature"
+    default y
diff --git a/components/bt/controller/esp32h2/ble.c b/components/bt/controller/esp32h2/ble.c
index caa8d85543..8aef45a9a8 100644
--- a/components/bt/controller/esp32h2/ble.c
+++ b/components/bt/controller/esp32h2/ble.c
@@ -44,6 +44,9 @@ void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
 void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+extern void mmgmt_enableRxbufOptFeature(void);
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
 
 /* Local functions definition
  ***************************************************************************
@@ -137,6 +140,10 @@ int ble_stack_enable(void)
     ble_stack_enableVsEvents(true);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
+#if CONFIG_BT_LE_RXBUF_OPT_ENABLED
+    mmgmt_enableRxbufOptFeature();
+#endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
+
     return 0;
 }
 
diff --git a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
index c0d98a9a03..a69fafcc0a 160000
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
@@ -1 +1 @@
-Subproject commit c0d98a9a03c266828a25bed38c0174ecfc882aea
+Subproject commit a69fafcc0a002a63f757bd4741a5d844d5e8dbf2
diff --git a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
index 246541ab93..73812a3edc 160000
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
@@ -1 +1 @@
-Subproject commit 246541ab93e853eba1591784a5253b219c0414f9
+Subproject commit 73812a3edcbc4f5b65d4ec381f82e32633482409
diff --git a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
index a3192174a9..dcbae97062 160000
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
@@ -1 +1 @@
-Subproject commit a3192174a9aef015a9ceca983acdb9fd1a198445
+Subproject commit dcbae9706293e7c062a0b2b4a0bdddbd401f77a7
diff --git a/components/bt/linker_esp32c2.lf b/components/bt/linker_esp32c2.lf
index 75f0d59680..c9ab4c2e49 100644
--- a/components/bt/linker_esp32c2.lf
+++ b/components/bt/linker_esp32c2.lf
@@ -10,6 +10,10 @@ entries:
 entries:
     .conn_iram1+
 
+[sections:bt_sleep_iram_text]
+entries:
+    .sleep_iram1+
+
 [sections:bt_bss]
 entries:
     .bss+
@@ -39,6 +43,10 @@ entries:
         else:
             bt_conn_iram_text -> flash_text
             bt_isr_iram_text -> flash_text
+        if BT_LE_PLACE_SLEEP_RELATED_INTO_IRAM = y:
+            bt_sleep_iram_text -> iram0_bt_text
+        else:
+            bt_sleep_iram_text -> flash_text
     else:
         bt_iram_text -> iram0_bt_text
         bt_bss -> dram0_bt_bss
@@ -47,6 +55,7 @@ entries:
 
         bt_conn_iram_text -> iram0_bt_text
         bt_isr_iram_text -> iram0_bt_text
+        bt_sleep_iram_text -> iram0_bt_text
 
 # For the following fragments, order matters for
 # 'ALIGN(4) ALIGN(4, post) SURROUND(sym)', which generates:
diff --git a/components/bt/porting/npl/freertos/src/npl_os_freertos.c b/components/bt/porting/npl/freertos/src/npl_os_freertos.c
index 9e5c9863c3..73f425262f 100644
--- a/components/bt/porting/npl/freertos/src/npl_os_freertos.c
+++ b/components/bt/porting/npl/freertos/src/npl_os_freertos.c
@@ -110,7 +110,9 @@ IRAM_ATTR npl_freertos_event_init(struct ble_npl_event *ev, ble_npl_event_fn *fn
 void
 IRAM_ATTR npl_freertos_event_deinit(struct ble_npl_event *ev)
 {
-    BLE_LL_ASSERT(ev->event);
+    if (!ev->event) {
+        return;
+    }
 #if OS_MEM_ALLOC
     os_memblock_put(&ble_freertos_ev_pool,ev->event);
 #else