versions: Update version to 4.4.5

Merge branch 'bugfix/fix_some_esp32c3_s3_ble_bugs_230422_4.4' into 'release/v4.4'
Fixed some ESP32C3/S3 BLE bugs 23-04-22(backport v4.4) See merge request espressif/esp-idf!23354
2023-06-08 10:16:36 +08:00 · 2023-05-26 11:15:27 +08:00 · 2023-05-25 10:46:12 +00:00 · 2023-05-25 10:46:12 +00:00 · 2023-05-25 10:46:12 +00:00 · 2023-05-25 10:46:12 +00:00
2773 changed files with 144284 additions and 172764 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -19,14 +19,6 @@ trim_trailing_whitespace = false
 indent_style = tab
 indent_size = 2

-[*/freertos/**]
-indent_style = tab
-indent_size = 4
-
-[{*/freertos/**.S,**/FreeRTOSConfig.h}]
-indent_style = space
-indent_size = 4
-
 [*.pem]
 insert_final_newline = false

--- a/.flake8
+++ b/.flake8
@ -152,6 +152,8 @@ exclude =
        components/openthread/openthread,
        components/tinyusb,
        components/unity/unity,
+        components/spiffs/spiffs,
+        components/freemodbus,
        examples/build_system/cmake/import_lib/main/lib/tinyxml2,
        examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
    # autogenerated scripts
@ -167,4 +169,5 @@ exclude =

 per-file-ignores =
    # Sphinx conf.py files use star imports to setup config variables
-        docs/conf_common.py: F405
+        docs/conf_common.py: F405,
+        components/freemodbus/docs/conf_common.py: F405
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -0,0 +1,75 @@
+name: docker
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release/*'
+    tags:
+      - 'v*.*'
+
+env:
+  # Platforms to build the image for
+  BUILD_PLATFORMS: linux/amd64,linux/arm64
+  DOCKERHUB_REPO: ${{ github.repository_owner }}/idf
+
+jobs:
+  docker:
+    # Disable the job in forks
+    if: ${{ github.repository_owner == 'espressif' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
+      # as a build arg) and TAG_NAME (used when tagging the image).
+      #
+      # The following 3 steps cover the alternatives (tag, release branch, master branch):
+      - name: Set variables (tags)
+        if: ${{ github.ref_type == 'tag' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
+      - name: Set variables (release branches)
+        if: ${{ github.ref_type == 'branch' && startsWith(github.ref_name, 'release/') }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=release-${GITHUB_REF_NAME##release/}" >> $GITHUB_ENV
+      - name: Set variables (main branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=master" >> $GITHUB_ENV
+          echo "TAG_NAME=latest" >> $GITHUB_ENV
+
+      # Display the variables set above, just in case.
+      - name: Check variables
+        run: |
+          echo "CLONE_BRANCH_OR_TAG: $CLONE_BRANCH_OR_TAG"
+          echo "CHECKOUT_REF: $CHECKOUT_REF"
+          echo "TAG_NAME: $TAG_NAME"
+
+      # The following steps are the standard boilerplate from
+      # https://github.com/marketplace/actions/build-and-push-docker-images
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up QEMU for multiarch builds
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: tools/docker
+          push: true
+          tags: ${{ env.DOCKERHUB_REPO }}:${{ env.TAG_NAME }}
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: |
+            IDF_CLONE_URL=${{ github.server_url }}/${{ github.repository }}.git
+            IDF_CLONE_BRANCH_OR_TAG=${{ env.CLONE_BRANCH_OR_TAG }}
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -14,6 +14,14 @@ workflow:
    # Disable those non-protected push triggered pipelines
    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
      when: never
+    # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
+    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
+    - if: $CI_OPEN_MERGE_REQUESTS != null
+      variables:
+        PIPELINE_COMMIT_SHA: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
+    - if: $CI_OPEN_MERGE_REQUESTS == null
+      variables:
+        PIPELINE_COMMIT_SHA: $CI_COMMIT_SHA
    - when: always

 variables:
@ -48,7 +56,7 @@ variables:

  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"
-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v4.4-1-v4"
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v4.4-1-v6"
  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env:v4.4-1"
  AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test:v4.4-1-1"
  CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis:v4.4-1-2"
@ -59,8 +67,6 @@ variables:

  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
-  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"

 .setup_tools_unless_target_test: &setup_tools_unless_target_test |
  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
@ -80,6 +86,7 @@ variables:

 before_script:
  - source tools/ci/utils.sh
+  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
  - source tools/ci/setup_python.sh
  - add_gitlab_ssh_keys
  - source tools/ci/configure_ci_environment.sh
@ -91,6 +98,7 @@ before_script:
  before_script:
    - echo "Not setting up GitLab key, not fetching submodules"
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - source tools/ci/setup_python.sh
    - source tools/ci/configure_ci_environment.sh

@ -98,11 +106,15 @@ before_script:
  before_script:
    - echo "Only load utils.sh"
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS

 .before_script_macos:
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
+    # Clean up idf-env.json which might not be compatible with one produced by newer ESP-IDF versions
+    - rm -f ${IDF_TOOLS_PATH}/idf-env.json
    - $IDF_PATH/tools/idf_tools.py install-python-env
    # On macOS, these tools need to be installed
    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@ -115,6 +127,12 @@ before_script:
    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
    - fetch_submodules

+default:
+  retry:
+    max: 2
+    # In case of a runner failure we could hop to another one, or a network error could go away.
+    when: runner_system_failure
+
 include:
  - '.gitlab/ci/rules.yml'
  - '.gitlab/ci/docs.yml'
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@ -2,210 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/Kconfig                              @esp-idf-codeowners/build-config
-/add_path.sh                          @esp-idf-codeowners/tools
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/tools
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/asio/                     @esp-idf-codeowners/network
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cbor/                     @esp-idf-codeowners/app-utilities
-/components/cmock/                    @esp-idf-codeowners/system
-/components/coap/                     @esp-idf-codeowners/app-utilities
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp32*/                   @esp-idf-codeowners/system
-/components/esp_adc_cal/              @esp-idf-codeowners/peripherals
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/tools
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system
-/components/esp_ipc/                  @esp-idf-codeowners/system
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_serial_slave_link/    @esp-idf-codeowners/peripherals
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_websocket_client/     @esp-idf-codeowners/network
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/tools
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/expat/                    @esp-idf-codeowners/app-utilities
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freemodbus/               @esp-idf-codeowners/peripherals
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/jsmn/                     @esp-idf-codeowners/app-utilities
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/libsodium/                @esp-idf-codeowners/security
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities @esp-idf-codeowners/security
-/components/mdns/                     @esp-idf-codeowners/network
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/tools
-/components/nghttp/                   @esp-idf-codeowners/app-utilities
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/openssl/                  @esp-idf-codeowners/network
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/tools
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities
-/components/pthread/                  @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/tcpip_adapter/            @esp-idf-codeowners/network
-/components/tinyusb/                  @esp-idf-codeowners/peripherals/usb
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/wifi/               @esp-idf-codeowners/wifi
-
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/make/    @esp-idf-codeowners/build-config
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/*_apps.py              @esp-idf-codeowners/ci
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/find_build_apps/       @esp-idf-codeowners/ci
-/tools/idf_size_yaml/         @esp-idf-codeowners/peripherals
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-requirements.txt              @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-# ignore lists
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/tools
-/tools/ci/check_copyright_permanent_ignore.txt          @esp-idf-codeowners/all-maintainers
-/tools/ci/check_examples_cmake_make-cmake_ignore.txt    @esp-idf-codeowners/tools
-/tools/ci/check_examples_cmake_make-make_ignore.txt     @esp-idf-codeowners/tools
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@ -48,7 +48,7 @@
 - `example_test[_esp32/esp32s2/...]`
 - `fuzzer_test`
 - `host_test`
- `integration_test`
+- `integration_test[_wifi/ble]`
 - `iperf_stress_test`
 - `macos`
 - `macos_test`
--- a/.gitlab/ci/assign-test.yml
+++ b/.gitlab/ci/assign-test.yml
@ -1,54 +1,137 @@
-assign_test:
-  extends: .rules:test:any_test
-  tags:
-    - assign_test
+.assign_test_template:
  image: $CI_DOCKER_REGISTRY/ubuntu-test-env$BOT_DOCKER_IMAGE_TAG
  stage: assign_test
-  # gitlab ci do not support match job with RegEx or wildcard now in dependencies.
-  # we have a lot build example jobs. now we don't use dependencies, just download all artifacts of build stage.
-  dependencies: # Here is not a hard dependency relationship, could be skipped. so we do not use "needs" here.
-    - build_ssc_esp32
-    - build_esp_idf_tests_cmake_esp32
-    - build_esp_idf_tests_cmake_esp32s2
-    - build_esp_idf_tests_cmake_esp32s3
-    - build_esp_idf_tests_cmake_esp32c3
+  tags:
+    - assign_test
  variables:
-    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
-    EXAMPLE_TEST_DIR: "${CI_PROJECT_DIR}/examples"
-    CUSTOM_TEST_DIR: "${CI_PROJECT_DIR}/tools/test_apps"
-    UNIT_TEST_DIR: "${CI_PROJECT_DIR}/components/idf_test/unit_test"
+    SUBMODULES_TO_FETCH: components/esptool_py/esptool
+  artifacts:
+    paths:
+      - ${TEST_DIR}/test_configs
+      - ${BUILD_DIR}/artifact_index.json
+    when: always
+    expire_in: 1 week
+  script:
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_example_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:example_test
+  needs:
+    - job: build_examples_cmake_esp32
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: example_test
+    TEST_DIR: ${CI_PROJECT_DIR}/examples
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_examples
+
+assign_custom_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:custom_test
+  needs:
+    - job: build_test_apps_esp32
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: custom_test
+    TEST_DIR: ${CI_PROJECT_DIR}/tools/test_apps
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_test_apps
+
+assign_component_ut:
+  extends:
+    - .assign_test_template
+    - .rules:build:component_ut
+  needs:
+    - job: build_component_ut_esp32
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: component_ut
+    TEST_DIR: ${CI_PROJECT_DIR}/component_ut
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_component_ut
+  script:
    # COMPONENT_UT_DIRS is set by `set_component_ut_vars` in `utils.sh`
-    COMPONENT_UT_OUTPUT_DIR: "${CI_PROJECT_DIR}/component_ut"
-    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    - set_component_ut_vars
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $COMPONENT_UT_DIRS -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_unit_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:unit_test
+  needs:
+    - job: build_esp_idf_tests_cmake_esp32
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32s2
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32c3
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32s3
+      optional: true
+  variables:
+    TEST_TYPE: unit_test
+    TEST_DIR: ${CI_PROJECT_DIR}/components/idf_test/unit_test
+    BUILD_DIR: ${CI_PROJECT_DIR}/tools/unit-test-app/builds
+  script:
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_integration_test:
+  extends:
+    - .assign_test_template
+    - .rules:test:integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  needs:
+    - build_ssc_esp32
+    - build_ssc_esp32c3
+  artifacts:
+    paths:
+      - $TEST_DIR/test_configs
+  variables:
+    TEST_DIR: ${CI_PROJECT_DIR}/tools/ci/integration_test
+    BUILD_DIR: ${CI_PROJECT_DIR}/SSC/ssc_bin
    INTEGRATION_TEST_CASE_PATH: "${CI_PROJECT_DIR}/auto_test_script/TestCaseFiles"
    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
-  artifacts:
-    paths:
-      - components/idf_test/*/CIConfigs
-      - $EXAMPLE_TEST_DIR/test_configs
-      - $CUSTOM_TEST_DIR/test_configs
-      - $COMPONENT_UT_OUTPUT_DIR/test_configs
-      - build_examples/artifact_index.json
-      - build_test_apps/artifact_index.json
-      - build_component_ut/artifact_index.json
-      - tools/unit-test-app/builds/artifact_index.json
-    expire_in: 1 week
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
-    - set_component_ut_vars
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py example_test $EXAMPLE_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py custom_test $CUSTOM_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $CUSTOM_TEST_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py component_ut $COMPONENT_UT_DIRS -c $CI_TARGET_TEST_CONFIG_FILE -o $COMPONENT_UT_OUTPUT_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py unit_test $UNIT_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $UNIT_TEST_DIR/CIConfigs
+    - add_gitlab_ssh_keys
    # clone test script to assign tests
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
    # assign integration test cases
-    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b ${BUILD_DIR} -o $TEST_DIR/test_configs

 update_test_cases:
  extends: .rules:ref:master-schedule
@ -70,10 +153,10 @@ update_test_cases:
    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
    UNIT_TEST_DIR: "${CI_PROJECT_DIR}/components/idf_test/unit_test"
    BOT_ACCOUNT_CONFIG_FILE: "${CI_PROJECT_DIR}/test-management/Config/Account.local.yml"
-    AUTO_TEST_SCRIPT_PATH: "${CI_PROJECT_DIR}/auto_test_script"
+    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
    PYTHON_VER: 3.7.7
  script:
-    - export GIT_SHA=$(echo ${CI_COMMIT_SHA} | cut -c 1-8)
+    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
    - retry_failed git clone $TEST_MANAGEMENT_REPO
    - python $CHECKOUT_REF_SCRIPT test-management test-management
    - cd test-management
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@ -5,6 +5,11 @@
    - build
  variables:
    SIZE_INFO_LOCATION: "$CI_PROJECT_DIR/size_info.txt"
+    # Enable ccache for all build jobs. See configure_ci_environment.sh for more ccache related settings.
+    IDF_CCACHE_ENABLE: "1"
+  after_script:
+    # Show ccache statistics if enabled globally
+    - test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats || true
  dependencies: []

 .build_template_app_template:
@ -34,10 +39,6 @@
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}
    # Only do the default cmake build for each target, remaining part are done in the build_template_app job
    - tools/ci/build_template_app.sh ${BUILD_COMMAND_ARGS}
-    # Check if there are any stray printf/ets_printf references in WiFi libs
-    - cd components/esp_wifi/lib
-    - for dir in esp32 esp32s2; do test $(xtensa-esp32-elf-nm $dir/*.a | grep -w printf | wc -l) -eq 0; done;
-    - for dir in esp32 esp32s2; do test $(xtensa-esp32-elf-nm $dir/*.a | grep -w ets_printf | wc -l) -eq 0; done;

 # build-related-pre-check-jobs ------------------------------------------------
 # Build at least one project for each target at earliest stage to reduce build cost for obvious failing commits
@ -82,6 +83,12 @@ build_ssc_esp32c3:
  variables:
    TARGET_NAME: "ESP32C3"

+build_ssc_esp32s3:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32S3"
+
 .build_esp_idf_tests_cmake_template:
  extends: .build_template
  dependencies:  # set dependencies to null to avoid missing artifacts issue
@ -361,8 +368,9 @@ build_docker:
  script:
    - export LOCAL_CI_REPOSITORY_URL=$CI_REPOSITORY_URL
    - if [ -n "$LOCAL_GITLAB_HTTPS_HOST" ]; then export LOCAL_CI_REPOSITORY_URL="https://gitlab-ci-token:${CI_JOB_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"; fi
+    - if [ -n "$LOCAL_GIT_MIRROR" ]; then export LOCAL_CI_REPOSITORY_URL="${LOCAL_GIT_MIRROR}/${CI_PROJECT_PATH}"; fi
    - echo "Using repository at $LOCAL_CI_REPOSITORY_URL"
-    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$PIPELINE_COMMIT_SHA}"
    # Build
    - docker build --tag ${DOCKER_TMP_IMAGE_NAME} ${DOCKER_BUILD_ARGS} tools/docker/
    # We can't mount $PWD/examples/get-started/blink into the container, see https://gitlab.com/gitlab-org/gitlab-ce/issues/41227.
@ -370,31 +378,6 @@ build_docker:
    # Therefore, build a copy of the example located inside the container.
    - docker run --rm --workdir /opt/esp/idf/examples/get-started/blink ${DOCKER_TMP_IMAGE_NAME} idf.py build

-.test-on-windows:
-  extends:
-    - .before_script_minimal
-    - .rules:build:windows
-  stage: host_test
-  needs: []
-  image: $CI_DOCKER_REGISTRY/esp32-toolchain-win-cross
-  tags:
-    - build
-  script:
-    - cd $TEST_DIR
-    - mkdir build
-    - cd build
-    - cmake -DCMAKE_TOOLCHAIN_FILE=../toolchain-i686-w64-mingw32.cmake -DCMAKE_BUILD_TYPE=Release ..
-    - cmake --build .
-
-build_idf_exe:
-  extends: .test-on-windows
-  artifacts:
-    paths:
-      - tools/windows/idf_exe/build/idf-exe-v*.zip
-    expire_in: 4 days
-  variables:
-    TEST_DIR: tools/windows/idf_exe
-
 # This job builds template app with permutations of targets and optimization levels
 build_template_app:
  extends:
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@ -61,6 +61,9 @@
  patterns:
    - build_components
    - build_system
+  included_in:
+    - "build:{0}"
+    - build:target_test

 build:integration_test:
  labels:
@ -68,19 +71,8 @@ build:integration_test:
  patterns:
    - build_components
    - build_system
-
-# -------------
-# Special Cases
-# -------------
-"build:example_test-esp32c3":  # esp32c3 test is only run by label, but build jobs should always be triggered
-  labels:
-    - build
-    - example_test
-  patterns:
-    - build_components
-    - build_system
-    - build-example_test
-    - example_test
+  included_in:
+    - build:target_test

 ####################
 # Target Test Jobs #
@ -92,14 +84,14 @@ build:integration_test:
  labels: # For each rule, use labels <test_type> and <test_type>-<target>
    - "{0}"
    - "{0}_{1}"
+    - target_test
  patterns: # For each rule, use patterns <test_type> and build-<test_type>
    - "{0}"
    - "build-{0}"
  included_in: # Parent rules
+    - "build:{0}"
    - "build:{0}-{1}"
    - build:target_test
-    - test:target_test
-    - test:any_test

 # -------------
 # Special Cases
@ -112,42 +104,36 @@ build:integration_test:
    - "component_ut_{0}"
    - unit_test
    - "unit_test_{0}"
+    - target_test
  patterns:
    - component_ut
    - "build-component_ut-{0}"
  included_in:
+    - build:component_ut
    - "build:component_ut-{0}"
    - build:target_test
-    - test:target_test
-    - test:any_test

-"test:example_test-esp32c3":  # For esp32c3 we trigger only with label
-
-"labels:example_test-esp32c3":
+"test:integration_test_{0}":
+  matrix:
+    - - wifi
+      - ble
  labels:
-    - example_test_esp32c3
-  included_in:
-    - build:example_test-esp32c3
-    - build:target_test
-
-"test:integration_test":
-  labels:
-    - "integration_test"
+    - integration_test_{0}
+    - integration_test
+    - target_test
  patterns:
-    - "integration_test"
+    - integration_test_{0}
+    # - maybe others
  included_in:
-    - "build:integration_test"
+    - test:integration_test
+    - build:integration_test
    - build:target_test
-    - test:target_test
-    - test:any_test

 "test:host_test":
  labels:
    - host_test
  patterns:
    - host_test
-  included_in:
-    - test:any_test

 "test:submodule":
  labels:
@ -162,17 +148,17 @@ build:integration_test:
  labels:
    - iperf_stress_test
  included_in:
+    - build:example_test
    - build:example_test-esp32
    - build:target_test
-    - test:any_test

 "labels:weekend_test": # custom test
  labels:
    - weekend_test
  included_in:
+    - build:custom_test
    - build:custom_test-esp32
    - build:target_test
-    - test:any_test

 "labels:nvs_coverage": # host_test
  labels:
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@ -21,7 +21,7 @@ deploy_test_result:
  extends:
    - .deploy_job_template
    - .before_script_minimal
-    - .rules:ref:master-schedule-always
+    - .rules:ref:master-always
  image: $CI_DOCKER_REGISTRY/bot-env
  tags:
    - deploy_test
@ -39,8 +39,8 @@ deploy_test_result:
    AUTO_TEST_SCRIPT_PATH: "${CI_PROJECT_DIR}/auto_test_script"
  script:
    - add_gitlab_ssh_keys
-    - export GIT_SHA=$(echo ${CI_COMMIT_SHA} | cut -c 1-8)
-    - export REV_COUNT=$(git rev-list --count HEAD)
+    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
+    - export REV_COUNT=$(git rev-list --count ${PIPELINE_COMMIT_SHA} --)
    - export SUMMARY="IDF CI test result for $GIT_SHA (r${REV_COUNT})"
    # artifacts of job update_test_cases creates test-management folder
    # we need to remove it so we can clone test-management folder again
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@ -58,13 +58,14 @@ check_docs_lang_sync:
 .build_docs_template:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
-    PYTHON_VER: 3.6.13
+    PYTHON_VER: 3.7.10
  tags:
    - build_docs
  dependencies: []
  script:
-    - cd docs
    - pip install -r requirements.txt
+    - cd docs
+    - pip install -U -r requirements.txt
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
  parallel:
    matrix:
@ -74,13 +75,14 @@ check_docs_lang_sync:
 check_docs_gh_links:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
-    PYTHON_VER: 3.6.13
+    PYTHON_VER: 3.7.10
  extends:
    - .pre_check_job_template
    - .doc-rules:build:docs
  script:
-    - cd docs
    - pip install -r requirements.txt
+    - cd docs
+    - pip install -U -r requirements.txt
    - build-docs gh-linkcheck

 # stage: build_doc
@ -150,20 +152,19 @@ build_docs_pdf:
  extends:
    - .before_script_no_sync_submodule
  image: $ESP_IDF_DOC_ENV_IMAGE
-  variables:
-    PYTHON_VER: 3.6.13
  stage: test_deploy
  tags:
    - deploy
    - shiny
  variables:
+    PYTHON_VER: 3.7.10
    DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
    PYTHONUNBUFFERED: 1
  dependencies: []
  script:
    - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
-    - export GIT_VER=$(git describe --always)
-    - pip install -r docs/requirements.txt
+    - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
+    - pip install -U -r docs/requirements.txt
    - deploy-docs

 # stage: test_deploy
@ -224,7 +225,7 @@ check_doc_links:
    expire_in: 1 week
  allow_failure: true
  script:
-    - cd docs
    - pip install -r requirements.txt
-    # At the moment this check will always fail due to multiple known limitations, ignore result
-    - build-docs -t $DOCTGT -l $DOCLANG linkcheck || { echo "THERE ARE ISSUES DUE TO KNOWN LIMITATIONS, PLEASE FIX THEM. Nowadays we're ignored them to pass pipeline."; true; }
+    - cd docs
+    - pip install -U -r requirements.txt
+    - build-docs -t $DOCTGT -l $DOCLANG linkcheck
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@ -245,7 +245,7 @@ test_espcoredump:
    expire_in: 1 week
  variables:
    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
-    IDF_COREDUMP_ELF_TAG: idf-20210910-00
+    IDF_COREDUMP_ELF_TAG: idf-20210915
    # install CMake version specified in tools.json
    SETUP_TOOLS_LIST: "all"
  script:
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@ -15,6 +15,7 @@
  image: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"

 check_pre_commit_master_release:
@ -22,7 +23,7 @@ check_pre_commit_master_release:
    - .check_pre_commit_template
    - .rules:protected
  script:
-    - git diff-tree --no-commit-id --name-only -r $CI_COMMIT_SHA | xargs pre-commit run --files
+    - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files

 check_pre_commit_MR:
  extends:
@ -83,15 +84,20 @@ test_check_kconfigs:
  script:
    - python ${IDF_PATH}/tools/ci/test_check_kconfigs.py

-check_wifi_lib_md5:
+check_blobs:
  extends: .pre_check_base_template
  tags:
    - build
  variables:
-    SUBMODULES_TO_FETCH: "components/esp_wifi/lib"
+    SUBMODULES_TO_FETCH: "components/esp_wifi/lib;components/esp_phy/lib"
  script:
+    # Check if Wi-Fi library header files match between IDF and the version used when compiling the libraries
    - IDF_TARGET=esp32 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
    - IDF_TARGET=esp32s2 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32s3 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c3 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    # Check if Wi-Fi, PHY, BT blobs contain references to specific symbols
+    - bash $IDF_PATH/tools/ci/check_blobs.sh

 check_fuzzer_compilation:
   extends: .pre_check_base_template
@ -157,10 +163,14 @@ scan_tests:
    TEST_APPS_OUTPUT_DIR: ${CI_PROJECT_DIR}/tools/test_apps/test_configs
    COMPONENT_UT_OUTPUT_DIR: ${CI_PROJECT_DIR}/component_ut/test_configs
    CI_SCAN_TESTS_PY: ${CI_PROJECT_DIR}/tools/ci/python_packages/ttfw_idf/CIScanTests.py
+    EXTRA_TEST_DIRS: >-
+      examples/bluetooth/esp_ble_mesh/ble_mesh_console
+      examples/bluetooth/hci/controller_hci_uart_esp32
+      examples/wifi/iperf
  script:
    - set_component_ut_vars
    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b make --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR
-    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b cmake --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR
+    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b cmake --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR --extra_test_dirs $EXTRA_TEST_DIRS
    - run_cmd python $CI_SCAN_TESTS_PY test_apps $TEST_APPS_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_APPS_OUTPUT_DIR
    - run_cmd python $CI_SCAN_TESTS_PY component_ut $COMPONENT_UT_DIRS --exclude $COMPONENT_UT_EXCLUDES -c $CI_TARGET_TEST_CONFIG_FILE -o $COMPONENT_UT_OUTPUT_DIR

@ -190,6 +200,6 @@ check_commit_msg:
  extends: .pre_check_job_template
  script:
    - git status
-    - git log -n10 --oneline
+    - git log -n10 --oneline ${PIPELINE_COMMIT_SHA}
    # commit start with "WIP: " need to be squashed before merge
-    - 'git log --pretty=%s master.. -- | grep "^WIP: " && exit 1 || exit 0'
+    - 'git log --pretty=%s origin/master..${PIPELINE_COMMIT_SHA} -- | grep -i "^WIP:" && exit 1 || exit 0'
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@ -87,8 +87,19 @@

  - "components/**/test_apps/**/*"

-.patterns-integration_test: &patterns-integration_test
-  - "tools/ci/python_packages/tiny_test_fw/**/*"
+.patterns-integration_test_ble: &patterns-integration_test_ble
+  - "tools/ci/python_packages/gitlab_api.py"
+  - "tools/ci/integration_test/**/*"
+  - "components/bt/controller/lib_esp32"
+  - "components/bt/controller/lib_esp32c3_family"
+  - "components/bt/host/nimble/nimble"
+  - "components/esp_phy/lib"
+
+.patterns-integration_test_wifi: &patterns-integration_test_wifi
+  - "tools/ci/python_packages/gitlab_api.py"
+  - "tools/ci/integration_test/**/*"
+  - "components/esp_wifi/lib"
+  - "components/esp_phy/lib"

 .patterns-host_test: &patterns-host_test
  - ".gitlab/ci/host-test.yml"
@ -221,12 +232,10 @@
    - <<: *if-ref-master
    - <<: *if-schedule

-.rules:ref:master-schedule-always:
+.rules:ref:master-always:
  rules:
    - <<: *if-ref-master
      when: always
-    - <<: *if-schedule
-      when: always

 .rules:patterns:clang_tidy:
  rules:
@ -321,6 +330,12 @@
 .if-label-integration_test: &if-label-integration_test
  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'

+.if-label-integration_test_ble: &if-label-integration_test_ble
+  if: '$BOT_LABEL_INTEGRATION_TEST_BLE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_ble(?:,[^,\n\r]+)*$/i'
+
+.if-label-integration_test_wifi: &if-label-integration_test_wifi
+  if: '$BOT_LABEL_INTEGRATION_TEST_WIFI || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_wifi(?:,[^,\n\r]+)*$/i'
+
 .if-label-iperf_stress_test: &if-label-iperf_stress_test
  if: '$BOT_LABEL_IPERF_STRESS_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*iperf_stress_test(?:,[^,\n\r]+)*$/i'

@ -336,6 +351,9 @@
 .if-label-submodule: &if-label-submodule
  if: '$BOT_LABEL_SUBMODULE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*submodule(?:,[^,\n\r]+)*$/i'

+.if-label-target_test: &if-label-target_test
+  if: '$BOT_LABEL_TARGET_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+
 .if-label-unit_test: &if-label-unit_test
  if: '$BOT_LABEL_UNIT_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test(?:,[^,\n\r]+)*$/i'

@ -366,12 +384,35 @@
    - <<: *if-dev-push
      changes: *patterns-build_system

+.rules:build:component_ut:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32
+    - <<: *if-label-unit_test_esp32c3
+    - <<: *if-label-unit_test_esp32s2
+    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-component_ut
+
 .rules:build:component_ut-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -387,6 +428,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -402,6 +444,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -417,6 +460,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -426,12 +470,31 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:build:custom_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-label-weekend_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-custom_test
+
 .rules:build:custom_test-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-weekend_test
    - <<: *if-dev-push
      changes: *patterns-build_components
@ -446,6 +509,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -459,6 +523,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -472,6 +537,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -487,6 +553,26 @@
    - <<: *if-dev-push
      changes: *patterns-docker

+.rules:build:example_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32
+    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+
 .rules:build:example_test-esp32:
  rules:
    - <<: *if-protected
@ -494,6 +580,7 @@
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32
    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -509,6 +596,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -524,6 +612,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -539,6 +628,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -553,12 +643,17 @@
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
      changes: *patterns-build_system
    - <<: *if-dev-push
-      changes: *patterns-integration_test
+      changes: *patterns-integration_test_ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test_wifi

 .rules:build:macos:
  rules:
@ -589,7 +684,10 @@
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-label-unit_test_esp32c3
@ -609,7 +707,26 @@
    - <<: *if-dev-push
      changes: *patterns-example_test
    - <<: *if-dev-push
-      changes: *patterns-integration_test
+      changes: *patterns-integration_test_ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test_wifi
+    - <<: *if-dev-push
+      changes: *patterns-unit_test
+
+.rules:build:unit_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32
+    - <<: *if-label-unit_test_esp32c3
+    - <<: *if-label-unit_test_esp32s2
+    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
    - <<: *if-dev-push
      changes: *patterns-unit_test

@ -617,6 +734,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -630,6 +748,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -643,6 +762,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -656,6 +776,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -675,12 +796,6 @@
    - <<: *if-dev-push
      changes: *patterns-windows

-.rules:labels:example_test-esp32c3:
-  rules:
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-example_test_esp32c3
-
 .rules:labels:fuzzer_test-weekend_test:
  rules:
    - <<: *if-label-fuzzer_test
@ -698,49 +813,6 @@
  rules:
    - <<: *if-label-weekend_test

-.rules:test:any_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-component_ut
-    - <<: *if-label-component_ut_esp32
-    - <<: *if-label-component_ut_esp32c3
-    - <<: *if-label-component_ut_esp32s2
-    - <<: *if-label-component_ut_esp32s3
-    - <<: *if-label-custom_test
-    - <<: *if-label-custom_test_esp32
-    - <<: *if-label-custom_test_esp32c3
-    - <<: *if-label-custom_test_esp32s2
-    - <<: *if-label-custom_test_esp32s3
-    - <<: *if-label-example_test
-    - <<: *if-label-example_test_esp32
-    - <<: *if-label-example_test_esp32s2
-    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-host_test
-    - <<: *if-label-integration_test
-    - <<: *if-label-iperf_stress_test
-    - <<: *if-label-unit_test
-    - <<: *if-label-unit_test_esp32
-    - <<: *if-label-unit_test_esp32c3
-    - <<: *if-label-unit_test_esp32s2
-    - <<: *if-label-unit_test_esp32s3
-    - <<: *if-label-weekend_test
-    - <<: *if-dev-push
-      changes: *patterns-build-example_test
-    - <<: *if-dev-push
-      changes: *patterns-component_ut
-    - <<: *if-dev-push
-      changes: *patterns-custom_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test
-    - <<: *if-dev-push
-      changes: *patterns-host_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-    - <<: *if-dev-push
-      changes: *patterns-unit_test
-
 .rules:test:component_ut-esp32:
  rules:
    - <<: *if-protected
@ -748,6 +820,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -760,6 +833,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -772,6 +846,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -784,6 +859,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -796,6 +872,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -806,6 +883,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -816,6 +894,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -826,6 +905,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -836,6 +916,20 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+
+.rules:test:example_test-esp32c3:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -848,6 +942,7 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -860,6 +955,7 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -880,8 +976,35 @@
    - <<: *if-label-build-only
      when: never
    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
    - <<: *if-dev-push
-      changes: *patterns-integration_test
+      changes: *patterns-integration_test_ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test_wifi
+
+.rules:test:integration_test_ble:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-integration_test_ble
+
+.rules:test:integration_test_wifi:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-integration_test_wifi

 .rules:test:submodule:
  rules:
@ -892,49 +1015,12 @@
    - <<: *if-dev-push
      changes: *patterns-submodule

-.rules:test:target_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-component_ut
-    - <<: *if-label-component_ut_esp32
-    - <<: *if-label-component_ut_esp32c3
-    - <<: *if-label-component_ut_esp32s2
-    - <<: *if-label-component_ut_esp32s3
-    - <<: *if-label-custom_test
-    - <<: *if-label-custom_test_esp32
-    - <<: *if-label-custom_test_esp32c3
-    - <<: *if-label-custom_test_esp32s2
-    - <<: *if-label-custom_test_esp32s3
-    - <<: *if-label-example_test
-    - <<: *if-label-example_test_esp32
-    - <<: *if-label-example_test_esp32s2
-    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
-    - <<: *if-label-unit_test
-    - <<: *if-label-unit_test_esp32
-    - <<: *if-label-unit_test_esp32c3
-    - <<: *if-label-unit_test_esp32s2
-    - <<: *if-label-unit_test_esp32s3
-    - <<: *if-dev-push
-      changes: *patterns-build-example_test
-    - <<: *if-dev-push
-      changes: *patterns-component_ut
-    - <<: *if-dev-push
-      changes: *patterns-custom_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-    - <<: *if-dev-push
-      changes: *patterns-unit_test
-
 .rules:test:unit_test-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -945,6 +1031,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -955,6 +1042,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -965,6 +1053,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@ -65,6 +65,7 @@ check_pylint:
    name: $SONARQUBE_SCANNER_IMAGE
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
    - fetch_submodules
    # Exclude the submodules, all paths ends with /**
@ -123,7 +124,7 @@ code_quality_report:
      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA
+      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
      -Dsonar.host.url=$SONAR_HOST_URL
      -Dsonar.login=$SONAR_LOGIN
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@ -7,13 +7,13 @@

 .target_test_job_template:
  stage: target_test
-  needs:
-    - assign_test
  artifacts:
    when: always
    paths:
      - "**/*.log"
      - $LOG_PATH
+    exclude:
+      - .git/**/*
    expire_in: 1 week
    reports:
      junit: $LOG_PATH/*/XUNIT_RESULT.xml
@ -38,6 +38,8 @@

 .example_test_template:
  extends: .target_test_job_template
+  needs:
+    - assign_example_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"
@ -55,7 +57,7 @@ test_weekend_mqtt:
    - .rules:labels:weekend_test
  tags:
    - ESP32
-    - Example_WIFI
+    - Example_EthKitV1
  script:
    - export MQTT_PUBLISH_TEST=1
    - export TEST_PATH=$CI_PROJECT_DIR/tools/test_apps/protocols/mqtt/publish_connect_test
@ -75,7 +77,7 @@ test_weekend_mqtt:
 .example_test_esp32c3_template:
  extends:
    - .example_test_template
-    - .rules:labels:example_test-esp32c3
+    - .rules:test:example_test-esp32c3

 .example_test_esp32s3_template:
  extends:
@ -115,10 +117,9 @@ example_test_001D:

 example_test_OTA:
  extends: .example_test_esp32_template
-  parallel: 2
  tags:
    - ESP32
-    - Example_WIFI_OTA
+    - EXAMPLE_ETH_OTA

 example_test_protocols:
  extends: .example_test_esp32_template
@ -127,6 +128,13 @@ example_test_protocols:
    - ESP32
    - Example_WIFI_Protocols

+# This job is only triggered by env var `NIGHTLY_RUN`, please do NOT remove
+example_test_esp32_WIFI_OTA:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - Example_WIFI_OTA
+
 example_test_002:
  extends: .example_test_esp32_template
  image: $CI_DOCKER_REGISTRY/ubuntu-test-env$BOT_DOCKER_IMAGE_TAG
@ -295,6 +303,8 @@ example_test_ESP32C3_SDSPI:

 .test_app_template:
  extends: .target_test_job_template
+  needs:
+    - assign_custom_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/test_apps"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/test_apps/test_configs"
@ -333,6 +343,12 @@ test_app_test_002:
    - ESP32
    - Example_WIFI

+test_app_test_eth:
+  extends: .test_app_esp32_template
+  tags:
+    - ESP32
+    - Example_EthKitV1
+
 test_app_test_003:
  extends: .test_app_esp32_template
  tags:
@ -379,8 +395,22 @@ test_app_test_flash_psram_f8r8:
    - ESP32S3
    - MSPI_F8R8

+test_app_test_xip_psram_esp32s2:
+  extends: .test_app_esp32s2_template
+  tags:
+    - ESP32S2
+    - Example_GENERIC
+
+test_app_test_xip_psram_esp32s3:
+  extends: .test_app_esp32s3_template
+  tags:
+    - ESP32S3
+    - MSPI_F4R8
+
 .component_ut_template:
  extends: .target_test_job_template
+  needs: # the assign already needs all the build jobs
+    - assign_component_ut
  variables:
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/component_ut/test_configs"
  script:
@ -443,9 +473,11 @@ component_ut_test_esp32c3:

 .unit_test_template:
  extends: .target_test_job_template
+  needs: # the assign already needs all the build jobs
+    - assign_unit_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/unit-test-app"
-    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/unit_test/CIConfigs"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/unit_test/test_configs"

 .unit_test_esp32_template:
  extends:
@ -513,7 +545,7 @@ UT_006:

 UT_007:
  extends: .unit_test_esp32_template
-  parallel: 4
+  parallel: 8
  tags:
    - ESP32_IDF
    - UT_T1_1
@ -664,7 +696,7 @@ UT_046:

 UT_047:
  extends: .unit_test_esp32s2_template
-  parallel: 5
+  parallel: 7
  tags:
    - ESP32S2_IDF
    - UT_T1_1
@ -683,7 +715,7 @@ UT_S2_SDSPI:

 UT_C3:
  extends: .unit_test_esp32c3_template
-  parallel: 33
+  parallel: 35
  tags:
    - ESP32C3_IDF
    - UT_T1_1
@ -727,7 +759,7 @@ UT_C3_SDSPI:

 UT_S3:
  extends: .unit_test_esp32s3_template
-  parallel: 31
+  parallel: 33
  tags:
    - ESP32S3_IDF
    - UT_T1_1
@ -761,38 +793,50 @@ component_ut_test_lan8720:
  extends:
    - .target_test_job_template
    - .rules:test:integration_test
-  needs:
-    - assign_test
-    - build_ssc_esp32
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  needs: # the assign already needs all the build jobs
+    - assign_integration_test
  variables:
    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
    LOG_PATH: "${CI_PROJECT_DIR}/TEST_LOGS"
    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
-    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
-    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/ci/integration_test/test_configs"
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/tools/ci/integration_test/KnownIssues"
    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
-    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
+    PREPARE_TEST_BIN_SCRIPT: "${CI_PROJECT_DIR}/tools/ci/integration_test/prepare_test_bins.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${CI_PROJECT_DIR}/tools/ci/python_packages:${PYTHONPATH}"
+    INITIAL_CONDITION_RETRY_COUNT: "1"
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
+    - add_gitlab_ssh_keys
    # clone local test env configs
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # Merge known issues
    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

+.integration_test_esp32c3_template:
+  extends:
+    - .integration_test_template
+  variables:
+    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32C3_IDF"
+
 nvs_compatible_test:
-  extends: .integration_test_template
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  artifacts:
    when: always
    paths:
@ -806,144 +850,213 @@ nvs_compatible_test:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
+    - add_gitlab_ssh_keys
    # clone local test env configs
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    # prepare nvs bins
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # prepare nvs bins
    - ./tools/prepare_nvs_bin.sh
    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

-IT_001:
-  extends: .integration_test_template
-  parallel: 3
-  tags:
-    - ESP32_IDF
-    - SSC_T1_4
-
-IT_002:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_2
-
-IT_003:
-  extends: .integration_test_template
-  parallel: 14
-  tags:
-    - ESP32_IDF
-    - SSC_T2_5
-
-IT_004:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_APC
-
-IT_005:
-  extends: .integration_test_template
+IT_T1_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  parallel: 2
  tags:
    - ESP32_IDF
-    - SSC_T1_5
+    - SSC_T1_Simple

-IT_006:
-  extends: .integration_test_template
-  parallel: 12
+IT_T1_WAP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
-    - SSC_T1_6
+    - SSC_T1_WAP

-IT_007:
-  extends: .integration_test_template
+IT_T2_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 9
+  tags:
+    - ESP32_IDF
+    - SSC_T2_Simple
+
+IT_T5_BT_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
  parallel: 3
  tags:
    - ESP32_IDF
-    - SSC_T1_7
+    - SSC_T5_BT_Simple

-IT_008:
-  extends: .integration_test_template
+IT_T2_BT_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
+  parallel: 6
  tags:
    - ESP32_IDF
-    - SSC_T1_8
+    - SSC_T2_BT_Simple

-IT_009:
-  extends: .integration_test_template
+IT_T1_BT_Dongle:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
+  parallel: 2
  tags:
    - ESP32_IDF
-    - SSC_T1_3
+    - SSC_T1_BT_Dongle

-IT_011:
-  extends: .integration_test_template
+IT_T1_AP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_AP
+
+IT_T1_AP_E:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 5
+  tags:
+    - ESP32_IDF
+    - SSC_T1_AP_E
+
+IT_T1_WNIC_AP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_WNIC_AP
+
+IT_T1_WNIC_AP_E:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_WNIC_AP_E
+
+IT_T1_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
    - SSC_T1_MESH1

-IT_012:
-  extends: .integration_test_template
+IT_T2_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  parallel: 2
  tags:
    - ESP32_IDF
    - SSC_T2_MESH1

-IT_013:
-  extends: .integration_test_template
+IT_T3_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
    - SSC_T3_MESH1

-IT_014:
-  extends: .integration_test_template
+IT_T6_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
    - SSC_T6_MESH1

-IT_015:
-  extends: .integration_test_template
+IT_T12_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
    - SSC_T12_MESH1

-IT_016:
-  extends: .integration_test_template
+IT_T50_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  allow_failure: true
  tags:
    - ESP32_IDF
    - SSC_T50_MESH1

-IT_017:
-  extends: .integration_test_template
+IT_T1_MESH2:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
    - SSC_T1_MESH2

-IT_018:
-  extends: .integration_test_template
+IT_T2_WNIC:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
  tags:
    - ESP32_IDF
-    - SSC_T1_9
+    - SSC_T2_WNIC

-IT_019:
-  extends: .integration_test_template
+IT_T2_AP:
+  extends:
+   - .integration_test_template
+   - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T2_AP
+
+IT_T3_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T3_Simple
+
+IT_C3_T2_BT_Simple:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  parallel: 9
+  tags:
+    - ESP32C3_IDF
+    - SSC_T2_BT_Simple
+
+IT_C3_T5_BT_Simple:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  parallel: 5
+  tags:
+    - ESP32C3_IDF
+    - SSC_T5_BT_Simple
+
+IT_C3_T1_BT_Dongle:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  image: gitlab.espressif.cn:5050/qa/dockerfiles/integration-test-env-dbg:1
  parallel: 2
  tags:
-    - ESP32_IDF
-    - SSC_T2_2
-
-IT_020:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_3
-
-IT_021:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T2_4
+    - ESP32C3_IDF
+    - SSC_T1_BT_Dongle
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -12,12 +12,16 @@ repos:
        # 2 - any file matching *test*/*expected* (for host tests, if possible use this naming pattern always)
        # 3 - any directory named 'testdata'
        # 4 - IDF monitor test data
+        # 5 - protobuf auto-generated files
        exclude: &whitespace_excludes |
          (?x)^(
            .+\.(md|rst|map|bin)|
            .+test.*\/.*expected.*|
            .+\/testdata\/.+|
-            .+test_idf_monitor\/tests\/.+
+            .+test_idf_monitor\/tests\/.+|
+            .*_pb2.py|
+            .*.pb-c.h|
+            .*.pb-c.c
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@ -25,16 +29,21 @@ repos:
      - id: mixed-line-ending
        args: ['-f=lf']
      - id: double-quote-string-fixer
-  - repo: https://gitlab.com/pycqa/flake8
+  - repo: https://github.com/PyCQA/flake8
    rev: 3.9.2
    hooks:
      - id: flake8
        args: ['--config=.flake8', '--tee', '--benchmark']
  - repo: https://github.com/pycqa/isort
-    rev: 5.9.3
+    rev: 5.11.5  # python 3.7 compatible
    hooks:
      - id: isort
        name: isort (python)
+        exclude: >
+          (?x)^(
+              .*_pb2.py
+          )$
+
  - repo: local
    hooks:
      - id: check-executables
@ -93,21 +102,14 @@ repos:
        name: Check type annotations in python files
        entry: tools/ci/check_type_comments.py
        additional_dependencies:
-          - 'mypy==0.800'
-          - 'mypy-extensions==0.4.3'
+          - 'mypy==1.0.1'
+          - 'mypy-extensions==1.0.0'
+        exclude: >
+          (?x)^(
+              .*_pb2.py
+          )$
        language: python
        types: [python]
-      - id: check-copyright
-        name: Check copyright notices
-        entry: tools/ci/check_copyright.py --verbose --replace
-        additional_dependencies:
-          - 'comment_parser == 1.2.3'
-          - 'thefuzz == 0.19.0'
-          - 'thefuzz[speedup] == 0.19.0; sys_platform != "win32"'
-          # don't depend on python-Levenshtein on Windows, as it requires Microsoft C++ Build Tools to install
-        language: python
-        files: \.(py|c|h|cpp|hpp|ld)$
-        require_serial: true
      - id: check-tools-files-patterns
        name: Check tools dir files patterns
        entry: tools/ci/check_tools_files_patterns.py
@ -120,4 +122,4 @@ repos:
    rev: v4.0.1
    hooks:
      - id: file-contents-sorter
-        files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt|check_copyright_ignore\.txt|check_copyright_permanent_ignore\.txt)'
+        files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt)'
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -7,11 +7,8 @@ if(CMAKE_CURRENT_LIST_DIR STREQUAL CMAKE_SOURCE_DIR)
    "again.")
 endif()

-unset(compile_options)
-unset(c_compile_options)
-unset(cxx_compile_options)
-unset(compile_definitions)
-unset(link_options)
+# Variables compile_options, c_compile_options, cxx_compile_options, compile_definitions, link_options shall
+# not be unset as they may already contain flags, set by toolchain-TARGET.cmake files.

 # Add the following build specifications here, since these seem to be dependent
 # on config values on the root Kconfig.
@ -119,6 +116,9 @@ if(CMAKE_C_COMPILER_ID MATCHES "Clang")
    # Multiple cases of attributes unknown to clang, for example
    # __attribute__((optimize("-O3")))
    list(APPEND compile_options "-Wno-unknown-attributes")
+    # Disable Clang warnings for atomic operations with access size
+    # more then 4 bytes
+    list(APPEND compile_options "-Wno-atomic-alignment")
    # Clang also produces many -Wunused-function warnings which GCC doesn't.
    # However these aren't treated as errors.
 endif()
@ -181,6 +181,7 @@ endif()
 idf_build_set_property(COMPILE_OPTIONS "${compile_options}" APPEND)
 idf_build_set_property(C_COMPILE_OPTIONS "${c_compile_options}" APPEND)
 idf_build_set_property(CXX_COMPILE_OPTIONS "${cxx_compile_options}" APPEND)
+idf_build_set_property(ASM_COMPILE_OPTIONS "${asm_compile_options}" APPEND)
 idf_build_set_property(COMPILE_DEFINITIONS "${compile_definitions}" APPEND)
 idf_build_set_property(LINK_OPTIONS "${link_options}" APPEND)

--- a/components/app_trace/Kconfig
+++ b/components/app_trace/Kconfig
@ -18,11 +18,13 @@ menu "Application Level Tracing"

    config APPTRACE_DEST_TRAX
        bool
-        depends on IDF_TARGET_ARCH_XTENSA && !ESP32_TRAX && !ESP32S2_TRAX
+        depends on IDF_TARGET_ARCH_XTENSA && !ESP32_TRAX && !ESP32S2_TRAX && !ESP32S3_TRAX
        select ESP32_MEMMAP_TRACEMEM
        select ESP32S2_MEMMAP_TRACEMEM
+        select ESP32S3_MEMMAP_TRACEMEM
        select ESP32_MEMMAP_TRACEMEM_TWOBANKS
        select ESP32S2_MEMMAP_TRACEMEM_TWOBANKS
+        select ESP32S3_MEMMAP_TRACEMEM_TWOBANKS
        default n
        help
            Enables/disable TRAX tracing HW.
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 #include <sys/param.h>
 #include <string.h>
 #include "sdkconfig.h"
@ -93,7 +99,8 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
    if (proto->hw->host_data_pending() && hdr->block_sz > 0) {
        // TODO: add support for multiple blocks from host, currently there is no need for that
        uint8_t *p = proto->blocks[new_block_num].start + proto->blocks[new_block_num].sz;
-        ESP_APPTRACE_LOGD("Recvd %d bytes from host [%x %x %x %x %x %x %x %x .. %x %x %x %x %x %x %x %x]", hdr->block_sz,
+        ESP_APPTRACE_LOGD("Recvd %d bytes from host (@ 0x%x) [%x %x %x %x %x %x %x %x .. %x %x %x %x %x %x %x %x]",
+            hdr->block_sz, proto->blocks[new_block_num].start,
            *(proto->blocks[new_block_num].start+0), *(proto->blocks[new_block_num].start+1),
            *(proto->blocks[new_block_num].start+2), *(proto->blocks[new_block_num].start+3),
            *(proto->blocks[new_block_num].start+4), *(proto->blocks[new_block_num].start+5),
--- a/components/app_trace/app_trace_util.c
+++ b/components/app_trace/app_trace_util.c
@ -60,22 +60,16 @@ esp_err_t esp_apptrace_lock_take(esp_apptrace_lock_t *lock, esp_apptrace_tmo_t *
    int res;

    while (1) {
+        //Todo: Replace the current locking mechanism and int_state with portTRY_ENTER_CRITICAL() instead.
        // do not overwrite lock->int_state before we actually acquired the mux
-        unsigned int_state = portENTER_CRITICAL_NESTED();
-        // FIXME: if mux is busy it is not good idea to loop during the whole tmo with disabled IRQs.
-        // So we check mux state using zero tmo, restore IRQs and let others tasks/IRQs to run on this CPU
-        // while we are doing our own tmo check.
-#ifdef CONFIG_FREERTOS_PORTMUX_DEBUG
-        bool success = vPortCPUAcquireMutexTimeout(&lock->mux, 0, __FUNCTION__, __LINE__);
-#else
+        unsigned int_state = portSET_INTERRUPT_MASK_FROM_ISR();
        bool success = vPortCPUAcquireMutexTimeout(&lock->mux, 0);
-#endif
        if (success) {
            lock->int_state = int_state;
            return ESP_OK;
        }
-        portEXIT_CRITICAL_NESTED(int_state);
-        // we can be preempted from this place till the next call (above) to portENTER_CRITICAL_NESTED()
+        portCLEAR_INTERRUPT_MASK_FROM_ISR(int_state);
+        // we can be preempted from this place till the next call (above) to portSET_INTERRUPT_MASK_FROM_ISR()
        res = esp_apptrace_tmo_check(tmo);
        if (res != ESP_OK) {
            break;
@ -90,12 +84,8 @@ esp_err_t esp_apptrace_lock_give(esp_apptrace_lock_t *lock)
    unsigned int_state = lock->int_state;
    // after call to the following func we can not be sure that lock->int_state
    // is not overwritten by other CPU who has acquired the mux just after we released it. See esp_apptrace_lock_take().
-#ifdef CONFIG_FREERTOS_PORTMUX_DEBUG
-    vPortCPUReleaseMutex(&lock->mux, __FUNCTION__, __LINE__);
-#else
    vPortCPUReleaseMutex(&lock->mux);
-#endif
-    portEXIT_CRITICAL_NESTED(int_state);
+    portCLEAR_INTERRUPT_MASK_FROM_ISR(int_state);
    return ESP_OK;
 }

--- a/components/app_trace/gcov/gcov_rtio.c
+++ b/components/app_trace/gcov/gcov_rtio.c
@ -52,18 +52,11 @@ void gcov_dump_task(void *pvParameter)
    }
    ESP_EARLY_LOGV(TAG, "Config apptrace down buf");
    esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
-    /* we are directing the std outputs to the fake ones in order to reduce stack usage */
-    FILE *old_stderr = stderr;
-    FILE *old_stdout = stdout;
-    stderr = (FILE *) &__sf_fake_stderr;
-    stdout = (FILE *) &__sf_fake_stdout;
    ESP_EARLY_LOGV(TAG, "Dump data...");
    __gcov_dump();
    // reset dump status to allow incremental data accumulation
    __gcov_reset();
    free(down_buf);
-    stderr = old_stderr;
-    stdout = old_stdout;
    ESP_EARLY_LOGV(TAG, "Finish file transfer session");
    dump_result = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
    if (dump_result != ESP_OK) {
--- a/components/app_trace/include/esp_app_trace_util.h
+++ b/components/app_trace/include/esp_app_trace_util.h
@ -68,7 +68,7 @@ typedef struct {
 */
 static inline void esp_apptrace_lock_init(esp_apptrace_lock_t *lock)
 {
-    vPortCPUInitializeMutex(&lock->mux);
+    portMUX_INITIALIZE(&lock->mux);
    lock->int_state = 0;
 }

--- a/components/app_trace/linker.lf
+++ b/components/app_trace/linker.lf
@ -3,6 +3,10 @@ archive: libapp_trace.a
 entries:
    app_trace (noflash)
    app_trace_util (noflash)
+    if APPTRACE_MEMBUFS_APPTRACE_PROTO_ENABLE:
+      app_trace_membufs_proto (noflash)
+    if APPTRACE_DEST_JTAG = y:
+      port (noflash)
    if APPTRACE_SV_ENABLE = y:
      SEGGER_SYSVIEW (noflash)
      SEGGER_RTT_esp (noflash)
--- a/components/app_trace/port/riscv/port.c
+++ b/components/app_trace/port/riscv/port.c
@ -1,6 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "riscv/semihosting.h"

 /** RISCV HW transport data */
 typedef struct {
@ -20,8 +27,6 @@ typedef struct {
    esp_apptrace_mem_block_t *  mem_blocks;
 } esp_apptrace_riscv_ctrl_block_t;

-#define RISCV_APPTRACE_SYSNR    0x64
-
 #define ESP_APPTRACE_RISCV_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_RISCV_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_RISCV_BLOCK_LEN_MSK)
 #define ESP_APPTRACE_RISCV_BLOCK_LEN_GET(_v_)    ((_v_) & ESP_APPTRACE_RISCV_BLOCK_LEN_MSK)
@ -94,25 +99,10 @@ esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
   e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_addr)
 {
-    register int sys_nr = RISCV_APPTRACE_SYSNR;
-    register int host_ret = 0;
-
    if (!esp_cpu_in_ocd_debug_mode()) {
        return 0;
    }
-    __asm__ volatile ( \
-        ".option push\n" \
-        ".option norvc\n" \
-        "mv a0, %[sys_nr]\n" \
-        "mv a1, %[arg1]\n" \
-        "slli    zero,zero,0x1f\n" \
-        "ebreak\n" \
-        "srai    zero,zero,0x7\n" \
-        "mv %[host_ret], a0\n" \
-    	".option pop\n" \
-        :[host_ret]"=r"(host_ret)
-        :[sys_nr]"r"(sys_nr),[arg1]"r"(ctrl_block_addr):"a0","a1");
-    return host_ret;
+    return (int) semihosting_call_noerrno(ESP_SEMIHOSTING_SYS_APPTRACE_INIT, (long*)ctrl_block_addr);
 }

 /* Returns up buffers config.
--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 //
 // How It Works
 // ************
@ -143,9 +149,9 @@
 #include "sdkconfig.h"
 #include "soc/soc.h"
 #include "soc/dport_access.h"
-#if CONFIG_IDF_TARGET_ESP32
 #include "soc/dport_reg.h"
-#elif CONFIG_IDF_TARGET_ESP32S2
+#include "soc/tracemem_config.h"
+#if CONFIG_IDF_TARGET_ESP32S2 || CONFIG_IDF_TARGET_ESP32S3
 #include "soc/sensitive_reg.h"
 #endif
 #include "eri.h"
@ -154,18 +160,6 @@
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"

-// TODO: move these (and same definitions in trax.c to dport_reg.h)
-#if CONFIG_IDF_TARGET_ESP32
-#define TRACEMEM_MUX_PROBLK0_APPBLK1            0
-#define TRACEMEM_MUX_BLK0_ONLY                  1
-#define TRACEMEM_MUX_BLK1_ONLY                  2
-#define TRACEMEM_MUX_PROBLK1_APPBLK0            3
-#elif CONFIG_IDF_TARGET_ESP32S2
-#define TRACEMEM_MUX_BLK0_NUM                   19
-#define TRACEMEM_MUX_BLK1_NUM                   20
-#define TRACEMEM_BLK_NUM2ADDR(_n_)              (0x3FFB8000UL + 0x4000UL*((_n_)-4))
-#endif
-
 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
@ -182,18 +176,6 @@

 #define ESP_APPTRACE_TRAX_INITED(_hw_)          ((_hw_)->inited & (1 << cpu_hal_get_core_id()))

-#if CONFIG_IDF_TARGET_ESP32
-static uint8_t * const s_trax_blocks[] = {
-    (uint8_t *) 0x3FFFC000,
-    (uint8_t *) 0x3FFF8000
-};
-#elif CONFIG_IDF_TARGET_ESP32S2
-static uint8_t * const s_trax_blocks[] = {
-    (uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK0_NUM),
-    (uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK1_NUM)
-};
-#endif
-
 #define ESP_APPTRACE_TRAX_BLOCK_SIZE            (0x4000UL)

 /** TRAX HW transport data */
@ -223,6 +205,12 @@ static bool esp_apptrace_trax_host_data_pending(void);

 const static char *TAG = "esp_apptrace";

+static uint8_t * const s_trax_blocks[] = {
+    (uint8_t *)TRACEMEM_BLK0_ADDR,
+    (uint8_t *)TRACEMEM_BLK1_ADDR
+};
+
+
 esp_apptrace_hw_t *esp_apptrace_uart_hw_get(int num, void **data)
 {
    return NULL;
@ -300,6 +288,14 @@ static inline void esp_apptrace_trax_select_memory_block(int block_num)
    DPORT_WRITE_PERI_REG(DPORT_TRACEMEM_MUX_MODE_REG, block_num ? TRACEMEM_MUX_BLK0_ONLY : TRACEMEM_MUX_BLK1_ONLY);
 #elif CONFIG_IDF_TARGET_ESP32S2
    WRITE_PERI_REG(DPORT_PMS_OCCUPY_3_REG, block_num ? BIT(TRACEMEM_MUX_BLK0_NUM-4) : BIT(TRACEMEM_MUX_BLK1_NUM-4));
+#elif CONFIG_IDF_TARGET_ESP32S3
+    // select memory block to be exposed to the TRAX module (accessed by host)
+    uint32_t block_bits = block_num ? TRACEMEM_CORE0_MUX_BLK_BITS(TRACEMEM_MUX_BLK0_NUM)
+                        : TRACEMEM_CORE0_MUX_BLK_BITS(TRACEMEM_MUX_BLK1_NUM);
+    block_bits |= block_num ? TRACEMEM_CORE1_MUX_BLK_BITS(TRACEMEM_MUX_BLK0_NUM)
+                        : TRACEMEM_CORE1_MUX_BLK_BITS(TRACEMEM_MUX_BLK1_NUM);
+    ESP_EARLY_LOGV(TAG, "Select block %d @ %p (bits 0x%x)", block_num, s_trax_blocks[block_num], block_bits);
+    DPORT_WRITE_PERI_REG(SENSITIVE_INTERNAL_SRAM_USAGE_2_REG, block_bits);
 #endif
 }

--- a/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
@ -73,6 +73,8 @@ Revision: $Rev: 3734 $
 #include "esp32/clk.h"
 #elif CONFIG_IDF_TARGET_ESP32S2
 #include "esp32s2/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/clk.h"
 #elif CONFIG_IDF_TARGET_ESP32C3
 #include "esp32c3/clk.h"
 #endif
@ -142,6 +144,8 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #elif CONFIG_IDF_TARGET_ESP32S2
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S2_DEFAULT_CPU_FREQ_MHZ * 1000000)
+#elif CONFIG_IDF_TARGET_ESP32S3
+#define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S3_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #endif
 #endif // TS_USE_CCOUNT

--- a/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
+++ b/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
@ -76,9 +76,6 @@ Notes:
 *
 **********************************************************************
 */
-#ifndef portSTACK_GROWTH
-  #define portSTACK_GROWTH              ( -1 )
-#endif

 #define SYSVIEW_FREERTOS_MAX_NOF_TASKS  CONFIG_APPTRACE_SV_MAX_TASKS

--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@ -327,9 +327,9 @@ typedef enum {
 /**
 * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
 *
- * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key #N-1, Key #N, Key #N+1).
- * When key #N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key #N-1 & Key #N.
- * After successfully booting the OTA app should call this function to revoke Key #N-1.
+ * Relevant for Secure boot v2 on ESP32-S2, ESP32-S3, ESP32-C3 where upto 3 key digests can be stored (Key \#N-1, Key \#N, Key \#N+1).
+ * When key \#N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key \#N-1 & Key \#N.
+ * After successfully booting the OTA app should call this function to revoke Key \#N-1.
 *
 * @param index - The index of the signature block to be revoked
 *
--- a/components/app_update/test/test_switch_ota.c
+++ b/components/app_update/test/test_switch_ota.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -824,3 +824,25 @@ static void test_flow6(void)
 // 2 Stage: run factory -> check it -> copy factory to OTA0             -> reboot  --//--
 // 3 Stage: run OTA0    -> check it -> erase OTA_DATA for next tests    -> PASS
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
+
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    const esp_partition_t *other_app = get_next_update_partition();
+    copy_current_app_to_next_part(cur_app, other_app);
+    erase_ota_data();
+
+    uint8_t sha_256_cur_app[32];
+    uint8_t sha_256_other_app[32];
+    TEST_ESP_OK(bootloader_common_get_sha256_of_partition(cur_app->address, cur_app->size, cur_app->type, sha_256_cur_app));
+    TEST_ESP_OK(bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
+
+    TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
+
+    uint32_t data = 0;
+    bootloader_flash_write(other_app->address + 0x50, &data, sizeof(data), false);
+
+    TEST_ESP_ERR(ESP_ERR_IMAGE_INVALID, bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
+    TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
+}
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@ -193,6 +193,14 @@ menu "Bootloader config"
            The GPIO must be held low continuously for this period of time after reset
            before a factory reset or test partition boot (as applicable) is performed.

+    config BOOTLOADER_REGION_PROTECTION_ENABLE
+        bool "Enable protection for unmapped memory regions"
+        default y
+        help
+            Protects the unmapped memory regions of the entire address space from unintended accesses.
+            This will ensure that an exception will be triggered whenever the CPU performs a memory
+            operation on unmapped regions of the address space.
+
    config BOOTLOADER_WDT_ENABLE
        bool "Use RTC watchdog in start code"
        default y
@ -377,7 +385,6 @@ menu "Bootloader config"

    config BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE
        hex "Size in bytes for custom purposes"
-        range 0 0x10
        default 0
        depends on BOOTLOADER_CUSTOM_RESERVE_RTC
        help
@ -421,17 +428,22 @@ menu "Security features"
        select MBEDTLS_ECDSA_C
        depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE

+    config SECURE_ESP32_SUPPORTS_RSA
+        bool
+        default y if ESP32_REV_MIN_FULL >= 300
+        depends on IDF_TARGET_ESP32
+
    config SECURE_BOOT_SUPPORTS_RSA
        bool
        default y
-        depends on ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3
+        # RSA secure boot is supported in ESP32 revision >= v3.0
+        depends on SECURE_ESP32_SUPPORTS_RSA || IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3 # NOERROR

    config SECURE_TARGET_HAS_SECURE_ROM_DL_MODE
        bool
        default y
        depends on IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3

-
    config SECURE_SIGNED_APPS_NO_SECURE_BOOT
        bool "Require signed app images"
        depends on !SECURE_BOOT
@ -501,7 +513,8 @@ menu "Security features"
    config SECURE_BOOT
        bool "Enable hardware Secure Boot in bootloader (READ DOCS FIRST)"
        default n
-        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || ESP32C3_REV_MIN_3 || IDF_TARGET_ESP32S3
+        # Secure boot is not supported for ESP32-C3 revision < v0.3
+        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || (IDF_TARGET_ESP32C3 && ESP32C3_REV_MIN_FULL >= 3) || IDF_TARGET_ESP32S3 # NOERROR
        select ESPTOOLPY_NO_STUB if !IDF_TARGET_ESP32 && !IDF_TARGET_ESP32S2
        help
            Build a bootloader which enables Secure Boot on first boot.
@ -514,7 +527,7 @@ menu "Security features"

    choice SECURE_BOOT_VERSION
        bool "Select secure boot version"
-        default SECURE_BOOT_V2_ENABLED if ESP32_REV_MIN_3
+        default SECURE_BOOT_V2_ENABLED if ESP32_REV_MIN_FULL >= 300
        depends on SECURE_BOOT
        help
            Select the Secure Boot Version. Depends on the Chip Revision.
@ -614,6 +627,22 @@ menu "Security features"

            Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.

+    config SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+        bool "Enable Aggressive key revoke strategy"
+        depends on SECURE_BOOT && (IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3)
+        default N
+        help
+            If this option is set, ROM bootloader will revoke the public key digest burned in efuse block
+            if it fails to verify the signature of software bootloader with it.
+            Revocation of keys does not happen when enabling secure boot. Once secure boot is enabled,
+            key revocation checks will be done on subsequent boot-up, while verifying the software bootloader
+
+            This feature provides a strong resistance against physical attacks on the device.
+
+            NOTE: Once a digest slot is revoked, it can never be used again to verify an image
+            This can lead to permanent bricking of the device, in case all keys are revoked
+            because of signature verification failure.
+
    choice SECURE_BOOTLOADER_KEY_ENCODING
        bool "Hardware Key Encoding"
        depends on SECURE_BOOTLOADER_REFLASHABLE
@ -851,7 +880,7 @@ menu "Security features"
        default SECURE_ENABLE_SECURE_ROM_DL_MODE if SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT # NOERROR
        default SECURE_INSECURE_ALLOW_DL_MODE
        depends on SECURE_BOOT_V2_ENABLED || SECURE_FLASH_ENC_ENABLED
-        depends on !IDF_TARGET_ESP32 || ESP32_REV_MIN_3
+        depends on !(IDF_TARGET_ESP32 && ESP32_REV_MIN_FULL < 300)

        config SECURE_DISABLE_ROM_DL_MODE
            bool "UART ROM download mode (Permanently disabled (recommended))"
@ -877,9 +906,9 @@ menu "Security features"
                Download Mode into a separate Secure Download mode. This option can only work if
                Download Mode is not already disabled by eFuse.

-                Secure Download mode limits the use of Download Mode functions to simple flash read,
-                write and erase operations, plus a command to return a summary of currently enabled
-                security features.
+                Secure Download mode limits the use of Download Mode functions to update SPI config,
+                changing baud rate, basic flash write and a command to return a summary of currently
+                enabled security features (`get_security_info`).

                Secure Download mode is not compatible with the esptool.py flasher stub feature,
                espefuse.py, read/writing memory or registers, encrypted download, or any other
--- a/components/bootloader/subproject/main/component.mk
+++ b/components/bootloader/subproject/main/component.mk
@ -17,7 +17,7 @@ ifdef CONFIG_IDF_TARGET_ESP32
    ifndef CONFIG_SPI_FLASH_ROM_DRIVER_PATCH
        LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.spiflash.ld
    endif
-    ifdef CONFIG_ESP32_REV_MIN_3
+    ifeq ($(shell expr $(CONFIG_ESP32_REV_MIN_FULL) \>= 300), 1)
        LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.eco3.ld
    endif
 endif
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.ld
@ -44,7 +44,7 @@ SECTIONS
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
    *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@ -60,6 +60,7 @@ SECTIONS
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libefuse.a:*.*(.literal .text .literal.* .text.*)
@ -111,8 +112,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -125,6 +124,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -183,4 +183,23 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }
--- a/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
@ -1,16 +1,50 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-C3 ROM static data usage is as follows:
+ *  - 0x3fccae00 - 0x3fcdc710: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdc710 - 0x3fcde710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcde710 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fcdc710).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fcdc710 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdc710;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

+/* The app may use RAM for static allocations up to the start of iram_loader_seg.
+ * If you have changed something above and this assert fails:
+ * 1. Check what the new value of bootloader_iram_loader_seg start is.
+ * 2. Update the value in this assert.
+ * 3. Update (SRAM_DRAM_END + I_D_SRAM_OFFSET) in components/esp_system/ld/esp32c3/memory.ld.in to the same value.
+ */
+ASSERT(bootloader_iram_loader_seg_start == 0x403ce710, "bootloader_iram_loader_seg_start inconsistent with SRAM_DRAM_END");
+
 /* Default entry point: */
 ENTRY(call_start_cpu0);

@ -31,7 +65,7 @@ SECTIONS
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    *libbootloader_support.a:bootloader_efuse_esp32c3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@ -47,6 +81,7 @@ SECTIONS
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@ -99,8 +134,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -113,6 +146,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.* .srodata .srodata.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -177,17 +211,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_AE00
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_C710
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_E710
+ * 0x3fccae00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdc710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcde710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdf060 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdf664 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdf830 ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
@ -1,14 +1,40 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-H2 ROM static data usage is as follows:
+ *  - 0x3fccb900 - 0x3fcdd210: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdd210 - 0x3fcdf210: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdf210 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdd120;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@ -31,7 +57,7 @@ SECTIONS
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    *libbootloader_support.a:bootloader_efuse_esp32h2.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@ -45,6 +71,7 @@ SECTIONS
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@ -97,8 +124,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -111,6 +136,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.* .srodata .srodata.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -174,17 +200,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_B900
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_D210
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_F210
+ * 0x3fccb81c ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdd120 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdf120 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdfa6c ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfe40 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfe4c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
@ -31,7 +31,7 @@ SECTIONS
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
    *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@ -47,6 +47,7 @@ SECTIONS
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@ -99,8 +100,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -113,6 +112,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -171,4 +171,23 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
@ -1,16 +1,51 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-S3 ROM static data usage is as follows:
+ *  - 0x3fcd7e00 - 0x3fce9704: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fce9710 - 0x3fceb710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fceb710 - 0x3fced710: APP CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fced710 - 0x3fcf0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x6f0000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fce9700;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x4000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x3000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403B6000, len = 0x4000
-  iram_loader_seg (RWX) :           org = 0x403BA000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD0000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

+/* The app may use RAM for static allocations up to the start of iram_loader_seg.
+ * If you have changed something above and this assert fails:
+ * 1. Check what the new value of bootloader_iram_loader_seg start is.
+ * 2. Update the value in this assert.
+ * 3. Update SRAM_IRAM_END in components/esp_system/ld/esp32s3/memory.ld.in to the same value.
+ */
+ASSERT(bootloader_iram_loader_seg_start == 0x403cc700, "bootloader_iram_loader_seg_start inconsistent with SRAM_IRAM_END");
+
 /* Default entry point: */
 ENTRY(call_start_cpu0);

@ -30,9 +65,8 @@ SECTIONS
    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
-    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
    *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
-    *libbootloader_support.a:bootloader_efuse_esp32s3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
@ -48,6 +82,7 @@ SECTIONS
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
@ -100,8 +135,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -114,6 +147,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -172,29 +206,62 @@ SECTIONS
    _etext = .;
  } > iram_seg

-}
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }

+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
+}

 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCD_8000
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCE_9910
- *  |        ^              |
- *  |        |              |
- *  |        | stack (pro)  |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCE_B910
- *  |        ^              |
- *  |        |              |
- *  |        | stack (app)  |
- *  |        |              |
- *  |        v              |
- *  +--------+--------------+------+ 0x3FCE_D910
+ * 0x3fcd7e00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fce9710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fceb710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x3fced710 ------------------> __stack_app (app cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fceee34 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcef770 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcef81c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fcf0000 ------------------> _data_end_interface
 */
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@ -13,7 +13,7 @@ set(srcs
    "src/flash_partitions.c"
    "src/flash_qio_mode.c"
    "src/bootloader_flash_config_${IDF_TARGET}.c"
-    "src/bootloader_efuse_${IDF_TARGET}.c"
+    "src/bootloader_efuse.c"
    )

 if(BOOTLOADER_BUILD)
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@ -26,7 +26,7 @@
 extern "C" {
 #endif

-/// Type of hold a GPIO in low state
+// Type of hold a GPIO in low state
 typedef enum {
    GPIO_LONG_HOLD  = 1,    /*!< The long hold GPIO */
    GPIO_SHORT_HOLD = -1,   /*!< The short hold GPIO */
@ -187,13 +187,6 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,
 */
 esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t *partition, esp_app_desc_t *app_desc);

-/**
- * @brief Get chip revision
- *
- * @return Chip revision number
- */
-uint8_t bootloader_common_get_chip_revision(void);
-
 /**
 * @brief Get chip package
 *
--- a/components/bootloader_support/include/bootloader_flash.h
+++ b/components/bootloader_support/include/bootloader_flash.h
@ -9,6 +9,7 @@
 #include <esp_spi_flash.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#include "bootloader_flash_override.h"

 #ifdef __cplusplus
 extern "C" {
@ -32,14 +33,6 @@ uint32_t bootloader_read_flash_id(void);
 esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode);
 #endif

-/**
-  * @brief Unlock Flash write protect.
-  *        Please do not call this function in SDK.
-  *
-  * @note This can be overridden because it's attribute weak.
-  */
-esp_err_t bootloader_flash_unlock(void);
-
 /**
 * @brief Startup flow recommended by XMC. Call at startup before any erase/write operation.
 *
@ -47,6 +40,15 @@ esp_err_t bootloader_flash_unlock(void);
 */
 esp_err_t bootloader_flash_xmc_startup(void);

+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
+
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/include/bootloader_flash_override.h
+++ b/components/bootloader_support/include/bootloader_flash_override.h
@ -0,0 +1,101 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "esp_err.h"
+#include "esp_attr.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef unsigned (*bootloader_flash_read_status_fn_t)(void);
+typedef void (*bootloader_flash_write_status_fn_t)(unsigned);
+
+typedef struct __attribute__((packed))
+{
+    const char *manufacturer;
+    uint8_t mfg_id; /* 8-bit JEDEC manufacturer ID */
+    uint16_t flash_id; /* 16-bit JEDEC flash chip ID */
+    uint16_t id_mask; /* Bits to match on in flash chip ID */
+    bootloader_flash_read_status_fn_t read_status_fn;
+    bootloader_flash_write_status_fn_t write_status_fn;
+    uint8_t status_qio_bit;
+} bootloader_qio_info_t;
+
+/**
+ * @brief Read 8 bit status using RDSR command
+ *
+ * @return Value of SR1.
+ */
+unsigned bootloader_read_status_8b_rdsr(void);
+
+/**
+ * @brief Read 8 bit status (second byte) using RDSR2 command
+ *
+ * @return Value of SR2
+ */
+unsigned bootloader_read_status_8b_rdsr2(void);
+
+/**
+ * @brief Read 16 bit status using RDSR & RDSR2 (low and high bytes)
+ *
+ * @return Value of SR2#SR1.
+ */
+unsigned bootloader_read_status_16b_rdsr_rdsr2(void);
+
+/**
+ * @brief Write 8 bit status using WRSR
+ */
+void bootloader_write_status_8b_wrsr(unsigned new_status);
+
+/**
+ * @brief Write 8 bit status (second byte) using WRSR2.
+ */
+void bootloader_write_status_8b_wrsr2(unsigned new_status);
+
+/**
+ * @brief Write 16 bit status using WRSR, (both write SR1 and SR2)
+ */
+void bootloader_write_status_16b_wrsr(unsigned new_status);
+
+/**
+ * @brief Read 8 bit status of XM25QU64A.
+ *
+ * @return Value of 8 bit SR.
+ */
+unsigned bootloader_read_status_8b_xmc25qu64a(void);
+
+/**
+ * @brief Write 8 bit status for XM25QU64A
+ */
+void bootloader_write_status_8b_xmc25qu64a(unsigned new_status);
+
+/* Array of known flash chips and data to enable Quad I/O mode
+
+   Manufacturer & flash ID can be tested by running "esptool.py
+   flash_id"
+
+   If manufacturer ID matches, and flash ID ORed with flash ID mask
+   matches, enable_qio_mode() will execute "Read Cmd", test if bit
+   number "QIE Bit" is set, and if not set it will call "Write Cmd"
+   with this bit set.
+
+   Searching of this table stops when the first match is found.
+ */
+extern const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_support_list[];
+
+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
+
+#ifdef __cplusplus
+}
+#endif
--- a/components/bootloader_support/include/esp_app_format.h
+++ b/components/bootloader_support/include/esp_app_format.h
@ -6,6 +6,7 @@
 #pragma once

 #include <inttypes.h>
+#include "esp_assert.h"

 /**
 * @brief ESP chip ID
@ -21,7 +22,7 @@ typedef enum {
 } __attribute__((packed)) esp_chip_id_t;

 /** @cond */
-_Static_assert(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
+ESP_STATIC_ASSERT(sizeof(esp_chip_id_t) == 2, "esp_chip_id_t should be 16 bit");
 /** @endcond */

 /**
@ -55,6 +56,9 @@ typedef enum {
    ESP_IMAGE_FLASH_SIZE_4MB,       /*!< SPI flash size 4 MB */
    ESP_IMAGE_FLASH_SIZE_8MB,       /*!< SPI flash size 8 MB */
    ESP_IMAGE_FLASH_SIZE_16MB,      /*!< SPI flash size 16 MB */
+    ESP_IMAGE_FLASH_SIZE_32MB,      /*!< SPI flash size 32 MB */
+    ESP_IMAGE_FLASH_SIZE_64MB,      /*!< SPI flash size 64 MB */
+    ESP_IMAGE_FLASH_SIZE_128MB,     /*!< SPI flash size 128 MB */
    ESP_IMAGE_FLASH_SIZE_MAX        /*!< SPI flash size MAX */
 } esp_image_flash_size_t;

@ -75,8 +79,15 @@ typedef struct {
                                * pin and sets this field to 0xEE=disabled) */
    uint8_t spi_pin_drv[3];     /*!< Drive settings for the SPI flash pins (read by ROM bootloader) */
    esp_chip_id_t chip_id;      /*!< Chip identification number */
-    uint8_t min_chip_rev;       /*!< Minimum chip revision supported by image */
-    uint8_t reserved[8];       /*!< Reserved bytes in additional header space, currently unused */
+    uint8_t min_chip_rev;       /*!< Minimal chip revision supported by image
+                                 * After the Major and Minor revision eFuses were introduced into the chips, this field is no longer used.
+                                 * But for compatibility reasons, we keep this field and the data in it.
+                                 * Use min_chip_rev_full instead.
+                                 * The software interprets this as a Major version for most of the chips and as a Minor version for the ESP32-C3.
+                                 */
+    uint16_t min_chip_rev_full; /*!< Minimal chip revision supported by image, in format: major * 100 + minor */
+    uint16_t max_chip_rev_full; /*!< Maximal chip revision supported by image, in format: major * 100 + minor */
+    uint8_t reserved[4];        /*!< Reserved bytes in additional header space, currently unused */
    uint8_t hash_appended;      /*!< If 1, a SHA256 digest "simple hash" (of the entire image) is appended after the checksum.
                                 * Included in image length. This digest
                                 * is separate to secure boot and only used for detecting corruption.
@ -85,7 +96,7 @@ typedef struct {
 } __attribute__((packed))  esp_image_header_t;

 /** @cond */
-_Static_assert(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");
+ESP_STATIC_ASSERT(sizeof(esp_image_header_t) == 24, "binary image header should be 24 bytes");
 /** @endcond */


--- a/components/bootloader_support/include/esp_flash_encrypt.h
+++ b/components/bootloader_support/include/esp_flash_encrypt.h
@ -12,6 +12,7 @@
 #include "esp_spi_flash.h"
 #endif
 #include "soc/efuse_periph.h"
+#include "hal/efuse_hal.h"
 #include "sdkconfig.h"

 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
@ -46,19 +47,15 @@ typedef enum {
 */
 static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_enabled(void)
 {
+#ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
+    return efuse_hal_flash_encryption_enabled();
+#else
+
    uint32_t flash_crypt_cnt = 0;
 #if CONFIG_IDF_TARGET_ESP32
-    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-        flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
-    #else
-        esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
-    #endif
+    esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
 #else
-    #ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-        flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
-    #else
-        esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
-    #endif
+    esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
 #endif
    /* __builtin_parity is in flash, so we calculate parity inline */
    bool enabled = false;
@ -69,6 +66,7 @@ static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_e
        flash_crypt_cnt >>= 1;
    }
    return enabled;
+#endif // CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
 }

 /* @brief Update on-device flash encryption
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@ -9,6 +9,7 @@
 #include <esp_err.h>
 #include "esp_flash_partitions.h"
 #include "esp_app_format.h"
+#include "esp_assert.h"

 #ifdef __cplusplus
 extern "C" {
@ -53,12 +54,18 @@ typedef struct {
    uint32_t crc;                   /*!< Check sum crc32 */
 } rtc_retain_mem_t;

+
+ESP_STATIC_ASSERT(offsetof(rtc_retain_mem_t, crc) == sizeof(rtc_retain_mem_t) - sizeof(uint32_t), "CRC field must be the last field of rtc_retain_mem_t structure");
+
 #ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
-_Static_assert(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+ESP_STATIC_ASSERT(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+/* The custom field must be the penultimate field */
+ESP_STATIC_ASSERT(offsetof(rtc_retain_mem_t, custom) == sizeof(rtc_retain_mem_t) - sizeof(uint32_t) - CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE,
+               "custom field in rtc_retain_mem_t structure must be the field before the CRC one");
 #endif

 #if defined(CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP) || defined(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC)
-_Static_assert(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
+ESP_STATIC_ASSERT(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_RESERVE_RTC_SIZE must be a multiple of 4 bytes");
 #endif

 #ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
@ -68,7 +75,7 @@ _Static_assert(CONFIG_BOOTLOADER_RESERVE_RTC_SIZE % 4 == 0, "CONFIG_BOOTLOADER_R
 #endif

 #if defined(CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP) || defined(CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC)
-_Static_assert(sizeof(rtc_retain_mem_t) <= ESP_BOOTLOADER_RESERVE_RTC, "Reserved RTC area must exceed size of rtc_retain_mem_t");
+ESP_STATIC_ASSERT(sizeof(rtc_retain_mem_t) <= ESP_BOOTLOADER_RESERVE_RTC, "Reserved RTC area must exceed size of rtc_retain_mem_t");
 #endif

 /**
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@ -200,7 +200,7 @@ typedef struct {
 */
 esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);

-#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3
+#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_FULL >= 300
 /**
 * @brief Structure to hold public key digests calculated from the signature blocks of a single image.
 *
@ -223,7 +223,7 @@ typedef struct {
 *
 */
 esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
-#endif // !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3
+#endif // !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_FULL >= 300

 /** @brief Legacy ECDSA verification function
 *
--- a/components/bootloader_support/include_bootloader/bootloader_flash_priv.h
+++ b/components/bootloader_support/include_bootloader/bootloader_flash_priv.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -24,10 +24,13 @@
 #define CMD_RDID       0x9F
 #define CMD_WRSR       0x01
 #define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
+#define CMD_WRSR3      0x11 /* Not all SPI flash uses this command */
 #define CMD_WREN       0x06
+#define CMD_WRENVSR    0x50 /* Flash write enable for volatile SR bits */
 #define CMD_WRDI       0x04
 #define CMD_RDSR       0x05
 #define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_RDSR3      0x15 /* Not all SPI flash uses this command */
 #define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
 #define CMD_RDSFDP     0x5A /* Read the SFDP of the flash */
 #define CMD_WRAP       0x77 /* Set burst with wrap command */
@ -171,4 +174,12 @@ uint32_t bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_n
 */
 void bootloader_enable_wp(void);

+/**
+ * @brief Once this function is called,
+ * any on-going internal operations will be terminated and the device will return to its default power-on
+ * state and lose all the current volatile settings, such as Volatile Status Register bits, Write Enable Latch
+ * (WEL) status, Program/Erase Suspend status, etc.
+ */
+void bootloader_spi_flash_reset(void);
+
 #endif
--- a/components/bootloader_support/include_bootloader/bootloader_utility.h
+++ b/components/bootloader_support/include_bootloader/bootloader_utility.h
@ -96,9 +96,10 @@ void bootloader_atexit(void);
 esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);

 /**
- * @brief Debug log contents of a buffer as hexadecimal
+ * @brief Debug log contents of a buffer as hexadecimal.
 *
- * @note Only works if component log level is DEBUG or higher.
+ * @note - Only works if component log level is DEBUG or higher.
+ *       - It will print at most 128 bytes from @c buffer.
 *
 * @param buffer Buffer to log
 * @param length Length of buffer in bytes. Maximum length 128 bytes.
--- a/components/bootloader_support/src/bootloader_clock_init.c
+++ b/components/bootloader_support/src/bootloader_clock_init.c
@ -7,10 +7,12 @@
 #include "soc/soc.h"
 #include "soc/rtc.h"
 #include "soc/efuse_periph.h"
+#include "soc/chip_revision.h"
 #include "soc/rtc_cntl_reg.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "soc/dport_reg.h"
 #endif
+#include "hal/efuse_hal.h"
 #include "esp_rom_sys.h"
 #include "esp_rom_uart.h"

@ -32,8 +34,7 @@ __attribute__((weak)) void bootloader_clock_configure(void)
     * document). For rev. 0, switch to 240 instead if it has been enabled
     * previously.
     */
-    uint32_t chip_ver_reg = REG_READ(EFUSE_BLK0_RDATA3_REG);
-    if ((chip_ver_reg & EFUSE_RD_CHIP_VER_REV1_M) == 0 &&
+    if (!ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 100) &&
            DPORT_REG_GET_FIELD(DPORT_CPU_PER_CONF_REG, DPORT_CPUPERIOD_SEL) == DPORT_CPUPERIOD_SEL_240) {
        cpu_freq_mhz = 240;
    }
--- a/components/bootloader_support/src/bootloader_common.c
+++ b/components/bootloader_support/src/bootloader_common.c
@ -168,6 +168,12 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
        }
        if (data.image.hash_appended) {
            memcpy(out_sha_256, data.image_digest, ESP_PARTITION_HASH_LEN);
+            uint8_t calc_sha256[ESP_PARTITION_HASH_LEN];
+            // The hash is verified before returning, if app content is invalid then the function returns ESP_ERR_IMAGE_INVALID.
+            esp_err_t error = bootloader_sha256_flash_contents(address, data.image_len - ESP_PARTITION_HASH_LEN, calc_sha256);
+            if (error || memcmp(data.image_digest, calc_sha256, ESP_PARTITION_HASH_LEN) != 0) {
+                return ESP_ERR_IMAGE_INVALID;
+            }
            return ESP_OK;
        }
        // If image doesn't have a appended hash then hash calculates for entire image.
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@ -22,6 +22,9 @@
 #include "soc/gpio_periph.h"
 #include "soc/rtc.h"
 #include "soc/efuse_reg.h"
+#include "soc/chip_revision.h"
+#include "hal/efuse_ll.h"
+#include "hal/efuse_hal.h"
 #include "soc/soc_memory_types.h"
 #include "hal/gpio_ll.h"
 #include "esp_image_format.h"
@ -30,6 +33,7 @@
 #include "bootloader_flash_priv.h"

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
+#define IS_MAX_REV_SET(max_chip_rev_full) (((max_chip_rev_full) != 65535) && ((max_chip_rev_full) != 0))

 static const char* TAG = "boot_comm";

@ -59,28 +63,38 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata)
    return bootloader_common_select_otadata(two_otadata, valid_two_otadata, true);
 }

-esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
+esp_err_t __attribute__((optimize("-Os"))) bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
 {
    esp_err_t err = ESP_OK;
    esp_chip_id_t chip_id = CONFIG_IDF_FIRMWARE_CHIP_ID;
    if (chip_id != img_hdr->chip_id) {
        ESP_LOGE(TAG, "mismatch chip ID, expected %d, found %d", chip_id, img_hdr->chip_id);
        err = ESP_FAIL;
-    }
-
+    } else {
 #ifndef CONFIG_IDF_ENV_FPGA
-    uint8_t revision = bootloader_common_get_chip_revision();
-    if (revision < img_hdr->min_chip_rev) {
-        /* To fix this error, please update mininum supported chip revision from configuration,
-         * located in TARGET (e.g. ESP32) specific options under "Component config" menu */
-        ESP_LOGE(TAG, "This chip is revision %d but the application is configured for minimum revision %d. Can't run.", revision, img_hdr->min_chip_rev);
-        err = ESP_FAIL;
-    } else if (revision != img_hdr->min_chip_rev) {
-#ifdef BOOTLOADER_BUILD
-        ESP_LOGI(TAG, "chip revision: %d, min. %s chip revision: %d", revision, type == ESP_IMAGE_BOOTLOADER ? "bootloader" : "application", img_hdr->min_chip_rev);
-#endif
-    }
+        unsigned revision = efuse_hal_chip_revision();
+        unsigned int major_rev = revision / 100;
+        unsigned int minor_rev = revision % 100;
+        unsigned min_rev = img_hdr->min_chip_rev_full;
+        if (type == ESP_IMAGE_BOOTLOADER || type == ESP_IMAGE_APPLICATION) {
+            if (!ESP_CHIP_REV_ABOVE(revision, min_rev)) {
+                ESP_LOGE(TAG, "Image requires chip rev >= v%d.%d, but chip is v%d.%d",
+                         min_rev / 100, min_rev % 100,
+                         major_rev, minor_rev);
+                err = ESP_FAIL;
+            }
+        }
+        if (type == ESP_IMAGE_APPLICATION) {
+            unsigned max_rev = img_hdr->max_chip_rev_full;
+            if ((IS_MAX_REV_SET(max_rev) && (revision > max_rev) && !efuse_ll_get_disable_wafer_version_major())) {
+                ESP_LOGE(TAG, "Image requires chip rev <= v%d.%d, but chip is v%d.%d",
+                         max_rev / 100, max_rev % 100,
+                         major_rev, minor_rev);
+                err = ESP_FAIL;
+            }
+        }
 #endif // CONFIG_IDF_ENV_FPGA
+    }

    return err;
 }
@ -139,6 +153,8 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t

 #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))

+_Static_assert(RTC_RETAIN_MEM_ADDR >= SOC_RTC_DRAM_LOW, "rtc_retain_mem_t structure size is bigger than the RTC memory size. Consider reducing RTC reserved memory size.");
+
 rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;

 #ifndef BOOTLOADER_BUILD
@ -151,14 +167,25 @@ rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR
 SOC_RESERVE_MEMORY_REGION(RTC_RETAIN_MEM_ADDR, RTC_RETAIN_MEM_ADDR + sizeof(rtc_retain_mem_t), rtc_retain_mem);
 #endif

+static uint32_t rtc_retain_mem_size(void) {
+#ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
+    /* A custom memory has been reserved by the user, do not consider this memory into CRC calculation as it may change without
+     * the have the user updating the CRC. Return the offset of the custom field, which is equivalent to size of the structure
+     * minus the size of everything after (including) `custom` */
+    return offsetof(rtc_retain_mem_t, custom);
+#else
+    return sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc);
+#endif
+}
+
 static bool check_rtc_retain_mem(void)
 {
-    return esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc)) == rtc_retain_mem->crc && rtc_retain_mem->crc != UINT32_MAX;
+    return esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size()) == rtc_retain_mem->crc && rtc_retain_mem->crc != UINT32_MAX;
 }

 static void update_rtc_retain_mem_crc(void)
 {
-    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc));
+    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size());
 }

 void bootloader_common_reset_rtc_retain_mem(void)
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@ -44,12 +44,7 @@ void bootloader_console_init(void)
 {
    const int uart_num = CONFIG_ESP_CONSOLE_UART_NUM;

-#if !ESP_ROM_SUPPORT_MULTIPLE_UART
-    /* esp_rom_install_channel_put is not available unless multiple UARTs are supported */
    esp_rom_install_uart_printf();
-#else
-    esp_rom_install_channel_putc(1, esp_rom_uart_putc);
-#endif

    // Wait for UART FIFO to be empty.
    esp_rom_uart_tx_wait_idle(0);
@ -58,10 +53,10 @@ void bootloader_console_init(void)
    // Some constants to make the following code less upper-case
    const int uart_tx_gpio = CONFIG_ESP_CONSOLE_UART_TX_GPIO;
    const int uart_rx_gpio = CONFIG_ESP_CONSOLE_UART_RX_GPIO;
+
    // Switch to the new UART (this just changes UART number used for esp_rom_printf in ROM code).
-#if ESP_ROM_SUPPORT_MULTIPLE_UART
    esp_rom_uart_set_as_console(uart_num);
-#endif
+
    // If console is attached to UART1 or if non-default pins are used,
    // need to reconfigure pins using GPIO matrix
    if (uart_num != 0 ||
@ -73,10 +68,12 @@ void bootloader_console_init(void)
        // Route GPIO signals to/from pins
        const uint32_t tx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_TX_PIN_IDX);
        const uint32_t rx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_RX_PIN_IDX);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
        esp_rom_gpio_pad_pullup_only(uart_rx_gpio);
        esp_rom_gpio_connect_out_signal(uart_tx_gpio, tx_idx, 0, 0);
        esp_rom_gpio_connect_in_signal(uart_rx_gpio, rx_idx, 0);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
        // Enable the peripheral
        periph_ll_enable_clk_clear_rst(PERIPH_UART0_MODULE + uart_num);
    }
--- a/components/bootloader_support/src/bootloader_efuse.c
+++ b/components/bootloader_support/src/bootloader_efuse.c
@ -0,0 +1,37 @@
+/*
+ * SPDX-FileCopyrightText: 2019-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <stdint.h>
+#include "sdkconfig.h"
+#include "bootloader_common.h"
+#include "hal/efuse_ll.h"
+#include "hal/efuse_hal.h"
+#include "esp_attr.h"
+
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
+{
+    return efuse_ll_get_chip_ver_pkg();
+}
+
+int bootloader_clock_get_rated_freq_mhz(void)
+{
+#ifdef CONFIG_IDF_TARGET_ESP32
+    return efuse_hal_get_rated_freq_mhz();
+
+#elif CONFIG_IDF_TARGET_ESP32C3
+    return 160;
+
+#elif CONFIG_IDF_TARGET_ESP32H2
+    return 96;
+
+#elif CONFIG_IDF_TARGET_ESP32S2
+    return 240;
+
+#elif CONFIG_IDF_TARGET_ESP32S3
+    return 240;
+
+#endif
+}
--- a/components/bootloader_support/src/bootloader_efuse_esp32.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32.c
@ -1,60 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2019-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "bootloader_common.h"
-#include "bootloader_clock.h"
-#include "soc/efuse_reg.h"
-#include "soc/syscon_reg.h"
-
-uint8_t bootloader_common_get_chip_revision(void)
-{
-    uint8_t eco_bit0, eco_bit1, eco_bit2;
-    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
-    eco_bit1 = (REG_READ(EFUSE_BLK0_RDATA5_REG) & 0x100000) >> 20;
-    eco_bit2 = (REG_READ(SYSCON_DATE_REG) & 0x80000000) >> 31;
-    uint32_t combine_value = (eco_bit2 << 2) | (eco_bit1 << 1) | eco_bit0;
-    uint8_t chip_ver = 0;
-    switch (combine_value) {
-    case 0:
-        chip_ver = 0;
-        break;
-    case 1:
-        chip_ver = 1;
-        break;
-    case 3:
-        chip_ver = 2;
-        break;
-#if CONFIG_IDF_ENV_FPGA
-    case 4: /* Empty efuses, but SYSCON_DATE_REG bit is set */
-        chip_ver = 3;
-        break;
-#endif
-    case 7:
-        chip_ver = 3;
-        break;
-    default:
-        chip_ver = 0;
-        break;
-    }
-    return chip_ver;
-}
-
-uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    uint32_t pkg_version = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
-    uint32_t pkg_version_4bit = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG_4BIT);
-    return (pkg_version_4bit << 3) | pkg_version;
-}
-
-int bootloader_clock_get_rated_freq_mhz()
-{
-    //Check if ESP32 is rated for a CPU frequency of 160MHz only
-    if (REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_RATED) &&
-        REG_GET_BIT(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_CPU_FREQ_LOW)) {
-        return 160;
-    }
-    return 240;
-}
--- a/components/bootloader_support/src/bootloader_efuse_esp32c3.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32c3.c
@ -1,20 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-#include "soc/efuse_reg.h"
-
-uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
-}
-
-uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
-}
--- a/components/bootloader_support/src/bootloader_efuse_esp32h2.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32h2.c
@ -1,20 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-#include "soc/efuse_reg.h"
-
-uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
-}
-
-uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
-}
--- a/components/bootloader_support/src/bootloader_efuse_esp32s2.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32s2.c
@ -1,23 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2019-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "sdkconfig.h"
-#include "bootloader_clock.h"
-#include "bootloader_common.h"
-#include "soc/efuse_reg.h"
-
-uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    /* No other revisions for ESP32-S2 */
-    return 0;
-}
-
-uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_4_REG, EFUSE_PKG_VERSION);
-}
--- a/components/bootloader_support/src/bootloader_efuse_esp32s3.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32s3.c
@ -1,20 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <stdint.h>
-
-uint8_t bootloader_common_get_chip_revision(void)
-{
-    // should return the same value as esp_efuse_get_chip_ver()
-    /* No other revisions for ESP32-S3 */
-    return 0;
-}
-
-uint32_t bootloader_common_get_chip_ver_pkg(void)
-{
-    // should return the same value as esp_efuse_get_pkg_ver()
-    return 0;
-}
--- a/components/bootloader_support/src/bootloader_flash.c
+++ b/components/bootloader_support/src/bootloader_flash.c
@ -10,6 +10,7 @@
 #include <esp_flash_encrypt.h>
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#include "hal/efuse_hal.h"

 #if CONFIG_IDF_TARGET_ESP32
 #   include "soc/spi_struct.h"
@ -36,22 +37,22 @@
 #endif

 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
-#define ENCRYPTION_IS_VIRTUAL 1
+#define ENCRYPTION_IS_VIRTUAL (!efuse_hal_flash_encryption_enabled())
 #else
 #define ENCRYPTION_IS_VIRTUAL 0
 #endif

 #define BYTESHIFT(VAR, IDX)    (((VAR) >> ((IDX) * 8)) & 0xFF)
 #define ISSI_ID                0x9D
+#define MXIC_ID                0xC2
 #define GD_Q_ID_HIGH           0xC8
 #define GD_Q_ID_MID            0x40
 #define GD_Q_ID_LOW            0x16

 #define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI    (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
-#define ESP_BOOTLOADER_SPIFLASH_QE_16B           BIT9   // QE position when you write 16 bits at one time.
-#define ESP_BOOTLOADER_SPIFLASH_QE_8B            BIT1   // QE position when you write 8 bits(for SR2) at one time.
-#define ESP_BOOTLOADER_SPIFLASH_WRITE_8B         (8)
-#define ESP_BOOTLOADER_SPIFLASH_WRITE_16B        (16)
+#define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2        BIT1   // QE position when you write 8 bits(for SR2) at one time.
+#define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE     BIT9   // QE position when you write 16 bits at one time.
+

 #ifndef BOOTLOADER_BUILD
 /* Normal app version maps to esp_spi_flash.h operations...
@ -495,72 +496,77 @@ FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
    return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
 }

+FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
+}
+
 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
 {
+    // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
+    // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
    uint16_t status = 0;    // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
    uint16_t new_status = 0;
    uint8_t status_sr2 = 0;    // status_sr2 for SR2.
    uint8_t new_status_sr2 = 0;
-    uint8_t write_sr_bit = 0;
+    uint8_t sr1_bit_num = 0;
    esp_err_t err = ESP_OK;

    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    if (is_issi_chip(&g_rom_flashchip)) {
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_8B;
-        // ISSI chips have different QE position
-
+    if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
+        // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
+        // If any code here needs to be modified, check both chips.
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);

        /* Clear all bits in the mask.
        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
        */
+        sr1_bit_num = 8;
        new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
-        // Skip if nothing needs to be cleared. Otherwise will waste time waiting for the flash to clear nothing.
    } else if (is_gd_q_chip(&g_rom_flashchip)) {
        /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
           Use 01H to write SR1 and 31H to write SR2.
        */
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_8B;
-
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+        sr1_bit_num = 8;
        new_status = 0;

        status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
-        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_8B;
+        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
    } else {
        /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_16B;
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);

        /* Clear all bits except QE, if it is set.
        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
        */
-        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_16B;
+        sr1_bit_num = 16;
+        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
    }

+    // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
+    bool status_written = false;
+    // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
    if (status != new_status) {
-        /* if the status in SR not equal to the ideal status, the status need to be updated */
        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-        bootloader_execute_flash_command(CMD_WRSR, new_status, write_sr_bit, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
+        status_written = true;
    }

    if (status_sr2 != new_status_sr2) {
-        /* If the status in SR2 not equal to the ideal status, the status need to be updated.
-           It doesn't need to be updated if status in SR2 is 0.
-           Note: if we need to update both SR1 and SR2, the `CMD_WREN` needs to be sent again.
-        */
        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, write_sr_bit, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
+        status_written = true;
+    }
+
+    if (status_written) {
+        //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
    }

-    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
-    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
    return err;
 }

@ -568,7 +574,7 @@ esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
 #ifndef g_rom_spiflash_dummy_len_plus // ESP32-C3 uses a macro to access ROM data here
 extern uint8_t g_rom_spiflash_dummy_len_plus[];
 #endif
-IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
+IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
    uint8_t command,
    uint32_t addr_len, uint32_t address,
    uint8_t dummy_len,
@ -598,14 +604,12 @@ IRAM_ATTR static uint32_t bootloader_flash_execute_command_common(
    SPIFLASH.addr = address;
 #endif
    //dummy phase
+    uint32_t total_dummy = dummy_len;
    if (miso_len > 0) {
-        uint32_t total_dummy = dummy_len + g_rom_spiflash_dummy_len_plus[1];
-        SPIFLASH.user.usr_dummy = total_dummy > 0;
-        SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
-    } else {
-        SPIFLASH.user.usr_dummy = 0;
-        SPIFLASH.user1.usr_dummy_cyclelen = 0;
+        total_dummy += g_rom_spiflash_dummy_len_plus[1];
    }
+    SPIFLASH.user.usr_dummy = total_dummy > 0;
+    SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
    //output data
    SPIFLASH.user.usr_mosi = mosi_len > 0;
 #if CONFIG_IDF_TARGET_ESP32
@ -674,6 +678,12 @@ uint32_t IRAM_ATTR bootloader_read_flash_id(void)
    return id;
 }

+void bootloader_spi_flash_reset(void)
+{
+    bootloader_execute_flash_command(0x66, 0, 0, 0);
+    bootloader_execute_flash_command(0x99, 0, 0, 0);
+}
+
 #if SOC_CACHE_SUPPORT_WRAP
 esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode)
 {
--- a/components/bootloader_support/src/bootloader_flash_config_esp32.c
+++ b/components/bootloader_support/src/bootloader_flash_config_esp32.c
@ -17,6 +17,8 @@
 #include "soc/spi_reg.h"
 #include "soc/soc_caps.h"
 #include "soc/soc_pins.h"
+#include "soc/chip_revision.h"
+#include "hal/efuse_hal.h"
 #include "hal/gpio_hal.h"
 #include "flash_qio_mode.h"
 #include "bootloader_common.h"
@ -168,16 +170,13 @@ int bootloader_flash_get_wp_pin(void)
    return CONFIG_SPIRAM_SPIWP_SD3_PIN; // can be set for app when DIO or DOUT config used for PSRAM only
 #else
    // no custom value, find it based on the package eFuse value
-    uint8_t chip_ver;
-    uint32_t pkg_ver = bootloader_common_get_chip_ver_pkg();
-    switch(pkg_ver) {
+    switch(bootloader_common_get_chip_ver_pkg()) {
    case EFUSE_RD_CHIP_VER_PKG_ESP32U4WDH:
    case EFUSE_RD_CHIP_VER_PKG_ESP32D2WDQ5:
        return ESP32_D2WD_WP_GPIO;
    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOD4:
        /* Same package IDs are used for ESP32-PICO-V3 and ESP32-PICO-D4, silicon version differentiates */
-        chip_ver = bootloader_common_get_chip_revision();
-        return (chip_ver < 3) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
+        return !ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 300) ? ESP32_D2WD_WP_GPIO : ESP32_PICO_V3_GPIO;
    case EFUSE_RD_CHIP_VER_PKG_ESP32PICOV302:
        return ESP32_PICO_V3_GPIO;
    default:
--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@ -18,6 +18,7 @@
 #include "soc/cpu.h"
 #include "soc/rtc.h"
 #include "hal/wdt_hal.h"
+#include "hal/efuse_hal.h"

 static const char *TAG = "boot";

@ -40,9 +41,10 @@ esp_err_t bootloader_read_bootloader_header(void)

 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    /* read chip revision from efuse */
-    uint8_t revision = bootloader_common_get_chip_revision();
-    ESP_LOGI(TAG, "chip revision: %d", revision);
+    unsigned revision = efuse_hal_chip_revision();
+    unsigned major = revision / 100;
+    unsigned minor = revision % 100;
+    ESP_LOGI(TAG, "chip revision: v%d.%d", major, minor);
    /* compare with the one set in bootloader image header */
    if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
        return ESP_FAIL;
--- a/components/bootloader_support/src/bootloader_mem.c
+++ b/components/bootloader_support/src/bootloader_mem.c
@ -17,6 +17,8 @@ void bootloader_init_mem(void)
 {
    cpu_hal_init_hwloop();

+#ifdef CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE
    // protect memory region
    esp_cpu_configure_region_protection();
+#endif
 }
--- a/components/bootloader_support/src/bootloader_panic.c
+++ b/components/bootloader_support/src/bootloader_panic.c
@ -12,7 +12,11 @@

 void __assert_func(const char *file, int line, const char *func, const char *expr)
 {
+
+#if !CONFIG_OPTIMIZATION_ASSERTIONS_SILENT
    esp_rom_printf("Assert failed in %s, %s:%d (%s)\r\n", func, file, line, expr);
+#endif
+
    while (1) {
    }
 }
--- a/components/bootloader_support/src/bootloader_random.c
+++ b/components/bootloader_support/src/bootloader_random.c
@ -18,6 +18,13 @@
 }

 #else
+
+#if !defined CONFIG_IDF_TARGET_ESP32S3
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 32 * 2) /* extra factor of 2 is precautionary */
+#else
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 23) /* 45 KHz reading frequency is the maximum we have tested so far on S3 */
+#endif
+
 __attribute__((weak)) void bootloader_fill_random(void *buffer, size_t length)
 {
    uint8_t *buffer_bytes = (uint8_t *)buffer;
@ -40,7 +47,7 @@
            do {
                random ^= REG_READ(WDEV_RND_REG);
                now = cpu_hal_get_cycle_count();
-            } while (now - start < 80 * 32 * 2); /* extra factor of 2 is precautionary */
+            } while (now - start < RNG_CPU_WAIT_CYCLE_NUM);
        }
        buffer_bytes[i] = random >> ((i % 4) * 8);
    }
--- a/components/bootloader_support/src/bootloader_random_esp32s3.c
+++ b/components/bootloader_support/src/bootloader_random_esp32s3.c
@ -6,18 +6,97 @@
 #include "sdkconfig.h"
 #include "bootloader_random.h"
 #include "esp_log.h"
-
-static const char *TAG = "bootloader_random";
+#include "soc/system_reg.h"
+#include "soc/syscon_reg.h"
+#include "soc/apb_saradc_reg.h"
+#include "soc/rtc_cntl_reg.h"
+#include "soc/sens_reg.h"
+#include "regi2c_ctrl.h"
+#include "regi2c_saradc.h"

 void bootloader_random_enable(void)
 {
-    ESP_LOGW(TAG, "RNG for ESP32-S3 not currently supported"); // IDF-1878
-    // Don't forget to remove the following line
-    // *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    // In the bootloader.ld when RNG support is ready for ESP32-S3
+    SET_PERI_REG_MASK(SYSTEM_WIFI_CLK_EN_REG, SYSTEM_WIFI_CLK_RNG_EN);
+
+    // Enable 8M clock source for RNG (this is actually enough to produce strong random results,
+    // but enabling the SAR ADC as well adds some insurance.)
+    REG_SET_BIT(RTC_CNTL_CLK_CONF_REG, RTC_CNTL_DIG_CLK8M_EN);
+
+    /// Enable SAR ADC to read a disconnected input for additional entropy
+
+    // Reset ADC clock
+    SET_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+    CLEAR_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+
+    // Enable clock and select clock source for ADC digital controller
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_SEL, 2); //APB clock
+    SET_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_SAR_CLK_GATED);
+    SET_PERI_REG_MASK(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_EN);
+
+    // Read freq = apb_clk / (APB_SARADC_CLKM_DIV_NUM + 1) / TIMER_TARGET / 2
+    // Internal ADC sample freq = apb_clk / (APB_SARADC_CLKM_DIV_NUM + 1) / (APB_SARADC_SAR_CLK_DIV + 1)
+    // Read frequency has to be at least 35 times lower than the sampling frequency
+
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLKM_DIV_NUM, 3);
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR_CLK_DIV, 3); // SAR clock divider has to be at least 2
+    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_TARGET, 70);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_START_FORCE);
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3);
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_MEAS_NUM_LIMIT);
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_WORK_MODE, 1);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR2_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB1_REG,0xafffff); // Test internal voltage if the channel info is 0xa.
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR1_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR1_PATT_TAB1_REG,0xafffff); // Test internal voltage if the channel info is 0xa.
+
+    // Enable adc1 digital controller
+    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+
+    // Set SARADC2 arbiter
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS2_MUX_REG, SENS_SAR2_RTC_FORCE);
+    CLEAR_PERI_REG_MASK(APB_SARADC_APB_ADC_ARB_CTRL_REG, APB_SARADC_ADC_ARB_GRANT_FORCE);
+    CLEAR_PERI_REG_MASK(APB_SARADC_APB_ADC_ARB_CTRL_REG, APB_SARADC_ADC_ARB_FIX_PRIORITY);
+
+    // Disable ADC filter
+    REG_SET_FIELD(APB_SARADC_FILTER_CTRL0_REG, APB_SARADC_FILTER_CHANNEL0, 0xD);
+    REG_SET_FIELD(APB_SARADC_FILTER_CTRL0_REG, APB_SARADC_FILTER_CHANNEL1, 0xD);
+
+    // Start ADC sample
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_SEL);
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    /*Choose the appropriate internal voltage to measure*/
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
 }

+//TODO: IDF-4714
 void bootloader_random_disable(void)
 {
-    ESP_LOGW(TAG, "RNG for ESP32-S3 not currently supported"); // IDF-1878
+    /* Restore internal I2C bus state */
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
+
+    //Power off SAR ADC
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0);
+    //return to ADC RTC controller
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+    //Invalidate ADC digital trigger timer
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    //Disable ADC digital part
+    CLEAR_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+    //Hold reset bit for ADC digital part
+    SET_PERI_REG_MASK(SYSTEM_PERIP_RST_EN0_REG, SYSTEM_APB_SARADC_RST);
+
+    /* Note: the 8M CLK entropy source continues running even after this function is called,
+       but as mentioned above it's better to enable Wi-Fi or BT or call bootloader_random_enable()
+       in order to get a secondary entropy source.
+    */
 }
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@ -78,6 +78,7 @@
 #include "bootloader_console.h"
 #include "bootloader_soc.h"
 #include "esp_efuse.h"
+#include "esp_fault.h"

 static const char *TAG = "boot";

@ -269,9 +270,16 @@ static esp_err_t write_otadata(esp_ota_select_entry_t *otadata, uint32_t offset,
 static bool check_anti_rollback(const esp_partition_pos_t *partition)
 {
 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
-    esp_app_desc_t app_desc;
+    esp_app_desc_t app_desc = {};
    esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
-    return err == ESP_OK && esp_efuse_check_secure_version(app_desc.secure_version) == true;
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
+        return false;
+    }
+    bool sec_ver = esp_efuse_check_secure_version(app_desc.secure_version);
+    /* Anti FI check */
+    ESP_FAULT_ASSERT(sec_ver == esp_efuse_check_secure_version(app_desc.secure_version));
+    return sec_ver;
 #else
    return true;
 #endif
@ -284,6 +292,8 @@ static void update_anti_rollback(const esp_partition_pos_t *partition)
    esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
    if (err == ESP_OK) {
        esp_efuse_update_secure_version(app_desc.secure_version);
+    } else {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
    }
 }

@ -700,7 +710,8 @@ static void set_cache_and_start_app(
    uint32_t irom_size,
    uint32_t entry_addr)
 {
-    int rc;
+    int rc __attribute__((unused));
+
    ESP_LOGD(TAG, "configure drom and irom and start");
 #if CONFIG_IDF_TARGET_ESP32
    Cache_Read_Disable(0);
@ -720,8 +731,8 @@ static void set_cache_and_start_app(
 #endif

    /* Clear the MMU entries that are already set up,
-       so the new app only has the mappings it creates.
-    */
+     * so the new app only has the mappings it creates.
+     */
 #if CONFIG_IDF_TARGET_ESP32
    for (int i = 0; i < DPORT_FLASH_MMU_TABLE_SIZE; i++) {
        DPORT_PRO_FLASH_MMU_TABLE[i] = DPORT_FLASH_MMU_TABLE_INVALID_VAL;
@ -732,31 +743,33 @@ static void set_cache_and_start_app(
    }
 #endif
    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
+    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK;
    uint32_t drom_page_count = bootloader_cache_pages_to_map(drom_size, drom_load_addr);
    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d",
-             drom_addr & MMU_FLASH_MASK, drom_load_addr_aligned, drom_size, drom_page_count);
+             drom_addr_aligned, drom_load_addr_aligned, drom_size, drom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count);
 #elif CONFIG_IDF_TARGET_ESP32S2
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32S3
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32C3
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32H2
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #endif
    ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count);
    ESP_LOGV(TAG, "rc=%d", rc);
 #endif
    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
+    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK;
    uint32_t irom_page_count = bootloader_cache_pages_to_map(irom_size, irom_load_addr);
    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d",
-             irom_addr & MMU_FLASH_MASK, irom_load_addr_aligned, irom_size, irom_page_count);
+             irom_addr_aligned, irom_load_addr_aligned, irom_size, irom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count);
 #elif CONFIG_IDF_TARGET_ESP32S2
    uint32_t iram1_used = 0;
    if (irom_load_addr + irom_size > IRAM1_ADDRESS_LOW) {
@ -767,17 +780,17 @@ static void set_cache_and_start_app(
        rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, IRAM1_ADDRESS_LOW, 0, 64, 64, 1);
        REG_CLR_BIT(EXTMEM_PRO_ICACHE_CTRL1_REG, EXTMEM_PRO_ICACHE_MASK_IRAM1);
    }
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32S3
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32C3
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32H2
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #endif
    ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count);
    ESP_LOGV(TAG, "rc=%d", rc);
    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG,
                       (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) |
@ -865,22 +878,19 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he

 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
 {
-#if BOOT_LOG_LEVEL >= LOG_LEVEL_DEBUG
-    assert(length <= 128); // Avoid unbounded VLA size
+#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
    const uint8_t *bytes = (const uint8_t *)buffer;
-    char hexbuf[length * 2 + 1];
-    hexbuf[length * 2] = 0;
-    for (size_t i = 0; i < length; i++) {
-        for (int shift = 0; shift < 2; shift++) {
-            uint8_t nibble = (bytes[i] >> (shift ? 0 : 4)) & 0x0F;
-            if (nibble < 10) {
-                hexbuf[i * 2 + shift] = '0' + nibble;
-            } else {
-                hexbuf[i * 2 + shift] = 'a' + nibble - 10;
-            }
-        }
-    }
+    const size_t output_len = MIN(length, 128);
+    char hexbuf[128 * 2 + 1];
+
+    bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
+
+    hexbuf[output_len * 2] = '\0';
    ESP_LOGD(TAG, "%s: %s", label, hexbuf);
+#else
+    (void) buffer;
+    (void) length;
+    (void) label;
 #endif
 }

--- a/components/bootloader_support/src/esp32/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32/secure_boot_secure_features.c
@ -79,7 +79,7 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
        return err;
    }
 #else
-    ESP_LOGW(TAG, "Not disabling ROM Download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
--- a/components/bootloader_support/src/esp32c3/bootloader_esp32c3.c
+++ b/components/bootloader_support/src/esp32c3/bootloader_esp32c3.c
@ -23,6 +23,7 @@
 #include "soc/extmem_reg.h"
 #include "soc/io_mux_reg.h"
 #include "soc/system_reg.h"
+#include "soc/chip_revision.h"
 #include "esp32c3/rom/efuse.h"
 #include "esp32c3/rom/spi_flash.h"
 #include "esp32c3/rom/cache.h"
@ -38,6 +39,7 @@
 #include "bootloader_flash_priv.h"
 #include "bootloader_soc.h"
 #include "esp_efuse.h"
+#include "hal/efuse_hal.h"

 static const char *TAG = "boot.esp32c3";

@ -258,7 +260,7 @@ static inline void bootloader_hardware_init(void)
 {
    // This check is always included in the bootloader so it can
    // print the minimum revision error message later in the boot
-    if (bootloader_common_get_chip_revision() < 3) {
+    if (!ESP_CHIP_REV_ABOVE(efuse_hal_chip_revision(), 3)) {
        REGI2C_WRITE_MASK(I2C_ULP, I2C_ULP_IR_FORCE_XPD_IPH, 1);
        REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_1P1_PVT, 12);
    }
@ -271,8 +273,7 @@ static inline void bootloader_ana_reset_config(void)
      For ECO2: fix brownout reset bug, support swt & brownout reset;
      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
    */
-    uint8_t chip_version = bootloader_common_get_chip_revision();
-    switch (chip_version) {
+    switch (efuse_hal_chip_revision()) {
        case 0:
        case 1:
            //Enable WDT reset. Disable BOR and GLITCH reset
--- a/components/bootloader_support/src/esp32c3/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32c3/flash_encryption_secure_features.c
@ -38,7 +38,7 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
--- a/components/bootloader_support/src/esp32c3/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32c3/secure_boot_secure_features.c
@ -16,13 +16,24 @@ static __attribute__((unused)) const char *TAG = "secure_boot";

 esp_err_t esp_secure_boot_enable_secure_features(void)
 {
-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp32h2/flash_encrypt.c
+++ b/components/bootloader_support/src/esp32h2/flash_encrypt.c
@ -142,7 +142,7 @@ static esp_err_t initialise_flash_encryption(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

    esp_err_t err = esp_efuse_batch_write_commit();
    if (err != ESP_OK) {
--- a/components/bootloader_support/src/esp32h2/secure_boot.c
+++ b/components/bootloader_support/src/esp32h2/secure_boot.c
@ -248,13 +248,25 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
        return key_state;
    }

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

+    esp_err_t err = ESP_FAIL;
 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
@ -272,7 +284,7 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag

    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);

-    esp_err_t err = esp_efuse_batch_write_commit();
+    err = esp_efuse_batch_write_commit();
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Error programming security eFuses (err=0x%x).", err);
        return err;
--- a/components/bootloader_support/src/esp32s2/bootloader_esp32s2.c
+++ b/components/bootloader_support/src/esp32s2/bootloader_esp32s2.c
@ -101,6 +101,15 @@ static void update_flash_config(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        size = 16;
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        size = 32;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        size = 64;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        size = 128;
+        break;
    default:
        size = 2;
    }
@ -174,6 +183,15 @@ static void print_flash_info(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        str = "16MB";
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        str = "32MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        str = "64MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        str = "128MB";
+        break;
    default:
        str = "2MB";
        break;
--- a/components/bootloader_support/src/esp32s2/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32s2/secure_boot_secure_features.c
@ -21,9 +21,20 @@ esp_err_t esp_secure_boot_enable_secure_features(void)

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp32s3/bootloader_esp32s3.c
+++ b/components/bootloader_support/src/esp32s3/bootloader_esp32s3.c
@ -103,6 +103,15 @@ static void update_flash_config(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        size = 16;
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        size = 32;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        size = 64;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        size = 128;
+        break;
    default:
        size = 2;
    }
@ -176,6 +185,15 @@ static void print_flash_info(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        str = "16MB";
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        str = "32MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        str = "64MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        str = "128MB";
+        break;
    default:
        str = "2MB";
        break;
@ -200,6 +218,11 @@ static esp_err_t bootloader_init_spi_flash(void)
    }
 #endif

+#if CONFIG_SPI_FLASH_HPM_ENABLE
+    // Reset flash, clear volatile bits DC[0:1]. Make it work under default mode to boot.
+    bootloader_spi_flash_reset();
+#endif
+
    bootloader_flash_unlock();

 #if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
--- a/components/bootloader_support/src/esp32s3/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32s3/flash_encryption_secure_features.c
@ -39,7 +39,7 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
--- a/components/bootloader_support/src/esp32s3/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32s3/secure_boot_secure_features.c
@ -16,13 +16,24 @@ static __attribute__((unused)) const char *TAG = "secure_boot";

 esp_err_t esp_secure_boot_enable_secure_features(void)
 {
-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@ -31,6 +31,8 @@
 #include "esp32h2/rom/secure_boot.h"
 #endif

+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
 /* Checking signatures as part of verifying images is necessary:
   - Always if secure boot is enabled
   - Differently in bootloader and/or app, depending on kconfig
@ -102,7 +104,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    while(0)

 static esp_err_t process_image_header(esp_image_metadata_t *data, uint32_t part_offset, bootloader_sha256_handle_t *sha_handle, bool do_verify, bool silent);
-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent);
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent);
 static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data, bool silent, bool skip_check_checksum);

 static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
@ -152,7 +154,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    CHECK_ERR(process_segments(data, silent, do_load, sha_handle, checksum));
    bool skip_check_checksum = !do_verify || esp_cpu_in_ocd_debug_mode();
    CHECK_ERR(process_checksum(sha_handle, checksum_word, data, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(data, part->size, do_verify, silent));
+    CHECK_ERR(process_appended_hash_and_sig(data, part->offset, part->size, do_verify, silent));
    if (verify_sha) {
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
        // secure boot images have a signature appended
@ -250,7 +252,11 @@ esp_err_t bootloader_load_image(const esp_partition_pos_t *part, esp_image_metad
 #if CONFIG_BOOTLOADER_SKIP_VALIDATE_ALWAYS
    mode = ESP_IMAGE_LOAD_NO_VALIDATE;
 #elif CONFIG_BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
-    if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON) {
+    if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON
+#if SOC_EFUSE_HAS_EFUSE_RST_BUG
+        || esp_rom_get_reset_reason(0) == RESET_REASON_CORE_EFUSE_CRC
+#endif
+        ) {
        mode = ESP_IMAGE_LOAD_NO_VALIDATE;
    }
 #endif // CONFIG_BOOTLOADER_SKIP_...
@ -288,7 +294,7 @@ esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_meta
    CHECK_ERR(process_segments(metadata, silent, do_load, NULL, NULL));
    bool skip_check_checksum = true;
    CHECK_ERR(process_checksum(NULL, 0, metadata, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(metadata, part->size, true, silent));
+    CHECK_ERR(process_appended_hash_and_sig(metadata, part->offset, part->size, true, silent));
    return ESP_OK;
 err:
    return err;
@ -737,7 +743,7 @@ esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
                            data);
 }

-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent)
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent)
 {
    esp_err_t err = ESP_OK;
    if (data->image.hash_appended) {
@ -748,8 +754,34 @@ static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part
        data->image_len += HASH_LEN;
    }

-    if (data->image_len > part_len) {
-        FAIL_LOAD("Image length %d doesn't fit in partition length %d", data->image_len, part_len);
+    uint32_t sig_block_len = 0;
+    const uint32_t end = data->image_len;
+#if CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    // Case I: Bootloader part
+    if (part_offset == ESP_BOOTLOADER_OFFSET) {
+        // For bootloader with secure boot v1, signature stays in an independant flash
+        // sector (offset 0x0)  and does not get appended to the image.
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    } else {
+    // Case II: Application part
+#if CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+        sig_block_len = sizeof(esp_secure_boot_sig_block_t);
+#else
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    }
+#endif // CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    const uint32_t full_image_len = end + sig_block_len;
+    if (full_image_len > part_len) {
+        FAIL_LOAD("Image length %d doesn't fit in partition length %d", full_image_len, part_len);
    }
    return err;
 err:
@ -810,7 +842,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 #if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
-    uint32_t padded_end = (end + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE-1);
+    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
    if (padded_end > end) {
        const void *padding = bootloader_mmap(end, padded_end - end);
        bootloader_sha256_data(sha_handle, padding, padded_end - end);
@ -901,6 +933,12 @@ int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size)
        return 8 * 1024 * 1024;
    case ESP_IMAGE_FLASH_SIZE_16MB:
        return 16 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        return 32 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        return 64 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        return 128 * 1024 * 1024;
    default:
        return 0;
    }
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@ -174,7 +174,12 @@ void esp_flash_encryption_set_release_mode(void)
    ESP_LOGE(TAG, "Flash Encryption support not added, abort..");
    abort();
 #endif
+
+#if CONFIG_SOC_SUPPORTS_SECURE_DL_MODE
+    esp_efuse_enable_rom_secure_download_mode();
+#else
    esp_efuse_disable_rom_download_mode();
+#endif
    esp_efuse_batch_write_commit();

    if (esp_get_flash_encryption_mode() != ESP_FLASH_ENC_MODE_RELEASE) {
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@ -104,7 +104,8 @@ static esp_err_t check_and_generate_encryption_keys(void)
 #endif // CONFIG_SECURE_FLASH_ENCRYPTION_AES256
 #endif // CONFIG_IDF_TARGET_ESP32

-    esp_efuse_block_t blocks[BLOCKS_NEEDED];
+    /* Initialize all efuse block entries to invalid (max) value */
+    esp_efuse_block_t blocks[BLOCKS_NEEDED] = {[0 ... BLOCKS_NEEDED-1] = EFUSE_BLK_KEY_MAX};
    bool has_key = true;
    for (unsigned i = 0; i < BLOCKS_NEEDED; i++) {
        bool tmp_has_key = esp_efuse_find_purpose(purposes[i], &blocks[i]);
--- a/components/bootloader_support/src/flash_qio_mode.c
+++ b/components/bootloader_support/src/flash_qio_mode.c
@ -30,39 +30,6 @@

 static const char *TAG = "qio_mode";

-typedef unsigned (*read_status_fn_t)(void);
-typedef void (*write_status_fn_t)(unsigned);
-
-typedef struct __attribute__((packed))
-{
-    const char *manufacturer;
-    uint8_t mfg_id; /* 8-bit JEDEC manufacturer ID */
-    uint16_t flash_id; /* 16-bit JEDEC flash chip ID */
-    uint16_t id_mask; /* Bits to match on in flash chip ID */
-    read_status_fn_t read_status_fn;
-    write_status_fn_t write_status_fn;
-    uint8_t status_qio_bit;
-} qio_info_t;
-
-/* Read 8 bit status using RDSR command */
-static unsigned read_status_8b_rdsr(void);
-/* Read 8 bit status (second byte) using RDSR2 command */
-static unsigned read_status_8b_rdsr2(void);
-/* read 16 bit status using RDSR & RDSR2 (low and high bytes) */
-static unsigned read_status_16b_rdsr_rdsr2(void);
-
-/* Write 8 bit status using WRSR */
-static void write_status_8b_wrsr(unsigned new_status);
-/* Write 8 bit status (second byte) using WRSR2 */
-static void write_status_8b_wrsr2(unsigned new_status);
-/* Write 16 bit status using WRSR */
-static void write_status_16b_wrsr(unsigned new_status);
-
-/* Read 8 bit status of XM25QU64A  */
-static unsigned read_status_8b_xmc25qu64a(void);
-/* Write 8 bit status of XM25QU64A */
-static void write_status_8b_xmc25qu64a(unsigned new_status);
-
 /* Array of known flash chips and data to enable Quad I/O mode

   Manufacturer & flash ID can be tested by running "esptool.py
@ -75,13 +42,14 @@ static void write_status_8b_xmc25qu64a(unsigned new_status);

   Searching of this table stops when the first match is found.
 */
-const static qio_info_t chip_data[] = {
+const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_support_list[] = {
    /*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,               QIE Bit */
-    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 },
-    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
-    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
-    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
-    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
+    { "MXIC",        0xC2,   0x2000, 0xFF00,    bootloader_read_status_8b_rdsr,        bootloader_write_status_8b_wrsr,       6 },
+    { "ISSI",        0x9D,   0x4000, 0xCF00,    bootloader_read_status_8b_rdsr,        bootloader_write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
+    { "WinBond",     0xEF,   0x4000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },
+    { "GD",          0xC8,   0x6000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },
+    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    bootloader_read_status_8b_xmc25qu64a,  bootloader_write_status_8b_xmc25qu64a, 6 },
+    { "TH",          0xcd,   0x6000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },

    /* Final entry is default entry, if no other IDs have matched.

@ -90,13 +58,13 @@ const static qio_info_t chip_data[] = {
       FM25Q32 (QOUT mode only, mfg ID 0xA1, flash IDs including 4016)
       BY25Q32 (mfg ID 0x68, flash IDs including 4016)
    */
-    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2,      1 },
+    { NULL,          0xFF,    0xFFFF, 0xFFFF,   bootloader_read_status_8b_rdsr2,       bootloader_write_status_8b_wrsr2,      1 },
 };

-#define NUM_CHIPS (sizeof(chip_data) / sizeof(qio_info_t))
+#define NUM_CHIPS (sizeof(bootloader_flash_qe_support_list) / sizeof(bootloader_qio_info_t))

-static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
-                                 write_status_fn_t write_status_fn,
+static esp_err_t enable_qio_mode(bootloader_flash_read_status_fn_t read_status_fn,
+                                 bootloader_flash_write_status_fn_t write_status_fn,
                                 uint8_t status_qio_bit);

 /* Generic function to use the "user command" SPI controller functionality
@ -123,9 +91,9 @@ void bootloader_enable_qio_mode(void)
    ESP_LOGD(TAG, "Manufacturer ID 0x%02x chip ID 0x%04x", mfg_id, flash_id);

    for (i = 0; i < NUM_CHIPS - 1; i++) {
-        const qio_info_t *chip = &chip_data[i];
+        const bootloader_qio_info_t *chip = &bootloader_flash_qe_support_list[i];
        if (mfg_id == chip->mfg_id && (flash_id & chip->id_mask) == (chip->flash_id & chip->id_mask)) {
-            ESP_LOGI(TAG, "Enabling QIO for flash chip %s", chip_data[i].manufacturer);
+            ESP_LOGI(TAG, "Enabling QIO for flash chip %s", bootloader_flash_qe_support_list[i].manufacturer);
            break;
        }
    }
@ -133,16 +101,16 @@ void bootloader_enable_qio_mode(void)
    if (i == NUM_CHIPS - 1) {
        ESP_LOGI(TAG, "Enabling default flash chip QIO");
    }
-    enable_qio_mode(chip_data[i].read_status_fn,
-                    chip_data[i].write_status_fn,
-                    chip_data[i].status_qio_bit);
+    enable_qio_mode(bootloader_flash_qe_support_list[i].read_status_fn,
+                    bootloader_flash_qe_support_list[i].write_status_fn,
+                    bootloader_flash_qe_support_list[i].status_qio_bit);
 #if SOC_CACHE_SUPPORT_WRAP
    bootloader_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
 #endif
 }

-static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
-                                 write_status_fn_t write_status_fn,
+static esp_err_t enable_qio_mode(bootloader_flash_read_status_fn_t read_status_fn,
+                                 bootloader_flash_write_status_fn_t write_status_fn,
                                 uint8_t status_qio_bit)
 {
    uint32_t status;
@ -190,37 +158,47 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
    return ESP_OK;
 }

-static unsigned read_status_8b_rdsr(void)
+unsigned bootloader_read_status_8b_rdsr(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
 }

-static unsigned read_status_8b_rdsr2(void)
+unsigned bootloader_read_status_8b_rdsr2(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
 }

-static unsigned read_status_16b_rdsr_rdsr2(void)
+unsigned bootloader_read_status_8b_rdsr3(void)
+{
+    return bootloader_execute_flash_command(CMD_RDSR3, 0, 0, 8);
+}
+
+unsigned bootloader_read_status_16b_rdsr_rdsr2(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
 }

-static void write_status_8b_wrsr(unsigned new_status)
+void bootloader_write_status_8b_wrsr(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
 }

-static void write_status_8b_wrsr2(unsigned new_status)
+void bootloader_write_status_8b_wrsr2(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR2, new_status, 8, 0);
 }

-static void write_status_16b_wrsr(unsigned new_status)
+void bootloader_write_status_8b_wrsr3(unsigned new_status)
+{
+    bootloader_execute_flash_command(CMD_WRSR3, new_status, 8, 0);
+}
+
+void bootloader_write_status_16b_wrsr(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }

-static unsigned read_status_8b_xmc25qu64a(void)
+unsigned bootloader_read_status_8b_xmc25qu64a(void)
 {
    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
@ -229,7 +207,7 @@ static unsigned read_status_8b_xmc25qu64a(void)
    return read_status;
 }

-static void write_status_8b_xmc25qu64a(unsigned new_status)
+void bootloader_write_status_8b_xmc25qu64a(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot.c
@ -156,11 +156,11 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
        return ret;
    }

+    /* Initialize all efuse block entries to invalid (max) value */
+    esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS] = {[0 ... SECURE_BOOT_NUM_BLOCKS-1] = EFUSE_BLK_KEY_MAX};
    /* Check if secure boot digests are present */
-    esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS];
    bool has_secure_boot_digest = false;
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
-        blocks[i] = EFUSE_BLK_KEY_MAX;
        bool tmp_has_key = esp_efuse_find_purpose(secure_boot_key_purpose[i], &blocks[i]);
        if (tmp_has_key) { // For ESP32: esp_efuse_find_purpose() always returns True, need to check whether the key block is used or not.
            tmp_has_key &= !esp_efuse_key_block_unused(blocks[i]);
@ -198,6 +198,12 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
        }
    } else {
        for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+            /* Check if corresponding digest slot is used or not */
+            if (blocks[i] == EFUSE_BLK_KEY_MAX) {
+                ESP_LOGD(TAG, "SECURE_BOOT_DIGEST%d slot is not used", i);
+                continue;
+            }
+
 #if SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
            if (esp_efuse_get_digest_revoke(i)) {
                continue;
@ -241,7 +247,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t

    ESP_LOGI(TAG, "%d signature block(s) found appended to the app.", app_key_digests.num_digests);
    if (app_key_digests.num_digests > boot_key_digests.num_digests) {
-        ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?");
+        ESP_LOGW(TAG, "App has %d signature blocks but bootloader only has %d. Some keys missing from bootloader?", app_key_digests.num_digests, boot_key_digests.num_digests);
    }

    /* Confirm if at least one public key from the application matches a public key in the bootloader
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
@ -137,10 +137,13 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
 #if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS == 1
    int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, trusted.key_digests[0], verified_digest);
 #else
-    ets_secure_boot_key_digests_t trusted_key_digests;
+    ets_secure_boot_key_digests_t trusted_key_digests = {0};
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
    }
+    // Key revocation happens in ROM bootloader.
+    // Do NOT allow key revocation while verifying application
+    trusted_key_digests.allow_key_revoke = false;
    int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_key_digests, verified_digest);
 #endif
    if (sb_result != SB_SUCCESS) {
--- a/components/bootloader_support/test_apps/rtc_custom_section/CMakeLists.txt
+++ b/components/bootloader_support/test_apps/rtc_custom_section/CMakeLists.txt
@ -0,0 +1,6 @@
+# The following lines of boilerplate have to be in your project's
+# CMakeLists in this exact order for cmake to work correctly
+cmake_minimum_required(VERSION 3.5)
+
+include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+project(test_rtc_custom_section)
--- a/components/bootloader_support/test_apps/rtc_custom_section/README.md
+++ b/components/bootloader_support/test_apps/rtc_custom_section/README.md
@ -0,0 +1,2 @@
+| Supported Targets | ESP32 | ESP32-C3 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- |
--- a/components/bootloader_support/test_apps/rtc_custom_section/main/CMakeLists.txt
+++ b/components/bootloader_support/test_apps/rtc_custom_section/main/CMakeLists.txt
@ -0,0 +1,2 @@
+idf_component_register(SRCS "test_main.c"
+                       INCLUDE_DIRS ".")
--- a/components/bootloader_support/test_apps/rtc_custom_section/main/test_main.c
+++ b/components/bootloader_support/test_apps/rtc_custom_section/main/test_main.c
@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "bootloader_common.h"
+#include <stdio.h>
+#include "sdkconfig.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+
+#define TEST_MAGIC_VALUE 0x42987561
+
+extern rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void);
+
+void app_main(void) {
+    rtc_retain_mem_t* mem = bootloader_common_get_rtc_retain_mem();
+    uint32_t* _rtc_vars = (uint32_t*) mem->custom;
+
+    if (_rtc_vars[0] != TEST_MAGIC_VALUE) {
+        /* On the first boot, set the data inside the array */
+        _rtc_vars[0] = TEST_MAGIC_VALUE;
+    } else {
+        /* Second boot, the data was saved saved, success */
+        printf("SUCCESS: data were saved across reboot\n");
+        vTaskDelay(10000 / portTICK_PERIOD_MS);
+    }
+
+    esp_restart();
+}
--- a/components/bootloader_support/test_apps/rtc_custom_section/sdkconfig.defaults
+++ b/components/bootloader_support/test_apps/rtc_custom_section/sdkconfig.defaults
@ -0,0 +1,3 @@
+CONFIG_BOOTLOADER_RESERVE_RTC_SIZE=0x10
+CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC=y
+CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE=0x200
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -6,7 +6,7 @@ if(CONFIG_BT_ENABLED)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
        set(srcs "controller/esp32c3/bt.c")
    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        set(srcs "controller/esp32s3/bt.c")
+        set(srcs "controller/esp32c3/bt.c")
    endif()

    set(include_dirs common/osi/include)
@ -16,7 +16,7 @@ if(CONFIG_BT_ENABLED)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
        list(APPEND include_dirs include/esp32c3/include)
    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        list(APPEND include_dirs include/esp32s3/include)
+        list(APPEND include_dirs include/esp32c3/include)
    endif()

    list(APPEND priv_include_dirs
@ -38,6 +38,8 @@ if(CONFIG_BT_ENABLED)
         "common/osi/buffer.c"
         "common/osi/config.c"
         "common/osi/fixed_queue.c"
+         "common/osi/pkt_queue.c"
+         "common/osi/fixed_pkt_queue.c"
         "common/osi/future.c"
         "common/osi/hash_functions.c"
         "common/osi/hash_map.c"
--- a/components/bt/common/api/esp_blufi_api.c
+++ b/components/bt/common/api/esp_blufi_api.c
@ -46,7 +46,8 @@ esp_err_t esp_blufi_send_wifi_conn_report(wifi_mode_t opmode, esp_blufi_sta_conn
    arg.wifi_conn_report.softap_conn_num = softap_conn_num;
    arg.wifi_conn_report.extra_info = extra_info;

-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

 esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list)
@ -62,7 +63,8 @@ esp_err_t esp_blufi_send_wifi_list(uint16_t apCount, esp_blufi_ap_record_t *list
    arg.wifi_list.apCount = apCount;
    arg.wifi_list.list = list;

-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

 esp_err_t esp_blufi_profile_init(void)
@ -75,7 +77,7 @@ esp_err_t esp_blufi_profile_init(void)
    msg.pid = BTC_PID_BLUFI;
    msg.act = BTC_BLUFI_ACT_INIT;

-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

 esp_err_t esp_blufi_profile_deinit(void)
@ -88,7 +90,7 @@ esp_err_t esp_blufi_profile_deinit(void)
    msg.pid = BTC_PID_BLUFI;
    msg.act = BTC_BLUFI_ACT_DEINIT;

-    return (btc_transfer_context(&msg, NULL, 0, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

 uint16_t esp_blufi_get_version(void)
@ -108,7 +110,7 @@ esp_err_t esp_blufi_send_error_info(esp_blufi_error_state_t state)
    msg.act = BTC_BLUFI_ACT_SEND_ERR_INFO;
    arg.blufi_err_infor.state = state;

-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

 esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)
@ -126,6 +128,7 @@ esp_err_t esp_blufi_send_custom_data(uint8_t *data, uint32_t data_len)
    arg.custom_data.data = data;
    arg.custom_data.data_len = data_len;

-    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_blufi_args_t), btc_blufi_call_deep_copy,
+                btc_blufi_call_deep_free) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 #endif  ///BLUFI_INCLUDED == TRUE
--- a/components/bt/common/api/include/api/esp_blufi_api.h
+++ b/components/bt/common/api/include/api/esp_blufi_api.h
@ -57,6 +57,8 @@ typedef enum {
 typedef enum {
    ESP_BLUFI_STA_CONN_SUCCESS = 0x00,
    ESP_BLUFI_STA_CONN_FAIL    = 0x01,
+    ESP_BLUFI_STA_CONNECTING   = 0x02,
+    ESP_BLUFI_STA_NO_IP        = 0x03,
 } esp_blufi_sta_conn_state_t;

 /// BLUFI init status
@ -82,6 +84,9 @@ typedef enum {
    ESP_BLUFI_READ_PARAM_ERROR,
    ESP_BLUFI_MAKE_PUBLIC_ERROR,
    ESP_BLUFI_DATA_FORMAT_ERROR,
+    ESP_BLUFI_CALC_MD5_ERROR,
+    ESP_BLUFI_WIFI_SCAN_FAIL,
+    ESP_BLUFI_MSG_STATE_ERROR,
 } esp_blufi_error_state_t;

 /**
@ -105,6 +110,12 @@ typedef struct {
    bool softap_max_conn_num_set;   /*!< is max connection number of softap interface set */
    uint8_t softap_channel;         /*!< channel of softap interface */
    bool softap_channel_set;        /*!< is channel of softap interface set */
+    uint8_t sta_max_conn_retry;     /*!< max retry of sta establish connection */
+    bool sta_max_conn_retry_set;    /*!< is max retry of sta establish connection set */
+    uint8_t sta_conn_end_reason;    /*!< reason of sta connection end */
+    bool sta_conn_end_reason_set;   /*!< is reason of sta connection end set */
+    int8_t sta_conn_rssi;           /*!< rssi of sta connection */
+    bool sta_conn_rssi_set;         /*!< is rssi of sta connection set */
 } esp_blufi_extra_info_t;

 /** @brief Description of an WiFi AP */
@ -114,9 +125,9 @@ typedef struct {
 } esp_blufi_ap_record_t;

 /// Bluetooth address length
-#define ESP_BD_ADDR_LEN     6
+#define ESP_BLUFI_BD_ADDR_LEN     6
 /// Bluetooth device address
-typedef uint8_t esp_bd_addr_t[ESP_BD_ADDR_LEN];
+typedef uint8_t esp_blufi_bd_addr_t[ESP_BLUFI_BD_ADDR_LEN];

 /**
 * @brief BLUFI callback parameters union
@ -147,7 +158,7 @@ typedef union {
     * @brief ESP_BLUFI_EVENT_CONNECT
 	 */
    struct blufi_connect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
        uint8_t    server_if;                       /*!< server interface */
        uint16_t   conn_id;                         /*!< Connection id */
    } connect;									    /*!< Blufi callback param of ESP_BLUFI_EVENT_CONNECT */
@ -156,7 +167,7 @@ typedef union {
     * @brief ESP_BLUFI_EVENT_DISCONNECT
 	 */
    struct blufi_disconnect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
    } disconnect;									/*!< Blufi callback param of ESP_BLUFI_EVENT_DISCONNECT */

    /* ESP_BLUFI_EVENT_REQ_WIFI_CONNECT */          /* No callback param */
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@ -62,6 +62,10 @@
 #endif /* #if CLASSIC_BT_INCLUDED */
 #endif

+#if (BLE_INCLUDED == TRUE)
+#include "btc_gap_ble.h"
+#endif
+
 #if CONFIG_BLE_MESH
 #include "btc_ble_mesh_ble.h"
 #include "btc_ble_mesh_prov.h"
@ -77,6 +81,9 @@
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
 #define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
+#define BTC_TASK_WORKQUEUE_NUM          (2)
+#define BTC_TASK_WORKQUEUE0_LEN         (0)
+#define BTC_TASK_WORKQUEUE1_LEN         (5)

 osi_thread_t *btc_thread;

@ -199,24 +206,12 @@ static void btc_thread_handler(void *arg)
        break;
    }

-    if (msg->arg) {
-        osi_free(msg->arg);
-    }
    osi_free(msg);
 }

 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
        return BT_STATUS_BUSY;
    }

@ -229,52 +224,61 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 * @param  arg       paramter
 * @param  arg_len   length of paramter
 * @param  copy_func deep copy function
+ * @param  free_func deep free function
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
 */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func)
 {
-    btc_msg_t lmsg;
-
-    if (msg == NULL) {
+    btc_msg_t* lmsg;
+    bt_status_t ret;
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
+        BTC_TRACE_WARNING("%s Invalid parameters\n", __func__);
        return BT_STATUS_PARM_INVALID;
    }

    BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);

-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t) + arg_len);
+    if (lmsg == NULL) {
+        BTC_TRACE_WARNING("%s No memory\n", __func__);
+        return BT_STATUS_NOMEM;
    }

-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    }

+    ret = btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);
+    if (ret != BT_STATUS_SUCCESS) {
+        if (copy_func && free_func) {
+            free_func(lmsg);
+        }
+        osi_free(lmsg);
+    }
+
+    return ret;
 }

 /**
 * transfer an message to another module in tha same task.
 * @param  msg       message
- * @param  arg       paramter
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
 */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg)
+bt_status_t btc_inter_profile_call(btc_msg_t *msg)
 {
    if (msg == NULL) {
        return BT_STATUS_PARM_INVALID;
    }

-    msg->arg = arg;
    switch (msg->sig) {
    case BTC_SIG_API_CALL:
        profile_tab[msg->pid].btc_call(msg);
@ -410,7 +414,9 @@ error_exit:;

 bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    const size_t workqueue_len[] = {BTC_TASK_WORKQUEUE0_LEN, BTC_TASK_WORKQUEUE1_LEN};
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE,
+                                   BTC_TASK_WORKQUEUE_NUM, workqueue_len);
    if (btc_thread == NULL) {
        return BT_STATUS_NOMEM;
    }
@ -423,6 +429,7 @@ bt_status_t btc_init(void)

 #if (BLE_INCLUDED == TRUE)
    btc_gap_callback_init();
+    btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE

 #if SCAN_QUEUE_CONGEST_CHECK
@ -440,7 +447,9 @@ void btc_deinit(void)

    osi_thread_free(btc_thread);
    btc_thread = NULL;
-
+#if (BLE_INCLUDED == TRUE)
+    btc_gap_ble_deinit();
+#endif  ///BLE_INCLUDED == TRUE
 #if SCAN_QUEUE_CONGEST_CHECK
    btc_adv_list_deinit();
 #endif
@ -459,3 +468,8 @@ int get_btc_work_queue_size(void)
 {
    return osi_thread_queue_wait_size(btc_thread, 0);
 }
+
+osi_thread_t *btc_get_current_thread(void)
+{
+    return btc_thread;
+}
--- a/components/bt/common/btc/include/btc/btc_task.h
+++ b/components/bt/common/btc/include/btc/btc_task.h
@ -28,7 +28,7 @@ typedef struct btc_msg {
    uint8_t aid;    //application id
    uint8_t pid;    //profile id
    uint8_t act;    //profile action, defined in seprerate header files
-    void   *arg;    //param for btc function or function param
+    UINT8   arg[0]; //param for btc function or function param
 } btc_msg_t;

 typedef struct btc_adv_packet {
@ -100,6 +100,7 @@ typedef struct {
 } btc_func_t;

 typedef void (* btc_arg_deep_copy_t)(btc_msg_t *msg, void *dst, void *src);
+typedef void (* btc_arg_deep_free_t)(btc_msg_t *msg);

 #ifdef __cplusplus
 extern "C" {
@ -111,25 +112,33 @@ extern "C" {
 * @param  arg       paramter
 * @param  arg_len   length of paramter
 * @param  copy_func deep copy function
+ * @param  free_func deep free function
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
 */
-bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func);
+bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func,
+                                    btc_arg_deep_free_t free_func);

 /**
 * transfer an message to another module in tha same task.
 * @param  msg       message
- * @param  arg       paramter
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
 */
-bt_status_t btc_inter_profile_call(btc_msg_t *msg, void *arg);
+bt_status_t btc_inter_profile_call(btc_msg_t *msg);

 bt_status_t btc_init(void);
 void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);

+/**
+ * get the BTC thread handle
+ * @return           NULL: fail
+ *                   others: pointer of osi_thread structure of BTC
+ */
+osi_thread_t *btc_get_current_thread(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
@ -144,7 +144,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
        param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;

-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);

        break;
    }
@ -283,7 +283,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        msg.act = ESP_BLUFI_EVENT_INIT_FINISH;
        param.init_finish.state = ESP_BLUFI_INIT_OK;

-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
        break;
    }
    case BTA_GATTS_CONNECT_EVT: {
@ -295,7 +295,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                        BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                        p_data->conn.reason, p_data->conn.conn_id);

-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.conn_id = p_data->conn.conn_id;
        blufi_env.is_connected = true;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
@ -303,11 +303,11 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_CONNECT;
-        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        param.connect.conn_id = BTC_GATT_GET_CONN_ID(p_data->conn.conn_id);
        conn_id = param.connect.conn_id;
        server_if = p_data->conn.server_if;
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
        break;
    }
    case BTA_GATTS_DISCONNECT_EVT: {
@ -320,16 +320,22 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                        BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                        p_data->conn.reason, p_data->conn.conn_id);

-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.conn_id = p_data->conn.conn_id;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
        blufi_env.sec_mode = 0x0;
+        blufi_env.offset = 0;
+
+        if (blufi_env.aggr_buf != NULL) {
+            osi_free(blufi_env.aggr_buf);
+            blufi_env.aggr_buf = NULL;
+        }

        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
        break;
    }
    case BTA_GATTS_OPEN_EVT:
@ -379,8 +385,6 @@ void esp_blufi_send_encap(void *arg)
 retry:
    if (blufi_env.is_connected == false) {
        BTC_TRACE_WARNING("%s ble connection is broken\n", __func__);
-        osi_free(hdr);
-        hdr =  NULL;
        return;
    }
    if (esp_ble_get_cur_sendable_packets_num(BTC_GATT_GET_CONN_ID(blufi_env.conn_id)) > 0) {
@ -404,7 +408,7 @@ esp_err_t esp_blufi_close(esp_gatt_if_t gatts_if, uint16_t conn_id)
    msg.pid = BTC_PID_GATTS;
    msg.act = BTC_GATTS_ACT_CLOSE;
    arg.close.conn_id = BTC_GATT_CREATE_CONN_ID(gatts_if, conn_id);
-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t), NULL)
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_gatts_args_t), NULL, NULL)
            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

--- a/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
@ -98,7 +98,7 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)
    msg.act = ESP_BLUFI_EVENT_REPORT_ERROR;
    esp_blufi_cb_param_t param;
    param.report_error.state = state;
-    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 }

 void btc_blufi_recv_handler(uint8_t *data, int len)
@ -144,6 +144,16 @@ void btc_blufi_recv_handler(uint8_t *data, int len)

    if (BLUFI_FC_IS_FRAG(hdr->fc)) {
        if (blufi_env.offset == 0) {
+            /*
+            blufi_env.aggr_buf should be NULL if blufi_env.offset is 0.
+            It is possible that the process of sending fragment packet
+            has not been completed
+            */
+            if (blufi_env.aggr_buf) {
+                BTC_TRACE_ERROR("%s msg error, blufi_env.aggr_buf is not freed\n", __func__);
+                btc_blufi_report_error(ESP_BLUFI_MSG_STATE_ERROR);
+                return;
+            }
            blufi_env.total_len = hdr->data[0] | (((uint16_t) hdr->data[1]) << 8);
            blufi_env.aggr_buf = osi_malloc(blufi_env.total_len);
            if (blufi_env.aggr_buf == NULL) {
@ -163,6 +173,18 @@ void btc_blufi_recv_handler(uint8_t *data, int len)

    } else {
        if (blufi_env.offset > 0) {   /* if previous pkt is frag */
+            /* blufi_env.aggr_buf should not be NULL */
+            if (blufi_env.aggr_buf == NULL) {
+                BTC_TRACE_ERROR("%s buffer is NULL\n", __func__);
+                btc_blufi_report_error(ESP_BLUFI_DH_MALLOC_ERROR);
+                return;
+            }
+            /* payload length should be equal to total_len */
+            if ((blufi_env.offset + hdr->data_len) != blufi_env.total_len) {
+                BTC_TRACE_ERROR("%s payload is longer than packet length, len %d \n", __func__, blufi_env.total_len);
+                btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+                return;
+            }
            memcpy(blufi_env.aggr_buf + blufi_env.offset, hdr->data, hdr->data_len);

            btc_blufi_protocol_handler(hdr->type, blufi_env.aggr_buf, blufi_env.total_len);
@ -321,6 +343,21 @@ static void btc_blufi_wifi_conn_report(uint8_t opmode, uint8_t sta_conn_state, u
            *p++ = 1;
            *p++ = info->softap_channel;
        }
+        if (info->sta_max_conn_retry_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_MAX_CONN_RETRY;
+            *p++ = 1;
+            *p++ = info->sta_max_conn_retry;
+        }
+        if (info->sta_conn_end_reason_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_END_REASON;
+            *p++ = 1;
+            *p++ = info->sta_conn_end_reason;
+        }
+        if (info->sta_conn_rssi_set) {
+            *p++ = BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_RSSI;
+            *p++ = 1;
+            *p++ = info->sta_conn_rssi;
+        }
    }
    if (p - data > data_len) {
        BTC_TRACE_ERROR("%s len error %d %d\n", __func__, (int)(p - data), data_len);
@ -714,6 +751,21 @@ void btc_blufi_call_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
            dst->wifi_conn_report.extra_info->softap_channel = src_info->softap_channel;
            dst->wifi_conn_report.extra_info_len += (1 + 2);
        }
+        if (src_info->sta_max_conn_retry_set) {
+            dst->wifi_conn_report.extra_info->sta_max_conn_retry_set = src_info->sta_max_conn_retry_set;
+            dst->wifi_conn_report.extra_info->sta_max_conn_retry = src_info->sta_max_conn_retry;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
+        if (src_info->sta_conn_end_reason_set) {
+            dst->wifi_conn_report.extra_info->sta_conn_end_reason_set = src_info->sta_conn_end_reason_set;
+            dst->wifi_conn_report.extra_info->sta_conn_end_reason = src_info->sta_conn_end_reason;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
+        if (src_info->sta_conn_rssi_set) {
+            dst->wifi_conn_report.extra_info->sta_conn_rssi_set = src_info->sta_conn_rssi_set;
+            dst->wifi_conn_report.extra_info->sta_conn_rssi = src_info->sta_conn_rssi;
+            dst->wifi_conn_report.extra_info_len += (1 + 2);
+        }
        break;
    }
    case BTC_BLUFI_ACT_SEND_WIFI_LIST:{
--- a/components/bt/common/btc/profile/esp/blufi/blufi_protocol.c
+++ b/components/bt/common/btc/profile/esp/blufi/blufi_protocol.c
@ -51,35 +51,35 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_SET_WIFI_OPMODE;
            param.wifi_mode.op_mode = data[0];

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_CONN_TO_AP:
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_REQ_CONNECT_TO_AP;

-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_DISCONN_FROM_AP:
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_REQ_DISCONNECT_FROM_AP;

-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_STATUS:
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_GET_WIFI_STATUS;

-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_DEAUTHENTICATE_STA:
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_DEAUTHENTICATE_STA;

-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL,NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_GET_VERSION: {
            uint8_t type = BLUFI_BUILD_TYPE(BLUFI_TYPE_DATA, BLUFI_TYPE_DATA_SUBTYPE_REPLY_VERSION);
@ -94,13 +94,13 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_RECV_SLAVE_DISCONNECT_BLE;
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
            break;
        case BLUFI_TYPE_CTRL_SUBTYPE_GET_WIFI_LIST:
            msg.sig = BTC_SIG_API_CB;
            msg.pid = BTC_PID_BLUFI;
            msg.act = ESP_BLUFI_EVENT_GET_WIFI_LIST;
-            btc_transfer_context(&msg, NULL, 0, NULL);
+            btc_transfer_context(&msg, NULL, 0, NULL, NULL);
            break;
        default:
            BTC_TRACE_ERROR("%s Unkown Ctrl pkt %02x\n", __func__, type);
@ -125,7 +125,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_RECV_STA_BSSID;
            memcpy(param.sta_bssid.bssid, &data[0], 6);

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_STA_SSID:
            msg.sig = BTC_SIG_API_CB;
@ -134,7 +134,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.sta_ssid.ssid = &data[0];
            param.sta_ssid.ssid_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_STA_PASSWD:
            msg.sig = BTC_SIG_API_CB;
@ -143,7 +143,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.sta_passwd.passwd = &data[0];
            param.sta_passwd.passwd_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_SSID:
            msg.sig = BTC_SIG_API_CB;
@ -152,7 +152,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.softap_ssid.ssid = &data[0];
            param.softap_ssid.ssid_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_PASSWD:
            msg.sig = BTC_SIG_API_CB;
@ -161,7 +161,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.softap_passwd.passwd = &data[0];
            param.softap_passwd.passwd_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_MAX_CONN_NUM:
            msg.sig = BTC_SIG_API_CB;
@ -169,7 +169,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_MAX_CONN_NUM;
            param.softap_max_conn_num.max_conn_num = data[0];

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_AUTH_MODE:
            msg.sig = BTC_SIG_API_CB;
@ -177,7 +177,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_AUTH_MODE;
            param.softap_auth_mode.auth_mode = data[0];

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SOFTAP_CHANNEL:
            msg.sig = BTC_SIG_API_CB;
@ -185,7 +185,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_RECV_SOFTAP_CHANNEL;
            param.softap_channel.channel = data[0];

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_USERNAME:
            msg.sig = BTC_SIG_API_CB;
@ -194,7 +194,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.username.name = &data[0];
            param.username.name_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_CA:
            msg.sig = BTC_SIG_API_CB;
@ -203,7 +203,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.ca.cert = &data[0];
            param.ca.cert_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_CLIENT_CERT:
            msg.sig = BTC_SIG_API_CB;
@ -212,7 +212,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.client_cert.cert = &data[0];
            param.client_cert.cert_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SERVER_CERT:
            msg.sig = BTC_SIG_API_CB;
@ -221,7 +221,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.client_cert.cert = &data[0];
            param.client_cert.cert_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_CLIENT_PRIV_KEY:
            msg.sig = BTC_SIG_API_CB;
@ -230,7 +230,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.client_pkey.pkey = &data[0];
            param.client_pkey.pkey_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_SERVER_PRIV_KEY:
            msg.sig = BTC_SIG_API_CB;
@ -239,7 +239,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            param.client_pkey.pkey = &data[0];
            param.client_pkey.pkey_len = len;

-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        case BLUFI_TYPE_DATA_SUBTYPE_CUSTOM_DATA:
            msg.sig = BTC_SIG_API_CB;
@ -247,7 +247,7 @@ void btc_blufi_protocol_handler(uint8_t type, uint8_t *data, int len)
            msg.act = ESP_BLUFI_EVENT_RECV_CUSTOM_DATA;
            param.custom_data.data = &data[0];
            param.custom_data.data_len = len;
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), btc_blufi_cb_deep_copy, btc_blufi_cb_deep_free);
            break;
        default:
            BTC_TRACE_ERROR("%s Unkown Ctrl pkt %02x\n", __func__, type);
--- a/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
@ -20,7 +20,7 @@
 #if (BLUFI_INCLUDED == TRUE)

 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
-#define BTC_BLUFI_SUB_VER     0x02  //Version + Subversion
+#define BTC_BLUFI_SUB_VER     0x03  //Version + Subversion
 #define BTC_BLUFI_VERSION     ((BTC_BLUFI_GREAT_VER<<8)|BTC_BLUFI_SUB_VER)  //Version + Subversion

 typedef UINT8 tGATT_IF;
@ -129,6 +129,9 @@ extern tBLUFI_ENV *blufi_env_ptr;
 #define BLUFI_TYPE_DATA_SUBTYPE_WIFI_LIST               0x11
 #define BLUFI_TYPE_DATA_SUBTYPE_ERROR_INFO              0x12
 #define BLUFI_TYPE_DATA_SUBTYPE_CUSTOM_DATA             0x13
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_MAX_CONN_RETRY      0x14
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_END_REASON     0x15
+#define BLUFI_TYPE_DATA_SUBTYPE_STA_CONN_RSSI           0x16
 #define BLUFI_TYPE_IS_CTRL(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_CTRL)
 #define BLUFI_TYPE_IS_DATA(type)        (BLUFI_GET_TYPE((type)) == BLUFI_TYPE_DATA)

--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@ -256,12 +256,12 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)

            rc = ble_gap_conn_find(event->connect.conn_handle, &desc);
            assert(rc == 0);
-            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, sizeof(esp_bd_addr_t));
+            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);

            param.connect.conn_id = event->connect.conn_handle;
            /* save connection handle */
            conn_handle = event->connect.conn_handle;
-            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+            btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
        }
        if (event->connect.status != 0) {
            /* Connection failed; resume advertising. */
@ -270,18 +270,25 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
        return 0;
    case BLE_GAP_EVENT_DISCONNECT:
        ESP_LOGI(TAG, "disconnect; reason=%d\n", event->disconnect.reason);
-        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.is_connected = false;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
        blufi_env.sec_mode = 0x0;
+        blufi_env.offset = 0;
+
+        if (blufi_env.aggr_buf != NULL) {
+            osi_free(blufi_env.aggr_buf);
+            blufi_env.aggr_buf = NULL;
+        }
+
        btc_msg_t msg;
        esp_blufi_cb_param_t param;

        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
-        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
+        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);

        return 0;
    case BLE_GAP_EVENT_CONN_UPDATE:
@ -412,7 +419,7 @@ void esp_blufi_deinit(void)
    msg.pid = BTC_PID_BLUFI;
    msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
    param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;
-    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
+    btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL, NULL);
 }

 void esp_blufi_send_notify(void *arg)
@ -420,9 +427,15 @@ void esp_blufi_send_notify(void *arg)
    struct pkt_info *pkts = (struct pkt_info *) arg;
    struct os_mbuf *om;
    om = ble_hs_mbuf_from_flat(pkts->pkt, pkts->pkt_len);
+    if (om == NULL) {
+        ESP_LOGE(TAG, "Error in allocating memory");
+        return;
+    }
    int rc = 0;
-    rc = ble_gattc_notify_custom(conn_handle, gatt_values[1].val_handle, om);
-    assert(rc == 0);
+    rc = ble_gatts_notify_custom(blufi_env.conn_id, gatt_values[1].val_handle, om);
+    if (rc != 0) {
+        ESP_LOGE(TAG, "Error in sending notification");
+    }
 }

 void esp_blufi_disconnect(void)
@ -437,8 +450,6 @@ void esp_blufi_send_encap(void *arg)
    struct blufi_hdr *hdr = (struct blufi_hdr *)arg;
    if (blufi_env.is_connected == false) {
        BTC_TRACE_WARNING("%s ble connection is broken\n", __func__);
-        osi_free(hdr);
-        hdr =  NULL;
        return;
    }
    btc_blufi_send_notify((uint8_t *)hdr,
--- a/components/bt/common/include/bt_common.h
+++ b/components/bt/common/include/bt_common.h
@ -62,6 +62,12 @@
 #define BTC_DYNAMIC_MEMORY         FALSE
 #endif

+#if UC_BT_BLUEDROID_MEM_DEBUG
+#define HEAP_MEMORY_DEBUG   TRUE
+#else
+#define HEAP_MEMORY_DEBUG   FALSE
+#endif
+
 #ifndef BT_BLE_DYNAMIC_ENV_MEMORY
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -93,4 +93,11 @@
 #define UC_BT_BLUFI_ENABLE                  FALSE
 #endif

+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */
--- a/components/bt/common/osi/alarm.c
+++ b/components/bt/common/osi/alarm.c
@ -143,13 +143,13 @@ static void alarm_cb_handler(struct alarm_t *alarm)
        OSI_TRACE_WARNING("%s, invalid state %d\n", __func__, alarm_state);
        return;
    }
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
    btc_alarm_args_t arg;
    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_ALARM;
    arg.cb = alarm->cb;
    arg.cb_data = alarm->cb_data;
-    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL);
+    btc_transfer_context(&msg, &arg, sizeof(btc_alarm_args_t), NULL, NULL);
 }

 osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback, void *data, period_ms_t timer_expire)
@ -173,7 +173,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
        goto end;
    }

-    esp_timer_create_args_t tca;
+    esp_timer_create_args_t tca = {0};
    tca.callback = (esp_timer_cb_t)alarm_cb_handler;
    tca.arg = timer_id;
    tca.dispatch_method = ESP_TIMER_TASK;
--- a/Show More
+++ b/Show More