change(version): Update version to 5.4.2

Merge branch 'bugfix/http_client_test_failure_v5.4' into 'release/v5.4'
fix: update root certificate for postman-echo endpoint (v5.4) See merge request espressif/esp-idf!39847
2025-06-20 14:35:04 +08:00 · 2025-06-20 14:18:29 +08:00 · 2025-06-18 11:30:52 +08:00 · 2025-06-17 15:09:40 +08:00 · 2025-06-17 15:09:40 +08:00 · 2025-06-16 20:42:34 +08:00
5857 changed files with 258604 additions and 345292 deletions
--- a/.codespellrc
+++ b/.codespellrc
@@ -1,4 +1,4 @@
 [codespell]
 skip = build,*.yuv,components/fatfs/src/*,alice.txt,*.rgb,components/wpa_supplicant/*,components/esp_wifi/*,*.pem
-ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn
+ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn,registr,oen,parms
 write-changes = true
--- a/.gitignore
+++ b/.gitignore
@@ -102,6 +102,7 @@ pytest_embedded_log/
 list_job*.txt
 size_info*.txt
 XUNIT_RESULT*.xml
+.manifest_sha

 # clang config (for LSP)
 .clangd
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -2,243 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.codespellrc                         @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_driver_*/             @esp-idf-codeowners/peripherals
-/components/esp_driver_sdmmc/         @esp-idf-codeowners/peripherals @esp-idf-codeowners/storage
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_hw_support/lowpower/  @esp-idf-codeowners/power-management
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_vfs_*/                @esp-idf-codeowners/storage
-/components/esp_vfs_console/          @esp-idf-codeowners/storage @esp-idf-codeowners/system
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/hal/test_apps/crypto/     @esp-idf-codeowners/peripherals @esp-idf-codeowners/security
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/rt/                       @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                      @esp-idf-codeowners/docs
-/docs/**/api-guides/tools/                  @esp-idf-codeowners/tools
-/docs/en/api-guides/core_dump.rst           @esp-idf-codeowners/debugging
-/docs/en/api-guides/jtag-debugging/         @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/           @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/             @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/         @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb*     @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/peripherals/usb*/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/           @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/             @esp-idf-codeowners/storage
-/docs/**/api-reference/system/              @esp-idf-codeowners/system
-/docs/**/security/                          @esp-idf-codeowners/security
-/docs/**/migration-guides/                  @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-/docs/**/contribute/install-pre-commit-hook.rst @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/ieee802154/         @esp-idf-codeowners/ieee802154
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-/tools/test_apps/                    @esp-idf-codeowners/ci
-/tools/test_apps/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/configs/            @esp-idf-codeowners/system
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/peripherals/        @esp-idf-codeowners/peripherals
-/tools/test_apps/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/storage/            @esp-idf-codeowners/storage
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -1,7 +1,7 @@
 .build_template:
  stage: build
  extends:
-    - .after_script:build:ccache:upload-when-fail
+    - .after_script:build:ccache-show-stats:upload-failed-job-logs
  image: $ESP_ENV_IMAGE
  tags:
    - build
@@ -12,11 +12,11 @@
    IDF_CCACHE_ENABLE: "1"
  dependencies: []

-.build_cmake_template:
+.build_cmake_clang_template:
  extends:
    - .build_template
    - .before_script:build
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
  dependencies: # set dependencies to null to avoid missing artifacts issue
  needs:
    - job: fast_template_app
@@ -34,29 +34,11 @@
      - "**/build*/size.json"
    expire_in: 1 week
    when: always
-  script:
-    # CI specific options start from "--parallel-count xxx". could ignore when running locally
-    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
-      -t $IDF_TARGET
-      --copy-sdkconfig
-      --parallel-count ${CI_NODE_TOTAL:-1}
-      --parallel-index ${CI_NODE_INDEX:-1}
-      --extra-preserve-dirs
-        examples/bluetooth/esp_ble_mesh/ble_mesh_console
-        examples/bluetooth/hci/controller_hci_uart_esp32
-        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
-    - python tools/ci/artifacts_handler.py upload
-
-.build_cmake_clang_template:
-  extends:
-    - .build_cmake_template
  variables:
    IDF_TOOLCHAIN: clang
    TEST_BUILD_OPTS_EXTRA: ""
    TEST_DIR: tools/test_apps/system/clang_build_test
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
    # CI specific options start from "--parallel-count xxx". could ignore when running locally
    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
@@ -126,7 +108,7 @@ gcc_static_analyzer:
    ANALYZING_APP: "examples/get-started/hello_world"
  script:
    - echo "CONFIG_COMPILER_STATIC_ANALYZER=y" >> ${ANALYZING_APP}/sdkconfig.defaults
-    - python -m idf_build_apps build -vv -p ${ANALYZING_APP} -t all
+    - python -m idf_build_apps build -v -p ${ANALYZING_APP} -t all

 ########################################
 # Clang Build Apps Without Tests Cases #
@@ -156,11 +138,12 @@ build_clang_test_apps_esp32s3:
  extends:
    - .build_cmake_clang_template
  variables:
-    # For RISCV clang generates '.linker-options' sections of type 'llvm_linker_options' in asm files.
-    # See (https://llvm.org/docs/Extensions.html#linker-options-section-linker-options).
-    # Binutils gas ignores them with warning.
-    # TODO: LLVM-333, Use integrated assembler.
-    TEST_BUILD_OPTS_EXTRA: "--ignore-warning-str 'Warning: unrecognized section type'"
+    # https://reviews.llvm.org/D90108.
+    # GNU 'as' lets .weak override .globl since binutils-gdb
+    # https://github.com/bminor/binutils-gdb/commit/5ca547dc2399a0a5d9f20626d4bf5547c3ccfddd (1996)
+    # while MC lets the last directive win (PR38921).
+    # For RISCV chips we use integrated assembler by default, so suppress this warning to pass CI pipeline.
+    TEST_BUILD_OPTS_EXTRA: "--ignore-warning-str 'changed binding to STB_WEAK'"

 build_clang_test_apps_esp32c3:
  extends:
@@ -245,15 +228,16 @@ pytest_build_system_macos:
  extends:
    - .test_build_system_template
    - .before_script:build:macos
-    - .after_script:build:macos:upload-when-fail
+    - .after_script:build:macos:upload-failed-job-logs:ccache-show-stats
    - .rules:build:macos
  tags:
    - macos_shell
  parallel: 3
  variables:
    PYENV_VERSION: "3.8"
-    CI_CCACHE_DISABLE: "1"  # ccache: error: Read-only file system
-
+    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
+    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
+    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
 build_docker:
  extends:
    - .before_script:minimal
@@ -299,6 +283,8 @@ generate_build_child_pipeline:
  dependencies: # set dependencies to null to avoid missing artifacts issue
  needs:
    - pipeline_variables
+    - job: baseline_manifest_sha
+      optional: true
  artifacts:
    paths:
      - build_child_pipeline.yml
@@ -306,7 +292,11 @@ generate_build_child_pipeline:
      - non_test_related_apps.txt
    expire_in: 1 week
    when: always
+  variables:
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
+    # requires basic pytest dependencies
+    - run_cmd bash install.sh --enable-pytest
    - run_cmd python tools/ci/dynamic_pipelines/scripts/generate_build_child_pipeline.py

 build_child_pipeline:
--- a/.gitlab/ci/common.yml
+++ b/.gitlab/ci/common.yml
@@ -6,9 +6,9 @@ stages:
  - pre_check
  - build
  - assign_test
+  - build_doc
  - target_test
  - host_test
-  - build_doc
  - test_deploy
  - deploy
  - post_deploy
@@ -40,7 +40,7 @@ variables:
  GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
  # we're using .cache folder for caches
  GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.4-dev
+  LATEST_GIT_TAG: v5.4.2

  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
  # by default we will fetch all submodules
@@ -55,15 +55,12 @@ variables:
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"

  # Docker images
-  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:1"
-  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:1-1"
-  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:1"
+  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:2"
+  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:2-1"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:2"
  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
  PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"

-  # target test repo parameters
-  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-
  # cache python dependencies
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

@@ -91,7 +88,7 @@ variables:
  CI_CLANG_DISTRO_URL: ""

  # Set this variable to specify the file name for the known failure cases.
-  KNOWN_FAILURE_CASES_FILE_NAME: "master.txt"
+  KNOWN_FAILURE_CASES_FILE_NAME: "5.4.txt"

  IDF_CI_BUILD: 1

@@ -144,40 +141,48 @@ variables:
    export IDF_MIRROR_PREFIX_MAP=
  fi

-  # install latest python packages
-  # target test jobs
-  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-pytest
-  elif [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-docs
-  elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-pytest
-  else
-    if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+  if [[ "${CI_JOB_STAGE}" != "target_test" ]]; then
+    section_start "running_install_sh" "Running install.sh"
+    if [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
+      run_cmd bash install.sh --enable-ci --enable-docs
+    elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
      run_cmd bash install.sh --enable-ci
    else
-      run_cmd bash install.sh --enable-ci --enable-pytest
+      if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+        run_cmd bash install.sh --enable-ci
+      else
+        run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      fi
    fi
+    section_end "running_install_sh"
+  else
+    section_start "install_python_env" "Install Python environment"
+    run_cmd python tools/idf_tools.py install-python-env --features ci,pytest,test-specific
+    section_end "install_python_env"
  fi

-  # Install esp-clang if necessary
+  if [[ ! -z "$INSTALL_EXTRA_TOOLS" ]]; then
+    section_start "installing_optional_tools" "Install optional tools ${INSTALL_EXTRA_TOOLS}"
+    $IDF_PATH/tools/idf_tools.py --non-interactive install $INSTALL_EXTRA_TOOLS
+    section_end "installing_optional_tools"
+  fi
+
+  # Install esp-clang if necessary (esp-clang is separately installed)
  if [[ "$IDF_TOOLCHAIN" == "clang" && -z "$CI_CLANG_DISTRO_URL" ]]; then
    $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
  fi

-  # Install QEMU if necessary
-  if [[ ! -z "$INSTALL_QEMU" ]]; then
-    $IDF_PATH/tools/idf_tools.py --non-interactive install qemu-xtensa qemu-riscv32
+  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
+    section_start "IDF_SKIP_TOOLS_CHECK" "Skip required tools check"
+    export IDF_SKIP_TOOLS_CHECK=1
+    section_end "IDF_SKIP_TOOLS_CHECK"
  fi
-
-  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
-  # Needed for pytest junit reports.
-  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
-
+  section_start "source_export" "Source export.sh"
  source ./export.sh
+  section_end "source_export"

  # Custom clang toolchain
-  if [[ ! -z "$CI_CLANG_DISTRO_URL" ]]; then
+  if [[ "$IDF_TOOLCHAIN" == "clang" && ! -z "$CI_CLANG_DISTRO_URL" ]]; then
    echo "Using custom clang from ${CI_CLANG_DISTRO_URL}"
    wget $CI_CLANG_DISTRO_URL
    ARCH_NAME=$(basename $CI_CLANG_DISTRO_URL)
@@ -186,13 +191,21 @@ variables:
  fi

  # Custom OpenOCD
-  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
+  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
+    machine="$(uname -m)"
+    if [[ "$machine" == "armv7l" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
+    elif [[ "$machine" == "aarch64" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
+    fi
+    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
+      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+      wget $OOCD_DISTRO_URL
+      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+      tar -x -f $ARCH_NAME
+      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+      export PATH=$PWD/openocd-esp32/bin:$PATH
+    fi
  fi

  if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then
@@ -201,6 +214,8 @@ variables:
    rm -rf ${CI_PYTHON_TOOL_REPO}
  fi

+  info "setup tools and python venv done"
+
 .show_ccache_statistics: &show_ccache_statistics |
  # Show ccache statistics if enabled globally
  test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats -vv || true
@@ -223,18 +238,22 @@ variables:
    - *common-before_scripts
    # On macOS, these tools need to be installed
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
-    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
+    # remove idf-env.json, since it may contains enabled "features"
+    - rm -f $IDF_TOOLS_PATH/idf-env.json
    # This adds tools (compilers) and the version-specific Python environment to PATH
    - *setup_tools_and_idf_python_venv
    - fetch_submodules
+  variables:
+    INSTALL_EXTRA_TOOLS: cmake ninja

-.after_script:build:macos:upload-when-fail:
+.after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
  after_script:
    # macos is running shell executor, which means it would use
    # the system installed /usr/local/bin/python3 by default.
    # Ensure pyenv and PYENV_VERSION installed
    - eval "$(pyenv init -)"
    - *upload_failed_job_log_artifacts
+    - *show_ccache_statistics

 .before_script:build:
  before_script:
@@ -245,11 +264,11 @@ variables:
    - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}

-.after_script:build:ccache:
+.after_script:build:ccache-show-stats:
  after_script:
    - *show_ccache_statistics

-.after_script:build:ccache:upload-when-fail:
+.after_script:build:ccache-show-stats:upload-failed-job-logs:
  after_script:
    - *show_ccache_statistics
    - *upload_failed_job_log_artifacts
@@ -288,8 +307,8 @@ variables:
    git remote add origin "${CI_REPOSITORY_URL}"
  fi

-.git_checkout_fetch_head: &git_checkout_fetch_head |
-  git checkout FETCH_HEAD
+.git_checkout_ci_commit_sha: &git_checkout_ci_commit_sha |
+  git checkout $CI_COMMIT_SHA
  git clean ${GIT_CLEAN_FLAGS}

 # git diff requires two commits, with different CI env var
@@ -313,6 +332,7 @@ variables:
        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
        git fetch origin $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA)
+        git fetch origin $CI_COMMIT_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
      # merge request pipelines, when the mr got conflicts
      elif [[ -n $CI_MERGE_REQUEST_DIFF_BASE_SHA ]]; then
        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
@@ -328,7 +348,7 @@ variables:
        git fetch origin $CI_COMMIT_SHA --depth=2 ${GIT_FETCH_EXTRA_FLAGS}
        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_COMMIT_SHA~1 $CI_COMMIT_SHA)
      fi
-    - *git_checkout_fetch_head
+    - *git_checkout_ci_commit_sha
    - *common-before_scripts
    - *setup_tools_and_idf_python_venv
    - add_gitlab_ssh_keys
@@ -342,7 +362,7 @@ variables:
    - *git_init
    - *git_fetch_from_mirror_url_if_exists
    - git fetch origin "${CI_COMMIT_SHA}" --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
-    - *git_checkout_fetch_head
+    - *git_checkout_ci_commit_sha
    - *common-before_scripts
    - *setup_tools_and_idf_python_venv
    - add_gitlab_ssh_keys
--- a/.gitlab/ci/default-build-test-rules.yml
+++ b/.gitlab/ci/default-build-test-rules.yml
@@ -7,11 +7,12 @@
 #
 # This file should ONLY be used during bringup. Should be reset to empty after the bringup process
 extra_default_build_targets:
+
+
+bypass_check_test_targets:
  - esp32c5
  - esp32c61

-bypass_check_test_targets:
-  - esp32c61
 #
 # These lines would
 # - enable the README.md check for esp32c6. Don't forget to add the build jobs in .gitlab/ci/build.yml
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@@ -37,25 +37,16 @@
 .if-dev-push: &if-dev-push
  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'

-.if-schedule: &if-schedule
-  if: '$CI_PIPELINE_SOURCE == "schedule"'
-
 .doc-rules:build:docs-full:
  rules:
    - <<: *if-qa-test-tag
      when: never
-    - <<: *if-schedule
+    - <<: *if-protected
    - <<: *if-label-build_docs
    - <<: *if-label-docs_full
    - <<: *if-dev-push
      changes: *patterns-docs-full

-.doc-rules:build:docs-full-prod:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-
 .doc-rules:build:docs-partial:
  rules:
    - <<: *if-qa-test-tag
@@ -92,13 +83,14 @@ check_docs_lang_sync:
  stage: build_doc
  tags:
    - build_docs
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
  script:
    - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
    - cd docs
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
-  artifacts:
-    expire_in: 4 days
-    when: always
  parallel:
    matrix:
      - DOCLANG: ["en", "zh_CN"]
@@ -119,26 +111,12 @@ build_docs_html_full:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    paths:
-      - docs/_build/*/*/*.txt
-      - docs/_build/*/*/html/*
-  variables:
-    DOC_BUILDERS: "html"
-
-build_docs_html_full_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/html/*
+    expire_in: 4 days
  variables:
    DOC_BUILDERS: "html"

@@ -146,14 +124,12 @@ build_docs_html_partial:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-partial
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/html/*
+    expire_in: 4 days
  variables:
    DOC_BUILDERS: "html"
  parallel:
@@ -163,33 +139,6 @@ build_docs_html_partial:
      - DOCLANG: "zh_CN"
        DOCTGT: "esp32p4"

-build_docs_pdf:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
-build_docs_pdf_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
 .deploy_docs_template:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
@@ -218,8 +167,6 @@ deploy_docs_preview:
      optional: true
    - job: build_docs_html_full
      optional: true
-    - job: build_docs_pdf
-      optional: true
  variables:
    TYPE: "preview"
    # older branches use DOCS_DEPLOY_KEY, DOCS_SERVER, DOCS_SERVER_USER, DOCS_PATH for preview server so we keep these names for 'preview'
@@ -234,12 +181,12 @@ deploy_docs_production:
  # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
  extends:
    - .deploy_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
  stage: post_deploy
  dependencies:  # set dependencies to null to avoid missing artifacts issue
  needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full_prod
-    - build_docs_pdf_prod
+    - build_docs_html_full
    - job: push_to_github
      artifacts: false
  variables:
@@ -254,16 +201,19 @@ deploy_docs_production:
 check_doc_links:
  extends:
    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
  stage: post_deploy
  needs:
    - job: deploy_docs_production
      artifacts: false
  tags: ["build", "amd64", "internet"]
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/linkcheck/*.txt
+    expire_in: 1 week
  allow_failure: true
  script:
    - cd docs
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@@ -34,22 +34,16 @@ check_public_headers:
    - IDF_TARGET=esp32p4 python tools/ci/check_public_headers.py --jobs 4 --prefix riscv32-esp-elf-
    - IDF_TARGET=esp32c61 python tools/ci/check_public_headers.py --jobs 4 --prefix riscv32-esp-elf-

-test_nvs_on_host:
-  extends: .host_test_template
-  script:
-    - cd components/nvs_flash/test_nvs_host
-    - make test
-
 test_nvs_coverage:
  extends:
    - .host_test_template
    - .rules:labels:nvs_coverage
  artifacts:
    paths:
-      - components/nvs_flash/test_nvs_host/coverage_report
+      - components/nvs_flash/host_test/nvs_host_test/coverage_report
  script:
-    - cd components/nvs_flash/test_nvs_host
-    - make coverage_report
+    - cd components/nvs_flash/host_test/nvs_host_test
+    - idf.py build coverage
  # the 'long' host tests take approx 11 hours on our current runners. Adding some margin here for possible CPU contention
  timeout: 18 hours

@@ -68,22 +62,6 @@ test_ldgen_on_host:
  variables:
    LC_ALL: C.UTF-8

-test_reproducible_build:
-  extends: .host_test_template
-  script:
-    - ./tools/ci/test_reproducible_build.sh
-  artifacts:
-    when: on_failure
-    paths:
-      - "**/sdkconfig"
-      - "**/build*/*.bin"
-      - "**/build*/*.elf"
-      - "**/build*/*.map"
-      - "**/build*/flasher_args.json"
-      - "**/build*/*.bin"
-      - "**/build*/bootloader/*.bin"
-      - "**/build*/partition_table/*.bin"
-
 test_spiffs_on_host:
  extends: .host_test_template
  script:
@@ -217,7 +195,7 @@ test_tools:
      junit: ${IDF_PATH}/XUNIT_*.xml
  variables:
    LC_ALL: C.UTF-8
-    INSTALL_QEMU: 1  # for test_idf_qemu.py
+    INSTALL_EXTRA_TOOLS: "qemu-xtensa qemu-riscv32"  # for test_idf_qemu.py
  script:
    - stat=0
    - cd ${IDF_PATH}/tools/ci/test_autocomplete
@@ -255,6 +233,7 @@ test_mqtt_on_host:

 test_transport_on_host:
  extends: .host_test_template
+  allow_failure: true # IDFCI-2781 [v5.5, v5.4] test_transport_on_host fails on ubuntu 24.04
  script:
    - cd ${IDF_PATH}/components/tcp_transport/host_test
    - idf.py build
@@ -304,9 +283,10 @@ test_pytest_qemu:
      junit: XUNIT_RESULT.xml
  parallel:
    matrix:
-      - IDF_TARGET: [esp32, esp32c3]
-  variables:
-    INSTALL_QEMU: 1
+      - IDF_TARGET: "esp32"
+        INSTALL_EXTRA_TOOLS: "qemu-xtensa"
+      - IDF_TARGET: "esp32c3"
+        INSTALL_EXTRA_TOOLS: "qemu-riscv32"
  script:
    - run_cmd python tools/ci/ci_build_apps.py . -v
      --target $IDF_TARGET
@@ -370,7 +350,7 @@ test_pytest_macos:
  variables:
    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
-    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -vv
+    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -v
      --target linux
      --pytest-apps
      -m \"host_test and macos_shell\"
@@ -404,3 +384,46 @@ test_idf_build_apps_load_soc_caps:
  extends: .host_test_template
  script:
    - python tools/ci/check_soc_headers_load_in_idf_build_apps.py
+
+test_nvs_gen_check:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+      - components/nvs_flash/nvs_partition_tool
+    reports:
+      junit: XUNIT_RESULT.xml
+  variables:
+    LC_ALL: C.UTF-8
+  script:
+    - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
+    - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml
+
+test_esp_rom:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+    reports:
+      junit: XUNIT_RESULT.xml
+  script:
+    - cd ${IDF_PATH}/components/esp_rom/
+    - pytest --noconftest test_esp_rom.py --junitxml=XUNIT_RESULT.xml
+
+make_sure_soc_caps_compatible_in_idf_build_apps:
+    extends:
+      - .host_test_template
+      - .rules:dev-push
+    artifacts:
+      paths:
+        - new.json
+        - base.json
+      when: always
+    when: manual
+    script:
+      - python tools/ci/idf_build_apps_dump_soc_caps.py new.json
+      - git fetch --depth=1 origin $CI_MERGE_REQUEST_DIFF_BASE_SHA
+      - git checkout -f $CI_MERGE_REQUEST_DIFF_BASE_SHA
+      - git checkout $CI_COMMIT_SHA -- tools/ci/idf_build_apps_dump_soc_caps.py
+      - python tools/ci/idf_build_apps_dump_soc_caps.py base.json
+      - diff new.json base.json
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@@ -44,6 +44,9 @@ check_blobs:
    - IDF_TARGET=esp32c2 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
    - IDF_TARGET=esp32c3 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
    - IDF_TARGET=esp32c6 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c5 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c61 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32_host $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
    # Check if Coexistence library header files match between IDF and the version used when compiling the libraries
    - IDF_TARGET=esp32 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
    - IDF_TARGET=esp32s2 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
@@ -52,6 +55,8 @@ check_blobs:
    - IDF_TARGET=esp32c3 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
    - IDF_TARGET=esp32c6 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
    - IDF_TARGET=esp32h2 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c5 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c61 $IDF_PATH/components/esp_coex/test_md5/test_md5.sh
    # Check if Wi-Fi, PHY, BT blobs contain references to specific symbols
    - bash $IDF_PATH/tools/ci/check_blobs.sh

@@ -112,8 +117,10 @@ check_test_scripts_build_test_rules:
  extends:
    - .pre_check_template
    - .before_script:build
+  variables:
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
-    # required pytest related packages
+    # requires basic pytest dependencies
    - run_cmd bash install.sh --enable-pytest
    - python tools/ci/check_build_test_rules.py check-test-scripts examples/ tools/test_apps components

@@ -158,6 +165,8 @@ pipeline_variables:
      if [ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]; then
        echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
      fi
+    - echo "OOCD_DISTRO_URL_ARMHF=$OOCD_DISTRO_URL_ARMHF" >> pipeline.env
+    - echo "OOCD_DISTRO_URL_ARM64=$OOCD_DISTRO_URL_ARM64" >> pipeline.env
    - python tools/ci/ci_process_description.py
    - cat pipeline.env
    - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
@@ -168,3 +177,47 @@ pipeline_variables:
      - pipeline.env
    expire_in: 1 week
    when: always
+
+baseline_manifest_sha:
+  extends:
+    - .pre_check_template
+    - .rules:dev-push
+  tags: [fast_run, shiny]
+  script:
+    - |
+      # merged results pipelines, by default
+      # diff between target-branch-head and merged-result-head
+      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_SHA" ]; then
+        git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_SHA --depth=1
+        git checkout FETCH_HEAD
+        idf-build-apps dump-manifest-sha \
+          --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
+          --output .manifest_sha
+      # merge request pipelines, when the mr got conflicts
+      # diff between diff-base-sha and merge-request-head
+      elif [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
+        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1
+        git checkout FETCH_HEAD
+        idf-build-apps dump-manifest-sha \
+          --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
+          --output .manifest_sha
+      # other pipelines, like the protected branches pipelines
+      # not triggered in this job
+      fi
+  artifacts:
+    paths:
+      - .manifest_sha
+    expire_in: 1 week
+    when: always
+
+redundant_pass_job:
+  stage: pre_check
+  tags: [shiny, fast_run]
+  image: $ESP_ENV_IMAGE
+  dependencies: null
+  before_script: []
+  cache: []
+  extends: []
+  script:
+    - echo "This job is redundant to ensure the 'retry_failed_jobs' job can exist and not be skipped"
+  when: always
--- a/.gitlab/ci/retry_failed_jobs.yml
+++ b/.gitlab/ci/retry_failed_jobs.yml
@@ -1,6 +1,7 @@
 retry_failed_jobs:
  stage: retry_failed_jobs
  tags: [shiny, fast_run]
+  allow_failure: true
  image: $ESP_ENV_IMAGE
  dependencies: null
  before_script: []
@@ -11,4 +12,4 @@ retry_failed_jobs:
    - python tools/ci/python_packages/gitlab_api.py retry_failed_jobs $CI_MERGE_REQUEST_PROJECT_ID --pipeline_id $CI_PIPELINE_ID
  when: manual
  needs:
-    - generate_failed_jobs_report
+    - redundant_pass_job
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@@ -83,6 +83,8 @@

  - "tools/idf_monitor.py"

+  - "tools/activate.py"
+
  - "tools/idf.py"
  - "tools/idf_py_actions/**/*"
  - "tools/test_idf_py/**/*"
@@ -96,6 +98,11 @@
  - "tools/test_idf_tools/**/*"
  - "tools/install_util.py"

+  - "tools/export_utils/utils.py"
+  - "tools/export_utils/shell_types.py"
+  - "tools/export_utils/console_output.py"
+  - "tools/export_utils/activate_venv.py"
+
  - "tools/requirements/*"
  - "tools/requirements.json"
  - "tools/requirements_schema.json"
@@ -108,8 +115,6 @@
  - "tools/detect_python.sh"
  - "tools/detect_python.fish"

-  - "tools/ci/test_reproducible_build.sh"
-
  - "tools/gen_soc_caps_kconfig/*"
  - "tools/gen_soc_caps_kconfig/test/test_gen_soc_caps_kconfig.py"

@@ -220,6 +225,10 @@
  rules:
    - <<: *if-tag-release

+.rules:dev-push:
+  rules:
+    - <<: *if-dev-push
+
 # Do not upload caches on dev branches by default
 .rules:upload-python-cache:
  rules:
@@ -252,14 +261,14 @@
    - <<: *if-dev-push
      changes: *patterns-python-files

-.rules:patterns:static-code-analysis-preview:
-  rules:
-    - <<: *if-dev-push
-      changes: *patterns-c-files
-    - <<: *if-dev-push
-      changes: *patterns-python-files
-    - <<: *if-dev-push
-      changes: *patterns-sonarqube-files
+#.rules:patterns:static-code-analysis-preview:
+#  rules:
+#    - <<: *if-dev-push
+#      changes: *patterns-c-files
+#    - <<: *if-dev-push
+#      changes: *patterns-python-files
+#    - <<: *if-dev-push
+#      changes: *patterns-sonarqube-files

 .rules:patterns:idf-pytest-plugin:
  rules:
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@@ -38,84 +38,84 @@ check_pylint:
      fi
    - if [ -z "$files" ]; then echo "No python files found"; exit 0; fi
    - run_cmd pylint --exit-zero --load-plugins=pylint_gitlab --output-format=gitlab-codeclimate:pylint.json $files
-
-# build stage
-# Sonarqube related jobs put here for this reason:
-# Here we have two jobs. code_quality_check and code_quality_report.
 #
-# code_quality_check will analyze the code changes between your MR and
-# code repo stored in sonarqube server. The analysis result is only shown in
-# the comments under this MR and won't be transferred to the server.
+## build stage
+## Sonarqube related jobs put here for this reason:
+## Here we have two jobs. code_quality_check and code_quality_report.
+##
+## code_quality_check will analyze the code changes between your MR and
+## code repo stored in sonarqube server. The analysis result is only shown in
+## the comments under this MR and won't be transferred to the server.
+##
+## code_quality_report will analyze and transfer both of the newly added code
+## and the analysis result to the server.
+##
+## Put in the front to ensure that the newly merged code can be stored in
+## sonarqube server ASAP, in order to avoid reporting unrelated code issues
+#.sonar_scan_template:
+#  stage: build
+#  extends: .pre_check_template
+#  # full clone since this image does not support fetch --shallow-since-cutoff
+#  # shiny runners are used for full clone
+#  tags: [build, shiny]
+#  image: $SONARQUBE_SCANNER_IMAGE
+#  before_script:
+#    - source tools/ci/utils.sh
+#    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
+#    - fetch_submodules
+#    # Exclude the submodules, all paths ends with /**
+#    - submodules=$(get_all_submodules)
+#    # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
+#    - custom_excludes=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
+#    # Exclude the report dir as well
+#    - export EXCLUSIONS="$custom_excludes,$submodules"
+#    - export SONAR_SCANNER_OPTS="-Xmx2048m"
+#  variables:
+#    GIT_DEPTH: 0
+#    REPORT_PATTERN: clang_tidy_reports/**/*.txt
+#  artifacts:
+#    paths:
+#      - $REPORT_PATTERN
+#    expire_in: 1 week
+#    when: always
+#  dependencies:  # Here is not a hard dependency relationship, could be skipped when only python files changed. so we do not use "needs" here.
+#    - clang_tidy_check
 #
-# code_quality_report will analyze and transfer both of the newly added code
-# and the analysis result to the server.
+#code_quality_check:
+#  extends:
+#    - .sonar_scan_template
+#    - .rules:patterns:static-code-analysis-preview
+#  allow_failure: true  # it's using exit code to indicate the code analysis result,
+#                       # we don't want to block ci when critical issues founded
+#  script:
+#    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits --src-branch ${CI_COMMIT_REF_NAME} | tr '\n' ',')
+#    # test if this branch have merge request, if not, exit 0
+#    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
+#    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
+#    - sonar-scanner
+#      -Dsonar.analysis.mode=preview
+#      -Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
+#      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
+#      -Dsonar.exclusions=$EXCLUSIONS
+#      -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID
+#      -Dsonar.gitlab.commit_sha=$CI_MERGE_REQUEST_COMMITS
+#      -Dsonar.gitlab.merge_request_discussion=true
+#      -Dsonar.gitlab.ref_name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
+#      -Dsonar.host.url=$SONAR_HOST_URL
+#      -Dsonar.login=$SONAR_LOGIN
 #
-# Put in the front to ensure that the newly merged code can be stored in
-# sonarqube server ASAP, in order to avoid reporting unrelated code issues
-.sonar_scan_template:
-  stage: build
-  extends: .pre_check_template
-  # full clone since this image does not support fetch --shallow-since-cutoff
-  # shiny runners are used for full clone
-  tags: [build, shiny]
-  image: $SONARQUBE_SCANNER_IMAGE
-  before_script:
-    - source tools/ci/utils.sh
-    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
-    - fetch_submodules
-    # Exclude the submodules, all paths ends with /**
-    - submodules=$(get_all_submodules)
-    # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
-    - custom_excludes=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
-    # Exclude the report dir as well
-    - export EXCLUSIONS="$custom_excludes,$submodules"
-    - export SONAR_SCANNER_OPTS="-Xmx2048m"
-  variables:
-    GIT_DEPTH: 0
-    REPORT_PATTERN: clang_tidy_reports/**/*.txt
-  artifacts:
-    paths:
-      - $REPORT_PATTERN
-    expire_in: 1 week
-    when: always
-  dependencies:  # Here is not a hard dependency relationship, could be skipped when only python files changed. so we do not use "needs" here.
-    - clang_tidy_check
-
-code_quality_check:
-  extends:
-    - .sonar_scan_template
-    - .rules:patterns:static-code-analysis-preview
-  allow_failure: true  # it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits --src-branch ${CI_COMMIT_REF_NAME} | tr '\n' ',')
-    # test if this branch have merge request, if not, exit 0
-    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
-    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
-    - sonar-scanner
-      -Dsonar.analysis.mode=preview
-      -Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID
-      -Dsonar.gitlab.commit_sha=$CI_MERGE_REQUEST_COMMITS
-      -Dsonar.gitlab.merge_request_discussion=true
-      -Dsonar.gitlab.ref_name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN
-
-code_quality_report:
-  extends:
-    - .sonar_scan_template
-    - .rules:protected
-  allow_failure: true  # it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - sonar-scanner
-      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
-      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN
+#code_quality_report:
+#  extends:
+#    - .sonar_scan_template
+#    - .rules:protected
+#  allow_failure: true  # it's using exit code to indicate the code analysis result,
+#                       # we don't want to block ci when critical issues founded
+#  script:
+#    - sonar-scanner
+#      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
+#      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
+#      -Dsonar.exclusions=$EXCLUSIONS
+#      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
+#      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
+#      -Dsonar.host.url=$SONAR_HOST_URL
+#      -Dsonar.login=$SONAR_LOGIN
--- a/.gitmodules
+++ b/.gitmodules
@@ -54,8 +54,10 @@
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-hash = 8f2beb57ddad1f94bed899790b00f46df893ccac
 	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
+	sbom-cve-exclude-list = CVE-2023-26819 Resolved in commit a328d65ad490b64da8c87523cbbfe16050ba5bf6
+	sbom-cve-exclude-list = CVE-2023-53154 Resolved in v1.7.18

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,7 +23,8 @@ repos:
            .*.pb-c.h|
            .*.pb-c.c|
            .*.yuv|
-            .*.rgb
+            .*.rgb|
+            docs/sphinx-known-warnings\.txt
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@@ -56,6 +57,7 @@ repos:
    rev: v2.3.0
    hooks:
      - id: codespell
+        exclude: ^docs/sphinx-known-warnings\.txt$
  - repo: local
    hooks:
      - id: check-executables
@@ -70,11 +72,6 @@ repos:
        language: python
        pass_filenames: false
        always_run: true
-      - id: check-deprecated-kconfigs-options
-        name: Check if any Kconfig Options Deprecated
-        entry: tools/ci/check_deprecated_kconfigs.py
-        language: python
-        files: 'sdkconfig\.ci$|sdkconfig\.rename$|sdkconfig.*$'
      - id: cmake-lint
        name: Check CMake Files Format
        entry: cmakelint --linelength=120 --spaces=4 --filter=-whitespace/indent
@@ -154,7 +151,7 @@ repos:
        require_serial: true
        additional_dependencies:
          - PyYAML == 5.3.1
-          - idf-build-apps~=2.0
+          - idf-build-apps~=2.5
      - id: sort-yaml-files
        name: sort yaml files
        entry: tools/ci/sort_yaml.py
@@ -241,6 +238,7 @@ repos:
        name: Lint rST files in docs folder using Sphinx Lint
        files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
  - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.3.0
+    rev: v2.5.0
    hooks:
      - id: check-kconfig-files
+      - id: check-deprecated-kconfig-options
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -16,7 +16,11 @@ endif()
 if(NOT BOOTLOADER_BUILD)

    if(CONFIG_COMPILER_OPTIMIZATION_SIZE)
-        list(APPEND compile_options "-Os")
+        if(CMAKE_C_COMPILER_ID MATCHES "Clang")
+            list(APPEND compile_options "-Oz")
+        else()
+            list(APPEND compile_options "-Os")
+        endif()
        if(CMAKE_C_COMPILER_ID MATCHES "GNU")
            list(APPEND compile_options "-freorder-blocks")
        endif()
@@ -34,7 +38,11 @@ if(NOT BOOTLOADER_BUILD)
 else()  # BOOTLOADER_BUILD

    if(CONFIG_BOOTLOADER_COMPILER_OPTIMIZATION_SIZE)
-        list(APPEND compile_options "-Os")
+        if(CMAKE_C_COMPILER_ID MATCHES "Clang")
+            list(APPEND compile_options "-Oz")
+        else()
+            list(APPEND compile_options "-Os")
+        endif()
        if(CMAKE_C_COMPILER_ID MATCHES "GNU")
            list(APPEND compile_options "-freorder-blocks")
        endif()
@@ -152,46 +160,8 @@ if(CONFIG_COMPILER_DUMP_RTL_FILES)
    list(APPEND compile_options "-fdump-rtl-expand")
 endif()

-if(NOT ${CMAKE_C_COMPILER_VERSION} VERSION_LESS 8.0.0)
-    if(CONFIG_COMPILER_HIDE_PATHS_MACROS)
-        list(APPEND compile_options "-fmacro-prefix-map=${CMAKE_SOURCE_DIR}=.")
-        list(APPEND compile_options "-fmacro-prefix-map=${IDF_PATH}=/IDF")
-    endif()
-
-    if(CONFIG_APP_REPRODUCIBLE_BUILD)
-        idf_build_set_property(DEBUG_PREFIX_MAP_GDBINIT "${BUILD_DIR}/prefix_map_gdbinit")
-
-        list(APPEND compile_options "-fdebug-prefix-map=${IDF_PATH}=/IDF")
-        list(APPEND compile_options "-fdebug-prefix-map=${PROJECT_DIR}=/IDF_PROJECT")
-        list(APPEND compile_options "-fdebug-prefix-map=${BUILD_DIR}=/IDF_BUILD")
-
-        # component dirs
-        idf_build_get_property(python PYTHON)
-        idf_build_get_property(idf_path IDF_PATH)
-        idf_build_get_property(component_dirs BUILD_COMPONENT_DIRS)
-
-        execute_process(
-            COMMAND ${python}
-                "${idf_path}/tools/generate_debug_prefix_map.py"
-                "${BUILD_DIR}"
-                "${component_dirs}"
-            OUTPUT_VARIABLE result
-            RESULT_VARIABLE ret
-        )
-        if(NOT ret EQUAL 0)
-            message(FATAL_ERROR "This is a bug. Please report to https://github.com/espressif/esp-idf/issues")
-        endif()
-
-        spaces2list(result)
-        list(LENGTH component_dirs length)
-        math(EXPR max_index "${length} - 1")
-        foreach(index RANGE ${max_index})
-            list(GET component_dirs ${index} folder)
-            list(GET result ${index} after)
-            list(APPEND compile_options "-fdebug-prefix-map=${folder}=${after}")
-        endforeach()
-    endif()
-endif()
+__generate_prefix_map(prefix_map_compile_options)
+list(APPEND compile_options ${prefix_map_compile_options})

 if(CONFIG_COMPILER_DISABLE_GCC12_WARNINGS)
    list(APPEND compile_options "-Wno-address"
@@ -205,6 +175,10 @@ if(CONFIG_COMPILER_DISABLE_GCC13_WARNINGS)
                                    "-Wno-dangling-reference")
 endif()

+if(CONFIG_COMPILER_DISABLE_GCC14_WARNINGS)
+    list(APPEND compile_options "-Wno-calloc-transposed-args")
+endif()
+
 if(CONFIG_COMPILER_DISABLE_DEFAULT_ERRORS)
    if(NOT CMAKE_C_COMPILER_ID MATCHES "Clang")
        idf_build_replace_option_from_property(COMPILE_OPTIONS "-Werror" "-Werror=all")
@@ -227,8 +201,35 @@ endif()
 list(APPEND link_options "-fno-lto")

 if(CONFIG_IDF_TARGET_LINUX AND CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin")
+    # Not all versions of the MacOS linker support the -warn_commons flag.
+    # ld version 1053.12 (and above) have been tested to support it.
+    # Hence, we extract the version string from the linker output
+    # before including the flag.
+
+    # Get the ld version, capturing both stdout and stderr
+    execute_process(
+        COMMAND ${CMAKE_LINKER} -v
+        OUTPUT_VARIABLE LD_VERSION_OUTPUT
+        ERROR_VARIABLE LD_VERSION_ERROR
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_STRIP_TRAILING_WHITESPACE
+    )
+
+    # Combine stdout and stderr
+    set(LD_VERSION_OUTPUT "${LD_VERSION_OUTPUT}\n${LD_VERSION_ERROR}")
+
+    # Extract the version string
+    string(REGEX MATCH "PROJECT:(ld|dyld)-([0-9]+)\\.([0-9]+)" LD_VERSION_MATCH "${LD_VERSION_OUTPUT}")
+    set(LD_VERSION_MAJOR_MINOR "${CMAKE_MATCH_2}.${CMAKE_MATCH_3}")
+
+    message(STATUS "Linker Version: ${LD_VERSION_MAJOR_MINOR}")
+
+    # Compare the version with 1053.12
+    if(LD_VERSION_MAJOR_MINOR VERSION_GREATER_EQUAL "1053.12")
+        list(APPEND link_options "-Wl,-warn_commons")
+    endif()
+
    list(APPEND link_options "-Wl,-dead_strip")
-    list(APPEND link_options "-Wl,-warn_commons")
 else()
    list(APPEND link_options "-Wl,--gc-sections")
    list(APPEND link_options "-Wl,--warn-common")
@@ -250,7 +251,9 @@ if(CMAKE_C_COMPILER_ID MATCHES "GNU")
 endif()

 if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-    list(APPEND compile_options "-fno-use-cxa-atexit")
+    list(APPEND compile_options "-fno-use-cxa-atexit")  # TODO IDF-10934
+else()
+    list(APPEND cxx_compile_options "-fuse-cxa-atexit")
 endif()

 if(COMPILER_RT_LIB_NAME)
--- a/32
+++ b/32
@@ -323,8 +323,8 @@ mainmenu "Espressif IoT Development Framework Configuration"
            help
                This option sets compiler optimization level (gcc -O argument) for the app.

-                - The "Debug" setting will add the -0g flag to CFLAGS.
-                - The "Size" setting will add the -0s flag to CFLAGS.
+                - The "Debug" setting will add the -Og flag to CFLAGS.
+                - The "Size" setting will add the -Os flag to CFLAGS (-Oz with Clang).
                - The "Performance" setting will add the -O2 flag to CFLAGS.
                - The "None" setting will add the -O0 flag to CFLAGS.

@@ -345,7 +345,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
            config COMPILER_OPTIMIZATION_DEBUG
                bool "Debug (-Og)"
            config COMPILER_OPTIMIZATION_SIZE
-                bool "Optimize for size (-Os)"
+                bool "Optimize for size (-Os with GCC, -Oz with Clang)"
            config COMPILER_OPTIMIZATION_PERF
                bool "Optimize for performance (-O2)"
            config COMPILER_OPTIMIZATION_NONE
@@ -388,6 +388,21 @@ mainmenu "Espressif IoT Development Framework Configuration"

        endchoice # assertions

+        config COMPILER_ASSERT_NDEBUG_EVALUATE
+            bool "Enable the evaluation of the expression inside assert(X) when NDEBUG is set"
+            default y
+            help
+                When NDEBUG is set, assert(X) will not cause code to trigger an assertion.
+                With this option set, assert(X) will still evaluate the expression X, though
+                the result will never cause an assertion. This means that if X is a function
+                then the function will be called.
+
+                This is not according to the standard, which states that the assert(X) should
+                be replaced with ((void)0) if NDEBUG is defined.
+
+                In ESP-IDF v6.0 the default behavior will change to "no" to be in line with the
+                standard.
+
        choice COMPILER_FLOAT_LIB_FROM
            prompt "Compiler float lib source"
            default COMPILER_FLOAT_LIB_FROM_RVFPLIB if ESP_ROM_HAS_RVFPLIB
@@ -572,6 +587,13 @@ mainmenu "Espressif IoT Development Framework Configuration"
                Enable this option if use GCC 13 or newer, and want to disable warnings which don't appear with
                GCC 12.

+        config COMPILER_DISABLE_GCC14_WARNINGS
+            bool "Disable new warnings introduced in GCC 14"
+            default "n"
+            help
+                Enable this option if use GCC 14 or newer, and want to disable warnings which don't appear with
+                GCC 13.
+
        config COMPILER_DUMP_RTL_FILES
            bool "Dump RTL files during compilation"
            help
@@ -619,7 +641,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
            config COMPILER_ORPHAN_SECTIONS_WARNING
                bool "Place with warning"
                help
-                    Places orphan sections without a warning message.
+                    Places orphan sections with a warning message.

            config COMPILER_ORPHAN_SECTIONS_PLACE
                bool "Place silently"
@@ -654,6 +676,6 @@ mainmenu "Espressif IoT Development Framework Configuration"
            - CONFIG_ESPTOOLPY_FLASHFREQ_120M && CONFIG_ESPTOOLPY_FLASH_SAMPLE_MODE_DTR
            - CONFIG_SPIRAM_SPEED_120M && CONFIG_SPIRAM_MODE_OCT
            - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
-            - CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL
            - CONFIG_ESP_WIFI_EAP_TLS1_3
            - CONFIG_ESP_WIFI_ENABLE_ROAMING_APP
+            - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS
--- a/README.md
+++ b/README.md
@@ -15,17 +15,18 @@ ESP-IDF is the development framework for Espressif SoCs supported on Windows, Li

 The following table shows ESP-IDF support of Espressif SoCs where ![alt text][preview] and ![alt text][supported] denote preview status and support, respectively. The preview support is usually limited in time and intended for beta versions of chips. Please use an ESP-IDF release where the desired SoC is already supported.

-|Chip         |          v5.0          |         v5.1           |         v5.2           |         v5.3           |                                                            |
-|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: | :--------------------------------------------------------- |
-|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                            |
-|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                            |
-|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                            |
-|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [Announcement](https://www.espressif.com/en/news/ESP32_S3) |
-|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [Announcement](https://www.espressif.com/en/news/ESP32-C2) |
-|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [Announcement](https://www.espressif.com/en/news/ESP32_C6) |
-|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [Announcement](https://www.espressif.com/en/news/ESP32_H2) |
-|ESP32-P4     |                        |                        |                        | ![alt text][supported] | [Announcement](https://www.espressif.com/en/news/ESP32-P4) |
-|ESP32-C5     |                        |                        |                        | ![alt text][preview]   | [Announcement](https://www.espressif.com/en/news/ESP32-C5) |
+|Chip         |          v5.0          |         v5.1           |         v5.2           |         v5.3           |          v5.4           |                                                                     |
+|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: |  :--------------------: |:------------------------------------------------------------------- |
+|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
+|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
+|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
+|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_S3)           |
+|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-C2)           |
+|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_C6)           |
+|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_H2)           |
+|ESP32-P4     |                        |                        |                        | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-P4)           |
+|ESP32-C5     |                        |                        |                        |                        |  ![alt text][preview]   |[Announcement](https://www.espressif.com/en/news/ESP32-C5)           |
+|ESP32-C61    |                        |                        |                        |                        |  ![alt text][preview]   |[Announcement](https://www.espressif.com/en/products/socs/esp32-c61) |

 [supported]: https://img.shields.io/badge/-supported-green "supported"
 [preview]: https://img.shields.io/badge/-preview-orange "preview"
--- a/README_CN.md
+++ b/README_CN.md
@@ -15,17 +15,18 @@ ESP-IDF 是乐鑫官方推出的物联网开发框架，支持 Windows、Linux

 下表总结了乐鑫芯片在 ESP-IDF 各版本中的支持状态，其中 ![alt text][supported] 代表已支持，![alt text][preview] 代表目前处于预览支持状态。预览支持状态通常有时间限制，而且仅适用于测试版芯片。请确保使用与芯片相匹配的 ESP-IDF 版本。

-|芯片         |          v5.0          |          v5.1          |          v5.2          |          v5.3          |                                                                 |
-|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: | :-------------------------------------------------------------- |
-|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                 |
-|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                 |
-|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                 |
-|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_S3) |
-|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C2) |
-|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_C6) |
-|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_H2) |
-|ESP32-P4     |                        |                        |                        | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-P4) |
-|ESP32-C5     |                        |                        |                        | ![alt text][preview]   | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C5) |
+|芯片         |          v5.0          |          v5.1          |          v5.2          |          v5.3          |          v5.4          |                                                                           |
+|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: | :--------------------: | :------------------------------------------------------------------------ |
+|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
+|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
+|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
+|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_S3)           |
+|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C2)           |
+|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_C6)           |
+|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_H2)           |
+|ESP32-P4     |                        |                        |                        | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-P4)           |
+|ESP32-C5     |                        |                        |                        |                        | ![alt text][preview]   | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C5)           |
+|ESP32-C61    |                        |                        |                        |                        | ![alt text][preview]   | [芯片发布公告](https://www.espressif.com/zh-hans/products/socs/esp32-c61) |

 [supported]: https://img.shields.io/badge/-%E6%94%AF%E6%8C%81-green "supported"
 [preview]: https://img.shields.io/badge/-%E9%A2%84%E8%A7%88-orange "preview"
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -0,0 +1,123 @@
+# ESP-IDF Project Roadmap 2024
+
+This document outlines the goals of ESP-IDF project and is shared for the convenience of our customers. It is important to clarify that this document is not a binding commitment to our customers. Instead, its primary purpose is to offer a clear roadmap and direction for the project's development. By openly sharing this information, we aim to enhance our customers' understanding, promote transparency and ensure alignment with the overarching objectives of the ESP-IDF project.
+
+## Project Overview
+
+### Project Goals
+
+In both minor and major releases, we integrate new chip support to enhance our product range. By expanding the chip matrix, we broaden the scope of our offerings, catering to a wider audience with diverse needs. This proactive approach ensures that our products remain at the forefront of technological advancements, consistently meeting and exceeding customer expectations.
+
+Furthermore, we prioritize bugfix releases for active branches, focusing on improving the stability and performance of products already in production. By addressing bugs promptly, we aim to enhance the overall user experience and provide tangible benefits to customers relying on our solutions. This proactive maintenance strategy reflects our commitment to delivering reliable, high-quality products to our valued customer base.
+
+Below are the main objectives that ESP-IDF project/teams would like to implement in 2024.
+
+-   New Chip Support
+
+    -   Add support for ESP32-P4
+    -   Add support for ESP32-C5
+    -   Add support for ESP32-C61
+
+-   More Minor Releases
+
+    -   Release IDF v5.3 in 2024
+    -   Release IDF v5.4 at the start of 2025
+
+-   More Bugfix Releases
+
+    -   Release v4.4.8 for IDF v4.4 before ESP-IDF v4.4 goes End of Life in July 2024
+    -   Do more bugfix releases for IDF v5.1 before release/5.1 enters maintenance period in June 2024
+    -   Do more bug fixes releases for release/5.2 and release/5.3, and push the two releases to be more stable and production-ready
+
+-   Updates of Libraries
+
+    -   Update GDB to 14.2
+    -   Update LLVM to 18.1.2
+    -   Update MbedTLS to 3.6 (LTS)
+    -   Update LWIP to 2.2.0
+    -   Change minimal Python requirement to 3.9
+
+Please note that support status of previous silicones could be found on [ESP-IDF Release and SoC Compatibility](https://github.com/espressif/esp-idf#esp-idf-release-and-soc-compatibility).
+
+### Roadmap Details
+
+The ESP-IDF project prioritizes consistent maintenance and updates to ensure our customers remain at the forefront of technological advancements. Our commitment to ongoing development ensures that customers continuously benefit from the latest innovations in the field.
+
+Moreover, we are dedicated to empowering our customers to leverage newly implemented features and enhanced functionalities through iterative improvements. Our steadfast commitment to pushing boundaries ensures that clients not only keep pace with evolving technology but also extract optimal value from the cutting-edge capabilities of our products.
+
+Below are the main roadmap details for functional areas inside ESP-IDF.
+
+-   New Chip Support
+
+    -   Add full support for ESP32-P4 in ESP-IDF v5.3, refer to [ESP32-P4 Support Status](https://github.com/espressif/esp-idf/issues/12996)
+    -   Add preview support for ESP32-C5 in ESP-IDF v5.3 and full support for ESP32-C5 in ESP-IDF v5.4, refer to [ESP32-C5 Support Status](https://github.com/espressif/esp-idf/issues/14021)
+    -   Add preview support for the early samples of ESP32-C61 in ESP-IDF v5.4 and full support for mass production version in ESP-IDF v5.4.x. Refer to [ESP32-C61 Support Status](https://developer.espressif.com/pages/chip-support-status/esp32c61/#esp-idf)
+
+-   Bugfix releases
+
+    -   Do bugfix release IDF v4.4.8 and stop maintaining ESP-IDF v4.4 in July 2024
+    -   Release bugfix IDF v5.0.6 and IDF v5.0.7 in 2024 (maintenance period)
+    -   Release bugfix IDF v5.1.3 and IDF v5.1.4 in H1 of 2024, and release IDF v5.1.5 in H2 of 2024
+    -   Push release/5.1 to maintenance period from June 2024
+    -   Do more bug fixes releases for release/5.2 (IDF v5.2.1, IDF v5.2.2, IDF v5.2.3) and release/5.3 (IDF v5.3.1, IDF v5.3.2), and push releases to be more stable and more production-ready
+
+## ESP-IDF Planning information
+
+For the full list of ESP-IDF releases, please visit https://github.com/espressif/esp-idf/releases
+
+### ESP-IDF Major Releases
+
+No Major Releases planned
+
+### ESP-IDF Minor Releases
+
+#### Quarter One
+
+-   v5.2-RC1, estimate release date: 2024/02/02
+-   v5.2 final release, estimate release date: 2024/02/08
+
+#### Quarter Two
+
+-   v5.3-beta1, estimate release date:: 2024/05/13
+-   v5.3-beta2, estimate release date:: 2024/05/31
+-   v5.3-RC1, estimate release date:: 2024/07/08
+
+#### Quarter Three
+
+-   v5.3-RC2, estimate release date:: 2024/07/26
+-   v5.3 final release, estimate release date:: 2024/08/02
+
+#### Quarter Four
+
+-   v5.4-beta1, estimate release date:: 2024/11/08
+-   v5.4-beta2, estimate release date:: 2024/11/29
+-   v5.4-RC1, estimate release date:: 2025/01/09
+-   v5.4-RC2, estimate release date:: 2025/01/29
+-   v5.4 final release, estimate release date: 2025/02/05
+
+### ESP-IDF Bugfix Releases
+
+#### Quarter One
+
+-   v5.1.3, estimate release date: 2024/02/08
+-   v5.0.6, estimate release date: 2024/02/18
+-   v4.4.7, estimate release date:: 2024/03/19
+-   v5.2.1, estimate release date:: 2024/03/31
+
+#### Quarter Two
+
+-   v5.1.4, estimate release date:: 2024/05/06
+-   v5.2.2, estimate release date:: 2024/06/17
+-   v4.4.8, estimate release date:: 2024/07/19
+
+#### Quarter Three
+
+-   v5.0.7, estimate release date: 2024/08/22
+-   v5.3.1, estimate release date: 2024/09/16
+-   v5.2.3, estimate release date: 2024/10/10
+
+#### Quarter Four
+
+-   v5.1.5, estimate release date: 2024/11/04  (Maintenance period since June 2024)
+-   v5.3.2, estimate release date: 2024/12/31
+-   v5.2.4, estimate release date: 2025/02/20 (Service period ends Feb. 2025)
--- a/ROADMAP_CN.md
+++ b/ROADMAP_CN.md
@@ -0,0 +1,123 @@
+# ESP-IDF 项目路线图 2024 (v1.0)
+
+本文档概述了 ESP-IDF 项目的年度计划，方便客户据此规划自己的项目周期。需要说明的是该文档并不是我们对客户的约束性承诺。相反，其主要目的是为客户提供 ESP-IDF 项目开发的路线图和方向。通过公开这些信息，我们希望增进客户对 ESP-IDF 项目的理解，提高透明度，并确保与 ESP-IDF 项目的总体目标保持一致。
+
+## 项目总览
+
+### 项目目标
+
+在 ESP-IDF 的主要版本和次要版本中，我们一般会增加对新芯片的支持，以扩展我们的产品线。通过扩展芯片矩阵，拓宽我们的产品范围，并满足广泛受众的各种需求。这样便能保证我们的产品始终处于技术进步的前沿，不断满足客户的需求并超越客户的期望。
+
+此外，ESP-IDF 各活跃分支的 Bugfix 版本发布也是我们项目的重中之重，着力提升已量产产品的稳定性和性能。通过及时解决问题，我们期待提升用户的整体体验，切实惠及使用乐鑫解决方案的客户。通过积极维护 ESP-IDF 的各活跃分支，我们践行了对宝贵的客户群提供可靠、高质量产品的承诺。
+
+以下是 ESP-IDF 项目在 2024 年计划实现的主要目标。
+
+* 新芯片支持
+
+	* 增加对 ESP32-P4 芯片的支持
+	* 增加对 ESP32-C5 芯片的支持
+	* 增加对 ESP32-C61 芯片的支持
+
+* 发布更多的次要版本
+
+	* 在 2024 年发布 IDF v5.3 
+	* 在 2025 年初发布 IDF v5.4
+
+* 发布更多 Bugfix 版本
+
+	* 在 2024 年 7 月底 IDF v4.4 停止维护之前，发布 IDF v4.4.8
+	* 在 2024 年 6 月底，release/5.1 分支进入维护周期之前，发布更多 Bugfix 版本
+	* release/5.2 分支和 release/5.3 分支发布更多 Bugfix 版本，使这两个分支更加稳定和产品化
+
+* 上游库与工具链的更新
+
+	* 将 GDB 升级至 14.2
+	* 将 LLVM 升级至 18.1.2
+	* 更新 MbedTLS 至 3.6（LTS）
+	* 更新 LWIP 至 2.2.0
+	* 将最低 Python 要求更改为 3.9
+
+请注意，获取之前芯片的支持状态，请参阅 [ESP-IDF 发布和 SoC 兼容性](https://github.com/espressif/esp-idf/blob/master/README_CN.md#esp-idf-与乐鑫芯片)。
+
+### 路线图细节
+
+ESP-IDF 项目重视持续维护和更新，确保我们的客户始终处于技术进步的前沿。我们承诺持续进行开发，并将该领域的最新创新成果呈现给客户。
+
+此外，我们也在给客户赋能，客户通过迭代改进便能接触到新开发的功能和更高的性能。我们在突破技术界限方面的坚定承诺，使客户不仅能接触到最新的技术，还能从我们产品的尖端功能中获取最大价值。
+
+以下是 ESP-IDF 路线图的主要信息。
+
+* 新芯片支持
+
+	* 在 ESP-IDF v5.3 中为 ESP32-P4 提供完整支持，参考 [ESP32-P4 支持状态](https://github.com/espressif/esp-idf/issues/12996)
+	* 在 ESP-IDF v5.3 中为 ESP32-C5 提供预览支持，并在 ESP-IDF v5.4 中为 ESP32-C5 提供完整支持，参考 [ESP32-C5 支持状态](https://github.com/espressif/esp-idf/issues/14021)
+	* 在 ESP-IDF v5.4 中增加对 ESP32-C61 早期样品的预览支持，并在 IDF v5.4.x 中增加对 ESP32-C61 量产版本的完整支持，参考 [ESP32-C61 支持状态](https://developer.espressif.com/pages/chip-support-status/esp32c61/#esp-idf)
+
+* Bugfix 版本发布
+
+	* 发布 Bugfix 版本 IDF v4.4.8，并在 2024 年 7 月底停止维护 ESP-IDF v4.4
+	* 2024 年，release/5.0 分支已处于维护周期，发布 IDF v5.0.6 和 IDF v5.0.7
+	* 2024 年上半年发布 Bugfix 版本 IDF v5.1.3 和 IDF v5.1.4，并在 2024 年下半年发布 IDF v5.1.5
+	* 自 2024 年 6 月起，release/5.1 分支进入到维护周期
+	* release/5.2 分支发布更多 Bugfix 版本，包括 IDF v5.2.1、IDF v5.2.2、IDF v5.2.3；release/5.3 分支发布更多 Bugfix 版本，包括 IDF v5.3.1、IDF v5.3.2。通过发布这些 Bugfix 版本，使 release/5.2 分支和 release/5.3 分支更加稳定和产品化。
+
+## ESP-IDF 发布计划
+
+获取 ESP-IDF 的完整发布列表，请访问 https://github.com/espressif/esp-idf/releases
+
+### ESP-IDF 主要版本发布
+
+2024 年，无主要版本发布计划
+
+### ESP-IDF 次要版本发布
+
+#### 第一季度
+
+* v5.2-RC1，预计发布日期：2024/02/02
+* v5.2 正式发布，预计发布日期：2024/02/08
+
+#### 第二季度
+
+* v5.3-beta1，预计发布日期：2024/05/13
+* v5.3-beta2，预计发布日期：2024/05/31
+* v5.3-RC1，预计发布日期：2024/07/08
+
+#### 第三季度
+
+* v5.3-RC2，预计发布日期：2024/07/26
+* v5.3 正式发布，预计发布日期：2024/08/02
+
+#### 第四季度
+
+* v5.4-beta1，预计发布日期：2024/11/08
+* v5.4-beta2，预计发布日期：2024/11/29
+* v5.4-RC1，预计发布日期：2025/01/09
+* v5.4-RC2，预计发布日期：2025/01/29
+* v5.4 正式发布，预计发布日期：2025/02/05
+
+### ESP-IDF Bugfix 版本发布
+
+#### 第一季度
+
+* v5.1.3，预计发布日期：2024/02/08
+* v5.0.6，预计发布日期：2024/02/18
+* v4.4.7，预计发布日期：2024/03/19
+* v5.2.1，预计发布日期：2024/03/31
+
+#### 第二季度
+
+* v5.1.4，预计发布日期：2024/05/06
+* v5.2.2，预计发布日期：2024/06/17
+* v4.4.8，预计发布日期：2024/07/19
+
+#### 第三季度
+
+* v5.0.7，预计发布日期：2024/08/22
+* v5.3.1，预计发布日期：2024/09/16
+* v5.2.3，预计发布日期：2024/10/10
+
+#### 第四季度
+
+* v5.1.5，预计发布日期：2024/11/04（自 2024 年 6 月进入维护周期）
+* v5.3.2，预计发布日期：2024/12/31
+* v5.2.4，预计发布日期：2025/02/20（服务周期截止至 2025 年 2 月）
--- a/components/app_trace/app_trace.c
+++ b/components/app_trace/app_trace.c
@@ -26,8 +26,6 @@
 #define ESP_APPTRACE_MAX_VPRINTF_ARGS 256
 #define ESP_APPTRACE_HOST_BUF_SIZE 256

-#define ESP_APPTRACE_PRINT_LOCK 0
-
 const static char *TAG = "esp_apptrace";

 /** tracing module internal data */
@@ -90,7 +88,7 @@ void esp_apptrace_down_buffer_config(uint8_t *buf, uint32_t size)
        return;
    }
    // currently down buffer is supported for JTAG interface only
-    // TODO: one more argument should be added to this function to specify HW inteface: JTAG, UART0 etc
+    // TODO: one more argument should be added to this function to specify HW interface: JTAG, UART0 etc
    ch = &s_trace_channels[ESP_APPTRACE_DEST_JTAG];
    if (ch->hw != NULL) {
        if (ch->hw->down_buffer_config != NULL) {
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -148,6 +148,18 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
        if (res != ESP_OK) {
            break;
        }
+#if CONFIG_IDF_TARGET_ESP32S3
+        /*
+        * ESP32S3 has a serious data corruption issue with the transferred data to host.
+        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
+        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
+        * the current thread continues execution. While this doesn't completely prevent
+        * memory access from other threads/cores/ISRs, it has shown to significantly improve
+        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
+        * number of retries needed to read an entire block without corruption.
+        */
+        esp_rom_delay_us(100);
+#endif
    }
    return res;
 }
@@ -339,7 +351,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
    esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
    // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
    // higher prio tasks and the latter can not allocate buffers at all
    // this is abnormal situation can be detected on host which will receive only uncompleted buffers
--- a/components/app_trace/app_trace_util.c
+++ b/components/app_trace/app_trace_util.c
@@ -9,12 +9,14 @@
 #include "esp_app_trace_util.h"
 #include "sdkconfig.h"

+#define ESP_APPTRACE_PRINT_LOCK 0
+
 ///////////////////////////////////////////////////////////////////////////////
 ///////////////////////////////// Locks /////////////////////////////////////
 ///////////////////////////////////////////////////////////////////////////////

 #if ESP_APPTRACE_PRINT_LOCK
-static esp_apptrace_lock_t s_log_lock = {.irq_stat = 0, .portmux = portMUX_INITIALIZER_UNLOCKED};
+static esp_apptrace_lock_t s_log_lock = { .mux = portMUX_INITIALIZER_UNLOCKED };
 #endif

 int esp_apptrace_log_lock(void)
@@ -31,7 +33,7 @@ int esp_apptrace_log_lock(void)

 void esp_apptrace_log_unlock(void)
 {
- #if ESP_APPTRACE_PRINT_LOCK
+#if ESP_APPTRACE_PRINT_LOCK
    esp_apptrace_lock_give(&s_log_lock);
 #endif
 }
@@ -87,7 +89,7 @@ esp_err_t esp_apptrace_lock_give(esp_apptrace_lock_t *lock)
 uint8_t *esp_apptrace_rb_produce(esp_apptrace_rb_t *rb, uint32_t size)
 {
    uint8_t *ptr = rb->data + rb->wr;
-    // check for avalable space
+    // check for available space
    if (rb->rd <= rb->wr) {
        // |?R......W??|
        if (rb->wr + size >= rb->size) {
--- a/components/app_trace/port/riscv/port.c
+++ b/components/app_trace/port/riscv/port.c
@@ -57,7 +57,13 @@ static bool esp_apptrace_riscv_host_data_pending(void);

 const static char *TAG = "esp_apptrace";

-static esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];
+#if SOC_CACHE_INTERNAL_MEM_VIA_L1CACHE
+#define APPTRACE_DRAM_ATTR TCM_DRAM_ATTR
+#else
+#define APPTRACE_DRAM_ATTR
+#endif
+
+static APPTRACE_DRAM_ATTR esp_apptrace_riscv_ctrl_block_t s_tracing_ctrl[CONFIG_FREERTOS_NUMBER_OF_CORES];

 esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 {
@@ -92,7 +98,7 @@ esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
 }

 /* Advertises apptrace control block address to host.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
   e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_addr)
 {
@@ -103,7 +109,7 @@ __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_add
 }

 /* Returns up buffers config.
-   This function can be overriden with custom implementation,
+   This function can be overridden with custom implementation,
   e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) void esp_apptrace_get_up_buffers(esp_apptrace_mem_block_t mem_blocks_cfg[2])
 {
@@ -165,7 +171,7 @@ static esp_err_t esp_apptrace_riscv_init(esp_apptrace_riscv_data_t *hw_data)
    }
    // notify host about control block address
    int res = esp_apptrace_advertise_ctrl_block(&s_tracing_ctrl[core_id]);
-    assert(res == 0 && "Falied to send config to host!");
+    assert(res == 0 && "Failed to send config to host!");

    return ESP_OK;
 }
--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -12,7 +12,7 @@
 // ======================

 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================

-// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,9 +55,15 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//   See 'Targets Connection' setion for details.
+//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//    See 'Targets Connection' section for details.
+//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
+//    The register has the following format:
+//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
+//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
+//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
+//    This allows the host to verify data integrity of the received trace data.

 // 3. Modes of operation
 // =====================
@@ -127,7 +133,7 @@

 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -142,9 +148,9 @@

 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When wating on trace data lock.
+// - Trace data are locked by another task/ISR. When waiting on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -159,11 +165,15 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "esp_rom_crc.h"

 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
+#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
+
+#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)

 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -498,7 +508,8 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
        uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
        uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
        if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32, esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
+                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
            res = ESP_ERR_NO_MEM;
            goto _on_err;
@@ -514,6 +525,14 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
    uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
    uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
+
+    /* calculate CRC16 of the already switched block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
    eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
              host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
    esp_apptrace_trax_buffer_swap_unlock();
--- a/components/app_trace/sys_view/SEGGER/sbom.yml
+++ b/components/app_trace/sys_view/SEGGER/sbom.yml
@@ -0,0 +1,6 @@
+name: 'SystemView'
+version: '3.42'
+cpe: cpe:2.3:a:segger:systemview:{}:*:*:*:*:*:*:*
+supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
+originator: 'Organization: SEGGER Microcontroller GmbH'
+description: Real-time recording and visualization tool for embedded systems.
--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
@@ -3,7 +3,7 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2017-2024 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
@@ -58,6 +58,7 @@ File    : SEGGER_SYSVIEW_Config_FreeRTOS.c
 Purpose : Sample setup configuration of SystemView with FreeRTOS.
 Revision: $Rev: 7745 $
 */
+#include <string.h>
 #include "sdkconfig.h"
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
@@ -156,15 +157,16 @@ static esp_apptrace_lock_t s_sys_view_lock = {.mux = portMUX_INITIALIZER_UNLOCKE
 *    Sends SystemView description strings.
 */
 static void _cbSendSystemDesc(void) {
-    char irq_str[32];
+    char irq_str[32] = "I#";
    SEGGER_SYSVIEW_SendSysDesc("N="SYSVIEW_APP_NAME",D="SYSVIEW_DEVICE_NAME",C="SYSVIEW_CORE_NAME",O=FreeRTOS");
-    snprintf(irq_str, sizeof(irq_str), "I#%d=SysTick", SYSTICK_INTR_ID);
+    strcat(itoa(SYSTICK_INTR_ID, irq_str + 2, 10), "=SysTick");
    SEGGER_SYSVIEW_SendSysDesc(irq_str);
    size_t isr_count = sizeof(esp_isr_names)/sizeof(esp_isr_names[0]);
    for (size_t i = 0; i < isr_count; ++i) {
        if (esp_isr_names[i] == NULL || (ETS_INTERNAL_INTR_SOURCE_OFF + i) == SYSTICK_INTR_ID)
            continue;
-        snprintf(irq_str, sizeof(irq_str), "I#%d=%s", ETS_INTERNAL_INTR_SOURCE_OFF + i, esp_isr_names[i]);
+        strcat(itoa(ETS_INTERNAL_INTR_SOURCE_OFF + i, irq_str + 2, 10), "=");
+        strncat(irq_str, esp_isr_names[i], sizeof(irq_str) - strlen(irq_str) - 1);
        SEGGER_SYSVIEW_SendSysDesc(irq_str);
    }
 }
--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-static U64 _cbGetTime(void) {
+__attribute__((unused)) static U64 _cbGetTime(void) {
  U64 Time;

  Time = xTaskGetTickCountFromISR();
@@ -260,7 +260,10 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  _cbGetTime,
+  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
+     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
+     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
+  NULL,
  _cbSendTaskList,
 };

--- a/components/app_trace/sys_view/ext/heap_trace_module.c
+++ b/components/app_trace/sys_view/ext/heap_trace_module.c
@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif

 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
    .NumEvents = 2,
 };

--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -41,6 +41,7 @@ typedef struct ota_ops_entry_ {
    bool need_erase;
    uint32_t wrote_size;
    uint8_t partial_bytes;
+    bool ota_resumption;
    WORD_ALIGNED_ATTR uint8_t partial_data[16];
    LIST_ENTRY(ota_ops_entry_) entries;
 } ota_ops_entry_t;
@@ -80,7 +81,7 @@ static const esp_partition_t *read_otadata(esp_ota_select_entry_t *two_otadata)
        return NULL;
    } else {
        memcpy(&two_otadata[0], result, sizeof(esp_ota_select_entry_t));
-        memcpy(&two_otadata[1], result + SPI_FLASH_SEC_SIZE, sizeof(esp_ota_select_entry_t));
+        memcpy(&two_otadata[1], result + otadata_partition->erase_size, sizeof(esp_ota_select_entry_t));
        esp_partition_munmap(ota_data_map);
    }
    return otadata_partition;
@@ -111,6 +112,22 @@ static esp_ota_img_states_t set_new_state_otadata(void)
 #endif
 }

+static ota_ops_entry_t* esp_ota_init_entry(const esp_partition_t *partition)
+{
+    ota_ops_entry_t *new_entry = (ota_ops_entry_t *) calloc(1, sizeof(ota_ops_entry_t));
+    if (new_entry == NULL) {
+        return NULL;
+    }
+
+    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
+
+    new_entry->part = partition;
+    new_entry->handle = ++s_ota_ops_last_handle;
+
+    return new_entry;
+}
+
+
 esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp_ota_handle_t *out_handle)
 {
    ota_ops_entry_t *new_entry;
@@ -144,12 +161,19 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
    }
 #endif

+    new_entry = esp_ota_init_entry(partition);
+    if (new_entry == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    *out_handle = new_entry->handle;
+
    if (image_size != OTA_WITH_SEQUENTIAL_WRITES) {
        // If input image size is 0 or OTA_SIZE_UNKNOWN, erase entire partition
        if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
            ret = esp_partition_erase_range(partition, 0, partition->size);
        } else {
-            const int aligned_erase_size = (image_size + SPI_FLASH_SEC_SIZE - 1) & ~(SPI_FLASH_SEC_SIZE - 1);
+            const int aligned_erase_size = (image_size + partition->erase_size - 1) & ~(partition->erase_size - 1);
            ret = esp_partition_erase_range(partition, 0, aligned_erase_size);
        }
        if (ret != ESP_OK) {
@@ -157,16 +181,44 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
        }
    }

-    new_entry = (ota_ops_entry_t *) calloc(sizeof(ota_ops_entry_t), 1);
+    return ESP_OK;
+}
+
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle)
+{
+    ota_ops_entry_t *new_entry;
+
+    if ((partition == NULL) || (out_handle == NULL)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (image_offset > partition->size) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    partition = esp_partition_verify(partition);
+    if (partition == NULL) {
+        return ESP_ERR_NOT_FOUND;
+    }
+
+    // The staging partition cannot be of type Factory, but the final partition can be.
+    if (!is_ota_partition(partition)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    const esp_partition_t* running_partition = esp_ota_get_running_partition();
+    if (partition == running_partition) {
+        return ESP_ERR_OTA_PARTITION_CONFLICT;
+    }
+
+    new_entry = esp_ota_init_entry(partition);
    if (new_entry == NULL) {
        return ESP_ERR_NO_MEM;
    }

-    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
-
-    new_entry->part = partition;
-    new_entry->handle = ++s_ota_ops_last_handle;
-    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    new_entry->ota_resumption = true;
+    new_entry->wrote_size = image_offset;
+    new_entry->need_erase = (erase_size == OTA_WITH_SEQUENTIAL_WRITES);
    *out_handle = new_entry->handle;
    return ESP_OK;
 }
@@ -192,14 +244,14 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
        if (it->handle == handle) {
            if (it->need_erase) {
                // must erase the partition before writing to it
-                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE; // first affected sector
-                uint32_t last_sector = (it->wrote_size + size - 1) / SPI_FLASH_SEC_SIZE; // last affected sector
+                uint32_t first_sector = it->wrote_size / it->part->erase_size; // first affected sector
+                uint32_t last_sector = (it->wrote_size + size - 1) / it->part->erase_size; // last affected sector

                ret = ESP_OK;
-                if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
-                    ret = esp_partition_erase_range(it->part, it->wrote_size, ((last_sector - first_sector) + 1) * SPI_FLASH_SEC_SIZE);
+                if ((it->wrote_size % it->part->erase_size) == 0) {
+                    ret = esp_partition_erase_range(it->part, it->wrote_size, ((last_sector - first_sector) + 1) * it->part->erase_size);
                } else if (first_sector != last_sector) {
-                    ret = esp_partition_erase_range(it->part, (first_sector + 1) * SPI_FLASH_SEC_SIZE, (last_sector - first_sector) * SPI_FLASH_SEC_SIZE);
+                    ret = esp_partition_erase_range(it->part, (first_sector + 1) * it->part->erase_size, (last_sector - first_sector) * it->part->erase_size);
                }
                if (ret != ESP_OK) {
                    return ret;
@@ -369,11 +421,11 @@ static esp_err_t rewrite_ota_seq(esp_ota_select_entry_t *two_otadata, uint32_t s

    two_otadata[sec_id].ota_seq = seq;
    two_otadata[sec_id].crc = bootloader_common_ota_select_crc(&two_otadata[sec_id]);
-    esp_err_t ret = esp_partition_erase_range(ota_data_partition, sec_id * SPI_FLASH_SEC_SIZE, SPI_FLASH_SEC_SIZE);
+    esp_err_t ret = esp_partition_erase_range(ota_data_partition, sec_id * ota_data_partition->erase_size, ota_data_partition->erase_size);
    if (ret != ESP_OK) {
        return ret;
    } else {
-        return esp_partition_write(ota_data_partition, SPI_FLASH_SEC_SIZE * sec_id, &two_otadata[sec_id], sizeof(esp_ota_select_entry_t));
+        return esp_partition_write(ota_data_partition, ota_data_partition->erase_size * sec_id, &two_otadata[sec_id], sizeof(esp_ota_select_entry_t));
    }
 }

@@ -906,7 +958,7 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void)
    }

    int sec_id = inactive_otadata;
-    err = esp_partition_erase_range(ota_data_partition, sec_id * SPI_FLASH_SEC_SIZE, SPI_FLASH_SEC_SIZE);
+    err = esp_partition_erase_range(ota_data_partition, sec_id * ota_data_partition->erase_size, ota_data_partition->erase_size);
    if (err != ESP_OK) {
        return err;
    }
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -99,6 +99,32 @@ int esp_ota_get_app_elf_sha256(char* dst, size_t size) __attribute__((deprecated
 */
 esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp_ota_handle_t* out_handle);

+/**
+ * @brief   Resume an interrupted OTA update by continuing to write to the specified partition.
+ *
+ * This function is used when an OTA update was previously started and needs to be resumed after an interruption.
+ * It continues the OTA process from the specified offset within the partition.
+ *
+ * Unlike esp_ota_begin(), this function does not erase the partition which receives the OTA update, but rather expects that part of the image
+ * has already been written correctly, and it resumes writing from the given offset.
+ *
+ * @param partition Pointer to info for the partition which is receiving the OTA update. Required.
+ * @param erase_size Specifies how much flash memory to erase before resuming OTA, depending on whether a sequential write or a bulk erase is being used.
+ * @param image_offset Offset from where to resume the OTA process. Should be set to the number of bytes already written.
+ * @param out_handle On success, returns a handle that should be used for subsequent esp_ota_write() and esp_ota_end() calls.
+ *
+ * @return
+ *    - ESP_OK: OTA operation resumed successfully.
+ *    - ESP_ERR_INVALID_ARG: partition, out_handle were NULL or image_offset arguments is negative, or partition doesn't point to an OTA app partition.
+ *    - ESP_ERR_NO_MEM: Cannot allocate memory for OTA operation.
+ *    - ESP_ERR_OTA_PARTITION_CONFLICT: Partition holds the currently running firmware, cannot update in place.
+ *    - ESP_ERR_NOT_FOUND: Partition argument not found in partition table.
+ *    - ESP_ERR_OTA_SELECT_INFO_INVALID: The OTA data partition contains invalid data.
+ *    - ESP_ERR_INVALID_SIZE: Partition doesn't fit in configured flash size.
+ *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
+ */
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle);
+
 /**
 * @brief   Write OTA update data to partition
 *
--- a/components/app_update/test_apps/.build-test-rules.yml
+++ b/components/app_update/test_apps/.build-test-rules.yml
@@ -1,7 +0,0 @@
-# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
-
-components/app_update/test_apps:
-  disable:
-    - if: IDF_TARGET in ["esp32c5", "esp32c61"]
-      temporary: true
-      reason: target esp32c5 is not supported yet  # TODO: [ESP32C5] IDF-8640, IDF-10317, [ESP32C61] IDF-9245
--- a/components/app_update/test_apps/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/pytest_app_update_ut.py
@@ -1,25 +0,0 @@
-# SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
-# SPDX-License-Identifier: Unlicense OR CC0-1.0
-import re
-
-import pytest
-from pytest_embedded import Dut
-
-DEFAULT_TIMEOUT = 20
-TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
-
-
-def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
-    for stage in range(1, stages + 1):
-        dut.write(str(test_case_num))
-        dut.expect(TEST_SUBMENU_PATTERN_PYTEST, timeout=DEFAULT_TIMEOUT)
-        dut.write(str(stage))
-        if stage != stages:
-            dut.expect_exact('Press ENTER to see the list of tests.')
-
-
-@pytest.mark.supported_targets
-@pytest.mark.temp_skip_ci(targets=['esp32c5'], reason='C5 has not supported deep sleep')  # TODO: [ESP32C5] IDF-8640, IDF-10317
-@pytest.mark.generic
-def test_app_update(dut: Dut) -> None:
-    dut.run_all_single_board_cases(timeout=90)
--- a/components/app_update/test_apps/test_app_update/.build-test-rules.yml
+++ b/components/app_update/test_apps/test_app_update/.build-test-rules.yml
@@ -0,0 +1,12 @@
+# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
+
+components/app_update/test_apps:
+  enable:
+    - if: CONFIG_NAME == "defaults" and IDF_TARGET != "linux"
+    - if: CONFIG_NAME == "xip_psram" and IDF_TARGET in ["esp32s2", "esp32s3", "esp32p4"]
+    # S2 doesn't have ROM for flash
+    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and IDF_TARGET in ["esp32s3", "esp32p4"]
+  disable:
+    - if: IDF_TARGET in ["esp32c61"]
+      temporary: true
+      reason: target esp32c61 is not supported yet  # TODO: [ESP32C61] IDF-9245
--- a/components/app_update/test_apps/test_app_update/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/CMakeLists.txt
--- a/components/app_update/test_apps/test_app_update/README.md
+++ b/components/app_update/test_apps/test_app_update/README.md
@@ -0,0 +1,2 @@
+| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | -------- | -------- | -------- |
--- a/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
                       PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
                      WHOLE_ARCHIVE)
--- a/components/app_update/test_apps/test_app_update/main/app_main.c
+++ b/components/app_update/test_apps/test_app_update/main/app_main.c
--- a/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
+++ b/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@@ -113,3 +114,11 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
    };
    TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
+
+TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
+{
+    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
+    const esp_partition_t* part = esp_ota_get_running_partition();
+    ESP_LOGI("running bin", "0x%p", (void*)part->address);
+    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
+}
--- a/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
+++ b/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -101,24 +101,6 @@ static void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const
    ESP_LOGI(TAG, "finish the copy process");
 }

-#if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
-/* @brief Copies partition from source partition to destination partition.
- *
- * Partitions can be of any types and subtypes.
- * @param[in] dst_partition - Destination partition
- * @param[in] src_partition - Source partition
- */
-static void copy_partition(const esp_partition_t *dst_partition, const esp_partition_t *src_partition)
-{
-    const void *partition_bin = NULL;
-    esp_partition_mmap_handle_t data_map;
-    TEST_ESP_OK(esp_partition_mmap(src_partition, 0, src_partition->size, ESP_PARTITION_MMAP_DATA, &partition_bin, &data_map));
-    TEST_ESP_OK(esp_partition_erase_range(dst_partition, 0, dst_partition->size));
-    TEST_ESP_OK(esp_partition_write(dst_partition, 0, (const void *)partition_bin, dst_partition->size));
-    esp_partition_munmap(data_map);
-}
-#endif
-
 /* @brief Get the next partition of OTA for the update.
 *
 * @return The next partition of OTA(OTA0-15).
@@ -177,7 +159,7 @@ static void erase_ota_data(void)
 {
    const esp_partition_t *data_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
    TEST_ASSERT_NOT_EQUAL(NULL, data_partition);
-    TEST_ESP_OK(esp_partition_erase_range(data_partition, 0, 2 * SPI_FLASH_SEC_SIZE));
+    TEST_ESP_OK(esp_partition_erase_range(data_partition, 0, 2 * data_partition->erase_size));
 }

 /* @brief Reboots ESP using mode deep sleep. This mode guaranty that RTC_DATA_ATTR variables is not reset.
@@ -251,7 +233,7 @@ static void get_ota_data(const esp_partition_t *otadata_partition, esp_ota_selec
        TEST_ASSERT_NOT_EQUAL(NULL, ota_select_map);

        memcpy(ota_data_0, ota_select_map, sizeof(esp_ota_select_entry_t));
-        memcpy(ota_data_1, (uint8_t *)ota_select_map + SPI_FLASH_SEC_SIZE, sizeof(esp_ota_select_entry_t));
+        memcpy(ota_data_1, (uint8_t *)ota_select_map + otadata_partition->erase_size, sizeof(esp_ota_select_entry_t));
        bootloader_munmap(ota_select_map);
    }
 }
@@ -264,7 +246,7 @@ static void get_ota_data(const esp_partition_t *otadata_partition, esp_ota_selec
 */
 static void write_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data, int sec_id)
 {
-    esp_partition_write(otadata_partition, SPI_FLASH_SEC_SIZE * sec_id, &ota_data[sec_id], sizeof(esp_ota_select_entry_t));
+    esp_partition_write(otadata_partition, otadata_partition->erase_size * sec_id, &ota_data[sec_id], sizeof(esp_ota_select_entry_t));
 }

 /* @brief Makes a corrupt of ota_data.
@@ -530,7 +512,7 @@ static void test_flow5(void)
            ESP_LOGI(TAG, "Factory");
            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_FACTORY, cur_app->subtype);
            set_output_pin(CONFIG_BOOTLOADER_NUM_PIN_APP_TEST);
-            copy_partition(esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_APP_TEST, NULL), cur_app);
+            esp_partition_copy(esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_APP_TEST, NULL), 0, cur_app, 0, cur_app->size);
            esp_restart();
            break;
        case 3:
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
@@ -7,5 +7,3 @@ factory,    0,    0,       ,        0xB0000
 ota_0,      0,    ota_0,   ,        0xB0000
 ota_1,      0,    ota_1,   ,        0xB0000
 test,       0,    test,    ,        0xB0000
-# flash_test partition used for SPI flash tests, WL FAT tests, and SPIFFS tests
-flash_test, data, fat,     ,        528K
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
@@ -7,5 +7,3 @@ factory,    0,    0,       ,        0x70000
 ota_0,      0,    ota_0,   ,        0x70000
 ota_1,      0,    ota_1,   ,        0x70000
 test,       0,    test,    ,        0x70000
-# flash_test partition used for SPI flash tests, WL FAT tests, and SPIFFS tests
-flash_test, data, fat,     ,        128K
--- a/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import re
+
+import pytest
+from pytest_embedded import Dut
+
+DEFAULT_TIMEOUT = 20
+TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c5'], reason='C5 has not supported deep sleep')  # TODO: [ESP32C5] IDF-8640, IDF-10317
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'defaults',
+    ],
+    indirect=True,
+)
+def test_app_update(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+# TODO: [ESP32C61] IDF-9245, IDF-10983
+@pytest.mark.temp_skip_ci(targets=['esp32c61'], reason='C61 has not supported deep sleep')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c5'], reason='C5 has not supported deep sleep')  # TODO: [ESP32C5] IDF-8640, IDF-10317
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram_with_rom_impl',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram
@@ -0,0 +1,2 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_XIP_FROM_PSRAM=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
@@ -0,0 +1,3 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_XIP_FROM_PSRAM=y
+CONFIG_SPI_FLASH_ROM_IMPL=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c6
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c6
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32h2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32h2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32p4
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32p4
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
--- a/components/bootloader/Kconfig.log.format
+++ b/components/bootloader/Kconfig.log.format
@@ -2,7 +2,7 @@ menu "Format"

    config BOOTLOADER_LOG_COLORS
        bool "Color"
-        default y
+        default n
        help
            Use ANSI terminal colors in log output
            Enable ANSI terminal color codes.
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -20,14 +20,14 @@ menu "Bootloader config"
            This option sets compiler optimization level (gcc -O argument)
            for the bootloader.

-            - The default "Size" setting will add the -0s flag to CFLAGS.
+            - The default "Size" setting will add the -Os (-Oz with clang) flag to CFLAGS.
            - The "Debug" setting will add the -Og flag to CFLAGS.
            - The "Performance" setting will add the -O2 flag to CFLAGS.

            Note that custom optimization levels may be unsupported.

        config BOOTLOADER_COMPILER_OPTIMIZATION_SIZE
-            bool "Size (-Os)"
+            bool "Size (-Os with GCC, -Oz with Clang)"
        config BOOTLOADER_COMPILER_OPTIMIZATION_DEBUG
            bool "Debug (-Og)"
        config BOOTLOADER_COMPILER_OPTIMIZATION_PERF
@@ -158,13 +158,23 @@ menu "Bootloader config"
        int "Number of the GPIO input for factory reset"
        depends on BOOTLOADER_FACTORY_RESET
        range 0 39 if IDF_TARGET_ESP32
-        range 0 44 if IDF_TARGET_ESP32S2
+        range 0 46 if IDF_TARGET_ESP32S2
+        range 0 48 if IDF_TARGET_ESP32S3
+        range 0 20 if IDF_TARGET_ESP32C2
+        range 0 21 if IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32C61
+        range 0 28 if IDF_TARGET_ESP32C5
+        range 0 30 if IDF_TARGET_ESP32C6
+        range 0 27 if IDF_TARGET_ESP32H2
+        range 0 54 if IDF_TARGET_ESP32P4
        default 4
        help
-            The selected GPIO will be configured as an input with internal pull-up enabled (note that on some SoCs.
-            not all pins have an internal pull-up, consult the hardware datasheet for details.) To trigger a factory
+            The selected GPIO will be configured as an input with internal pull-up enabled. To trigger a factory
            reset, this GPIO must be held high or low (as configured) on startup.

+            Note that on some SoCs not all pins have an internal pull-up and certain pins are already
+            used by ROM bootloader as bootstrapping. Refer to the technical reference manual for further
+            details on the selected SoC.
+
    choice BOOTLOADER_FACTORY_RESET_PIN_LEVEL
        bool "Factory reset GPIO level"
        depends on BOOTLOADER_FACTORY_RESET
@@ -210,14 +220,25 @@ menu "Bootloader config"
    config BOOTLOADER_NUM_PIN_APP_TEST
        int "Number of the GPIO input to boot TEST partition"
        depends on BOOTLOADER_APP_TEST
-        range 0 39
+        range 0 39 if IDF_TARGET_ESP32
+        range 0 46 if IDF_TARGET_ESP32S2
+        range 0 48 if IDF_TARGET_ESP32S3
+        range 0 20 if IDF_TARGET_ESP32C2
+        range 0 21 if IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32C61
+        range 0 28 if IDF_TARGET_ESP32C5
+        range 0 30 if IDF_TARGET_ESP32C6
+        range 0 27 if IDF_TARGET_ESP32H2
+        range 0 54 if IDF_TARGET_ESP32P4
        default 18
        help
            The selected GPIO will be configured as an input with internal pull-up enabled.
            To trigger a test app, this GPIO must be pulled low on reset.
            After the GPIO input is deactivated and the device reboots, the old application will boot.
            (factory or OTA[x]).
-            Note that GPIO34-39 do not have an internal pullup and an external one must be provided.
+
+            Note that on some SoCs not all pins have an internal pull-up and certain pins are already
+            used by ROM bootloader as bootstrapping. Refer to the technical reference manual for further
+            details on the selected SoC.

    choice BOOTLOADER_APP_TEST_PIN_LEVEL
        bool "App test GPIO level"
@@ -776,6 +797,33 @@ menu "Security features"
            This can lead to permanent bricking of the device, in case all keys are revoked
            because of signature verification failure.

+    config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+        bool "Do not disable the ability to further read protect eFuses"
+        depends on SECURE_BOOT_V2_ENABLED
+        default n
+        help
+            If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
+            efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
+
+            If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
+            Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+            BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the secure boot public key digest,
+            causing an immediate denial of service and possibly allowing an additional fault injection attack to
+            bypass the signature protection.
+
+            The option must be set when you need to program any read-protected key type into the efuses,
+            e.g., HMAC, ECDSA etc. after secure boot has already been enabled on the device.
+            Please refer to secure boot V2 documentation guide for more details.
+
+            NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+            NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+            "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+            then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+            However, efuse can be read/written from the application
+
+            Please refer to the Secure Boot V2 documentation guide for more information.
+
    config SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT
        bool "Flash bootloader along with other artifacts when using the default flash command"
        depends on SECURE_BOOT_V2_ENABLED && SECURE_BOOT_BUILD_SIGNED_BINARIES
@@ -956,26 +1004,6 @@ menu "Security features"
                image to this length. It is generally not recommended to set this option, unless you have a legacy
                partitioning scheme which doesn't support 64KB aligned partition lengths.

-        config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
-            bool "Allow additional read protecting of efuses"
-            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
-            help
-                If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
-                efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
-
-                If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
-                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
-                immediate denial of service and possibly allowing an additional fault injection attack to
-                bypass the signature protection.
-
-                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
-
-                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
-                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
-                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
-                However, efuse can be read/written from the application
-
        config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
            bool "Leave unused digest slots available (not revoke)"
            depends on SECURE_BOOT_INSECURE && SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -1106,6 +1134,44 @@ menu "Security features"

            If not set, the app does not care if the flash encryption eFuse bit is set or not.

+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
    config SECURE_ROM_DL_MODE_ENABLED
        bool
        default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
--- a/components/bootloader/subproject/CMakeLists.txt
+++ b/components/bootloader/subproject/CMakeLists.txt
@@ -58,6 +58,7 @@ foreach(component ${proj_components})
 endforeach()

 set(BOOTLOADER_BUILD 1)
+set(NON_OS_BUILD 1)
 include("${IDF_PATH}/tools/cmake/project.cmake")
 set(common_req log esp_rom esp_common esp_hw_support newlib)
 idf_build_set_property(EXTRA_COMPONENT_EXCLUDE_DIRS "${EXTRA_COMPONENT_EXCLUDE_DIRS}")
@@ -66,6 +67,7 @@ idf_build_set_property(__OUTPUT_SDKCONFIG 0)
 project(bootloader)

 idf_build_set_property(COMPILE_DEFINITIONS "BOOTLOADER_BUILD=1" APPEND)
+idf_build_set_property(COMPILE_DEFINITIONS "NON_OS_BUILD=1" APPEND)
 idf_build_set_property(COMPILE_OPTIONS "-fno-stack-protector" APPEND)

 idf_component_get_property(main_args esptool_py FLASH_ARGS)
@@ -207,7 +209,7 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
        COMMAND ${CMAKE_COMMAND} -E echo
            "* After first boot, only re-flashes of this kind (with same key) will be accepted."
        COMMAND ${CMAKE_COMMAND} -E echo
-            "* Not recommended to re-use the same secure boot keyfile on multiple production devices."
+            "* Not recommended to reuse the same secure boot keyfile on multiple production devices."
        DEPENDS gen_secure_bootloader_key gen_bootloader_digest_bin
        VERBATIM)
 elseif(
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -36,6 +36,10 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
        )
 endif()

+if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
+    list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
+endif()
+
 if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    set(include_dirs "include" "bootloader_flash/include"
        "private_include")
@@ -50,10 +54,6 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
    )
    list(APPEND priv_requires hal)
-    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
-        list(APPEND srcs
-            "src/${IDF_TARGET}/bootloader_ecdsa.c")
-    endif()
 else()
    list(APPEND srcs
        "src/idf/bootloader_sha.c")
--- a/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
+++ b/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -13,6 +13,7 @@
 #include <spi_flash_mmap.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "bootloader_flash.h"
+#include "soc/ext_mem_defs.h"

 #ifdef __cplusplus
 extern "C" {
@@ -20,8 +21,11 @@ extern "C" {

 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 	0x10000
+
 #define MMAP_ALIGNED_MASK 	(SPI_FLASH_MMU_PAGE_SIZE - 1)
 #define MMU_FLASH_MASK    (~(SPI_FLASH_MMU_PAGE_SIZE - 1))
+#define MMU_FLASH_MASK_FROM_VAL(PAGE_SZ) (~((PAGE_SZ) - 1))
+#define MMU_DROM_END_ENTRY_VADDR_FROM_VAL(PAGE_SZ) (SOC_DRAM_FLASH_ADDRESS_HIGH - (PAGE_SZ))

 /**
 * MMU mapping must always be in the unit of a SPI_FLASH_MMU_PAGE_SIZE
@@ -89,7 +93,7 @@ uint32_t bootloader_mmap_get_free_pages(void);
 * @param length - Length of data to map.
 *
 * @return Pointer to mapped data memory (at src_addr), or NULL
- * if an allocation error occured.
+ * if an allocation error occurred.
 */
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size);

--- a/components/bootloader_support/bootloader_flash/include/esp_private/bootloader_flash_internal.h
+++ b/components/bootloader_support/bootloader_flash/include/esp_private/bootloader_flash_internal.h
@@ -1,11 +1,12 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 #pragma once
 #include <stdint.h>
 #include <esp_err.h>
+#include "soc/soc_caps.h"

 #ifdef __cplusplus
 extern "C" {
@@ -27,6 +28,11 @@ esp_err_t bootloader_init_spi_flash(void);
 void bootloader_flash_hardware_init(void);
 #endif

+/**
+ * @brief Initialise mspi core clock
+ */
+void bootloader_init_mspi_clock(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
@@ -18,19 +18,8 @@
 #endif
 #include "hal/spi_flash_ll.h"
 #include "rom/spi_flash.h"
-#if CONFIG_IDF_TARGET_ESP32
-#   include "soc/spi_struct.h"
-#   include "soc/spi_reg.h"
-    /* SPI flash controller */
-#   define SPIFLASH SPI1
-#   define SPI0     SPI0
-#else
-#   include "hal/spimem_flash_ll.h"
-#   include "soc/spi_mem_struct.h"
-#   include "soc/spi_mem_reg.h"
-    /* SPI flash controller */
-#   define SPIFLASH SPIMEM1
-#   define SPI0     SPIMEM0
+#if !CONFIG_IDF_TARGET_ESP32
+#include "hal/spimem_flash_ll.h"
 #endif

 // This dependency will be removed in the future.  IDF-5025
@@ -334,7 +323,8 @@ static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest
            ESP_EARLY_LOGD(TAG, "mmu set block paddr=0x%08" PRIx32 " (was 0x%08" PRIx32 ")", map_at, current_read_mapping);
 #if CONFIG_IDF_TARGET_ESP32
            //Should never fail if we only map a SPI_FLASH_MMU_PAGE_SIZE to the vaddr starting from FLASH_READ_VADDR
-            int e = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
+            // Return value unused if asserts are disabled
+            int e __attribute__((unused)) = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
            assert(e == 0);
 #else
            uint32_t actual_mapped_len = 0;
@@ -587,61 +577,43 @@ IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
 {
    assert(mosi_len <= 32);
    assert(miso_len <= 32);
-    uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
-    uint32_t old_user_reg = SPIFLASH.user.val;
-    uint32_t old_user1_reg = SPIFLASH.user1.val;
-    uint32_t old_user2_reg = SPIFLASH.user2.val;
-    // Clear ctrl regs.
-    SPIFLASH.ctrl.val = 0;
+    uint32_t old_ctrl_reg = 0;
+    uint32_t old_user_reg = 0;
+    uint32_t old_user1_reg = 0;
+    uint32_t old_user2_reg = 0;
+    spi_flash_ll_get_common_command_register_info(&SPIMEM_LL_APB, &old_ctrl_reg, &old_user_reg, &old_user1_reg, &old_user2_reg);
+    SPIMEM_LL_APB.ctrl.val = 0;
 #if CONFIG_IDF_TARGET_ESP32
-    spi_flash_ll_set_wp_level(&SPIFLASH, true);
+    spi_flash_ll_set_wp_level(&SPIMEM_LL_APB, true);
 #else
-    spimem_flash_ll_set_wp_level(&SPIFLASH, true);
+    spimem_flash_ll_set_wp_level(&SPIMEM_LL_APB, true);
 #endif
    //command phase
-    SPIFLASH.user.usr_command = 1;
-    SPIFLASH.user2.usr_command_bitlen = 7;
-    SPIFLASH.user2.usr_command_value = command;
+    spi_flash_ll_set_command(&SPIMEM_LL_APB, command, 8);
    //addr phase
-    SPIFLASH.user.usr_addr = addr_len > 0;
-    SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
-#else
-    SPIFLASH.addr = address;
-#endif
+    spi_flash_ll_set_addr_bitlen(&SPIMEM_LL_APB, addr_len);
+    spi_flash_ll_set_usr_address(&SPIMEM_LL_APB, address, addr_len);
    //dummy phase
    uint32_t total_dummy = dummy_len;
    if (miso_len > 0) {
        total_dummy += g_rom_spiflash_dummy_len_plus[1];
    }
-    SPIFLASH.user.usr_dummy = total_dummy > 0;
-    SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
+    spi_flash_ll_set_dummy(&SPIMEM_LL_APB, total_dummy);
    //output data
-    SPIFLASH.user.usr_mosi = mosi_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
-#else
-    SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
-#endif
-    SPIFLASH.data_buf[0] = mosi_data;
+
+    spi_flash_ll_set_mosi_bitlen(&SPIMEM_LL_APB, mosi_len);
+    spi_flash_ll_set_buffer_data(&SPIMEM_LL_APB, &mosi_data, mosi_len / 8);
    //input data
-    SPIFLASH.user.usr_miso = miso_len > 0;
-#if CONFIG_IDF_TARGET_ESP32
-    SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
-#else
-    SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
-#endif
+    spi_flash_ll_set_miso_bitlen(&SPIMEM_LL_APB, miso_len);

-    SPIFLASH.cmd.usr = 1;
-    while (SPIFLASH.cmd.usr != 0) {
+    spi_flash_ll_user_start(&SPIMEM_LL_APB, false);
+    while(!spi_flash_ll_cmd_is_done(&SPIMEM_LL_APB)) {
    }
-    SPIFLASH.ctrl.val = old_ctrl_reg;
-    SPIFLASH.user.val = old_user_reg;
-    SPIFLASH.user1.val = old_user1_reg;
-    SPIFLASH.user2.val = old_user2_reg;
+    spi_flash_ll_set_common_command_register_info(&SPIMEM_LL_APB, old_ctrl_reg, old_user_reg, old_user1_reg, old_user2_reg);

-    uint32_t ret = SPIFLASH.data_buf[0];
+    uint32_t output_data = 0;
+    spi_flash_ll_get_buffer_data(&SPIMEM_LL_APB, &output_data, miso_len / 8);
+    uint32_t ret = output_data;
    if (miso_len < 32) {
        //set unused bits to 0
        ret &= ~(UINT32_MAX << miso_len);
@@ -697,7 +669,7 @@ void bootloader_spi_flash_reset(void)
 ******************************************************************************/

 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
-#define XMC_VENDOR_ID 0x20
+#define XMC_VENDOR_ID_1 0x20

 #if BOOTLOADER_BUILD
 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
@@ -714,7 +686,7 @@ static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
    uint32_t mfid = BYTESHIFT(rdid, 1);
    uint32_t cpid = BYTESHIFT(rdid, 0);

-    if (vendor_id != XMC_VENDOR_ID) {
+    if (vendor_id != XMC_VENDOR_ID_1) {
        return false;
    }

@@ -747,7 +719,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
    // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
    const int sfdp_mfid_addr = 0x10;
    uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
-    if (mf_id != XMC_VENDOR_ID) {
+    if (mf_id != XMC_VENDOR_ID_1) {
        BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
        return ESP_OK;
    }
@@ -779,7 +751,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
 {
    uint32_t vendor_id = (rdid >> 16) & 0xFF;
-    return (vendor_id == XMC_VENDOR_ID);
+    return (vendor_id == XMC_VENDOR_ID_1);
 }

 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
@@ -793,28 +765,9 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)

 #endif //XMC_SUPPORT

-FORCE_INLINE_ATTR void bootloader_mspi_reset(void)
-{
-#if CONFIG_IDF_TARGET_ESP32
-    SPI1.slave.sync_reset = 0;
-    SPI0.slave.sync_reset = 0;
-    SPI1.slave.sync_reset = 1;
-    SPI0.slave.sync_reset = 1;
-    SPI1.slave.sync_reset = 0;
-    SPI0.slave.sync_reset = 0;
-#else
-    SPIMEM1.ctrl2.sync_reset = 0;
-    SPIMEM0.ctrl2.sync_reset = 0;
-    SPIMEM1.ctrl2.sync_reset = 1;
-    SPIMEM0.ctrl2.sync_reset = 1;
-    SPIMEM1.ctrl2.sync_reset = 0;
-    SPIMEM0.ctrl2.sync_reset = 0;
-#endif
-}
-
 esp_err_t IRAM_ATTR bootloader_flash_reset_chip(void)
 {
-    bootloader_mspi_reset();
+    spi_flash_ll_sync_reset();
    // Seems that sync_reset cannot make host totally idle.'
    // Sending an extra(useless) command to make the host idle in order to send reset command.
    bootloader_execute_flash_command(0x05, 0, 0, 0);
@@ -844,7 +797,7 @@ bool IRAM_ATTR bootloader_flash_is_octal_mode_enabled(void)
 esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void)
 {
    esp_rom_spiflash_read_mode_t spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
-    uint32_t spi_ctrl = spi_flash_ll_get_ctrl_val(&SPI0);
+    uint32_t spi_ctrl = spi_flash_ll_get_ctrl_val(&SPIMEM_LL_CACHE);
 #if CONFIG_IDF_TARGET_ESP32
    if (spi_ctrl & SPI_FREAD_QIO) {
        spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -28,12 +28,12 @@
 #include "bootloader_flash_priv.h"
 #include "bootloader_init.h"

-#define FLASH_CLK_IO SPI_CLK_GPIO_NUM
-#define FLASH_CS_IO SPI_CS0_GPIO_NUM
-#define FLASH_SPIQ_IO SPI_Q_GPIO_NUM
-#define FLASH_SPID_IO SPI_D_GPIO_NUM
-#define FLASH_SPIWP_IO SPI_WP_GPIO_NUM
-#define FLASH_SPIHD_IO SPI_HD_GPIO_NUM
+#define FLASH_CLK_IO    MSPI_IOMUX_PIN_NUM_CLK
+#define FLASH_CS_IO     MSPI_IOMUX_PIN_NUM_CS0
+#define FLASH_SPIQ_IO   MSPI_IOMUX_PIN_NUM_MISO
+#define FLASH_SPID_IO   MSPI_IOMUX_PIN_NUM_MOSI
+#define FLASH_SPIWP_IO  MSPI_IOMUX_PIN_NUM_WP
+#define FLASH_SPIHD_IO  MSPI_IOMUX_PIN_NUM_HD

 void bootloader_flash_update_id(void)
 {
@@ -98,15 +98,15 @@ void IRAM_ATTR bootloader_flash_gpio_config(const esp_image_header_t* pfhdr)
    } else {
        const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
        if (spiconfig == ESP_ROM_EFUSE_FLASH_DEFAULT_SPI) {
-            esp_rom_gpio_connect_out_signal(SPI_IOMUX_PIN_NUM_CS, SPICS0_OUT_IDX, 0, 0);
-            esp_rom_gpio_connect_out_signal(SPI_IOMUX_PIN_NUM_MISO, SPIQ_OUT_IDX, 0, 0);
-            esp_rom_gpio_connect_in_signal(SPI_IOMUX_PIN_NUM_MISO, SPIQ_IN_IDX, 0);
-            esp_rom_gpio_connect_out_signal(SPI_IOMUX_PIN_NUM_MOSI, SPID_OUT_IDX, 0, 0);
-            esp_rom_gpio_connect_in_signal(SPI_IOMUX_PIN_NUM_MOSI, SPID_IN_IDX, 0);
-            esp_rom_gpio_connect_out_signal(SPI_IOMUX_PIN_NUM_WP, SPIWP_OUT_IDX, 0, 0);
-            esp_rom_gpio_connect_in_signal(SPI_IOMUX_PIN_NUM_WP, SPIWP_IN_IDX, 0);
-            esp_rom_gpio_connect_out_signal(SPI_IOMUX_PIN_NUM_HD, SPIHD_OUT_IDX, 0, 0);
-            esp_rom_gpio_connect_in_signal(SPI_IOMUX_PIN_NUM_HD, SPIHD_IN_IDX, 0);
+            esp_rom_gpio_connect_out_signal(FLASH_CS_IO, SPICS0_OUT_IDX, 0, 0);
+            esp_rom_gpio_connect_out_signal(FLASH_SPIQ_IO, SPIQ_OUT_IDX, 0, 0);
+            esp_rom_gpio_connect_in_signal(FLASH_SPIQ_IO, SPIQ_IN_IDX, 0);
+            esp_rom_gpio_connect_out_signal(FLASH_SPID_IO, SPID_OUT_IDX, 0, 0);
+            esp_rom_gpio_connect_in_signal(FLASH_SPID_IO, SPID_IN_IDX, 0);
+            esp_rom_gpio_connect_out_signal(FLASH_SPIWP_IO, SPIWP_OUT_IDX, 0, 0);
+            esp_rom_gpio_connect_in_signal(FLASH_SPIWP_IO, SPIWP_IN_IDX, 0);
+            esp_rom_gpio_connect_out_signal(FLASH_SPIHD_IO, SPIHD_OUT_IDX, 0, 0);
+            esp_rom_gpio_connect_in_signal(FLASH_SPIHD_IO, SPIHD_IN_IDX, 0);
            //select pin function gpio
            gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_SD_DATA0_U, PIN_FUNC_GPIO);
            gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_SD_DATA1_U, PIN_FUNC_GPIO);
@@ -190,7 +190,7 @@ int bootloader_flash_get_wp_pin(void)
    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
        return ESP32_PICO_V3_GPIO;
    default:
-        return SPI_WP_GPIO_NUM;
+        return MSPI_IOMUX_PIN_NUM_WP;
    }
 #endif
 }
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c2.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c2.c
@@ -88,12 +88,12 @@ void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
    // IDF-4066
    const uint32_t spiconfig = 0;
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    if (spiconfig == 0) {

    }
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c3.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c3.c
@@ -92,12 +92,12 @@ void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
    const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
    uint8_t wp_pin = esp_rom_efuse_get_flash_wp_gpio();
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    if (spiconfig == 0) {

    } else {
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c5.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c5.c
@@ -48,8 +48,18 @@ void IRAM_ATTR bootloader_flash_cs_timing_config()
    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
 }

+void IRAM_ATTR bootloader_init_mspi_clock(void)
+{
+    // Set source mspi pll clock as 80M in bootloader stage.
+    // SPLL clock on C5 is 480MHz , and mspi_pll needs 80MHz
+    // in this stage, set divider as 6
+    mspi_ll_clock_src_sel(MSPI_CLK_SRC_SPLL);
+    mspi_ll_fast_set_hs_divider(6);
+}
+
 void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
 {
+    bootloader_init_mspi_clock();
    uint32_t spi_clk_div = 0;
    switch (pfhdr->spi_speed) {
    case ESP_IMAGE_SPI_SPEED_DIV_1:
@@ -74,12 +84,12 @@ static const char *TAG = "boot.esp32c5";

 void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
@@ -204,11 +214,7 @@ static void bootloader_spi_flash_resume(void)

 esp_err_t bootloader_init_spi_flash(void)
 {
-    // Set source mspi pll clock as 80M in bootloader stage.
-    // SPLL clock on C5 is 480MHz , and mspi_pll needs 80MHz
-    // in this stage, set divider as 6
-    mspi_ll_clock_src_sel(MSPI_CLK_SRC_SPLL);
-    mspi_ll_fast_set_hs_divider(6);
+    bootloader_init_mspi_clock();

    bootloader_init_flash_configure();
    bootloader_spi_flash_resume();
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c6.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c6.c
@@ -69,12 +69,12 @@ static const char *TAG = "boot.esp32c6";

 void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c61.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c61.c
@@ -24,6 +24,7 @@
 #include "hal/mmu_ll.h"
 #include "hal/cache_hal.h"
 #include "hal/cache_ll.h"
+#include "hal/mspi_timing_tuning_ll.h"

 static const char *TAG __attribute__((unused))  = "boot.esp32c61";

@@ -45,8 +46,19 @@ void IRAM_ATTR bootloader_flash_cs_timing_config()
    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
 }

+void IRAM_ATTR bootloader_init_mspi_clock(void)
+{
+    // Set source mspi pll clock as 80M in bootloader stage.
+    // SPLL clock on C61 is 480MHz , and mspi_pll needs 80MHz
+    // in this stage, set divider as 6
+    mspi_ll_clock_src_sel(MSPI_CLK_SRC_SPLL);
+    mspi_ll_fast_set_hs_divider(6);
+}
+
 void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
 {
+    bootloader_init_mspi_clock();
+
    uint32_t spi_clk_div = 0;
    switch (pfhdr->spi_speed) {
    case ESP_IMAGE_SPI_SPEED_DIV_1:
@@ -69,12 +81,12 @@ void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)

 void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
@@ -197,6 +209,7 @@ static void bootloader_spi_flash_resume(void)

 esp_err_t bootloader_init_spi_flash(void)
 {
+    bootloader_init_mspi_clock();
    bootloader_init_flash_configure();
    bootloader_spi_flash_resume();
    bootloader_flash_unlock();
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32h2.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32h2.c
@@ -70,12 +70,12 @@ static const char *TAG = "boot.esp32h2";

 void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32p4.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32p4.c
@@ -19,10 +19,12 @@
 #include "bootloader_init.h"
 #include "hal/mmu_hal.h"
 #include "hal/mmu_ll.h"
+#include "hal/spimem_flash_ll.h"
 #include "hal/cache_hal.h"
 #include "hal/cache_ll.h"
+#include "esp_private/bootloader_flash_internal.h"

-void IRAM_ATTR bootloader_flash_update_id()
+void IRAM_ATTR bootloader_flash_update_id(void)
 {
    esp_rom_spiflash_chip_t *chip = &rom_spiflash_legacy_data->chip;
    chip->device_id = bootloader_read_flash_id();
@@ -33,15 +35,23 @@ void bootloader_flash_update_size(uint32_t size)
    rom_spiflash_legacy_data->chip.chip_size = size;
 }

-void IRAM_ATTR bootloader_flash_cs_timing_config()
+void IRAM_ATTR bootloader_flash_cs_timing_config(void)
 {
    SET_PERI_REG_MASK(SPI_MEM_C_USER_REG, SPI_MEM_C_CS_HOLD_M | SPI_MEM_C_CS_SETUP_M);
    SET_PERI_REG_BITS(SPI_MEM_C_CTRL2_REG, SPI_MEM_C_CS_HOLD_TIME_V, 0, SPI_MEM_C_CS_HOLD_TIME_S);
    SET_PERI_REG_BITS(SPI_MEM_C_CTRL2_REG, SPI_MEM_C_CS_SETUP_TIME_V, 0, SPI_MEM_C_CS_SETUP_TIME_S);
 }

+void IRAM_ATTR bootloader_init_mspi_clock(void)
+{
+    _spimem_flash_ll_select_clk_source(0, FLASH_CLK_SRC_SPLL);
+    _spimem_ctrlr_ll_set_core_clock(0, 6);
+}
+
 void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
 {
+    bootloader_init_mspi_clock();
+
    uint32_t spi_clk_div = 0;
    switch (pfhdr->spi_speed) {
    case ESP_IMAGE_SPI_SPEED_DIV_1:
@@ -66,12 +76,12 @@ static const char *TAG = "boot.esp32p4";

 void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s2.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s2.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -94,12 +94,12 @@ void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
    const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
    uint8_t wp_pin = esp_rom_efuse_get_flash_wp_gpio();
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    if (spiconfig == 0) {

    } else {
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s3.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s3.c
@@ -105,12 +105,12 @@ void IRAM_ATTR bootloader_configure_spi_pins(int drv)
 {
    const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
    uint8_t wp_pin = esp_rom_efuse_get_flash_wp_gpio();
-    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
-    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
-    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
-    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
-    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
-    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    uint8_t clk_gpio_num = MSPI_IOMUX_PIN_NUM_CLK;
+    uint8_t q_gpio_num   = MSPI_IOMUX_PIN_NUM_MISO;
+    uint8_t d_gpio_num   = MSPI_IOMUX_PIN_NUM_MOSI;
+    uint8_t cs0_gpio_num = MSPI_IOMUX_PIN_NUM_CS0;
+    uint8_t hd_gpio_num  = MSPI_IOMUX_PIN_NUM_HD;
+    uint8_t wp_gpio_num  = MSPI_IOMUX_PIN_NUM_WP;
    if (spiconfig == 0) {

    } else {
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -181,6 +181,20 @@ uint32_t bootloader_common_get_chip_ver_pkg(void);
 */
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type);

+#if !CONFIG_IDF_TARGET_ESP32
+/**
+ * @brief Check the eFuse block revision
+ *
+ * @param[in] min_rev_full The required minimum revision of the eFuse block
+ * @param[in] max_rev_full The required maximum revision of the eFuse block
+ * @return
+ *          - ESP_OK: The eFuse block revision is in the required range.
+ *          - ESP_OK: DISABLE_BLK_VERSION_MAJOR has been set in the eFuse of the SoC. No requirements shall be checked at this time.
+ *          - ESP_FAIL: The eFuse block revision of this chip does not match the requirement of the current image.
+ */
+esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full);
+#endif  // !CONFIG_IDF_TARGET_ESP32
+
 /**
 * @brief Configure VDDSDIO, call this API to rise VDDSDIO to 1.9V when VDDSDIO regulator is enabled as 1.8V mode.
 */
--- a/components/bootloader_support/include/bootloader_memory_utils.h
+++ b/components/bootloader_support/include/bootloader_memory_utils.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2010-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2010-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -28,7 +28,21 @@ extern "C" {
 */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    return ((SOC_DRAM_LOW == SOC_IRAM_LOW) && (SOC_DRAM_HIGH == SOC_IRAM_HIGH));
+}
+
+/**
+ * @brief Check if the RTC IRAM and RTC DRAM are separate or using the same memory space
+ *
+ * @return true if the RTC DRAM and RTC IRAM are sharing the same memory space, false otherwise
+ */
+__attribute__((always_inline))
+inline static bool esp_rtc_dram_match_rtc_iram(void) {
+#if SOC_RTC_FAST_MEM_SUPPORTED
+    return ((SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW) && (SOC_RTC_IRAM_HIGH == SOC_RTC_DRAM_HIGH));
+#else
+    return false;
+#endif
 }

 /**
@@ -82,6 +96,7 @@ __attribute__((always_inline))
 inline static bool esp_ptr_in_diram_iram(const void *p) {
 // TODO: IDF-5980 esp32c6 D/I RAM share the same address
 #if SOC_DIRAM_IRAM_LOW == SOC_DIRAM_DRAM_LOW
+    (void)p;
    return false;
 #else
    return ((intptr_t)p >= SOC_DIRAM_IRAM_LOW && (intptr_t)p < SOC_DIRAM_IRAM_HIGH);
@@ -100,6 +115,7 @@ inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
    return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@@ -116,6 +132,7 @@ inline static bool esp_ptr_in_rtc_dram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
    return ((intptr_t)p >= SOC_RTC_DRAM_LOW && (intptr_t)p < SOC_RTC_DRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@@ -151,6 +168,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }

+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM

   - Address must be word aligned
--- a/components/bootloader_support/include/esp_flash_encrypt.h
+++ b/components/bootloader_support/include/esp_flash_encrypt.h
@@ -180,9 +180,19 @@ void esp_flash_encryption_init_checks(void);
 /** @brief Set all secure eFuse features related to flash encryption
 *
 * @return
- *  - ESP_OK - Successfully
+ *  - ESP_OK - On success
 */
 esp_err_t esp_flash_encryption_enable_secure_features(void);
+
+#if CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY
+/** @brief Enable the key manager for flash encryption
+ *
+ * @return
+ *  - ESP_OK - On success
+ */
+esp_err_t esp_flash_encryption_enable_key_mgr(void);
+#endif // CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY
+
 #endif /* BOOTLOADER_BUILD && CONFIG_SECURE_FLASH_ENC_ENABLED */

 /** @brief Returns the verification status for all physical security features of flash encryption in release mode
--- a/components/bootloader_support/include/esp_flash_partitions.h
+++ b/components/bootloader_support/include/esp_flash_partitions.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -29,6 +29,14 @@ extern "C" {
 #define PART_SUBTYPE_DATA_NVS_KEYS 0x04
 #define PART_SUBTYPE_DATA_EFUSE_EM 0x05

+#define PART_TYPE_BOOTLOADER 0x02
+#define PART_SUBTYPE_BOOTLOADER_PRIMARY 0x00
+#define PART_SUBTYPE_BOOTLOADER_OTA 0x01
+
+#define PART_TYPE_PARTITION_TABLE 0x03
+#define PART_SUBTYPE_PARTITION_TABLE_PRIMARY 0x00
+#define PART_SUBTYPE_PARTITION_TABLE_OTA 0x01
+
 #define PART_TYPE_END 0xff
 #define PART_SUBTYPE_END 0xff

@@ -41,7 +49,11 @@ extern "C" {
 /* Pre-partition table fixed flash offsets */
 #define ESP_BOOTLOADER_DIGEST_OFFSET 0x0
 #define ESP_BOOTLOADER_OFFSET CONFIG_BOOTLOADER_OFFSET_IN_FLASH  /* Offset of bootloader image. Has matching value in bootloader KConfig.projbuild file. */
+#define ESP_PRIMARY_BOOTLOADER_OFFSET CONFIG_BOOTLOADER_OFFSET_IN_FLASH  /* Offset of Primary bootloader image. */
 #define ESP_PARTITION_TABLE_OFFSET CONFIG_PARTITION_TABLE_OFFSET /* Offset of partition table. Backwards-compatible name.*/
+#define ESP_PRIMARY_PARTITION_TABLE_OFFSET CONFIG_PARTITION_TABLE_OFFSET /* Offset of partition table. */
+#define ESP_PARTITION_TABLE_SIZE (0x1000) /* The partition table occupies 1 sector of flash (SPI_FLASH_SEC_SIZE) */
+#define ESP_BOOTLOADER_SIZE (ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET)

 #define ESP_PARTITION_TABLE_MAX_LEN 0xC00 /* Maximum length of partition table data */
 #define ESP_PARTITION_TABLE_MAX_ENTRIES (ESP_PARTITION_TABLE_MAX_LEN / sizeof(esp_partition_info_t)) /* Maximum length of partition table data, including terminating entry */
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@@ -34,6 +34,7 @@ typedef struct {
  uint32_t image_len; /* Length of image on flash, in bytes */
  uint8_t image_digest[32]; /* appended SHA-256 digest */
  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
+  uint32_t mmu_page_size; /* Flash MMU page size per binary header */
 } esp_image_metadata_t;

 typedef enum {
--- a/components/bootloader_support/private_include/bootloader_soc.h
+++ b/components/bootloader_support/private_include/bootloader_soc.h
@@ -24,6 +24,14 @@ void bootloader_ana_super_wdt_reset_config(bool enable);
 */
 void bootloader_ana_clock_glitch_reset_config(bool enable);

+/**
+ * @brief Configure analog power glitch reset & glitch reset dref
+ *
+ * @param enable Boolean to enable or disable power glitch reset
+ * @param dref voltage threshold
+ */
+void bootloader_power_glitch_reset_config(bool enable, uint8_t dref);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@@ -27,7 +27,8 @@
 #include "esp_rom_caps.h"

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
-#define IS_MAX_REV_SET(max_chip_rev_full) (((max_chip_rev_full) != 65535) && ((max_chip_rev_full) != 0))
+#define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

 static const char* TAG = "boot_comm";

@@ -57,6 +58,31 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata)
    return bootloader_common_select_otadata(two_otadata, valid_two_otadata, true);
 }

+#if !CONFIG_IDF_TARGET_ESP32
+esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full)
+{
+    esp_err_t err = ESP_OK;
+#ifndef CONFIG_IDF_ENV_FPGA
+    // Check whether the efuse block version satisfy the requirements of current image.
+    uint32_t revision = efuse_hal_blk_version();
+    uint32_t major_rev = revision / 100;
+    uint32_t minor_rev = revision % 100;
+    if (IS_FIELD_SET(min_rev_full) && !ESP_EFUSE_BLK_REV_ABOVE(revision, min_rev_full)) {
+        ESP_LOGE(TAG, "Image requires efuse blk rev >= v%"PRIu32".%"PRIu32", but chip is v%"PRIu32".%"PRIu32,
+                    min_rev_full / 100, min_rev_full % 100, major_rev, minor_rev);
+        err = ESP_FAIL;
+    }
+    // If burnt `disable_blk_version_major` bit, skip the max version check
+    if ((IS_FIELD_SET(max_rev_full) && (revision > max_rev_full) && !efuse_hal_get_disable_blk_version_major())) {
+        ESP_LOGE(TAG, "Image requires efuse blk rev <= v%"PRIu32".%"PRIu32", but chip is v%"PRIu32".%"PRIu32,
+                    max_rev_full / 100, max_rev_full % 100, major_rev, minor_rev);
+        err = ESP_FAIL;
+    }
+#endif
+    return err;
+}
+#endif  // !CONFIG_IDF_TARGET_ESP32
+
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
 {
    esp_err_t err = ESP_OK;
@@ -80,7 +106,7 @@ esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hd
        }
        if (type == ESP_IMAGE_APPLICATION) {
            unsigned max_rev = img_hdr->max_chip_rev_full;
-            if ((IS_MAX_REV_SET(max_rev) && (revision > max_rev) && !efuse_hal_get_disable_wafer_version_major())) {
+            if ((IS_FIELD_SET(max_rev) && (revision > max_rev) && !efuse_hal_get_disable_wafer_version_major())) {
                ESP_LOGE(TAG, "Image requires chip rev <= v%d.%d, but chip is v%d.%d",
                         max_rev / 100, max_rev % 100,
                         major_rev, minor_rev);
@@ -217,7 +243,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
    static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
    return s_bootloader_retain_mem;
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@@ -48,8 +48,8 @@ void bootloader_console_init(void)

 #if CONFIG_ESP_CONSOLE_UART_CUSTOM
    // Some constants to make the following code less upper-case
-    const int uart_tx_gpio = CONFIG_ESP_CONSOLE_UART_TX_GPIO;
-    const int uart_rx_gpio = CONFIG_ESP_CONSOLE_UART_RX_GPIO;
+    const int uart_tx_gpio = (CONFIG_ESP_CONSOLE_UART_TX_GPIO >= 0) ? CONFIG_ESP_CONSOLE_UART_TX_GPIO : UART_NUM_0_TXD_DIRECT_GPIO_NUM;
+    const int uart_rx_gpio = (CONFIG_ESP_CONSOLE_UART_RX_GPIO >= 0) ? CONFIG_ESP_CONSOLE_UART_RX_GPIO : UART_NUM_0_RXD_DIRECT_GPIO_NUM;

    // Switch to the new UART (this just changes UART number used for esp_rom_printf in ROM code).
    esp_rom_output_set_as_console(uart_num);
@@ -74,6 +74,12 @@ void bootloader_console_init(void)
        // Enable the peripheral
        uart_ll_enable_bus_clock(uart_num, true);
        uart_ll_reset_register(uart_num);
+        // Set clock source
+#if SOC_UART_SUPPORT_XTAL_CLK
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_XTAL);
+#else
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_APB);
+#endif
        // Reset TX and RX FIFOs
        uart_ll_txfifo_rst(UART_LL_GET_HW(uart_num));
        uart_ll_rxfifo_rst(UART_LL_GET_HW(uart_num));
--- a/components/bootloader_support/src/bootloader_efuse.c
+++ b/components/bootloader_support/src/bootloader_efuse.c
@@ -30,7 +30,7 @@ int bootloader_clock_get_rated_freq_mhz(void)
 #elif CONFIG_IDF_TARGET_ESP32C6
    return 160;

-#elif CONFIG_IDF_TARGET_ESP32C61    //TODO: [ESP32C61] IDF-9282
+#elif CONFIG_IDF_TARGET_ESP32C61
    return 160;

 #elif CONFIG_IDF_TARGET_ESP32C5
--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@@ -43,10 +43,17 @@ esp_err_t bootloader_read_bootloader_header(void)

 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    unsigned int revision = efuse_hal_chip_revision();
-    unsigned int major = revision / 100;
-    unsigned int minor = revision % 100;
-    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", major, minor);
+    unsigned int chip_revision = efuse_hal_chip_revision();
+    unsigned int chip_major_rev = chip_revision / 100;
+    unsigned int chip_minor_rev = chip_revision % 100;
+    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", chip_major_rev, chip_minor_rev);
+/* ESP32 doesn't have more memory and more efuse bits for block major version. */
+#if !CONFIG_IDF_TARGET_ESP32
+    unsigned int efuse_revision = efuse_hal_blk_version();
+    unsigned int efuse_major_rev = efuse_revision / 100;
+    unsigned int efuse_minor_rev = efuse_revision % 100;
+    ESP_EARLY_LOGI(TAG, "efuse block revision: v%d.%d", efuse_major_rev, efuse_minor_rev);
+#endif  // !CONFIG_IDF_TARGET_ESP32
    /* compare with the one set in bootloader image header */
    if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
        return ESP_FAIL;
--- a/components/bootloader_support/src/bootloader_mem.c
+++ b/components/bootloader_support/src/bootloader_mem.c
@@ -16,12 +16,6 @@
 #include "hal/apm_hal.h"
 #endif

-#if CONFIG_IDF_TARGET_ESP32C61 // TODO: IDF-9230 Remove the workaround when APM supported on C61!
-#include "soc/hp_apm_reg.h"
-#include "soc/lp_apm_reg.h"
-#endif
-
-
 void bootloader_init_mem(void)
 {

@@ -38,13 +32,6 @@ void bootloader_init_mem(void)
 #endif
 #endif

-#if CONFIG_IDF_TARGET_ESP32C61 // TODO: IDF-9230 Remove the workaround when APM supported on C61!
-    // disable apm filter
-    REG_WRITE(LP_APM_FUNC_CTRL_REG, 0);
-    REG_WRITE(HP_APM_FUNC_CTRL_REG, 0);
-#endif
-
-
 #ifdef CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE
    // protect memory region
    esp_cpu_configure_region_protection();
--- a/components/bootloader_support/src/bootloader_random_esp32p4.c
+++ b/components/bootloader_support/src/bootloader_random_esp32p4.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -30,8 +30,8 @@ static void adc1_fix_initcode_set(uint32_t initcode_value)
 {
    uint32_t msb = initcode_value >> 8;
    uint32_t lsb = initcode_value & 0xff;
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_SAR1_INIT_CODE_MSB, msb);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_SAR1_INIT_CODE_LSB, lsb);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, msb);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, lsb);
 }

 //total 4 tables
@@ -94,7 +94,8 @@ void bootloader_random_enable(void)

 void bootloader_random_disable(void)
 {
-    // No-op for now TODO IDF-6497
-    // ADC should be set to defaults here, once ADC API is implemented
-    // OR just keep this empty and let application continue to use RNG initialized by the bootloader
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_ENT_VDD_GRP1, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_DTEST_VDD_GRP1, 0);
 }
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -20,6 +20,7 @@
 #include "esp_rom_spiflash.h"

 #include "soc/soc.h"
+#include "soc/soc_caps.h"
 #include "soc/rtc.h"
 #include "soc/efuse_periph.h"
 #include "soc/rtc_periph.h"
@@ -66,7 +67,7 @@ static void set_cache_and_start_app(uint32_t drom_addr,
                                    uint32_t irom_addr,
                                    uint32_t irom_load_addr,
                                    uint32_t irom_size,
-                                    uint32_t entry_addr);
+                                    const esp_image_metadata_t *data);

 esp_err_t bootloader_common_read_otadata(const esp_partition_pos_t *ota_info, esp_ota_select_entry_t *two_otadata)
 {
@@ -199,6 +200,26 @@ bool bootloader_utility_load_partition_table(bootloader_state_t *bs)
                break;
            }
            break; /* PARTITION_USAGE_DATA */
+        case PART_TYPE_BOOTLOADER: /* Bootloader partition */
+            switch (partition->subtype) {
+            case PART_SUBTYPE_BOOTLOADER_PRIMARY:
+                partition_usage = "primary bootloader";
+                break;
+            case PART_SUBTYPE_BOOTLOADER_OTA:
+                partition_usage = "ota bootloader";
+                break;
+            }
+            break; /* PART_TYPE_BOOTLOADER */
+        case PART_TYPE_PARTITION_TABLE: /* Partition table partition */
+            switch (partition->subtype) {
+            case PART_SUBTYPE_PARTITION_TABLE_PRIMARY:
+                partition_usage = "primary partition_table";
+                break;
+            case PART_SUBTYPE_PARTITION_TABLE_OTA:
+                partition_usage = "ota partition_table";
+                break;
+            }
+            break; /* PART_TYPE_PARTITION_TABLE */
        default: /* other partition type */
            break;
        }
@@ -769,7 +790,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                            rom_addr[1],
                            rom_load_addr[1],
                            rom_size[1],
-                            data->image.entry_addr);
+                            data);
 }

 #else  //!SOC_MMU_DI_VADDR_SHARED
@@ -814,7 +835,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                            irom_addr,
                            irom_load_addr,
                            irom_size,
-                            data->image.entry_addr);
+                            data);
 }
 #endif  //#if SOC_MMU_DI_VADDR_SHARED

@@ -839,9 +860,11 @@ static void set_cache_and_start_app(
    uint32_t irom_addr,
    uint32_t irom_load_addr,
    uint32_t irom_size,
-    uint32_t entry_addr)
+    const esp_image_metadata_t *data)
 {
    int rc __attribute__((unused));
+    const uint32_t entry_addr = data->image.entry_addr;
+    const uint32_t mmu_page_size = data->mmu_page_size;

    ESP_EARLY_LOGD(TAG, "configure drom and irom and start");
    //-----------------------Disable Cache to do the mapping---------
@@ -851,12 +874,18 @@ static void set_cache_and_start_app(
 #else
    cache_hal_disable(CACHE_LL_LEVEL_EXT_MEM, CACHE_TYPE_ALL);
 #endif
+
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    // re-configure MMU page size
+    mmu_ll_set_page_size(0, mmu_page_size);
+#endif //SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
    //reset MMU table first
    mmu_hal_unmap_all();

    //-----------------------MAP DROM--------------------------
-    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
-    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK;
+    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
    ESP_EARLY_LOGV(TAG, "rodata starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, drom_addr, drom_load_addr, drom_size);
    //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
    drom_size = (drom_load_addr - drom_load_addr_aligned) + drom_size;
@@ -874,13 +903,13 @@ static void set_cache_and_start_app(
        ESP_EARLY_LOGV(TAG, "after mapping rodata, starting from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, drom_load_addr_aligned, actual_mapped_len);
    }
    //we use the MMU_LL_END_DROM_ENTRY_ID mmu entry as a map page for app to find the boot partition
-    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_LL_END_DROM_ENTRY_VADDR, drom_addr_aligned, CONFIG_MMU_PAGE_SIZE, &actual_mapped_len);
-    ESP_EARLY_LOGV(TAG, "mapped one page of the rodata, from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, drom_load_addr_aligned, actual_mapped_len);
+    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_DROM_END_ENTRY_VADDR_FROM_VAL(mmu_page_size), drom_addr_aligned, mmu_page_size, &actual_mapped_len);
+    ESP_EARLY_LOGV(TAG, "mapped one page of the rodata, from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, MMU_LL_END_DROM_ENTRY_VADDR, actual_mapped_len);
 #endif

    //-----------------------MAP IROM--------------------------
-    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
-    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK;
+    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
    ESP_EARLY_LOGV(TAG, "text starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, irom_addr, irom_load_addr, irom_size);
    //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
    irom_size = (irom_load_addr - irom_load_addr_aligned) + irom_size;
--- a/components/bootloader_support/src/esp32/bootloader_esp32.c
+++ b/components/bootloader_support/src/esp32/bootloader_esp32.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -69,11 +69,11 @@ static void bootloader_reset_mmu(void)
 }
 #endif //#if !CONFIG_APP_BUILD_TYPE_PURE_RAM_APP

-static esp_err_t bootloader_check_rated_cpu_clock(void)
+static inline esp_err_t bootloader_check_rated_cpu_clock(void)
 {
    int rated_freq = bootloader_clock_get_rated_freq_mhz();
    if (rated_freq < CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ) {
-        ESP_LOGE(TAG, "Chip CPU frequency rated for %dMHz, configured for %dMHz. Modify CPU frequency in menuconfig",
+        ESP_LOGE(TAG, "Chip CPU freq rated for %dMHz, configured for %dMHz. Modify CPU freq in menuconfig",
                 rated_freq, CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ);
        return ESP_FAIL;
    }
@@ -119,19 +119,19 @@ static void wdt_reset_info_dump(int cpu)

    if (DPORT_RECORD_PDEBUGINST_SZ(inst) == 0 &&
            DPORT_RECORD_PDEBUGSTATUS_BBCAUSE(dstat) == DPORT_RECORD_PDEBUGSTATUS_BBCAUSE_WAITI) {
-        ESP_LOGW(TAG, "WDT reset info: %s CPU PC=0x%"PRIx32" (waiti mode)", cpu_name, pc);
+        ESP_LOGW(TAG, "WDT rst info: %s CPU PC=0x%"PRIx32" (waiti mode)", cpu_name, pc);
    } else {
-        ESP_LOGW(TAG, "WDT reset info: %s CPU PC=0x%"PRIx32, cpu_name, pc);
+        ESP_LOGW(TAG, "WDT rst info: %s CPU PC=0x%"PRIx32, cpu_name, pc);
    }
-    ESP_LOGD(TAG, "WDT reset info: %s CPU STATUS        0x%08"PRIx32, cpu_name, stat);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PID           0x%08"PRIx32, cpu_name, pid);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGINST    0x%08"PRIx32, cpu_name, inst);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGSTATUS  0x%08"PRIx32, cpu_name, dstat);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGDATA    0x%08"PRIx32, cpu_name, data);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGPC      0x%08"PRIx32, cpu_name, pc);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGLS0STAT 0x%08"PRIx32, cpu_name, lsstat);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGLS0ADDR 0x%08"PRIx32, cpu_name, lsaddr);
-    ESP_LOGD(TAG, "WDT reset info: %s CPU PDEBUGLS0DATA 0x%08"PRIx32, cpu_name, lsdata);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU STATUS        0x%08"PRIx32, cpu_name, stat);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PID           0x%08"PRIx32, cpu_name, pid);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGINST    0x%08"PRIx32, cpu_name, inst);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGSTATUS  0x%08"PRIx32, cpu_name, dstat);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGDATA    0x%08"PRIx32, cpu_name, data);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGPC      0x%08"PRIx32, cpu_name, pc);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGLS0STAT 0x%08"PRIx32, cpu_name, lsstat);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGLS0ADDR 0x%08"PRIx32, cpu_name, lsaddr);
+    ESP_LOGD(TAG, "WDT rst info: %s CPU PDEBUGLS0DATA 0x%08"PRIx32, cpu_name, lsdata);
 }

 static void bootloader_check_wdt_reset(void)
@@ -143,12 +143,12 @@ static void bootloader_check_wdt_reset(void)
    rst_reas[1] = esp_rom_get_reset_reason(1);
    if (rst_reas[0] == RESET_REASON_CORE_RTC_WDT || rst_reas[0] == RESET_REASON_CORE_MWDT0 || rst_reas[0] == RESET_REASON_CORE_MWDT1 ||
        rst_reas[0] == RESET_REASON_CPU0_MWDT0 || rst_reas[0] == RESET_REASON_CPU0_RTC_WDT) {
-        ESP_LOGW(TAG, "PRO CPU has been reset by WDT.");
+        ESP_LOGW(TAG, "PRO CPU has been reset by WDT");
        wdt_rst = 1;
    }
    if (rst_reas[1] == RESET_REASON_CORE_RTC_WDT || rst_reas[1] == RESET_REASON_CORE_MWDT0 || rst_reas[1] == RESET_REASON_CORE_MWDT1 ||
        rst_reas[1] == RESET_REASON_CPU1_MWDT1 || rst_reas[1] == RESET_REASON_CPU1_RTC_WDT) {
-        ESP_LOGW(TAG, "APP CPU has been reset by WDT.");
+        ESP_LOGW(TAG, "APP CPU has been reset by WDT");
        wdt_rst = 1;
    }
    if (wdt_rst) {
@@ -215,7 +215,7 @@ esp_err_t bootloader_init(void)
    bootloader_flash_update_id();
    // Check and run XMC startup flow
    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
-        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        ESP_LOGE(TAG, "XMC startup flow failed, reboot!");
        return ret;
    }
    // read bootloader header
@@ -232,7 +232,7 @@ esp_err_t bootloader_init(void)
    }
 #endif // #if !CONFIG_APP_BUILD_TYPE_RAM

-    // check whether a WDT reset happend
+    // check whether a WDT reset happened
    bootloader_check_wdt_reset();
    // config WDT
    bootloader_config_wdt();
--- a/components/bootloader_support/src/esp32c5/bootloader_esp32c5.c
+++ b/components/bootloader_support/src/esp32c5/bootloader_esp32c5.c
@@ -42,6 +42,7 @@
 #include "hal/efuse_hal.h"
 #include "hal/lpwdt_ll.h"
 #include "hal/regi2c_ctrl_ll.h"
+#include "hal/brownout_ll.h"

 static const char *TAG = "boot.esp32c5";

@@ -91,12 +92,13 @@ static inline void bootloader_hardware_init(void)

 static inline void bootloader_ana_reset_config(void)
 {
-    // TODO: [ESP32C5] IDF-8650
-    //Enable super WDT reset.
-    // bootloader_ana_super_wdt_reset_config(true);
-    // TODO: [ESP32C5] IDF-8647
-    //Enable BOD reset TODO: [ESP32C5] IDF-8667
-    // brownout_ll_ana_reset_enable(true);
+    //Enable BOD reset (mode1)
+    brownout_ll_ana_reset_enable(true);
+    if (efuse_hal_chip_revision() == 0) {
+        // decrease power glitch reset voltage to avoid start the glitch reset
+        uint8_t power_glitch_dref = 0;
+        bootloader_power_glitch_reset_config(true, power_glitch_dref);
+    }
 }

 esp_err_t bootloader_init(void)
--- a/components/bootloader_support/src/esp32c5/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c5/bootloader_soc.c
@@ -7,18 +7,29 @@
 #include <assert.h>
 #include "soc/soc.h"
 #include "soc/lp_analog_peri_reg.h"
-// TODO: [ESP32C5] IDF-8667 remove esp_log.h
-#include "esp_log.h"
-
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    // TODO: [ESP32C5] IDF-8667
-    ESP_EARLY_LOGW("bootloader", "bootloader_ana_super_wdt_reset_config() has not been implemented on C5 yet");
-}
+#include "soc/pmu_reg.h"
+#include "hal/regi2c_ctrl.h"
+#include "soc/regi2c_saradc.h"

 //Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
-     // TODO: [ESP32C5] IDF-8667
    (void)enable;
 }
+
+void bootloader_power_glitch_reset_config(bool enable, uint8_t dref)
+{
+    assert(dref < 8);
+    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);
+    if (enable) {
+        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
+        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PERIF, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_VDDPST, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_XTAL, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLL, dref);
+        REG_SET_FIELD(LP_ANA_CK_GLITCH_CNTL_REG, LP_ANA_PWR_GLITCH_RESET_ENA, 0xf);
+    } else {
+        REG_SET_FIELD(LP_ANA_CK_GLITCH_CNTL_REG, LP_ANA_PWR_GLITCH_RESET_ENA, 0);
+    }
+}
--- a/components/bootloader_support/src/esp32c5/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32c5/flash_encryption_secure_features.c
@@ -11,6 +11,8 @@
 #include "esp_efuse_table.h"
 #include "esp_log.h"
 #include "sdkconfig.h"
+#include "hal/key_mgr_ll.h"
+#include "hal/mspi_timing_tuning_ll.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";

@@ -58,3 +60,22 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    return ESP_OK;
 }
+
+esp_err_t esp_flash_encryption_enable_key_mgr(void)
+{
+    // Enable and reset key manager
+    // To suppress build errors about spinlock's __DECLARE_RCC_ATOMIC_ENV
+    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused));
+    key_mgr_ll_enable_bus_clock(true);
+    key_mgr_ll_enable_peripheral_clock(true);
+    key_mgr_ll_reset_register();
+
+    while (key_mgr_ll_get_state() != ESP_KEY_MGR_STATE_IDLE) {
+    };
+
+    // Force Key Manager to use eFuse key for XTS-AES operation
+    key_mgr_ll_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+    _mspi_timing_ll_reset_mspi();
+
+    return ESP_OK;
+}
--- a/components/bootloader_support/src/esp32c61/bootloader_esp32c61.c
+++ b/components/bootloader_support/src/esp32c61/bootloader_esp32c61.c
@@ -43,6 +43,7 @@
 #include "hal/efuse_hal.h"
 #include "hal/lpwdt_ll.h"
 #include "hal/regi2c_ctrl_ll.h"
+#include "hal/brownout_ll.h"

 static const char *TAG = "boot.esp32c61";

@@ -92,17 +93,17 @@ static inline void bootloader_hardware_init(void)

 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable super WDT reset.
-    bootloader_ana_super_wdt_reset_config(true);
-    //Enable BOD reset TODO: IDF-9254 BOD support
-    // brownout_ll_ana_reset_enable(true);
+    //Enable BOD reset (mode1)
+    brownout_ll_ana_reset_enable(true);
+    uint8_t power_glitch_dref = 0;
+    bootloader_power_glitch_reset_config(true, power_glitch_dref);
 }

 esp_err_t bootloader_init(void)
 {
    esp_err_t ret = ESP_OK;
    bootloader_hardware_init();
-    // bootloader_ana_reset_config();   //TODO: [ESP32C61] IDF-9260
+    bootloader_ana_reset_config();
    bootloader_super_wdt_auto_feed();

 // In RAM_APP, memory will be initialized in `call_start_cpu0`
--- a/components/bootloader_support/src/esp32c61/bootloader_sha.c
+++ b/components/bootloader_support/src/esp32c61/bootloader_sha.c
@@ -13,8 +13,6 @@

 static SHA_CTX ctx;

-//TODO: [ESP32C61] IDF-9234
-
 bootloader_sha256_handle_t bootloader_sha256_start()
 {
    // Enable SHA hardware
--- a/components/bootloader_support/src/esp32c61/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c61/bootloader_soc.c
@@ -7,19 +7,29 @@
 #include <assert.h>
 #include "soc/soc.h"
 #include "soc/lp_analog_peri_reg.h"
-
-//TODO: [ESP32C61] IDF-9260, commented in verify code, check
-
-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    //C61 doesn't support bypass super WDT reset
-    assert(enable);
-    // lp_analog_peri_reg.h updated, now following registers
-    // REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_SUPER_WDT_RST);
-}
+#include "soc/pmu_reg.h"
+#include "hal/regi2c_ctrl.h"
+#include "soc/regi2c_saradc.h"

 //Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
    (void)enable;
 }
+
+void bootloader_power_glitch_reset_config(bool enable, uint8_t dref)
+{
+    assert(dref < 8);
+    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);
+    if (enable) {
+        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
+        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PERIF, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_VDDPST, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLLBB, dref);
+        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLL, dref);
+        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_POWER_GLITCH_RESET_ENA, 0xf);
+    } else {
+        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_POWER_GLITCH_RESET_ENA, 0);
+    }
+}
--- a/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
+++ b/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
@@ -92,6 +92,8 @@ static inline void bootloader_hardware_init(void)

    regi2c_ctrl_ll_master_enable_clock(true);
    regi2c_ctrl_ll_master_configure_clock();
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }

 static inline void bootloader_ana_reset_config(void)
--- a/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
    // otherwise the Flash Encryption key cannot be read protected
--- a/components/bootloader_support/src/esp32p4/bootloader_esp32p4.c
+++ b/components/bootloader_support/src/esp32p4/bootloader_esp32p4.c
@@ -37,6 +37,7 @@
 #include "bootloader_soc.h"
 #include "esp_private/bootloader_flash_internal.h"
 #include "esp_efuse.h"
+#include "hal/assist_debug_ll.h"
 #include "hal/mmu_hal.h"
 #include "hal/cache_hal.h"
 #include "hal/clk_tree_ll.h"
@@ -55,7 +56,7 @@ static const char *TAG = "boot.esp32p4";

 static void wdt_reset_cpu0_info_enable(void)
 {
-    //TODO: IDF-7688
+    _assist_debug_ll_enable_bus_clock(true);
    REG_WRITE(ASSIST_DEBUG_CORE_0_RCD_EN_REG, ASSIST_DEBUG_CORE_0_RCD_PDEBUGEN | ASSIST_DEBUG_CORE_0_RCD_RECORDEN);
 }

@@ -109,12 +110,12 @@ static inline void bootloader_hardware_init(void)
    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_1P1, 10);
    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_1P1_PVT, 10);

+#if !CONFIG_APP_BUILD_TYPE_PURE_RAM_APP
    // IDF-10019 TODO: This is temporarily for ESP32P4-ECO0, please remove it when eco0 is not widly used.
-    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused));
    if (likely(ESP_CHIP_REV_ABOVE(chip_version, 1))) {
-        spimem_flash_ll_select_clk_source(0, FLASH_CLK_SRC_SPLL);
-        spimem_ctrlr_ll_set_core_clock(0, 6);
+        bootloader_init_mspi_clock();
    }
+#endif
 }

 static inline void bootloader_ana_reset_config(void)
--- a/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -11,6 +11,8 @@
 #include "esp_efuse_table.h"
 #include "esp_log.h"
 #include "sdkconfig.h"
+#include "hal/key_mgr_ll.h"
+#include "hal/mspi_timing_tuning_ll.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";

@@ -48,3 +50,22 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    return ESP_OK;
 }
+
+esp_err_t esp_flash_encryption_enable_key_mgr(void)
+{
+    // Enable and reset key manager
+    // To suppress build errors about spinlock's __DECLARE_RCC_ATOMIC_ENV
+    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused));
+    key_mgr_ll_enable_bus_clock(true);
+    key_mgr_ll_enable_peripheral_clock(true);
+    key_mgr_ll_reset_register();
+
+    while (key_mgr_ll_get_state() != ESP_KEY_MGR_STATE_IDLE) {
+    };
+
+    // Force Key Manager to use eFuse key for XTS-AES operation
+    key_mgr_ll_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
+    _mspi_timing_ll_reset_mspi();
+
+    return ESP_OK;
+}
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -22,6 +22,7 @@
 #include "bootloader_memory_utils.h"
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
+#include "spi_flash_mmap.h"

 #define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

@@ -47,7 +48,12 @@ static const char *TAG = "esp_image";

 #define HASH_LEN ESP_IMAGE_HASH_LEN

-#define SIXTEEN_MB 0x1000000
+#if SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    UINT32_MAX
+#else
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    0x1000000
+#endif
+
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF

 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
@@ -77,7 +83,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);

 /* Verify a segment header */
-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent);
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent);

 /* Log-and-fail macro for use in esp_image_load */
 #define FAIL_LOAD(...) do {                         \
@@ -138,7 +144,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    verify_sha = (part->offset != ESP_BOOTLOADER_OFFSET) && do_verify;
 #endif

-    if (part->size > SIXTEEN_MB) {
+    if (part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        err = ESP_ERR_INVALID_ARG;
        FAIL_LOAD("partition size 0x%"PRIx32" invalid, larger than 16MB", part->size);
    }
@@ -297,7 +303,7 @@ esp_err_t esp_image_verify(esp_image_load_mode_t mode, const esp_partition_pos_t
 esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_metadata_t *metadata)
 {
    esp_err_t err;
-    if (metadata == NULL || part == NULL || part->size > SIXTEEN_MB) {
+    if (metadata == NULL || part == NULL || part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        return ESP_ERR_INVALID_ARG;
    }

@@ -559,7 +565,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme

    ESP_LOGV(TAG, "segment data length 0x%"PRIx32" data starts 0x%"PRIx32, data_len, data_addr);

-    CHECK_ERR(verify_segment_header(index, header, data_addr, silent));
+    CHECK_ERR(verify_segment_header(index, header, data_addr, metadata, silent));

    if (data_len % 4 != 0) {
        FAIL_LOAD("unaligned segment length 0x%"PRIx32, data_len);
@@ -691,19 +697,28 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t

    const uint32_t *src = data;

-#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
    // Case I: Bootloader verifying application
    // Case II: Bootloader verifying bootloader
-    // Anti-rollback check should handle only Case I from above.
+    // The esp_app_desc_t structure is located in DROM and is always in segment #0.
+    // Anti-rollback check and efuse block version check should handle only Case I from above.
    if (segment == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+/* ESP32 doesn't have more memory and more efuse bits for block major version. */
+#if !CONFIG_IDF_TARGET_ESP32
+        const esp_app_desc_t *app_desc = (const esp_app_desc_t *)src;
+        esp_err_t ret = bootloader_common_check_efuse_blk_validity(app_desc->min_efuse_blk_rev_full, app_desc->max_efuse_blk_rev_full);
+        if (ret != ESP_OK) {
+            bootloader_munmap(data);
+            return ret;
+        }
+#endif  // !CONFIG_IDF_TARGET_ESP32
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
        ESP_LOGD(TAG, "additional anti-rollback check 0x%"PRIx32, data_addr);
-        // The esp_app_desc_t structure is located in DROM and is always in segment #0.
        size_t len = process_esp_app_desc_data(src, sha_handle, checksum, metadata);
        data_len -= len;
        src += len / 4;
        // In BOOTLOADER_BUILD, for DROM (segment #0) we do not load it into dest (only map it), do_load = false.
-    }
 #endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    }

    for (size_t i = 0; i < data_len; i += 4) {
        int w_i = i / 4; // Word index
@@ -739,10 +754,10 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
    return ESP_OK;
 }

-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent)
 {
    if ((segment->data_len & 3) != 0
-            || segment->data_len >= SIXTEEN_MB) {
+            || segment->data_len >= ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        if (!silent) {
            ESP_LOGE(TAG, "invalid segment length 0x%"PRIx32, segment->data_len);
        }
@@ -752,13 +767,46 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    uint32_t load_addr = segment->load_addr;
    bool map_segment = should_map(load_addr);

+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    esp_err_t err = ESP_FAIL;
+
+    /* ESP APP descriptor is present in the DROM segment #0 */
+    if (index == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+        uint32_t mmu_page_size = 0, magic_word = 0;
+        const uint32_t mmu_page_size_offset = segment_data_offs + offsetof(esp_app_desc_t, mmu_page_size);
+        CHECK_ERR(bootloader_flash_read(segment_data_offs, &magic_word, sizeof(uint32_t), true));
+        CHECK_ERR(bootloader_flash_read(mmu_page_size_offset, &mmu_page_size, sizeof(uint32_t), true));
+        // Extract only the lowest byte from mmu_page_size (as per image format)
+        mmu_page_size &= 0xFF;
+
+        if (magic_word != ESP_APP_DESC_MAGIC_WORD) {
+            ESP_LOGE(TAG, "Failed to fetch app description header!");
+            return ESP_FAIL;
+        }
+
+        // Convert from log base 2 number to actual size while handling legacy image case (value 0)
+        metadata->mmu_page_size = (mmu_page_size > 0) ? (1UL << mmu_page_size) : SPI_FLASH_MMU_PAGE_SIZE;
+        if (metadata->mmu_page_size != SPI_FLASH_MMU_PAGE_SIZE) {
+            ESP_LOGI(TAG, "MMU page size mismatch, configured: 0x%x, found: 0x%"PRIx32, SPI_FLASH_MMU_PAGE_SIZE, metadata->mmu_page_size);
+        }
+    } else if (index == 0 && metadata->start_addr == ESP_BOOTLOADER_OFFSET) {
+        // Bootloader always uses the default MMU page size
+        metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#else // SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+#endif // !SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
+    const int mmu_page_size = metadata->mmu_page_size;
+    ESP_LOGV(TAG, "MMU page size 0x%x", mmu_page_size);
+
    /* Check that flash cache mapped segment aligns correctly from flash to its mapped address,
-       relative to the 64KB page mapping size.
+       relative to the MMU page mapping size.
    */
    ESP_LOGV(TAG, "segment %d map_segment %d segment_data_offs 0x%"PRIx32" load_addr 0x%"PRIx32,
             index, map_segment, segment_data_offs, load_addr);
    if (map_segment
-            && ((segment_data_offs % SPI_FLASH_MMU_PAGE_SIZE) != (load_addr % SPI_FLASH_MMU_PAGE_SIZE))) {
+            && ((segment_data_offs % mmu_page_size) != (load_addr % mmu_page_size))) {
        if (!silent) {
            ESP_LOGE(TAG, "Segment %d load address 0x%08"PRIx32", doesn't match data 0x%08"PRIx32,
                     index, load_addr, segment_data_offs);
@@ -767,6 +815,10 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    }

    return ESP_OK;
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+err:
+    return err;
+#endif
 }

 static bool should_map(uint32_t load_addr)
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"

 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@@ -207,6 +210,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32

+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -468,6 +478,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
    }
    result &= secure;

+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
    return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@@ -15,18 +15,7 @@
 #include "esp_efuse_table.h"
 #include "esp_log.h"
 #include "hal/wdt_hal.h"
-
-// Need to remove check and merge accordingly for ESP32C5 once key manager support added in IDF-8621
-#if SOC_KEY_MANAGER_SUPPORTED || CONFIG_IDF_TARGET_ESP32C5
-#if CONFIG_IDF_TARGET_ESP32C5
-#include "soc/keymng_reg.h"
-#include "hal/key_mgr_types.h"
-#include "soc/pcr_reg.h"
-#else
-#include "hal/key_mgr_hal.h"
-#include "hal/mspi_timing_tuning_ll.h"
-#endif /* CONFIG_IDF_TARGET_ESP32C5 */
-#endif
+#include "sdkconfig.h"

 #ifdef CONFIG_SOC_EFUSE_CONSISTS_OF_ONE_KEY_BLOCK
 #include "soc/sensitive_reg.h"
@@ -222,18 +211,6 @@ static esp_err_t check_and_generate_encryption_keys(void)
        }
        ESP_LOGI(TAG, "Using pre-loaded flash encryption key in efuse");
    }
-// Need to remove check for ESP32C5 and merge accordingly once key manager support added in IDF-8621
-#if SOC_KEY_MANAGER_SUPPORTED || CONFIG_IDF_TARGET_ESP32C5
-#if CONFIG_IDF_TARGET_ESP32C5
-    REG_SET_FIELD(KEYMNG_STATIC_REG, KEYMNG_USE_EFUSE_KEY, 2);
-    REG_SET_BIT(PCR_MSPI_CLK_CONF_REG, PCR_MSPI_AXI_RST_EN);
-    REG_CLR_BIT(PCR_MSPI_CLK_CONF_REG, PCR_MSPI_AXI_RST_EN);
-#else
-    // Force Key Manager to use eFuse key for XTS-AES operation
-    key_mgr_hal_set_key_usage(ESP_KEY_MGR_XTS_AES_128_KEY, ESP_KEY_MGR_USE_EFUSE_KEY);
-    _mspi_timing_ll_reset_mspi();
-#endif /* CONFIG_IDF_TARGET_ESP32C5 */
-#endif

    return ESP_OK;
 }
@@ -281,6 +258,10 @@ esp_err_t esp_flash_encrypt_contents(void)
    REG_WRITE(SENSITIVE_XTS_AES_KEY_UPDATE_REG, 1);
 #endif

+#if CONFIG_SOC_KEY_MANAGER_FE_KEY_DEPLOY
+    esp_flash_encryption_enable_key_mgr();
+#endif
+
    err = encrypt_bootloader();
    if (err != ESP_OK) {
        return err;
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
@@ -154,13 +154,12 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
    ets_secure_boot_key_digests_t trusted_key_digests = {0};
    bool valid_sig_blk = false;
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
        if (sig_block->block[i].version != ESP_SECURE_BOOT_SCHEME) {
            ESP_LOGD(TAG, "%s signing scheme selected but signature block %d generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), i, esp_secure_boot_get_scheme_name(sig_block->block[i].version));
-            continue;
        } else {
            valid_sig_blk = true;
        }
-        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
    }
    if (valid_sig_blk != true) {
        ESP_LOGE(TAG, "No signature block generated for valid scheme");
--- a/Show More
+++ b/Show More