versions: Update version to 4.4.3

Merge branch 'bugfix/backup_dma_stall_when_sw_rst_v4.4' into 'release/v4.4'
backport v4.4: force clear reset signal to fix the backup dma operation failure... See merge request espressif/esp-idf!20634
2022-11-08 16:22:14 +01:00 · 2022-10-20 17:06:58 +08:00 · 2022-10-18 15:52:55 +08:00 · 2022-10-17 17:58:38 +08:00 · 2022-10-17 11:07:51 +08:00 · 2022-10-14 17:52:07 +08:00
2089 changed files with 89091 additions and 49274 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -19,14 +19,6 @@ trim_trailing_whitespace = false
 indent_style = tab
 indent_size = 2

-[*/freertos/**]
-indent_style = tab
-indent_size = 4
-
-[{*/freertos/**.S,**/FreeRTOSConfig.h}]
-indent_style = space
-indent_size = 4
-
 [*.pem]
 insert_final_newline = false

--- a/.flake8
+++ b/.flake8
@ -152,6 +152,7 @@ exclude =
        components/openthread/openthread,
        components/tinyusb,
        components/unity/unity,
+        components/spiffs/spiffs,
        examples/build_system/cmake/import_lib/main/lib/tinyxml2,
        examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
    # autogenerated scripts
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -0,0 +1,75 @@
+name: docker
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release/*'
+    tags:
+      - 'v*.*'
+
+env:
+  # Platforms to build the image for
+  BUILD_PLATFORMS: linux/amd64,linux/arm64
+  DOCKERHUB_REPO: ${{ github.repository_owner }}/idf
+
+jobs:
+  docker:
+    # Disable the job in forks
+    if: ${{ github.repository_owner == 'espressif' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
+      # as a build arg) and TAG_NAME (used when tagging the image).
+      #
+      # The following 3 steps cover the alternatives (tag, release branch, master branch):
+      - name: Set variables (tags)
+        if: ${{ github.ref_type == 'tag' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
+      - name: Set variables (release branches)
+        if: ${{ github.ref_type == 'branch' && startsWith(github.ref_name, 'release/') }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "TAG_NAME=release-${GITHUB_REF_NAME##release/}" >> $GITHUB_ENV
+      - name: Set variables (main branch)
+        if: ${{ github.ref_type == 'branch' && github.ref_name == 'master' }}
+        run: |
+          echo "CLONE_BRANCH_OR_TAG=master" >> $GITHUB_ENV
+          echo "TAG_NAME=latest" >> $GITHUB_ENV
+
+      # Display the variables set above, just in case.
+      - name: Check variables
+        run: |
+          echo "CLONE_BRANCH_OR_TAG: $CLONE_BRANCH_OR_TAG"
+          echo "CHECKOUT_REF: $CHECKOUT_REF"
+          echo "TAG_NAME: $TAG_NAME"
+
+      # The following steps are the standard boilerplate from
+      # https://github.com/marketplace/actions/build-and-push-docker-images
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up QEMU for multiarch builds
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: tools/docker
+          push: true
+          tags: ${{ env.DOCKERHUB_REPO }}:${{ env.TAG_NAME }}
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: |
+            IDF_CLONE_URL=${{ github.server_url }}/${{ github.repository }}.git
+            IDF_CLONE_BRANCH_OR_TAG=${{ env.CLONE_BRANCH_OR_TAG }}
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -14,6 +14,14 @@ workflow:
    # Disable those non-protected push triggered pipelines
    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
      when: never
+    # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
+    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
+    - if: $CI_OPEN_MERGE_REQUESTS != null
+      variables:
+        PIPELINE_COMMIT_SHA: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
+    - if: $CI_OPEN_MERGE_REQUESTS == null
+      variables:
+        PIPELINE_COMMIT_SHA: $CI_COMMIT_SHA
    - when: always

 variables:
@ -48,7 +56,7 @@ variables:

  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"
-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v4.4-1-v4"
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v4.4-1-v6"
  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env:v4.4-1"
  AFL_FUZZER_TEST_IMAGE: "$CI_DOCKER_REGISTRY/afl-fuzzer-test:v4.4-1-1"
  CLANG_STATIC_ANALYSIS_IMAGE: "${CI_DOCKER_REGISTRY}/clang-static-analysis:v4.4-1-2"
@ -59,8 +67,6 @@ variables:

  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
-  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
-  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"

 .setup_tools_unless_target_test: &setup_tools_unless_target_test |
  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
@ -80,6 +86,7 @@ variables:

 before_script:
  - source tools/ci/utils.sh
+  - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
  - source tools/ci/setup_python.sh
  - add_gitlab_ssh_keys
  - source tools/ci/configure_ci_environment.sh
@ -91,6 +98,7 @@ before_script:
  before_script:
    - echo "Not setting up GitLab key, not fetching submodules"
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - source tools/ci/setup_python.sh
    - source tools/ci/configure_ci_environment.sh

@ -98,11 +106,15 @@ before_script:
  before_script:
    - echo "Only load utils.sh"
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS

 .before_script_macos:
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
+    # Clean up idf-env.json which might not be compatible with one produced by newer ESP-IDF versions
+    - rm -f ${IDF_TOOLS_PATH}/idf-env.json
    - $IDF_PATH/tools/idf_tools.py install-python-env
    # On macOS, these tools need to be installed
    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@ -115,6 +127,12 @@ before_script:
    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
    - fetch_submodules

+default:
+  retry:
+    max: 2
+    # In case of a runner failure we could hop to another one, or a network error could go away.
+    when: runner_system_failure
+
 include:
  - '.gitlab/ci/rules.yml'
  - '.gitlab/ci/docs.yml'
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@ -2,210 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/Kconfig                              @esp-idf-codeowners/build-config
-/add_path.sh                          @esp-idf-codeowners/tools
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/tools
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/asio/                     @esp-idf-codeowners/network
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cbor/                     @esp-idf-codeowners/app-utilities
-/components/cmock/                    @esp-idf-codeowners/system
-/components/coap/                     @esp-idf-codeowners/app-utilities
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp32*/                   @esp-idf-codeowners/system
-/components/esp_adc_cal/              @esp-idf-codeowners/peripherals
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/tools
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system
-/components/esp_ipc/                  @esp-idf-codeowners/system
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_serial_slave_link/    @esp-idf-codeowners/peripherals
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_websocket_client/     @esp-idf-codeowners/network
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/tools
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/expat/                    @esp-idf-codeowners/app-utilities
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freemodbus/               @esp-idf-codeowners/peripherals
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/jsmn/                     @esp-idf-codeowners/app-utilities
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/libsodium/                @esp-idf-codeowners/security
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities @esp-idf-codeowners/security
-/components/mdns/                     @esp-idf-codeowners/network
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/tools
-/components/nghttp/                   @esp-idf-codeowners/app-utilities
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/openssl/                  @esp-idf-codeowners/network
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/tools
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities
-/components/pthread/                  @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/tcpip_adapter/            @esp-idf-codeowners/network
-/components/tinyusb/                  @esp-idf-codeowners/peripherals/usb
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/wifi/               @esp-idf-codeowners/wifi
-
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/make/    @esp-idf-codeowners/build-config
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/*_apps.py              @esp-idf-codeowners/ci
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/find_build_apps/       @esp-idf-codeowners/ci
-/tools/idf_size_yaml/         @esp-idf-codeowners/peripherals
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-requirements.txt              @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-# ignore lists
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/tools
-/tools/ci/check_copyright_permanent_ignore.txt          @esp-idf-codeowners/all-maintainers
-/tools/ci/check_examples_cmake_make-cmake_ignore.txt    @esp-idf-codeowners/tools
-/tools/ci/check_examples_cmake_make-make_ignore.txt     @esp-idf-codeowners/tools
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/assign-test.yml
+++ b/.gitlab/ci/assign-test.yml
@ -1,54 +1,137 @@
-assign_test:
-  extends: .rules:test:any_test
-  tags:
-    - assign_test
+.assign_test_template:
  image: $CI_DOCKER_REGISTRY/ubuntu-test-env$BOT_DOCKER_IMAGE_TAG
  stage: assign_test
-  # gitlab ci do not support match job with RegEx or wildcard now in dependencies.
-  # we have a lot build example jobs. now we don't use dependencies, just download all artifacts of build stage.
-  dependencies: # Here is not a hard dependency relationship, could be skipped. so we do not use "needs" here.
-    - build_ssc_esp32
-    - build_esp_idf_tests_cmake_esp32
-    - build_esp_idf_tests_cmake_esp32s2
-    - build_esp_idf_tests_cmake_esp32s3
-    - build_esp_idf_tests_cmake_esp32c3
+  tags:
+    - assign_test
  variables:
-    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
-    EXAMPLE_TEST_DIR: "${CI_PROJECT_DIR}/examples"
-    CUSTOM_TEST_DIR: "${CI_PROJECT_DIR}/tools/test_apps"
-    UNIT_TEST_DIR: "${CI_PROJECT_DIR}/components/idf_test/unit_test"
+    SUBMODULES_TO_FETCH: components/esptool_py/esptool
+  artifacts:
+    paths:
+      - ${TEST_DIR}/test_configs
+      - ${BUILD_DIR}/artifact_index.json
+    when: always
+    expire_in: 1 week
+  script:
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_example_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:example_test
+  needs:
+    - job: build_examples_cmake_esp32
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_examples_cmake_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: example_test
+    TEST_DIR: ${CI_PROJECT_DIR}/examples
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_examples
+
+assign_custom_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:custom_test
+  needs:
+    - job: build_test_apps_esp32
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_test_apps_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: custom_test
+    TEST_DIR: ${CI_PROJECT_DIR}/tools/test_apps
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_test_apps
+
+assign_component_ut:
+  extends:
+    - .assign_test_template
+    - .rules:build:component_ut
+  needs:
+    - job: build_component_ut_esp32
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32s2
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32c3
+      artifacts: false
+      optional: true
+    - job: build_component_ut_esp32s3
+      artifacts: false
+      optional: true
+  variables:
+    TEST_TYPE: component_ut
+    TEST_DIR: ${CI_PROJECT_DIR}/component_ut
+    BUILD_DIR: ${CI_PROJECT_DIR}/build_component_ut
+  script:
    # COMPONENT_UT_DIRS is set by `set_component_ut_vars` in `utils.sh`
-    COMPONENT_UT_OUTPUT_DIR: "${CI_PROJECT_DIR}/component_ut"
-    INTEGRATION_CONFIG_OUTPUT_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
+    - set_component_ut_vars
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $COMPONENT_UT_DIRS -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_unit_test:
+  extends:
+    - .assign_test_template
+    - .rules:build:unit_test
+  needs:
+    - job: build_esp_idf_tests_cmake_esp32
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32s2
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32c3
+      optional: true
+    - job: build_esp_idf_tests_cmake_esp32s3
+      optional: true
+  variables:
+    TEST_TYPE: unit_test
+    TEST_DIR: ${CI_PROJECT_DIR}/components/idf_test/unit_test
+    BUILD_DIR: ${CI_PROJECT_DIR}/tools/unit-test-app/builds
+  script:
+    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py $TEST_TYPE $TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_DIR/test_configs
+
+assign_integration_test:
+  extends:
+    - .assign_test_template
+    - .rules:test:integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  needs:
+    - build_ssc_esp32
+    - build_ssc_esp32c3
+  artifacts:
+    paths:
+      - $TEST_DIR/test_configs
+  variables:
+    TEST_DIR: ${CI_PROJECT_DIR}/tools/ci/integration_test
+    BUILD_DIR: ${CI_PROJECT_DIR}/SSC/ssc_bin
    INTEGRATION_TEST_CASE_PATH: "${CI_PROJECT_DIR}/auto_test_script/TestCaseFiles"
    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
-  artifacts:
-    paths:
-      - components/idf_test/*/CIConfigs
-      - $EXAMPLE_TEST_DIR/test_configs
-      - $CUSTOM_TEST_DIR/test_configs
-      - $COMPONENT_UT_OUTPUT_DIR/test_configs
-      - build_examples/artifact_index.json
-      - build_test_apps/artifact_index.json
-      - build_component_ut/artifact_index.json
-      - tools/unit-test-app/builds/artifact_index.json
-    expire_in: 1 week
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
-    - set_component_ut_vars
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py example_test $EXAMPLE_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py custom_test $CUSTOM_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $CUSTOM_TEST_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py component_ut $COMPONENT_UT_DIRS -c $CI_TARGET_TEST_CONFIG_FILE -o $COMPONENT_UT_OUTPUT_DIR/test_configs
-    - python tools/ci/python_packages/ttfw_idf/IDFAssignTest.py unit_test $UNIT_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $UNIT_TEST_DIR/CIConfigs
+    - add_gitlab_ssh_keys
    # clone test script to assign tests
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
    # assign integration test cases
-    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b $IDF_PATH/SSC/ssc_bin -o $INTEGRATION_CONFIG_OUTPUT_PATH
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b ${BUILD_DIR} -o $TEST_DIR/test_configs

 update_test_cases:
  extends: .rules:ref:master-schedule
@ -70,10 +153,10 @@ update_test_cases:
    SUBMODULES_TO_FETCH: "components/esptool_py/esptool"
    UNIT_TEST_DIR: "${CI_PROJECT_DIR}/components/idf_test/unit_test"
    BOT_ACCOUNT_CONFIG_FILE: "${CI_PROJECT_DIR}/test-management/Config/Account.local.yml"
-    AUTO_TEST_SCRIPT_PATH: "${CI_PROJECT_DIR}/auto_test_script"
+    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
    PYTHON_VER: 3.7.7
  script:
-    - export GIT_SHA=$(echo ${CI_COMMIT_SHA} | cut -c 1-8)
+    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
    - retry_failed git clone $TEST_MANAGEMENT_REPO
    - python $CHECKOUT_REF_SCRIPT test-management test-management
    - cd test-management
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@ -5,6 +5,11 @@
    - build
  variables:
    SIZE_INFO_LOCATION: "$CI_PROJECT_DIR/size_info.txt"
+    # Enable ccache for all build jobs. See configure_ci_environment.sh for more ccache related settings.
+    IDF_CCACHE_ENABLE: "1"
+  after_script:
+    # Show ccache statistics if enabled globally
+    - test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats || true
  dependencies: []

 .build_template_app_template:
@ -34,10 +39,6 @@
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}
    # Only do the default cmake build for each target, remaining part are done in the build_template_app job
    - tools/ci/build_template_app.sh ${BUILD_COMMAND_ARGS}
-    # Check if there are any stray printf/ets_printf references in WiFi libs
-    - cd components/esp_wifi/lib
-    - for dir in esp32 esp32s2; do test $(xtensa-esp32-elf-nm $dir/*.a | grep -w printf | wc -l) -eq 0; done;
-    - for dir in esp32 esp32s2; do test $(xtensa-esp32-elf-nm $dir/*.a | grep -w ets_printf | wc -l) -eq 0; done;

 # build-related-pre-check-jobs ------------------------------------------------
 # Build at least one project for each target at earliest stage to reduce build cost for obvious failing commits
@ -82,6 +83,12 @@ build_ssc_esp32c3:
  variables:
    TARGET_NAME: "ESP32C3"

+build_ssc_esp32s3:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32S3"
+
 .build_esp_idf_tests_cmake_template:
  extends: .build_template
  dependencies:  # set dependencies to null to avoid missing artifacts issue
@ -361,8 +368,9 @@ build_docker:
  script:
    - export LOCAL_CI_REPOSITORY_URL=$CI_REPOSITORY_URL
    - if [ -n "$LOCAL_GITLAB_HTTPS_HOST" ]; then export LOCAL_CI_REPOSITORY_URL="https://gitlab-ci-token:${CI_JOB_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"; fi
+    - if [ -n "$LOCAL_GIT_MIRROR" ]; then export LOCAL_CI_REPOSITORY_URL="${LOCAL_GIT_MIRROR}/${CI_PROJECT_PATH}"; fi
    - echo "Using repository at $LOCAL_CI_REPOSITORY_URL"
-    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+    - export DOCKER_BUILD_ARGS="--build-arg IDF_CLONE_URL=${LOCAL_CI_REPOSITORY_URL} --build-arg IDF_CLONE_BRANCH_OR_TAG=${CI_COMMIT_REF_NAME} --build-arg IDF_CHECKOUT_REF=${CI_COMMIT_TAG:-$PIPELINE_COMMIT_SHA}"
    # Build
    - docker build --tag ${DOCKER_TMP_IMAGE_NAME} ${DOCKER_BUILD_ARGS} tools/docker/
    # We can't mount $PWD/examples/get-started/blink into the container, see https://gitlab.com/gitlab-org/gitlab-ce/issues/41227.
@ -370,31 +378,6 @@ build_docker:
    # Therefore, build a copy of the example located inside the container.
    - docker run --rm --workdir /opt/esp/idf/examples/get-started/blink ${DOCKER_TMP_IMAGE_NAME} idf.py build

-.test-on-windows:
-  extends:
-    - .before_script_minimal
-    - .rules:build:windows
-  stage: host_test
-  needs: []
-  image: $CI_DOCKER_REGISTRY/esp32-toolchain-win-cross
-  tags:
-    - build
-  script:
-    - cd $TEST_DIR
-    - mkdir build
-    - cd build
-    - cmake -DCMAKE_TOOLCHAIN_FILE=../toolchain-i686-w64-mingw32.cmake -DCMAKE_BUILD_TYPE=Release ..
-    - cmake --build .
-
-build_idf_exe:
-  extends: .test-on-windows
-  artifacts:
-    paths:
-      - tools/windows/idf_exe/build/idf-exe-v*.zip
-    expire_in: 4 days
-  variables:
-    TEST_DIR: tools/windows/idf_exe
-
 # This job builds template app with permutations of targets and optimization levels
 build_template_app:
  extends:
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@ -61,6 +61,9 @@
  patterns:
    - build_components
    - build_system
+  included_in:
+    - "build:{0}"
+    - build:target_test

 build:integration_test:
  labels:
@ -68,19 +71,8 @@ build:integration_test:
  patterns:
    - build_components
    - build_system
-
-# -------------
-# Special Cases
-# -------------
-"build:example_test-esp32c3":  # esp32c3 test is only run by label, but build jobs should always be triggered
-  labels:
-    - build
-    - example_test
-  patterns:
-    - build_components
-    - build_system
-    - build-example_test
-    - example_test
+  included_in:
+    - build:target_test

 ####################
 # Target Test Jobs #
@ -92,14 +84,14 @@ build:integration_test:
  labels: # For each rule, use labels <test_type> and <test_type>-<target>
    - "{0}"
    - "{0}_{1}"
+    - target_test
  patterns: # For each rule, use patterns <test_type> and build-<test_type>
    - "{0}"
    - "build-{0}"
  included_in: # Parent rules
+    - "build:{0}"
    - "build:{0}-{1}"
    - build:target_test
-    - test:target_test
-    - test:any_test

 # -------------
 # Special Cases
@ -112,42 +104,30 @@ build:integration_test:
    - "component_ut_{0}"
    - unit_test
    - "unit_test_{0}"
+    - target_test
  patterns:
    - component_ut
    - "build-component_ut-{0}"
  included_in:
+    - build:component_ut
    - "build:component_ut-{0}"
    - build:target_test
-    - test:target_test
-    - test:any_test
-
-"test:example_test-esp32c3":  # For esp32c3 we trigger only with label
-
-"labels:example_test-esp32c3":
-  labels:
-    - example_test_esp32c3
-  included_in:
-    - build:example_test-esp32c3
-    - build:target_test

 "test:integration_test":
  labels:
-    - "integration_test"
+    - integration_test
+    - target_test
  patterns:
-    - "integration_test"
+    - integration_test
  included_in:
-    - "build:integration_test"
+    - build:integration_test
    - build:target_test
-    - test:target_test
-    - test:any_test

 "test:host_test":
  labels:
    - host_test
  patterns:
    - host_test
-  included_in:
-    - test:any_test

 "test:submodule":
  labels:
@ -162,17 +142,17 @@ build:integration_test:
  labels:
    - iperf_stress_test
  included_in:
+    - build:example_test
    - build:example_test-esp32
    - build:target_test
-    - test:any_test

 "labels:weekend_test": # custom test
  labels:
    - weekend_test
  included_in:
+    - build:custom_test
    - build:custom_test-esp32
    - build:target_test
-    - test:any_test

 "labels:nvs_coverage": # host_test
  labels:
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@ -21,7 +21,7 @@ deploy_test_result:
  extends:
    - .deploy_job_template
    - .before_script_minimal
-    - .rules:ref:master-schedule-always
+    - .rules:ref:master-always
  image: $CI_DOCKER_REGISTRY/bot-env
  tags:
    - deploy_test
@ -39,8 +39,8 @@ deploy_test_result:
    AUTO_TEST_SCRIPT_PATH: "${CI_PROJECT_DIR}/auto_test_script"
  script:
    - add_gitlab_ssh_keys
-    - export GIT_SHA=$(echo ${CI_COMMIT_SHA} | cut -c 1-8)
-    - export REV_COUNT=$(git rev-list --count HEAD)
+    - export GIT_SHA=$(echo ${PIPELINE_COMMIT_SHA} | cut -c 1-8)
+    - export REV_COUNT=$(git rev-list --count ${PIPELINE_COMMIT_SHA} --)
    - export SUMMARY="IDF CI test result for $GIT_SHA (r${REV_COUNT})"
    # artifacts of job update_test_cases creates test-management folder
    # we need to remove it so we can clone test-management folder again
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@ -58,13 +58,14 @@ check_docs_lang_sync:
 .build_docs_template:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
-    PYTHON_VER: 3.6.13
+    PYTHON_VER: 3.7.10
  tags:
    - build_docs
  dependencies: []
  script:
-    - cd docs
    - pip install -r requirements.txt
+    - cd docs
+    - pip install -U -r requirements.txt
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
  parallel:
    matrix:
@ -74,13 +75,14 @@ check_docs_lang_sync:
 check_docs_gh_links:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
-    PYTHON_VER: 3.6.13
+    PYTHON_VER: 3.7.10
  extends:
    - .pre_check_job_template
    - .doc-rules:build:docs
  script:
-    - cd docs
    - pip install -r requirements.txt
+    - cd docs
+    - pip install -U -r requirements.txt
    - build-docs gh-linkcheck

 # stage: build_doc
@ -150,20 +152,19 @@ build_docs_pdf:
  extends:
    - .before_script_no_sync_submodule
  image: $ESP_IDF_DOC_ENV_IMAGE
-  variables:
-    PYTHON_VER: 3.6.13
  stage: test_deploy
  tags:
    - deploy
    - shiny
  variables:
+    PYTHON_VER: 3.7.10
    DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
    PYTHONUNBUFFERED: 1
  dependencies: []
  script:
    - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
-    - export GIT_VER=$(git describe --always)
-    - pip install -r docs/requirements.txt
+    - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
+    - pip install -U -r docs/requirements.txt
    - deploy-docs

 # stage: test_deploy
@ -224,7 +225,7 @@ check_doc_links:
    expire_in: 1 week
  allow_failure: true
  script:
-    - cd docs
    - pip install -r requirements.txt
-    # At the moment this check will always fail due to multiple known limitations, ignore result
-    - build-docs -t $DOCTGT -l $DOCLANG linkcheck || { echo "THERE ARE ISSUES DUE TO KNOWN LIMITATIONS, PLEASE FIX THEM. Nowadays we're ignored them to pass pipeline."; true; }
+    - cd docs
+    - pip install -U -r requirements.txt
+    - build-docs -t $DOCTGT -l $DOCLANG linkcheck
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@ -245,7 +245,7 @@ test_espcoredump:
    expire_in: 1 week
  variables:
    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
-    IDF_COREDUMP_ELF_TAG: idf-20210910-00
+    IDF_COREDUMP_ELF_TAG: idf-20210915
    # install CMake version specified in tools.json
    SETUP_TOOLS_LIST: "all"
  script:
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@ -15,6 +15,7 @@
  image: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"

 check_pre_commit_master_release:
@ -22,7 +23,7 @@ check_pre_commit_master_release:
    - .check_pre_commit_template
    - .rules:protected
  script:
-    - git diff-tree --no-commit-id --name-only -r $CI_COMMIT_SHA | xargs pre-commit run --files
+    - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files

 check_pre_commit_MR:
  extends:
@ -83,15 +84,20 @@ test_check_kconfigs:
  script:
    - python ${IDF_PATH}/tools/ci/test_check_kconfigs.py

-check_wifi_lib_md5:
+check_blobs:
  extends: .pre_check_base_template
  tags:
    - build
  variables:
-    SUBMODULES_TO_FETCH: "components/esp_wifi/lib"
+    SUBMODULES_TO_FETCH: "components/esp_wifi/lib;components/esp_phy/lib"
  script:
+    # Check if Wi-Fi library header files match between IDF and the version used when compiling the libraries
    - IDF_TARGET=esp32 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
    - IDF_TARGET=esp32s2 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32s3 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    - IDF_TARGET=esp32c3 $IDF_PATH/components/esp_wifi/test_md5/test_md5.sh
+    # Check if Wi-Fi, PHY, BT blobs contain references to specific symbols
+    - bash $IDF_PATH/tools/ci/check_blobs.sh

 check_fuzzer_compilation:
   extends: .pre_check_base_template
@ -157,10 +163,14 @@ scan_tests:
    TEST_APPS_OUTPUT_DIR: ${CI_PROJECT_DIR}/tools/test_apps/test_configs
    COMPONENT_UT_OUTPUT_DIR: ${CI_PROJECT_DIR}/component_ut/test_configs
    CI_SCAN_TESTS_PY: ${CI_PROJECT_DIR}/tools/ci/python_packages/ttfw_idf/CIScanTests.py
+    EXTRA_TEST_DIRS: >-
+      examples/bluetooth/esp_ble_mesh/ble_mesh_console
+      examples/bluetooth/hci/controller_hci_uart_esp32
+      examples/wifi/iperf
  script:
    - set_component_ut_vars
    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b make --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR
-    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b cmake --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR
+    - run_cmd python $CI_SCAN_TESTS_PY example_test $EXAMPLE_TEST_DIR -b cmake --exclude examples/build_system/idf_as_lib -c $CI_TARGET_TEST_CONFIG_FILE -o $EXAMPLE_TEST_OUTPUT_DIR --extra_test_dirs $EXTRA_TEST_DIRS
    - run_cmd python $CI_SCAN_TESTS_PY test_apps $TEST_APPS_TEST_DIR -c $CI_TARGET_TEST_CONFIG_FILE -o $TEST_APPS_OUTPUT_DIR
    - run_cmd python $CI_SCAN_TESTS_PY component_ut $COMPONENT_UT_DIRS --exclude $COMPONENT_UT_EXCLUDES -c $CI_TARGET_TEST_CONFIG_FILE -o $COMPONENT_UT_OUTPUT_DIR

@ -190,6 +200,6 @@ check_commit_msg:
  extends: .pre_check_job_template
  script:
    - git status
-    - git log -n10 --oneline
+    - git log -n10 --oneline ${PIPELINE_COMMIT_SHA}
    # commit start with "WIP: " need to be squashed before merge
-    - 'git log --pretty=%s master.. -- | grep "^WIP: " && exit 1 || exit 0'
+    - 'git log --pretty=%s origin/master..${PIPELINE_COMMIT_SHA} -- | grep -i "^WIP:" && exit 1 || exit 0'
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@ -89,6 +89,7 @@

 .patterns-integration_test: &patterns-integration_test
  - "tools/ci/python_packages/tiny_test_fw/**/*"
+  - "tools/ci/integration_test/**/*"

 .patterns-host_test: &patterns-host_test
  - ".gitlab/ci/host-test.yml"
@ -221,12 +222,10 @@
    - <<: *if-ref-master
    - <<: *if-schedule

-.rules:ref:master-schedule-always:
+.rules:ref:master-always:
  rules:
    - <<: *if-ref-master
      when: always
-    - <<: *if-schedule
-      when: always

 .rules:patterns:clang_tidy:
  rules:
@ -336,6 +335,9 @@
 .if-label-submodule: &if-label-submodule
  if: '$BOT_LABEL_SUBMODULE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*submodule(?:,[^,\n\r]+)*$/i'

+.if-label-target_test: &if-label-target_test
+  if: '$BOT_LABEL_TARGET_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+
 .if-label-unit_test: &if-label-unit_test
  if: '$BOT_LABEL_UNIT_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test(?:,[^,\n\r]+)*$/i'

@ -366,12 +368,35 @@
    - <<: *if-dev-push
      changes: *patterns-build_system

+.rules:build:component_ut:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-component_ut
+    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32
+    - <<: *if-label-unit_test_esp32c3
+    - <<: *if-label-unit_test_esp32s2
+    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-component_ut
+
 .rules:build:component_ut-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -387,6 +412,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -402,6 +428,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -417,6 +444,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -426,12 +454,31 @@
    - <<: *if-dev-push
      changes: *patterns-component_ut

+.rules:build:custom_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
+    - <<: *if-label-weekend_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-custom_test
+
 .rules:build:custom_test-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-weekend_test
    - <<: *if-dev-push
      changes: *patterns-build_components
@ -446,6 +493,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -459,6 +507,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -472,6 +521,7 @@
    - <<: *if-label-build
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -487,6 +537,26 @@
    - <<: *if-dev-push
      changes: *patterns-docker

+.rules:build:example_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32
+    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+
 .rules:build:example_test-esp32:
  rules:
    - <<: *if-protected
@ -494,6 +564,7 @@
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32
    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -509,6 +580,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -524,6 +596,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -539,6 +612,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -553,6 +627,7 @@
    - <<: *if-protected
    - <<: *if-label-build
    - <<: *if-label-integration_test
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@ -590,6 +665,7 @@
    - <<: *if-label-example_test_esp32s3
    - <<: *if-label-integration_test
    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-label-unit_test_esp32c3
@ -613,10 +689,28 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test

+.rules:build:unit_test:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-target_test
+    - <<: *if-label-unit_test
+    - <<: *if-label-unit_test_esp32
+    - <<: *if-label-unit_test_esp32c3
+    - <<: *if-label-unit_test_esp32s2
+    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-unit_test
+
 .rules:build:unit_test-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -630,6 +724,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -643,6 +738,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -656,6 +752,7 @@
  rules:
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -675,12 +772,6 @@
    - <<: *if-dev-push
      changes: *patterns-windows

-.rules:labels:example_test-esp32c3:
-  rules:
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-example_test_esp32c3
-
 .rules:labels:fuzzer_test-weekend_test:
  rules:
    - <<: *if-label-fuzzer_test
@ -698,49 +789,6 @@
  rules:
    - <<: *if-label-weekend_test

-.rules:test:any_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-component_ut
-    - <<: *if-label-component_ut_esp32
-    - <<: *if-label-component_ut_esp32c3
-    - <<: *if-label-component_ut_esp32s2
-    - <<: *if-label-component_ut_esp32s3
-    - <<: *if-label-custom_test
-    - <<: *if-label-custom_test_esp32
-    - <<: *if-label-custom_test_esp32c3
-    - <<: *if-label-custom_test_esp32s2
-    - <<: *if-label-custom_test_esp32s3
-    - <<: *if-label-example_test
-    - <<: *if-label-example_test_esp32
-    - <<: *if-label-example_test_esp32s2
-    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-host_test
-    - <<: *if-label-integration_test
-    - <<: *if-label-iperf_stress_test
-    - <<: *if-label-unit_test
-    - <<: *if-label-unit_test_esp32
-    - <<: *if-label-unit_test_esp32c3
-    - <<: *if-label-unit_test_esp32s2
-    - <<: *if-label-unit_test_esp32s3
-    - <<: *if-label-weekend_test
-    - <<: *if-dev-push
-      changes: *patterns-build-example_test
-    - <<: *if-dev-push
-      changes: *patterns-component_ut
-    - <<: *if-dev-push
-      changes: *patterns-custom_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test
-    - <<: *if-dev-push
-      changes: *patterns-host_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-    - <<: *if-dev-push
-      changes: *patterns-unit_test
-
 .rules:test:component_ut-esp32:
  rules:
    - <<: *if-protected
@ -748,6 +796,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -760,6 +809,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -772,6 +822,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -784,6 +835,7 @@
      when: never
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@ -796,6 +848,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -806,6 +859,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -816,6 +870,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -826,6 +881,7 @@
      when: never
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-custom_test

@ -836,6 +892,20 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+
+.rules:test:example_test-esp32c3:
+  rules:
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32c3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -848,6 +918,7 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s2
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -860,6 +931,7 @@
      when: never
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@ -880,6 +952,7 @@
    - <<: *if-label-build-only
      when: never
    - <<: *if-label-integration_test
+    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-integration_test

@ -892,49 +965,12 @@
    - <<: *if-dev-push
      changes: *patterns-submodule

-.rules:test:target_test:
-  rules:
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-component_ut
-    - <<: *if-label-component_ut_esp32
-    - <<: *if-label-component_ut_esp32c3
-    - <<: *if-label-component_ut_esp32s2
-    - <<: *if-label-component_ut_esp32s3
-    - <<: *if-label-custom_test
-    - <<: *if-label-custom_test_esp32
-    - <<: *if-label-custom_test_esp32c3
-    - <<: *if-label-custom_test_esp32s2
-    - <<: *if-label-custom_test_esp32s3
-    - <<: *if-label-example_test
-    - <<: *if-label-example_test_esp32
-    - <<: *if-label-example_test_esp32s2
-    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
-    - <<: *if-label-unit_test
-    - <<: *if-label-unit_test_esp32
-    - <<: *if-label-unit_test_esp32c3
-    - <<: *if-label-unit_test_esp32s2
-    - <<: *if-label-unit_test_esp32s3
-    - <<: *if-dev-push
-      changes: *patterns-build-example_test
-    - <<: *if-dev-push
-      changes: *patterns-component_ut
-    - <<: *if-dev-push
-      changes: *patterns-custom_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test
-    - <<: *if-dev-push
-      changes: *patterns-integration_test
-    - <<: *if-dev-push
-      changes: *patterns-unit_test
-
 .rules:test:unit_test-esp32:
  rules:
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
    - <<: *if-dev-push
@ -945,6 +981,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-dev-push
@ -955,6 +992,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-dev-push
@ -965,6 +1003,7 @@
    - <<: *if-protected
    - <<: *if-label-build-only
      when: never
+    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@ -65,6 +65,7 @@ check_pylint:
    name: $SONARQUBE_SCANNER_IMAGE
  before_script:
    - source tools/ci/utils.sh
+    - is_based_on_commits $REQUIRED_ANCESTOR_COMMITS
    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
    - fetch_submodules
    # Exclude the submodules, all paths ends with /**
@ -123,7 +124,7 @@ code_quality_report:
      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.commit_sha=$CI_COMMIT_SHA
+      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
      -Dsonar.host.url=$SONAR_HOST_URL
      -Dsonar.login=$SONAR_LOGIN
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@ -7,13 +7,13 @@

 .target_test_job_template:
  stage: target_test
-  needs:
-    - assign_test
  artifacts:
    when: always
    paths:
      - "**/*.log"
      - $LOG_PATH
+    exclude:
+      - .git/**/*
    expire_in: 1 week
    reports:
      junit: $LOG_PATH/*/XUNIT_RESULT.xml
@ -38,6 +38,8 @@

 .example_test_template:
  extends: .target_test_job_template
+  needs:
+    - assign_example_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/examples"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/examples/test_configs"
@ -55,7 +57,7 @@ test_weekend_mqtt:
    - .rules:labels:weekend_test
  tags:
    - ESP32
-    - Example_WIFI
+    - Example_EthKitV1
  script:
    - export MQTT_PUBLISH_TEST=1
    - export TEST_PATH=$CI_PROJECT_DIR/tools/test_apps/protocols/mqtt/publish_connect_test
@ -75,7 +77,7 @@ test_weekend_mqtt:
 .example_test_esp32c3_template:
  extends:
    - .example_test_template
-    - .rules:labels:example_test-esp32c3
+    - .rules:test:example_test-esp32c3

 .example_test_esp32s3_template:
  extends:
@ -115,10 +117,9 @@ example_test_001D:

 example_test_OTA:
  extends: .example_test_esp32_template
-  parallel: 2
  tags:
    - ESP32
-    - Example_WIFI_OTA
+    - EXAMPLE_ETH_OTA

 example_test_protocols:
  extends: .example_test_esp32_template
@ -127,6 +128,13 @@ example_test_protocols:
    - ESP32
    - Example_WIFI_Protocols

+# This job is only triggered by env var `NIGHTLY_RUN`, please do NOT remove
+example_test_esp32_WIFI_OTA:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - Example_WIFI_OTA
+
 example_test_002:
  extends: .example_test_esp32_template
  image: $CI_DOCKER_REGISTRY/ubuntu-test-env$BOT_DOCKER_IMAGE_TAG
@ -295,6 +303,8 @@ example_test_ESP32C3_SDSPI:

 .test_app_template:
  extends: .target_test_job_template
+  needs:
+    - assign_custom_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/test_apps"
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/test_apps/test_configs"
@ -333,6 +343,12 @@ test_app_test_002:
    - ESP32
    - Example_WIFI

+test_app_test_eth:
+  extends: .test_app_esp32_template
+  tags:
+    - ESP32
+    - Example_EthKitV1
+
 test_app_test_003:
  extends: .test_app_esp32_template
  tags:
@ -381,6 +397,8 @@ test_app_test_flash_psram_f8r8:

 .component_ut_template:
  extends: .target_test_job_template
+  needs: # the assign already needs all the build jobs
+    - assign_component_ut
  variables:
    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/component_ut/test_configs"
  script:
@ -443,9 +461,11 @@ component_ut_test_esp32c3:

 .unit_test_template:
  extends: .target_test_job_template
+  needs: # the assign already needs all the build jobs
+    - assign_unit_test
  variables:
    TEST_CASE_PATH: "$CI_PROJECT_DIR/tools/unit-test-app"
-    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/unit_test/CIConfigs"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/unit_test/test_configs"

 .unit_test_esp32_template:
  extends:
@ -513,7 +533,7 @@ UT_006:

 UT_007:
  extends: .unit_test_esp32_template
-  parallel: 4
+  parallel: 7
  tags:
    - ESP32_IDF
    - UT_T1_1
@ -664,7 +684,7 @@ UT_046:

 UT_047:
  extends: .unit_test_esp32s2_template
-  parallel: 5
+  parallel: 7
  tags:
    - ESP32S2_IDF
    - UT_T1_1
@ -683,7 +703,7 @@ UT_S2_SDSPI:

 UT_C3:
  extends: .unit_test_esp32c3_template
-  parallel: 33
+  parallel: 35
  tags:
    - ESP32C3_IDF
    - UT_T1_1
@ -727,7 +747,7 @@ UT_C3_SDSPI:

 UT_S3:
  extends: .unit_test_esp32s3_template
-  parallel: 31
+  parallel: 32
  tags:
    - ESP32S3_IDF
    - UT_T1_1
@ -761,36 +781,46 @@ component_ut_test_lan8720:
  extends:
    - .target_test_job_template
    - .rules:test:integration_test
-  needs:
-    - assign_test
-    - build_ssc_esp32
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  needs: # the assign already needs all the build jobs
+    - assign_integration_test
  variables:
    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
    LOG_PATH: "${CI_PROJECT_DIR}/TEST_LOGS"
    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
-    MODULE_UPDATE_FILE: "$CI_PROJECT_DIR/components/idf_test/ModuleDefinition.yml"
-    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/components/idf_test/integration_test/CIConfigs"
-    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/components/idf_test/integration_test/KnownIssues"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/ci/integration_test/test_configs"
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/tools/ci/integration_test/KnownIssues"
    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
-    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
-    # auto_test_script only supports python 3.7.x
-    PYTHON_VER: 3.7.7
+    PREPARE_TEST_BIN_SCRIPT: "${CI_PROJECT_DIR}/tools/ci/integration_test/prepare_test_bins.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${CI_PROJECT_DIR}/tools/ci/python_packages:${PYTHONPATH}"
+    INITIAL_CONDITION_RETRY_COUNT: "1"
+    GIT_LFS_SKIP_SMUDGE: 1
  script:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
+    - add_gitlab_ssh_keys
    # clone local test env configs
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # Merge known issues
    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

+.integration_test_esp32c3_template:
+  extends:
+    - .integration_test_template
+  variables:
+    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32C3_IDF"
+
 nvs_compatible_test:
  extends: .integration_test_template
  artifacts:
@ -806,23 +836,24 @@ nvs_compatible_test:
    - *define_config_file_name
    # first test if config file exists, if not exist, exit 0
    - test -e $CONFIG_FILE || exit 0
+    - add_gitlab_ssh_keys
    # clone local test env configs
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # clone test bench
-    # can not retry if downing git lfs files failed, so using empty_branch first.
-    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} -b empty_branch
-    - retry_failed git -C auto_test_script checkout -f ${CI_AUTO_TEST_SCRIPT_REPO_BRANCH}
-    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script --customized_only
-    # prepare nvs bins
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # prepare nvs bins
    - ./tools/prepare_nvs_bin.sh
    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH

 IT_001:
  extends: .integration_test_template
-  parallel: 3
+  parallel: 2
  tags:
    - ESP32_IDF
    - SSC_T1_4
@ -835,34 +866,26 @@ IT_002:

 IT_003:
  extends: .integration_test_template
-  parallel: 14
+  parallel: 9
  tags:
    - ESP32_IDF
    - SSC_T2_5

-IT_004:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_APC
-
 IT_005:
  extends: .integration_test_template
-  parallel: 2
  tags:
    - ESP32_IDF
    - SSC_T1_5

 IT_006:
  extends: .integration_test_template
-  parallel: 12
+  parallel: 5
  tags:
    - ESP32_IDF
    - SSC_T1_6

 IT_007:
  extends: .integration_test_template
-  parallel: 3
  tags:
    - ESP32_IDF
    - SSC_T1_7
@ -873,12 +896,6 @@ IT_008:
    - ESP32_IDF
    - SSC_T1_8

-IT_009:
-  extends: .integration_test_template
-  tags:
-    - ESP32_IDF
-    - SSC_T1_3
-
 IT_011:
  extends: .integration_test_template
  tags:
@ -931,7 +948,6 @@ IT_018:

 IT_019:
  extends: .integration_test_template
-  parallel: 2
  tags:
    - ESP32_IDF
    - SSC_T2_2
@ -942,8 +958,15 @@ IT_020:
    - ESP32_IDF
    - SSC_T2_3

-IT_021:
+IT_022:
  extends: .integration_test_template
  tags:
    - ESP32_IDF
-    - SSC_T2_4
+    - SSC_T3_2
+
+IT_C3_001:
+  extends: .integration_test_esp32c3_template
+  parallel: 6
+  tags:
+    - ESP32C3_IDF
+    - SSC_T2_5
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -12,12 +12,16 @@ repos:
        # 2 - any file matching *test*/*expected* (for host tests, if possible use this naming pattern always)
        # 3 - any directory named 'testdata'
        # 4 - IDF monitor test data
+        # 5 - protobuf auto-generated files
        exclude: &whitespace_excludes |
          (?x)^(
            .+\.(md|rst|map|bin)|
            .+test.*\/.*expected.*|
            .+\/testdata\/.+|
-            .+test_idf_monitor\/tests\/.+
+            .+test_idf_monitor\/tests\/.+|
+            .*_pb2.py|
+            .*.pb-c.h|
+            .*.pb-c.c
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@ -35,6 +39,11 @@ repos:
    hooks:
      - id: isort
        name: isort (python)
+        exclude: >
+          (?x)^(
+              .*_pb2.py
+          )$
+
  - repo: local
    hooks:
      - id: check-executables
@ -95,19 +104,12 @@ repos:
        additional_dependencies:
          - 'mypy==0.800'
          - 'mypy-extensions==0.4.3'
+        exclude: >
+          (?x)^(
+              .*_pb2.py
+          )$
        language: python
        types: [python]
-      - id: check-copyright
-        name: Check copyright notices
-        entry: tools/ci/check_copyright.py --verbose --replace
-        additional_dependencies:
-          - 'comment_parser == 1.2.3'
-          - 'thefuzz == 0.19.0'
-          - 'thefuzz[speedup] == 0.19.0; sys_platform != "win32"'
-          # don't depend on python-Levenshtein on Windows, as it requires Microsoft C++ Build Tools to install
-        language: python
-        files: \.(py|c|h|cpp|hpp|ld)$
-        require_serial: true
      - id: check-tools-files-patterns
        name: Check tools dir files patterns
        entry: tools/ci/check_tools_files_patterns.py
@ -120,4 +122,4 @@ repos:
    rev: v4.0.1
    hooks:
      - id: file-contents-sorter
-        files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt|check_copyright_ignore\.txt|check_copyright_permanent_ignore\.txt)'
+        files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt)'
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -7,11 +7,8 @@ if(CMAKE_CURRENT_LIST_DIR STREQUAL CMAKE_SOURCE_DIR)
    "again.")
 endif()

-unset(compile_options)
-unset(c_compile_options)
-unset(cxx_compile_options)
-unset(compile_definitions)
-unset(link_options)
+# Variables compile_options, c_compile_options, cxx_compile_options, compile_definitions, link_options shall
+# not be unset as they may already contain flags, set by toolchain-TARGET.cmake files.

 # Add the following build specifications here, since these seem to be dependent
 # on config values on the root Kconfig.
@ -119,6 +116,9 @@ if(CMAKE_C_COMPILER_ID MATCHES "Clang")
    # Multiple cases of attributes unknown to clang, for example
    # __attribute__((optimize("-O3")))
    list(APPEND compile_options "-Wno-unknown-attributes")
+    # Disable Clang warnings for atomic operations with access size
+    # more then 4 bytes
+    list(APPEND compile_options "-Wno-atomic-alignment")
    # Clang also produces many -Wunused-function warnings which GCC doesn't.
    # However these aren't treated as errors.
 endif()
@ -181,6 +181,7 @@ endif()
 idf_build_set_property(COMPILE_OPTIONS "${compile_options}" APPEND)
 idf_build_set_property(C_COMPILE_OPTIONS "${c_compile_options}" APPEND)
 idf_build_set_property(CXX_COMPILE_OPTIONS "${cxx_compile_options}" APPEND)
+idf_build_set_property(ASM_COMPILE_OPTIONS "${asm_compile_options}" APPEND)
 idf_build_set_property(COMPILE_DEFINITIONS "${compile_definitions}" APPEND)
 idf_build_set_property(LINK_OPTIONS "${link_options}" APPEND)

--- a/components/app_trace/Kconfig
+++ b/components/app_trace/Kconfig
@ -18,11 +18,13 @@ menu "Application Level Tracing"

    config APPTRACE_DEST_TRAX
        bool
-        depends on IDF_TARGET_ARCH_XTENSA && !ESP32_TRAX && !ESP32S2_TRAX
+        depends on IDF_TARGET_ARCH_XTENSA && !ESP32_TRAX && !ESP32S2_TRAX && !ESP32S3_TRAX
        select ESP32_MEMMAP_TRACEMEM
        select ESP32S2_MEMMAP_TRACEMEM
+        select ESP32S3_MEMMAP_TRACEMEM
        select ESP32_MEMMAP_TRACEMEM_TWOBANKS
        select ESP32S2_MEMMAP_TRACEMEM_TWOBANKS
+        select ESP32S3_MEMMAP_TRACEMEM_TWOBANKS
        default n
        help
            Enables/disable TRAX tracing HW.
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 #include <sys/param.h>
 #include <string.h>
 #include "sdkconfig.h"
@ -93,7 +99,8 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
    if (proto->hw->host_data_pending() && hdr->block_sz > 0) {
        // TODO: add support for multiple blocks from host, currently there is no need for that
        uint8_t *p = proto->blocks[new_block_num].start + proto->blocks[new_block_num].sz;
-        ESP_APPTRACE_LOGD("Recvd %d bytes from host [%x %x %x %x %x %x %x %x .. %x %x %x %x %x %x %x %x]", hdr->block_sz,
+        ESP_APPTRACE_LOGD("Recvd %d bytes from host (@ 0x%x) [%x %x %x %x %x %x %x %x .. %x %x %x %x %x %x %x %x]",
+            hdr->block_sz, proto->blocks[new_block_num].start,
            *(proto->blocks[new_block_num].start+0), *(proto->blocks[new_block_num].start+1),
            *(proto->blocks[new_block_num].start+2), *(proto->blocks[new_block_num].start+3),
            *(proto->blocks[new_block_num].start+4), *(proto->blocks[new_block_num].start+5),
--- a/components/app_trace/app_trace_util.c
+++ b/components/app_trace/app_trace_util.c
@ -60,22 +60,16 @@ esp_err_t esp_apptrace_lock_take(esp_apptrace_lock_t *lock, esp_apptrace_tmo_t *
    int res;

    while (1) {
+        //Todo: Replace the current locking mechanism and int_state with portTRY_ENTER_CRITICAL() instead.
        // do not overwrite lock->int_state before we actually acquired the mux
-        unsigned int_state = portENTER_CRITICAL_NESTED();
-        // FIXME: if mux is busy it is not good idea to loop during the whole tmo with disabled IRQs.
-        // So we check mux state using zero tmo, restore IRQs and let others tasks/IRQs to run on this CPU
-        // while we are doing our own tmo check.
-#ifdef CONFIG_FREERTOS_PORTMUX_DEBUG
-        bool success = vPortCPUAcquireMutexTimeout(&lock->mux, 0, __FUNCTION__, __LINE__);
-#else
+        unsigned int_state = portSET_INTERRUPT_MASK_FROM_ISR();
        bool success = vPortCPUAcquireMutexTimeout(&lock->mux, 0);
-#endif
        if (success) {
            lock->int_state = int_state;
            return ESP_OK;
        }
-        portEXIT_CRITICAL_NESTED(int_state);
-        // we can be preempted from this place till the next call (above) to portENTER_CRITICAL_NESTED()
+        portCLEAR_INTERRUPT_MASK_FROM_ISR(int_state);
+        // we can be preempted from this place till the next call (above) to portSET_INTERRUPT_MASK_FROM_ISR()
        res = esp_apptrace_tmo_check(tmo);
        if (res != ESP_OK) {
            break;
@ -90,12 +84,8 @@ esp_err_t esp_apptrace_lock_give(esp_apptrace_lock_t *lock)
    unsigned int_state = lock->int_state;
    // after call to the following func we can not be sure that lock->int_state
    // is not overwritten by other CPU who has acquired the mux just after we released it. See esp_apptrace_lock_take().
-#ifdef CONFIG_FREERTOS_PORTMUX_DEBUG
-    vPortCPUReleaseMutex(&lock->mux, __FUNCTION__, __LINE__);
-#else
    vPortCPUReleaseMutex(&lock->mux);
-#endif
-    portEXIT_CRITICAL_NESTED(int_state);
+    portCLEAR_INTERRUPT_MASK_FROM_ISR(int_state);
    return ESP_OK;
 }

--- a/components/app_trace/gcov/gcov_rtio.c
+++ b/components/app_trace/gcov/gcov_rtio.c
@ -52,18 +52,11 @@ void gcov_dump_task(void *pvParameter)
    }
    ESP_EARLY_LOGV(TAG, "Config apptrace down buf");
    esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
-    /* we are directing the std outputs to the fake ones in order to reduce stack usage */
-    FILE *old_stderr = stderr;
-    FILE *old_stdout = stdout;
-    stderr = (FILE *) &__sf_fake_stderr;
-    stdout = (FILE *) &__sf_fake_stdout;
    ESP_EARLY_LOGV(TAG, "Dump data...");
    __gcov_dump();
    // reset dump status to allow incremental data accumulation
    __gcov_reset();
    free(down_buf);
-    stderr = old_stderr;
-    stdout = old_stdout;
    ESP_EARLY_LOGV(TAG, "Finish file transfer session");
    dump_result = esp_apptrace_fstop(ESP_APPTRACE_DEST_TRAX);
    if (dump_result != ESP_OK) {
--- a/components/app_trace/include/esp_app_trace_util.h
+++ b/components/app_trace/include/esp_app_trace_util.h
@ -68,7 +68,7 @@ typedef struct {
 */
 static inline void esp_apptrace_lock_init(esp_apptrace_lock_t *lock)
 {
-    vPortCPUInitializeMutex(&lock->mux);
+    portMUX_INITIALIZE(&lock->mux);
    lock->int_state = 0;
 }

--- a/components/app_trace/linker.lf
+++ b/components/app_trace/linker.lf
@ -3,6 +3,10 @@ archive: libapp_trace.a
 entries:
    app_trace (noflash)
    app_trace_util (noflash)
+    if APPTRACE_MEMBUFS_APPTRACE_PROTO_ENABLE:
+      app_trace_membufs_proto (noflash)
+    if APPTRACE_DEST_JTAG = y:
+      port (noflash)
    if APPTRACE_SV_ENABLE = y:
      SEGGER_SYSVIEW (noflash)
      SEGGER_RTT_esp (noflash)
--- a/components/app_trace/port/riscv/port.c
+++ b/components/app_trace/port/riscv/port.c
@ -1,6 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "riscv/semihosting.h"

 /** RISCV HW transport data */
 typedef struct {
@ -20,8 +27,6 @@ typedef struct {
    esp_apptrace_mem_block_t *  mem_blocks;
 } esp_apptrace_riscv_ctrl_block_t;

-#define RISCV_APPTRACE_SYSNR    0x64
-
 #define ESP_APPTRACE_RISCV_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_RISCV_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_RISCV_BLOCK_LEN_MSK)
 #define ESP_APPTRACE_RISCV_BLOCK_LEN_GET(_v_)    ((_v_) & ESP_APPTRACE_RISCV_BLOCK_LEN_MSK)
@ -94,25 +99,10 @@ esp_apptrace_hw_t *esp_apptrace_jtag_hw_get(void **data)
   e.g. OpenOCD flasher stub use own implementation of it. */
 __attribute__((weak)) int esp_apptrace_advertise_ctrl_block(void *ctrl_block_addr)
 {
-    register int sys_nr = RISCV_APPTRACE_SYSNR;
-    register int host_ret = 0;
-
    if (!esp_cpu_in_ocd_debug_mode()) {
        return 0;
    }
-    __asm__ volatile ( \
-        ".option push\n" \
-        ".option norvc\n" \
-        "mv a0, %[sys_nr]\n" \
-        "mv a1, %[arg1]\n" \
-        "slli    zero,zero,0x1f\n" \
-        "ebreak\n" \
-        "srai    zero,zero,0x7\n" \
-        "mv %[host_ret], a0\n" \
-    	".option pop\n" \
-        :[host_ret]"=r"(host_ret)
-        :[sys_nr]"r"(sys_nr),[arg1]"r"(ctrl_block_addr):"a0","a1");
-    return host_ret;
+    return (int) semihosting_call_noerrno(ESP_SEMIHOSTING_SYS_APPTRACE_INIT, (long*)ctrl_block_addr);
 }

 /* Returns up buffers config.
--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@ -1,3 +1,9 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
 //
 // How It Works
 // ************
@ -143,9 +149,9 @@
 #include "sdkconfig.h"
 #include "soc/soc.h"
 #include "soc/dport_access.h"
-#if CONFIG_IDF_TARGET_ESP32
 #include "soc/dport_reg.h"
-#elif CONFIG_IDF_TARGET_ESP32S2
+#include "soc/tracemem_config.h"
+#if CONFIG_IDF_TARGET_ESP32S2 || CONFIG_IDF_TARGET_ESP32S3
 #include "soc/sensitive_reg.h"
 #endif
 #include "eri.h"
@ -154,18 +160,6 @@
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"

-// TODO: move these (and same definitions in trax.c to dport_reg.h)
-#if CONFIG_IDF_TARGET_ESP32
-#define TRACEMEM_MUX_PROBLK0_APPBLK1            0
-#define TRACEMEM_MUX_BLK0_ONLY                  1
-#define TRACEMEM_MUX_BLK1_ONLY                  2
-#define TRACEMEM_MUX_PROBLK1_APPBLK0            3
-#elif CONFIG_IDF_TARGET_ESP32S2
-#define TRACEMEM_MUX_BLK0_NUM                   19
-#define TRACEMEM_MUX_BLK1_NUM                   20
-#define TRACEMEM_BLK_NUM2ADDR(_n_)              (0x3FFB8000UL + 0x4000UL*((_n_)-4))
-#endif
-
 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
@ -182,18 +176,6 @@

 #define ESP_APPTRACE_TRAX_INITED(_hw_)          ((_hw_)->inited & (1 << cpu_hal_get_core_id()))

-#if CONFIG_IDF_TARGET_ESP32
-static uint8_t * const s_trax_blocks[] = {
-    (uint8_t *) 0x3FFFC000,
-    (uint8_t *) 0x3FFF8000
-};
-#elif CONFIG_IDF_TARGET_ESP32S2
-static uint8_t * const s_trax_blocks[] = {
-    (uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK0_NUM),
-    (uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK1_NUM)
-};
-#endif
-
 #define ESP_APPTRACE_TRAX_BLOCK_SIZE            (0x4000UL)

 /** TRAX HW transport data */
@ -223,6 +205,12 @@ static bool esp_apptrace_trax_host_data_pending(void);

 const static char *TAG = "esp_apptrace";

+static uint8_t * const s_trax_blocks[] = {
+    (uint8_t *)TRACEMEM_BLK0_ADDR,
+    (uint8_t *)TRACEMEM_BLK1_ADDR
+};
+
+
 esp_apptrace_hw_t *esp_apptrace_uart_hw_get(int num, void **data)
 {
    return NULL;
@ -300,6 +288,14 @@ static inline void esp_apptrace_trax_select_memory_block(int block_num)
    DPORT_WRITE_PERI_REG(DPORT_TRACEMEM_MUX_MODE_REG, block_num ? TRACEMEM_MUX_BLK0_ONLY : TRACEMEM_MUX_BLK1_ONLY);
 #elif CONFIG_IDF_TARGET_ESP32S2
    WRITE_PERI_REG(DPORT_PMS_OCCUPY_3_REG, block_num ? BIT(TRACEMEM_MUX_BLK0_NUM-4) : BIT(TRACEMEM_MUX_BLK1_NUM-4));
+#elif CONFIG_IDF_TARGET_ESP32S3
+    // select memory block to be exposed to the TRAX module (accessed by host)
+    uint32_t block_bits = block_num ? TRACEMEM_CORE0_MUX_BLK_BITS(TRACEMEM_MUX_BLK0_NUM)
+                        : TRACEMEM_CORE0_MUX_BLK_BITS(TRACEMEM_MUX_BLK1_NUM);
+    block_bits |= block_num ? TRACEMEM_CORE1_MUX_BLK_BITS(TRACEMEM_MUX_BLK0_NUM)
+                        : TRACEMEM_CORE1_MUX_BLK_BITS(TRACEMEM_MUX_BLK1_NUM);
+    ESP_EARLY_LOGV(TAG, "Select block %d @ %p (bits 0x%x)", block_num, s_trax_blocks[block_num], block_bits);
+    DPORT_WRITE_PERI_REG(SENSITIVE_INTERNAL_SRAM_USAGE_2_REG, block_bits);
 #endif
 }

--- a/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
@ -73,6 +73,8 @@ Revision: $Rev: 3734 $
 #include "esp32/clk.h"
 #elif CONFIG_IDF_TARGET_ESP32S2
 #include "esp32s2/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/clk.h"
 #elif CONFIG_IDF_TARGET_ESP32C3
 #include "esp32c3/clk.h"
 #endif
@ -142,6 +144,8 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #elif CONFIG_IDF_TARGET_ESP32S2
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S2_DEFAULT_CPU_FREQ_MHZ * 1000000)
+#elif CONFIG_IDF_TARGET_ESP32S3
+#define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S3_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #endif
 #endif // TS_USE_CCOUNT

--- a/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
+++ b/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
@ -76,9 +76,6 @@ Notes:
 *
 **********************************************************************
 */
-#ifndef portSTACK_GROWTH
-  #define portSTACK_GROWTH              ( -1 )
-#endif

 #define SYSVIEW_FREERTOS_MAX_NOF_TASKS  CONFIG_APPTRACE_SV_MAX_TASKS

--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@ -327,9 +327,9 @@ typedef enum {
 /**
 * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
 *
- * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key #N-1, Key #N, Key #N+1).
- * When key #N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key #N-1 & Key #N.
- * After successfully booting the OTA app should call this function to revoke Key #N-1.
+ * Relevant for Secure boot v2 on ESP32-S2, ESP32-S3, ESP32-C3 where upto 3 key digests can be stored (Key \#N-1, Key \#N, Key \#N+1).
+ * When key \#N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key \#N-1 & Key \#N.
+ * After successfully booting the OTA app should call this function to revoke Key \#N-1.
 *
 * @param index - The index of the signature block to be revoked
 *
--- a/components/app_update/test/test_switch_ota.c
+++ b/components/app_update/test/test_switch_ota.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -824,3 +824,25 @@ static void test_flow6(void)
 // 2 Stage: run factory -> check it -> copy factory to OTA0             -> reboot  --//--
 // 3 Stage: run OTA0    -> check it -> erase OTA_DATA for next tests    -> PASS
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
+
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    const esp_partition_t *other_app = get_next_update_partition();
+    copy_current_app_to_next_part(cur_app, other_app);
+    erase_ota_data();
+
+    uint8_t sha_256_cur_app[32];
+    uint8_t sha_256_other_app[32];
+    TEST_ESP_OK(bootloader_common_get_sha256_of_partition(cur_app->address, cur_app->size, cur_app->type, sha_256_cur_app));
+    TEST_ESP_OK(bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
+
+    TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
+
+    uint32_t data = 0;
+    bootloader_flash_write(other_app->address + 0x50, &data, sizeof(data), false);
+
+    TEST_ESP_ERR(ESP_ERR_IMAGE_INVALID, bootloader_common_get_sha256_of_partition(other_app->address, other_app->size, other_app->type, sha_256_other_app));
+    TEST_ASSERT_EQUAL_MEMORY_MESSAGE(sha_256_cur_app, sha_256_other_app, sizeof(sha_256_cur_app), "must be the same");
+}
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@ -193,6 +193,14 @@ menu "Bootloader config"
            The GPIO must be held low continuously for this period of time after reset
            before a factory reset or test partition boot (as applicable) is performed.

+    config BOOTLOADER_REGION_PROTECTION_ENABLE
+        bool "Enable protection for unmapped memory regions"
+        default y
+        help
+            Protects the unmapped memory regions of the entire address space from unintended accesses.
+            This will ensure that an exception will be triggered whenever the CPU performs a memory
+            operation on unmapped regions of the address space.
+
    config BOOTLOADER_WDT_ENABLE
        bool "Use RTC watchdog in start code"
        default y
@ -501,7 +509,7 @@ menu "Security features"
    config SECURE_BOOT
        bool "Enable hardware Secure Boot in bootloader (READ DOCS FIRST)"
        default n
-        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || ESP32C3_REV_MIN_3 || IDF_TARGET_ESP32S3
+        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || ESP32C3_REV_MIN >= 3 || IDF_TARGET_ESP32S3
        select ESPTOOLPY_NO_STUB if !IDF_TARGET_ESP32 && !IDF_TARGET_ESP32S2
        help
            Build a bootloader which enables Secure Boot on first boot.
@ -614,6 +622,22 @@ menu "Security features"

            Refer to the Secure Boot section of the ESP-IDF Programmer's Guide for this version before enabling.

+    config SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
+        bool "Enable Aggressive key revoke strategy"
+        depends on SECURE_BOOT && (IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3)
+        default N
+        help
+            If this option is set, ROM bootloader will revoke the public key digest burned in efuse block
+            if it fails to verify the signature of software bootloader with it.
+            Revocation of keys does not happen when enabling secure boot. Once secure boot is enabled,
+            key revocation checks will be done on subsequent boot-up, while verifying the software bootloader
+
+            This feature provides a strong resistance against physical attacks on the device.
+
+            NOTE: Once a digest slot is revoked, it can never be used again to verify an image
+            This can lead to permanent bricking of the device, in case all keys are revoked
+            because of signature verification failure.
+
    choice SECURE_BOOTLOADER_KEY_ENCODING
        bool "Hardware Key Encoding"
        depends on SECURE_BOOTLOADER_REFLASHABLE
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.ld
@ -111,8 +111,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -125,6 +123,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -183,4 +182,23 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }
--- a/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
@ -1,14 +1,40 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-C3 ROM static data usage is as follows:
+ *  - 0x3fccae00 - 0x3fcdc710: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdc710 - 0x3fcde710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcde710 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fcdc710).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fcdc710 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdc710;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@ -99,8 +125,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -113,6 +137,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.* .srodata .srodata.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -177,17 +202,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_AE00
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_C710
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_E710
+ * 0x3fccae00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdc710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcde710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdf060 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdf664 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdf830 ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
@ -1,14 +1,40 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-H2 ROM static data usage is as follows:
+ *  - 0x3fccb900 - 0x3fcdd210: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdd210 - 0x3fcdf210: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdf210 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdd120;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
-  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

 /* Default entry point: */
@ -97,8 +123,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -111,6 +135,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.* .srodata .srodata.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -174,17 +199,34 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCC_B900
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_D210
- *  |        ^              |
- *  |        |              |
- *  |        | stack        |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCD_F210
+ * 0x3fccb81c ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdd120 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdf120 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdfa6c ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfe40 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfe4c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
@ -99,8 +99,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -113,6 +111,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -171,4 +170,23 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }
+
+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
 }
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
@ -1,16 +1,51 @@
 /** Simplified memory map for the bootloader.
 *  Make sure the bootloader can load into main memory without overwriting itself.
- *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
- *  See memory usage for ROM bootloader at the end of this file.
+ *
+ *  ESP32-S3 ROM static data usage is as follows:
+ *  - 0x3fcd7e00 - 0x3fce9704: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fce9710 - 0x3fceb710: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fceb710 - 0x3fced710: APP CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fced710 - 0x3fcf0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
 */

+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x6f0000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fce9700;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x4000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x3000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
 MEMORY
 {
-  iram_seg (RWX) :                  org = 0x403B6000, len = 0x4000
-  iram_loader_seg (RWX) :           org = 0x403BA000, len = 0x6000
-  dram_seg (RW) :                   org = 0x3FCD0000, len = 0x4000
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
 }

+/* The app may use RAM for static allocations up to the start of iram_loader_seg.
+ * If you have changed something above and this assert fails:
+ * 1. Check what the new value of bootloader_iram_loader_seg start is.
+ * 2. Update the value in this assert.
+ * 3. Update SRAM_IRAM_END in components/esp_system/ld/esp32s3/memory.ld.in to the same value.
+ */
+ASSERT(bootloader_iram_loader_seg_start == 0x403cc700, "bootloader_iram_loader_seg_start inconsistent with SRAM_IRAM_END");
+
 /* Default entry point: */
 ENTRY(call_start_cpu0);

@ -30,7 +65,6 @@ SECTIONS
    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
-    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
    *libesp_common.a:fpga_overrides.*(.literal.bootloader_fill_random .text.bootloader_fill_random)
    *libbootloader_support.a:bootloader_efuse_esp32s3.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
@ -100,8 +134,6 @@ SECTIONS
    *(.sdata)
    *(.sdata.*)
    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
    *(.gnu.linkonce.s2.*)
    *(.jcr)
    _data_end = ABSOLUTE(.);
@ -114,6 +146,7 @@ SECTIONS
    *(.rodata.*)
    *(.gnu.linkonce.r.*)
    *(.rodata1)
+    *(.sdata2 .sdata2.*)
    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
    *(.xt_except_table)
    *(.gcc_except_table)
@ -172,29 +205,62 @@ SECTIONS
    _etext = .;
  } > iram_seg

-}
+  /** This section will be used by the debugger and disassembler to get more information
+   * about raw data present in the code.
+   * Indeed, it may be required to add some padding at some points in the code
+   * in order to align a branch/jump destination on a particular bound.
+   * Padding these instructions will generate null bytes that shall be
+   * interpreted as data, and not code by the debugger or disassembler.
+   * This section will only be present in the ELF file, not in the final binary
+   * For more details, check GCC-212
+   */
+  .xt.prop 0 :
+  {
+    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+  }

+  .xt.lit 0 :
+  {
+    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+  }
+
+}

 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- *  +--------+--------------+------+ 0x3FCD_8000
- *  |        ^              |
- *  |        |              |
- *  |        | data/bss     |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCE_9910
- *  |        ^              |
- *  |        |              |
- *  |        | stack (pro)  |
- *  |        |              |
- *  |        v              |
- *  +------------------------------+ 0x3FCE_B910
- *  |        ^              |
- *  |        |              |
- *  |        | stack (app)  |
- *  |        |              |
- *  |        v              |
- *  +--------+--------------+------+ 0x3FCE_D910
+ * 0x3fcd7e00 ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fce9710 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fceb710 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x3fced710 ------------------> __stack_app (app cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fceee34 ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcef770 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcef81c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fcf0000 ------------------> _data_end_interface
 */
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@ -26,7 +26,7 @@
 extern "C" {
 #endif

-/// Type of hold a GPIO in low state
+// Type of hold a GPIO in low state
 typedef enum {
    GPIO_LONG_HOLD  = 1,    /*!< The long hold GPIO */
    GPIO_SHORT_HOLD = -1,   /*!< The short hold GPIO */
--- a/components/bootloader_support/include/bootloader_flash.h
+++ b/components/bootloader_support/include/bootloader_flash.h
@ -9,6 +9,7 @@
 #include <esp_spi_flash.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "soc/soc_caps.h"
+#include "bootloader_flash_override.h"

 #ifdef __cplusplus
 extern "C" {
@ -32,14 +33,6 @@ uint32_t bootloader_read_flash_id(void);
 esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode);
 #endif

-/**
-  * @brief Unlock Flash write protect.
-  *        Please do not call this function in SDK.
-  *
-  * @note This can be overridden because it's attribute weak.
-  */
-esp_err_t bootloader_flash_unlock(void);
-
 /**
 * @brief Startup flow recommended by XMC. Call at startup before any erase/write operation.
 *
@ -47,6 +40,15 @@ esp_err_t bootloader_flash_unlock(void);
 */
 esp_err_t bootloader_flash_xmc_startup(void);

+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
+
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/include/bootloader_flash_override.h
+++ b/components/bootloader_support/include/bootloader_flash_override.h
@ -0,0 +1,101 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#pragma once
+
+#include "esp_err.h"
+#include "esp_attr.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef unsigned (*bootloader_flash_read_status_fn_t)(void);
+typedef void (*bootloader_flash_write_status_fn_t)(unsigned);
+
+typedef struct __attribute__((packed))
+{
+    const char *manufacturer;
+    uint8_t mfg_id; /* 8-bit JEDEC manufacturer ID */
+    uint16_t flash_id; /* 16-bit JEDEC flash chip ID */
+    uint16_t id_mask; /* Bits to match on in flash chip ID */
+    bootloader_flash_read_status_fn_t read_status_fn;
+    bootloader_flash_write_status_fn_t write_status_fn;
+    uint8_t status_qio_bit;
+} bootloader_qio_info_t;
+
+/**
+ * @brief Read 8 bit status using RDSR command
+ *
+ * @return Value of SR1.
+ */
+unsigned bootloader_read_status_8b_rdsr(void);
+
+/**
+ * @brief Read 8 bit status (second byte) using RDSR2 command
+ *
+ * @return Value of SR2
+ */
+unsigned bootloader_read_status_8b_rdsr2(void);
+
+/**
+ * @brief Read 16 bit status using RDSR & RDSR2 (low and high bytes)
+ *
+ * @return Value of SR2#SR1.
+ */
+unsigned bootloader_read_status_16b_rdsr_rdsr2(void);
+
+/**
+ * @brief Write 8 bit status using WRSR
+ */
+void bootloader_write_status_8b_wrsr(unsigned new_status);
+
+/**
+ * @brief Write 8 bit status (second byte) using WRSR2.
+ */
+void bootloader_write_status_8b_wrsr2(unsigned new_status);
+
+/**
+ * @brief Write 16 bit status using WRSR, (both write SR1 and SR2)
+ */
+void bootloader_write_status_16b_wrsr(unsigned new_status);
+
+/**
+ * @brief Read 8 bit status of XM25QU64A.
+ *
+ * @return Value of 8 bit SR.
+ */
+unsigned bootloader_read_status_8b_xmc25qu64a(void);
+
+/**
+ * @brief Write 8 bit status for XM25QU64A
+ */
+void bootloader_write_status_8b_xmc25qu64a(unsigned new_status);
+
+/* Array of known flash chips and data to enable Quad I/O mode
+
+   Manufacturer & flash ID can be tested by running "esptool.py
+   flash_id"
+
+   If manufacturer ID matches, and flash ID ORed with flash ID mask
+   matches, enable_qio_mode() will execute "Read Cmd", test if bit
+   number "QIE Bit" is set, and if not set it will call "Write Cmd"
+   with this bit set.
+
+   Searching of this table stops when the first match is found.
+ */
+extern const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_support_list[];
+
+/**
+  * @brief Unlock Flash write protect.
+  *        Please do not call this function in SDK.
+  *
+  * @note This can be overridden because it's attribute weak.
+  */
+esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void);
+
+#ifdef __cplusplus
+}
+#endif
--- a/components/bootloader_support/include/esp_app_format.h
+++ b/components/bootloader_support/include/esp_app_format.h
@ -55,6 +55,9 @@ typedef enum {
    ESP_IMAGE_FLASH_SIZE_4MB,       /*!< SPI flash size 4 MB */
    ESP_IMAGE_FLASH_SIZE_8MB,       /*!< SPI flash size 8 MB */
    ESP_IMAGE_FLASH_SIZE_16MB,      /*!< SPI flash size 16 MB */
+    ESP_IMAGE_FLASH_SIZE_32MB,      /*!< SPI flash size 32 MB */
+    ESP_IMAGE_FLASH_SIZE_64MB,      /*!< SPI flash size 64 MB */
+    ESP_IMAGE_FLASH_SIZE_128MB,     /*!< SPI flash size 128 MB */
    ESP_IMAGE_FLASH_SIZE_MAX        /*!< SPI flash size MAX */
 } esp_image_flash_size_t;

--- a/components/bootloader_support/include_bootloader/bootloader_utility.h
+++ b/components/bootloader_support/include_bootloader/bootloader_utility.h
@ -96,9 +96,10 @@ void bootloader_atexit(void);
 esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);

 /**
- * @brief Debug log contents of a buffer as hexadecimal
+ * @brief Debug log contents of a buffer as hexadecimal.
 *
- * @note Only works if component log level is DEBUG or higher.
+ * @note - Only works if component log level is DEBUG or higher.
+ *       - It will print at most 128 bytes from @c buffer.
 *
 * @param buffer Buffer to log
 * @param length Length of buffer in bytes. Maximum length 128 bytes.
--- a/components/bootloader_support/src/bootloader_common.c
+++ b/components/bootloader_support/src/bootloader_common.c
@ -168,6 +168,12 @@ esp_err_t bootloader_common_get_sha256_of_partition (uint32_t address, uint32_t
        }
        if (data.image.hash_appended) {
            memcpy(out_sha_256, data.image_digest, ESP_PARTITION_HASH_LEN);
+            uint8_t calc_sha256[ESP_PARTITION_HASH_LEN];
+            // The hash is verified before returning, if app content is invalid then the function returns ESP_ERR_IMAGE_INVALID.
+            esp_err_t error = bootloader_sha256_flash_contents(address, data.image_len - ESP_PARTITION_HASH_LEN, calc_sha256);
+            if (error || memcmp(data.image_digest, calc_sha256, ESP_PARTITION_HASH_LEN) != 0) {
+                return ESP_ERR_IMAGE_INVALID;
+            }
            return ESP_OK;
        }
        // If image doesn't have a appended hash then hash calculates for entire image.
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@ -73,10 +73,12 @@ void bootloader_console_init(void)
        // Route GPIO signals to/from pins
        const uint32_t tx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_TX_PIN_IDX);
        const uint32_t rx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_RX_PIN_IDX);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_rx_gpio], PIN_FUNC_GPIO);
        PIN_INPUT_ENABLE(GPIO_PIN_MUX_REG[uart_rx_gpio]);
        esp_rom_gpio_pad_pullup_only(uart_rx_gpio);
        esp_rom_gpio_connect_out_signal(uart_tx_gpio, tx_idx, 0, 0);
        esp_rom_gpio_connect_in_signal(uart_rx_gpio, rx_idx, 0);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
        // Enable the peripheral
        periph_ll_enable_clk_clear_rst(PERIPH_UART0_MODULE + uart_num);
    }
--- a/components/bootloader_support/src/bootloader_efuse_esp32.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32.c
@ -8,8 +8,9 @@
 #include "bootloader_clock.h"
 #include "soc/efuse_reg.h"
 #include "soc/syscon_reg.h"
+#include "esp_attr.h"

-uint8_t bootloader_common_get_chip_revision(void)
+IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
 {
    uint8_t eco_bit0, eco_bit1, eco_bit2;
    eco_bit0 = (REG_READ(EFUSE_BLK0_RDATA3_REG) & 0xF000) >> 15;
@ -42,7 +43,7 @@ uint8_t bootloader_common_get_chip_revision(void)
    return chip_ver;
 }

-uint32_t bootloader_common_get_chip_ver_pkg(void)
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
 {
    uint32_t pkg_version = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG);
    uint32_t pkg_version_4bit = REG_GET_FIELD(EFUSE_BLK0_RDATA3_REG, EFUSE_RD_CHIP_VER_PKG_4BIT);
--- a/components/bootloader_support/src/bootloader_efuse_esp32c3.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32c3.c
@ -6,14 +6,15 @@

 #include <stdint.h>
 #include "soc/efuse_reg.h"
+#include "esp_attr.h"

-uint8_t bootloader_common_get_chip_revision(void)
+IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
 {
    // should return the same value as esp_efuse_get_chip_ver()
    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
 }

-uint32_t bootloader_common_get_chip_ver_pkg(void)
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
 {
    // should return the same value as esp_efuse_get_pkg_ver()
    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
--- a/components/bootloader_support/src/bootloader_efuse_esp32h2.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32h2.c
@ -6,14 +6,15 @@

 #include <stdint.h>
 #include "soc/efuse_reg.h"
+#include "esp_attr.h"

-uint8_t bootloader_common_get_chip_revision(void)
+IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
 {
    // should return the same value as esp_efuse_get_chip_ver()
    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
 }

-uint32_t bootloader_common_get_chip_ver_pkg(void)
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
 {
    // should return the same value as esp_efuse_get_pkg_ver()
    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_PKG_VERSION);
--- a/components/bootloader_support/src/bootloader_efuse_esp32s2.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32s2.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -8,15 +8,15 @@
 #include "bootloader_clock.h"
 #include "bootloader_common.h"
 #include "soc/efuse_reg.h"
+#include "esp_attr.h"

-uint8_t bootloader_common_get_chip_revision(void)
+IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
 {
    // should return the same value as esp_efuse_get_chip_ver()
-    /* No other revisions for ESP32-S2 */
-    return 0;
+    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_3_REG, EFUSE_WAFER_VERSION);
 }

-uint32_t bootloader_common_get_chip_ver_pkg(void)
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
 {
    // should return the same value as esp_efuse_get_pkg_ver()
    return REG_GET_FIELD(EFUSE_RD_MAC_SPI_SYS_4_REG, EFUSE_PKG_VERSION);
--- a/components/bootloader_support/src/bootloader_efuse_esp32s3.c
+++ b/components/bootloader_support/src/bootloader_efuse_esp32s3.c
@ -5,15 +5,16 @@
 */

 #include <stdint.h>
+#include "esp_attr.h"

-uint8_t bootloader_common_get_chip_revision(void)
+IRAM_ATTR uint8_t bootloader_common_get_chip_revision(void)
 {
    // should return the same value as esp_efuse_get_chip_ver()
    /* No other revisions for ESP32-S3 */
    return 0;
 }

-uint32_t bootloader_common_get_chip_ver_pkg(void)
+IRAM_ATTR uint32_t bootloader_common_get_chip_ver_pkg(void)
 {
    // should return the same value as esp_efuse_get_pkg_ver()
    return 0;
--- a/components/bootloader_support/src/bootloader_flash.c
+++ b/components/bootloader_support/src/bootloader_flash.c
@ -43,15 +43,15 @@

 #define BYTESHIFT(VAR, IDX)    (((VAR) >> ((IDX) * 8)) & 0xFF)
 #define ISSI_ID                0x9D
+#define MXIC_ID                0xC2
 #define GD_Q_ID_HIGH           0xC8
 #define GD_Q_ID_MID            0x40
 #define GD_Q_ID_LOW            0x16

 #define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI    (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
-#define ESP_BOOTLOADER_SPIFLASH_QE_16B           BIT9   // QE position when you write 16 bits at one time.
-#define ESP_BOOTLOADER_SPIFLASH_QE_8B            BIT1   // QE position when you write 8 bits(for SR2) at one time.
-#define ESP_BOOTLOADER_SPIFLASH_WRITE_8B         (8)
-#define ESP_BOOTLOADER_SPIFLASH_WRITE_16B        (16)
+#define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2        BIT1   // QE position when you write 8 bits(for SR2) at one time.
+#define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE     BIT9   // QE position when you write 16 bits at one time.
+

 #ifndef BOOTLOADER_BUILD
 /* Normal app version maps to esp_spi_flash.h operations...
@ -495,72 +495,77 @@ FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
    return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
 }

+FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
+{
+    return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
+}
+
 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
 {
+    // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
+    // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
    uint16_t status = 0;    // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
    uint16_t new_status = 0;
    uint8_t status_sr2 = 0;    // status_sr2 for SR2.
    uint8_t new_status_sr2 = 0;
-    uint8_t write_sr_bit = 0;
+    uint8_t sr1_bit_num = 0;
    esp_err_t err = ESP_OK;

    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-    if (is_issi_chip(&g_rom_flashchip)) {
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_8B;
-        // ISSI chips have different QE position
-
+    if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
+        // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
+        // If any code here needs to be modified, check both chips.
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);

        /* Clear all bits in the mask.
        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
        */
+        sr1_bit_num = 8;
        new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
-        // Skip if nothing needs to be cleared. Otherwise will waste time waiting for the flash to clear nothing.
    } else if (is_gd_q_chip(&g_rom_flashchip)) {
        /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
           Use 01H to write SR1 and 31H to write SR2.
        */
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_8B;
-
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
+        sr1_bit_num = 8;
        new_status = 0;

        status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
-        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_8B;
+        new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
    } else {
        /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
-        write_sr_bit = ESP_BOOTLOADER_SPIFLASH_WRITE_16B;
        status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);

        /* Clear all bits except QE, if it is set.
        (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
        */
-        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_16B;
+        sr1_bit_num = 16;
+        new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
    }

+    // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
+    bool status_written = false;
+    // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
    if (status != new_status) {
-        /* if the status in SR not equal to the ideal status, the status need to be updated */
        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-        bootloader_execute_flash_command(CMD_WRSR, new_status, write_sr_bit, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
+        status_written = true;
    }

    if (status_sr2 != new_status_sr2) {
-        /* If the status in SR2 not equal to the ideal status, the status need to be updated.
-           It doesn't need to be updated if status in SR2 is 0.
-           Note: if we need to update both SR1 and SR2, the `CMD_WREN` needs to be sent again.
-        */
        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
        bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
-        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, write_sr_bit, 0);
-        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
+        status_written = true;
+    }
+
+    if (status_written) {
+        //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
+        esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+        bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
    }

-    bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
-    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
    return err;
 }

--- a/components/bootloader_support/src/bootloader_mem.c
+++ b/components/bootloader_support/src/bootloader_mem.c
@ -17,6 +17,8 @@ void bootloader_init_mem(void)
 {
    cpu_hal_init_hwloop();

+#ifdef CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE
    // protect memory region
    esp_cpu_configure_region_protection();
+#endif
 }
--- a/components/bootloader_support/src/bootloader_panic.c
+++ b/components/bootloader_support/src/bootloader_panic.c
@ -12,7 +12,11 @@

 void __assert_func(const char *file, int line, const char *func, const char *expr)
 {
+
+#if !CONFIG_OPTIMIZATION_ASSERTIONS_SILENT
    esp_rom_printf("Assert failed in %s, %s:%d (%s)\r\n", func, file, line, expr);
+#endif
+
    while (1) {
    }
 }
--- a/components/bootloader_support/src/bootloader_random.c
+++ b/components/bootloader_support/src/bootloader_random.c
@ -18,6 +18,13 @@
 }

 #else
+
+#if !defined CONFIG_IDF_TARGET_ESP32S3
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 32 * 2) /* extra factor of 2 is precautionary */
+#else
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 23) /* 45 KHz reading frequency is the maximum we have tested so far on S3 */
+#endif
+
 __attribute__((weak)) void bootloader_fill_random(void *buffer, size_t length)
 {
    uint8_t *buffer_bytes = (uint8_t *)buffer;
@ -40,7 +47,7 @@
            do {
                random ^= REG_READ(WDEV_RND_REG);
                now = cpu_hal_get_cycle_count();
-            } while (now - start < 80 * 32 * 2); /* extra factor of 2 is precautionary */
+            } while (now - start < RNG_CPU_WAIT_CYCLE_NUM);
        }
        buffer_bytes[i] = random >> ((i % 4) * 8);
    }
--- a/components/bootloader_support/src/bootloader_random_esp32s3.c
+++ b/components/bootloader_support/src/bootloader_random_esp32s3.c
@ -6,18 +6,97 @@
 #include "sdkconfig.h"
 #include "bootloader_random.h"
 #include "esp_log.h"
-
-static const char *TAG = "bootloader_random";
+#include "soc/system_reg.h"
+#include "soc/syscon_reg.h"
+#include "soc/apb_saradc_reg.h"
+#include "soc/rtc_cntl_reg.h"
+#include "soc/sens_reg.h"
+#include "regi2c_ctrl.h"
+#include "regi2c_saradc.h"

 void bootloader_random_enable(void)
 {
-    ESP_LOGW(TAG, "RNG for ESP32-S3 not currently supported"); // IDF-1878
-    // Don't forget to remove the following line
-    // *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
-    // In the bootloader.ld when RNG support is ready for ESP32-S3
+    SET_PERI_REG_MASK(SYSTEM_WIFI_CLK_EN_REG, SYSTEM_WIFI_CLK_RNG_EN);
+
+    // Enable 8M clock source for RNG (this is actually enough to produce strong random results,
+    // but enabling the SAR ADC as well adds some insurance.)
+    REG_SET_BIT(RTC_CNTL_CLK_CONF_REG, RTC_CNTL_DIG_CLK8M_EN);
+
+    /// Enable SAR ADC to read a disconnected input for additional entropy
+
+    // Reset ADC clock
+    SET_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+    CLEAR_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+
+    // Enable clock and select clock source for ADC digital controller
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_SEL, 2); //APB clock
+    SET_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_SAR_CLK_GATED);
+    SET_PERI_REG_MASK(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLK_EN);
+
+    // Read freq = apb_clk / (APB_SARADC_CLKM_DIV_NUM + 1) / TIMER_TARGET / 2
+    // Internal ADC sample freq = apb_clk / (APB_SARADC_CLKM_DIV_NUM + 1) / (APB_SARADC_SAR_CLK_DIV + 1)
+    // Read frequency has to be at least 35 times lower than the sampling frequency
+
+    REG_SET_FIELD(APB_SARADC_APB_ADC_CLKM_CONF_REG, APB_SARADC_CLKM_DIV_NUM, 3);
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR_CLK_DIV, 3); // SAR clock divider has to be at least 2
+    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_TARGET, 70);
+
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL_REG, APB_SARADC_START_FORCE);
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 3);
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_MEAS_NUM_LIMIT);
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_WORK_MODE, 1);
+
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR2_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR2_PATT_TAB1_REG,0xafffff); // Test internal voltage if the channel info is 0xa.
+    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SAR1_PATT_LEN, 0);
+    WRITE_PERI_REG(APB_SARADC_SAR1_PATT_TAB1_REG,0xafffff); // Test internal voltage if the channel info is 0xa.
+
+    // Enable adc1 digital controller
+    SET_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+
+    // Set SARADC2 arbiter
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS2_MUX_REG, SENS_SAR2_RTC_FORCE);
+    CLEAR_PERI_REG_MASK(APB_SARADC_APB_ADC_ARB_CTRL_REG, APB_SARADC_ADC_ARB_GRANT_FORCE);
+    CLEAR_PERI_REG_MASK(APB_SARADC_APB_ADC_ARB_CTRL_REG, APB_SARADC_ADC_ARB_FIX_PRIORITY);
+
+    // Disable ADC filter
+    REG_SET_FIELD(APB_SARADC_FILTER_CTRL0_REG, APB_SARADC_FILTER_CHANNEL0, 0xD);
+    REG_SET_FIELD(APB_SARADC_FILTER_CTRL0_REG, APB_SARADC_FILTER_CHANNEL1, 0xD);
+
+    // Start ADC sample
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_SEL);
+    SET_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    /*Choose the appropriate internal voltage to measure*/
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 1);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
 }

+//TODO: IDF-4714
 void bootloader_random_disable(void)
 {
-    ESP_LOGW(TAG, "RNG for ESP32-S3 not currently supported"); // IDF-1878
+    /* Restore internal I2C bus state */
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENCAL_REF_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_TSENS_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
+
+    //Power off SAR ADC
+    REG_SET_FIELD(SENS_SAR_POWER_XPD_SAR_REG, SENS_FORCE_XPD_SAR, 0);
+    //return to ADC RTC controller
+    CLEAR_PERI_REG_MASK(SENS_SAR_MEAS1_MUX_REG, SENS_SAR1_DIG_FORCE);
+    //Invalidate ADC digital trigger timer
+    CLEAR_PERI_REG_MASK(APB_SARADC_CTRL2_REG, APB_SARADC_TIMER_EN);
+
+    //Disable ADC digital part
+    CLEAR_PERI_REG_MASK(SYSTEM_PERIP_CLK_EN0_REG, SYSTEM_APB_SARADC_CLK_EN);
+    //Hold reset bit for ADC digital part
+    SET_PERI_REG_MASK(SYSTEM_PERIP_RST_EN0_REG, SYSTEM_APB_SARADC_RST);
+
+    /* Note: the 8M CLK entropy source continues running even after this function is called,
+       but as mentioned above it's better to enable Wi-Fi or BT or call bootloader_random_enable()
+       in order to get a secondary entropy source.
+    */
 }
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@ -78,6 +78,7 @@
 #include "bootloader_console.h"
 #include "bootloader_soc.h"
 #include "esp_efuse.h"
+#include "esp_fault.h"

 static const char *TAG = "boot";

@ -269,9 +270,16 @@ static esp_err_t write_otadata(esp_ota_select_entry_t *otadata, uint32_t offset,
 static bool check_anti_rollback(const esp_partition_pos_t *partition)
 {
 #ifdef CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
-    esp_app_desc_t app_desc;
+    esp_app_desc_t app_desc = {};
    esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
-    return err == ESP_OK && esp_efuse_check_secure_version(app_desc.secure_version) == true;
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
+        return false;
+    }
+    bool sec_ver = esp_efuse_check_secure_version(app_desc.secure_version);
+    /* Anti FI check */
+    ESP_FAULT_ASSERT(sec_ver == esp_efuse_check_secure_version(app_desc.secure_version));
+    return sec_ver;
 #else
    return true;
 #endif
@ -284,6 +292,8 @@ static void update_anti_rollback(const esp_partition_pos_t *partition)
    esp_err_t err = bootloader_common_get_partition_description(partition, &app_desc);
    if (err == ESP_OK) {
        esp_efuse_update_secure_version(app_desc.secure_version);
+    } else {
+        ESP_LOGE(TAG, "Failed to get partition description %d", err);
    }
 }

@ -700,7 +710,8 @@ static void set_cache_and_start_app(
    uint32_t irom_size,
    uint32_t entry_addr)
 {
-    int rc;
+    int rc __attribute__((unused));
+
    ESP_LOGD(TAG, "configure drom and irom and start");
 #if CONFIG_IDF_TARGET_ESP32
    Cache_Read_Disable(0);
@ -720,8 +731,8 @@ static void set_cache_and_start_app(
 #endif

    /* Clear the MMU entries that are already set up,
-       so the new app only has the mappings it creates.
-    */
+     * so the new app only has the mappings it creates.
+     */
 #if CONFIG_IDF_TARGET_ESP32
    for (int i = 0; i < DPORT_FLASH_MMU_TABLE_SIZE; i++) {
        DPORT_PRO_FLASH_MMU_TABLE[i] = DPORT_FLASH_MMU_TABLE_INVALID_VAL;
@ -732,31 +743,33 @@ static void set_cache_and_start_app(
    }
 #endif
    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
+    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK;
    uint32_t drom_page_count = bootloader_cache_pages_to_map(drom_size, drom_load_addr);
    ESP_LOGV(TAG, "d mmu set paddr=%08x vaddr=%08x size=%d n=%d",
-             drom_addr & MMU_FLASH_MASK, drom_load_addr_aligned, drom_size, drom_page_count);
+             drom_addr_aligned, drom_load_addr_aligned, drom_size, drom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    rc = cache_flash_mmu_set(0, 0, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count);
 #elif CONFIG_IDF_TARGET_ESP32S2
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32S3
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32C3
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32H2
-    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr & 0xffff0000, drom_addr & 0xffff0000, 64, drom_page_count, 0);
+    rc = Cache_Dbus_MMU_Set(MMU_ACCESS_FLASH, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count, 0);
 #endif
    ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr & MMU_FLASH_MASK, 64, drom_page_count);
+    rc = cache_flash_mmu_set(1, 0, drom_load_addr_aligned, drom_addr_aligned, 64, drom_page_count);
    ESP_LOGV(TAG, "rc=%d", rc);
 #endif
    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
+    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK;
    uint32_t irom_page_count = bootloader_cache_pages_to_map(irom_size, irom_load_addr);
    ESP_LOGV(TAG, "i mmu set paddr=%08x vaddr=%08x size=%d n=%d",
-             irom_addr & MMU_FLASH_MASK, irom_load_addr_aligned, irom_size, irom_page_count);
+             irom_addr_aligned, irom_load_addr_aligned, irom_size, irom_page_count);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    rc = cache_flash_mmu_set(0, 0, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count);
 #elif CONFIG_IDF_TARGET_ESP32S2
    uint32_t iram1_used = 0;
    if (irom_load_addr + irom_size > IRAM1_ADDRESS_LOW) {
@ -767,17 +780,17 @@ static void set_cache_and_start_app(
        rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, IRAM1_ADDRESS_LOW, 0, 64, 64, 1);
        REG_CLR_BIT(EXTMEM_PRO_ICACHE_CTRL1_REG, EXTMEM_PRO_ICACHE_MASK_IRAM1);
    }
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32S3
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32C3
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #elif CONFIG_IDF_TARGET_ESP32H2
-    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr & 0xffff0000, irom_addr & 0xffff0000, 64, irom_page_count, 0);
+    rc = Cache_Ibus_MMU_Set(MMU_ACCESS_FLASH, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count, 0);
 #endif
    ESP_LOGV(TAG, "rc=%d", rc);
 #if CONFIG_IDF_TARGET_ESP32
-    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr & MMU_FLASH_MASK, 64, irom_page_count);
+    rc = cache_flash_mmu_set(1, 0, irom_load_addr_aligned, irom_addr_aligned, 64, irom_page_count);
    ESP_LOGV(TAG, "rc=%d", rc);
    DPORT_REG_CLR_BIT( DPORT_PRO_CACHE_CTRL1_REG,
                       (DPORT_PRO_CACHE_MASK_IRAM0) | (DPORT_PRO_CACHE_MASK_IRAM1 & 0) |
@ -865,22 +878,19 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he

 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
 {
-#if BOOT_LOG_LEVEL >= LOG_LEVEL_DEBUG
-    assert(length <= 128); // Avoid unbounded VLA size
+#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
    const uint8_t *bytes = (const uint8_t *)buffer;
-    char hexbuf[length * 2 + 1];
-    hexbuf[length * 2] = 0;
-    for (size_t i = 0; i < length; i++) {
-        for (int shift = 0; shift < 2; shift++) {
-            uint8_t nibble = (bytes[i] >> (shift ? 0 : 4)) & 0x0F;
-            if (nibble < 10) {
-                hexbuf[i * 2 + shift] = '0' + nibble;
-            } else {
-                hexbuf[i * 2 + shift] = 'a' + nibble - 10;
-            }
-        }
-    }
+    const size_t output_len = MIN(length, 128);
+    char hexbuf[128 * 2 + 1];
+
+    bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
+
+    hexbuf[output_len * 2] = '\0';
    ESP_LOGD(TAG, "%s: %s", label, hexbuf);
+#else
+    (void) buffer;
+    (void) length;
+    (void) label;
 #endif
 }

--- a/components/bootloader_support/src/esp32/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32/secure_boot_secure_features.c
@ -79,7 +79,7 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
        return err;
    }
 #else
-    ESP_LOGW(TAG, "Not disabling ROM Download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
--- a/components/bootloader_support/src/esp32c3/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32c3/flash_encryption_secure_features.c
@ -38,7 +38,7 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
--- a/components/bootloader_support/src/esp32c3/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32c3/secure_boot_secure_features.c
@ -16,13 +16,24 @@ static __attribute__((unused)) const char *TAG = "secure_boot";

 esp_err_t esp_secure_boot_enable_secure_features(void)
 {
-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp32h2/flash_encrypt.c
+++ b/components/bootloader_support/src/esp32h2/flash_encrypt.c
@ -142,7 +142,7 @@ static esp_err_t initialise_flash_encryption(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

    esp_err_t err = esp_efuse_batch_write_commit();
    if (err != ESP_OK) {
--- a/components/bootloader_support/src/esp32h2/secure_boot.c
+++ b/components/bootloader_support/src/esp32h2/secure_boot.c
@ -248,13 +248,25 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
        return key_state;
    }

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

+    esp_err_t err = ESP_FAIL;
 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
@ -272,7 +284,7 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag

    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);

-    esp_err_t err = esp_efuse_batch_write_commit();
+    err = esp_efuse_batch_write_commit();
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Error programming security eFuses (err=0x%x).", err);
        return err;
--- a/components/bootloader_support/src/esp32s2/bootloader_esp32s2.c
+++ b/components/bootloader_support/src/esp32s2/bootloader_esp32s2.c
@ -101,6 +101,15 @@ static void update_flash_config(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        size = 16;
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        size = 32;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        size = 64;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        size = 128;
+        break;
    default:
        size = 2;
    }
@ -174,6 +183,15 @@ static void print_flash_info(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        str = "16MB";
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        str = "32MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        str = "64MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        str = "128MB";
+        break;
    default:
        str = "2MB";
        break;
--- a/components/bootloader_support/src/esp32s2/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32s2/secure_boot_secure_features.c
@ -21,9 +21,20 @@ esp_err_t esp_secure_boot_enable_secure_features(void)

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp32s3/bootloader_esp32s3.c
+++ b/components/bootloader_support/src/esp32s3/bootloader_esp32s3.c
@ -103,6 +103,15 @@ static void update_flash_config(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        size = 16;
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        size = 32;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        size = 64;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        size = 128;
+        break;
    default:
        size = 2;
    }
@ -176,6 +185,15 @@ static void print_flash_info(const esp_image_header_t *bootloader_hdr)
    case ESP_IMAGE_FLASH_SIZE_16MB:
        str = "16MB";
        break;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        str = "32MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        str = "64MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        str = "128MB";
+        break;
    default:
        str = "2MB";
        break;
--- a/components/bootloader_support/src/esp32s3/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32s3/flash_encryption_secure_features.c
@ -39,7 +39,7 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)
    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
 #endif

-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
--- a/components/bootloader_support/src/esp32s3/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32s3/secure_boot_secure_features.c
@ -16,13 +16,24 @@ static __attribute__((unused)) const char *TAG = "secure_boot";

 esp_err_t esp_secure_boot_enable_secure_features(void)
 {
-    esp_efuse_write_field_bit(ESP_EFUSE_DIS_LEGACY_SPI_BOOT);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

 #ifdef CONFIG_SECURE_ENABLE_SECURE_ROM_DL_MODE
    ESP_LOGI(TAG, "Enabling Security download mode...");
-    esp_efuse_write_field_bit(ESP_EFUSE_ENABLE_SECURITY_DOWNLOAD);
+    esp_err_t err = esp_efuse_enable_rom_secure_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not enable Security download mode...");
+        return err;
+    }
+#elif CONFIG_SECURE_DISABLE_ROM_DL_MODE
+    ESP_LOGI(TAG, "Disable ROM Download mode...");
+    esp_err_t err = esp_efuse_disable_rom_download_mode();
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Could not disable ROM Download mode...");
+        return err;
+    }
 #else
-    ESP_LOGW(TAG, "Not enabling Security download mode - SECURITY COMPROMISED");
+    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@ -31,6 +31,8 @@
 #include "esp32h2/rom/secure_boot.h"
 #endif

+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
+
 /* Checking signatures as part of verifying images is necessary:
   - Always if secure boot is enabled
   - Differently in bootloader and/or app, depending on kconfig
@ -102,7 +104,7 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    while(0)

 static esp_err_t process_image_header(esp_image_metadata_t *data, uint32_t part_offset, bootloader_sha256_handle_t *sha_handle, bool do_verify, bool silent);
-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent);
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent);
 static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data, bool silent, bool skip_check_checksum);

 static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
@ -152,7 +154,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    CHECK_ERR(process_segments(data, silent, do_load, sha_handle, checksum));
    bool skip_check_checksum = !do_verify || esp_cpu_in_ocd_debug_mode();
    CHECK_ERR(process_checksum(sha_handle, checksum_word, data, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(data, part->size, do_verify, silent));
+    CHECK_ERR(process_appended_hash_and_sig(data, part->offset, part->size, do_verify, silent));
    if (verify_sha) {
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
        // secure boot images have a signature appended
@ -250,7 +252,11 @@ esp_err_t bootloader_load_image(const esp_partition_pos_t *part, esp_image_metad
 #if CONFIG_BOOTLOADER_SKIP_VALIDATE_ALWAYS
    mode = ESP_IMAGE_LOAD_NO_VALIDATE;
 #elif CONFIG_BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
-    if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON) {
+    if (esp_rom_get_reset_reason(0) == RESET_REASON_CHIP_POWER_ON
+#if SOC_EFUSE_HAS_EFUSE_RST_BUG
+        || esp_rom_get_reset_reason(0) == RESET_REASON_CORE_EFUSE_CRC
+#endif
+        ) {
        mode = ESP_IMAGE_LOAD_NO_VALIDATE;
    }
 #endif // CONFIG_BOOTLOADER_SKIP_...
@ -288,7 +294,7 @@ esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_meta
    CHECK_ERR(process_segments(metadata, silent, do_load, NULL, NULL));
    bool skip_check_checksum = true;
    CHECK_ERR(process_checksum(NULL, 0, metadata, silent, skip_check_checksum));
-    CHECK_ERR(process_appended_hash(metadata, part->size, true, silent));
+    CHECK_ERR(process_appended_hash_and_sig(metadata, part->offset, part->size, true, silent));
    return ESP_OK;
 err:
    return err;
@ -737,7 +743,7 @@ esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data)
                            data);
 }

-static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part_len, bool do_verify, bool silent)
+static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent)
 {
    esp_err_t err = ESP_OK;
    if (data->image.hash_appended) {
@ -748,8 +754,34 @@ static esp_err_t process_appended_hash(esp_image_metadata_t *data, uint32_t part
        data->image_len += HASH_LEN;
    }

-    if (data->image_len > part_len) {
-        FAIL_LOAD("Image length %d doesn't fit in partition length %d", data->image_len, part_len);
+    uint32_t sig_block_len = 0;
+    const uint32_t end = data->image_len;
+#if CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    // Case I: Bootloader part
+    if (part_offset == ESP_BOOTLOADER_OFFSET) {
+        // For bootloader with secure boot v1, signature stays in an independant flash
+        // sector (offset 0x0)  and does not get appended to the image.
+#if CONFIG_SECURE_BOOT_V2_ENABLED
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    } else {
+    // Case II: Application part
+#if CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+        sig_block_len = sizeof(esp_secure_boot_sig_block_t);
+#else
+        // Sanity check - secure boot v2 signature block starts on 4K boundary
+        sig_block_len = ALIGN_UP(end, FLASH_SECTOR_SIZE) - end;
+        sig_block_len += sizeof(ets_secure_boot_signature_t);
+#endif
+    }
+#endif // CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
+
+    const uint32_t full_image_len = end + sig_block_len;
+    if (full_image_len > part_len) {
+        FAIL_LOAD("Image length %d doesn't fit in partition length %d", full_image_len, part_len);
    }
    return err;
 err:
@ -810,7 +842,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
 #if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
-    uint32_t padded_end = (end + FLASH_SECTOR_SIZE - 1) & ~(FLASH_SECTOR_SIZE-1);
+    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
    if (padded_end > end) {
        const void *padding = bootloader_mmap(end, padded_end - end);
        bootloader_sha256_data(sha_handle, padding, padded_end - end);
@ -901,6 +933,12 @@ int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size)
        return 8 * 1024 * 1024;
    case ESP_IMAGE_FLASH_SIZE_16MB:
        return 16 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_32MB:
+        return 32 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_64MB:
+        return 64 * 1024 * 1024;
+    case ESP_IMAGE_FLASH_SIZE_128MB:
+        return 128 * 1024 * 1024;
    default:
        return 0;
    }
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@ -104,7 +104,8 @@ static esp_err_t check_and_generate_encryption_keys(void)
 #endif // CONFIG_SECURE_FLASH_ENCRYPTION_AES256
 #endif // CONFIG_IDF_TARGET_ESP32

-    esp_efuse_block_t blocks[BLOCKS_NEEDED];
+    /* Initialize all efuse block entries to invalid (max) value */
+    esp_efuse_block_t blocks[BLOCKS_NEEDED] = {[0 ... BLOCKS_NEEDED-1] = EFUSE_BLK_KEY_MAX};
    bool has_key = true;
    for (unsigned i = 0; i < BLOCKS_NEEDED; i++) {
        bool tmp_has_key = esp_efuse_find_purpose(purposes[i], &blocks[i]);
--- a/components/bootloader_support/src/flash_qio_mode.c
+++ b/components/bootloader_support/src/flash_qio_mode.c
@ -30,39 +30,6 @@

 static const char *TAG = "qio_mode";

-typedef unsigned (*read_status_fn_t)(void);
-typedef void (*write_status_fn_t)(unsigned);
-
-typedef struct __attribute__((packed))
-{
-    const char *manufacturer;
-    uint8_t mfg_id; /* 8-bit JEDEC manufacturer ID */
-    uint16_t flash_id; /* 16-bit JEDEC flash chip ID */
-    uint16_t id_mask; /* Bits to match on in flash chip ID */
-    read_status_fn_t read_status_fn;
-    write_status_fn_t write_status_fn;
-    uint8_t status_qio_bit;
-} qio_info_t;
-
-/* Read 8 bit status using RDSR command */
-static unsigned read_status_8b_rdsr(void);
-/* Read 8 bit status (second byte) using RDSR2 command */
-static unsigned read_status_8b_rdsr2(void);
-/* read 16 bit status using RDSR & RDSR2 (low and high bytes) */
-static unsigned read_status_16b_rdsr_rdsr2(void);
-
-/* Write 8 bit status using WRSR */
-static void write_status_8b_wrsr(unsigned new_status);
-/* Write 8 bit status (second byte) using WRSR2 */
-static void write_status_8b_wrsr2(unsigned new_status);
-/* Write 16 bit status using WRSR */
-static void write_status_16b_wrsr(unsigned new_status);
-
-/* Read 8 bit status of XM25QU64A  */
-static unsigned read_status_8b_xmc25qu64a(void);
-/* Write 8 bit status of XM25QU64A */
-static void write_status_8b_xmc25qu64a(unsigned new_status);
-
 /* Array of known flash chips and data to enable Quad I/O mode

   Manufacturer & flash ID can be tested by running "esptool.py
@ -75,13 +42,14 @@ static void write_status_8b_xmc25qu64a(unsigned new_status);

   Searching of this table stops when the first match is found.
 */
-const static qio_info_t chip_data[] = {
+const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_support_list[] = {
    /*   Manufacturer,   mfg_id, flash_id, id mask, Read Status,                Write Status,               QIE Bit */
-    { "MXIC",        0xC2,   0x2000, 0xFF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 },
-    { "ISSI",        0x9D,   0x4000, 0xCF00,    read_status_8b_rdsr,        write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
-    { "WinBond",     0xEF,   0x4000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
-    { "GD",          0xC8,   0x6000, 0xFF00,    read_status_16b_rdsr_rdsr2, write_status_16b_wrsr,      9 },
-    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    read_status_8b_xmc25qu64a,  write_status_8b_xmc25qu64a, 6 },
+    { "MXIC",        0xC2,   0x2000, 0xFF00,    bootloader_read_status_8b_rdsr,        bootloader_write_status_8b_wrsr,       6 },
+    { "ISSI",        0x9D,   0x4000, 0xCF00,    bootloader_read_status_8b_rdsr,        bootloader_write_status_8b_wrsr,       6 }, /* IDs 0x40xx, 0x70xx */
+    { "WinBond",     0xEF,   0x4000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },
+    { "GD",          0xC8,   0x6000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },
+    { "XM25QU64A",   0x20,   0x3817, 0xFFFF,    bootloader_read_status_8b_xmc25qu64a,  bootloader_write_status_8b_xmc25qu64a, 6 },
+    { "TH",          0xcd,   0x6000, 0xFF00,    bootloader_read_status_16b_rdsr_rdsr2, bootloader_write_status_16b_wrsr,      9 },

    /* Final entry is default entry, if no other IDs have matched.

@ -90,13 +58,13 @@ const static qio_info_t chip_data[] = {
       FM25Q32 (QOUT mode only, mfg ID 0xA1, flash IDs including 4016)
       BY25Q32 (mfg ID 0x68, flash IDs including 4016)
    */
-    { NULL,          0xFF,    0xFFFF, 0xFFFF,   read_status_8b_rdsr2,       write_status_8b_wrsr2,      1 },
+    { NULL,          0xFF,    0xFFFF, 0xFFFF,   bootloader_read_status_8b_rdsr2,       bootloader_write_status_8b_wrsr2,      1 },
 };

-#define NUM_CHIPS (sizeof(chip_data) / sizeof(qio_info_t))
+#define NUM_CHIPS (sizeof(bootloader_flash_qe_support_list) / sizeof(bootloader_qio_info_t))

-static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
-                                 write_status_fn_t write_status_fn,
+static esp_err_t enable_qio_mode(bootloader_flash_read_status_fn_t read_status_fn,
+                                 bootloader_flash_write_status_fn_t write_status_fn,
                                 uint8_t status_qio_bit);

 /* Generic function to use the "user command" SPI controller functionality
@ -123,9 +91,9 @@ void bootloader_enable_qio_mode(void)
    ESP_LOGD(TAG, "Manufacturer ID 0x%02x chip ID 0x%04x", mfg_id, flash_id);

    for (i = 0; i < NUM_CHIPS - 1; i++) {
-        const qio_info_t *chip = &chip_data[i];
+        const bootloader_qio_info_t *chip = &bootloader_flash_qe_support_list[i];
        if (mfg_id == chip->mfg_id && (flash_id & chip->id_mask) == (chip->flash_id & chip->id_mask)) {
-            ESP_LOGI(TAG, "Enabling QIO for flash chip %s", chip_data[i].manufacturer);
+            ESP_LOGI(TAG, "Enabling QIO for flash chip %s", bootloader_flash_qe_support_list[i].manufacturer);
            break;
        }
    }
@ -133,16 +101,16 @@ void bootloader_enable_qio_mode(void)
    if (i == NUM_CHIPS - 1) {
        ESP_LOGI(TAG, "Enabling default flash chip QIO");
    }
-    enable_qio_mode(chip_data[i].read_status_fn,
-                    chip_data[i].write_status_fn,
-                    chip_data[i].status_qio_bit);
+    enable_qio_mode(bootloader_flash_qe_support_list[i].read_status_fn,
+                    bootloader_flash_qe_support_list[i].write_status_fn,
+                    bootloader_flash_qe_support_list[i].status_qio_bit);
 #if SOC_CACHE_SUPPORT_WRAP
    bootloader_flash_wrap_set(FLASH_WRAP_MODE_DISABLE);
 #endif
 }

-static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
-                                 write_status_fn_t write_status_fn,
+static esp_err_t enable_qio_mode(bootloader_flash_read_status_fn_t read_status_fn,
+                                 bootloader_flash_write_status_fn_t write_status_fn,
                                 uint8_t status_qio_bit)
 {
    uint32_t status;
@ -190,37 +158,37 @@ static esp_err_t enable_qio_mode(read_status_fn_t read_status_fn,
    return ESP_OK;
 }

-static unsigned read_status_8b_rdsr(void)
+unsigned bootloader_read_status_8b_rdsr(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
 }

-static unsigned read_status_8b_rdsr2(void)
+unsigned bootloader_read_status_8b_rdsr2(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
 }

-static unsigned read_status_16b_rdsr_rdsr2(void)
+unsigned bootloader_read_status_16b_rdsr_rdsr2(void)
 {
    return bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
 }

-static void write_status_8b_wrsr(unsigned new_status)
+void bootloader_write_status_8b_wrsr(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR, new_status, 8, 0);
 }

-static void write_status_8b_wrsr2(unsigned new_status)
+void bootloader_write_status_8b_wrsr2(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR2, new_status, 8, 0);
 }

-static void write_status_16b_wrsr(unsigned new_status)
+void bootloader_write_status_16b_wrsr(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_WRSR, new_status, 16, 0);
 }

-static unsigned read_status_8b_xmc25qu64a(void)
+unsigned bootloader_read_status_8b_xmc25qu64a(void)
 {
    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
@ -229,7 +197,7 @@ static unsigned read_status_8b_xmc25qu64a(void)
    return read_status;
 }

-static void write_status_8b_xmc25qu64a(unsigned new_status)
+void bootloader_write_status_8b_xmc25qu64a(unsigned new_status)
 {
    bootloader_execute_flash_command(CMD_OTPEN, 0, 0, 0);  /* Enter OTP mode */
    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot.c
@ -156,11 +156,11 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
        return ret;
    }

+    /* Initialize all efuse block entries to invalid (max) value */
+    esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS] = {[0 ... SECURE_BOOT_NUM_BLOCKS-1] = EFUSE_BLK_KEY_MAX};
    /* Check if secure boot digests are present */
-    esp_efuse_block_t blocks[SECURE_BOOT_NUM_BLOCKS];
    bool has_secure_boot_digest = false;
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
-        blocks[i] = EFUSE_BLK_KEY_MAX;
        bool tmp_has_key = esp_efuse_find_purpose(secure_boot_key_purpose[i], &blocks[i]);
        if (tmp_has_key) { // For ESP32: esp_efuse_find_purpose() always returns True, need to check whether the key block is used or not.
            tmp_has_key &= !esp_efuse_key_block_unused(blocks[i]);
@ -198,6 +198,12 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
        }
    } else {
        for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+            /* Check if corresponding digest slot is used or not */
+            if (blocks[i] == EFUSE_BLK_KEY_MAX) {
+                ESP_LOGD(TAG, "SECURE_BOOT_DIGEST%d slot is not used", i);
+                continue;
+            }
+
 #if SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
            if (esp_efuse_get_digest_revoke(i)) {
                continue;
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
@ -137,10 +137,13 @@ esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signa
 #if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS == 1
    int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, trusted.key_digests[0], verified_digest);
 #else
-    ets_secure_boot_key_digests_t trusted_key_digests;
+    ets_secure_boot_key_digests_t trusted_key_digests = {0};
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
    }
+    // Key revocation happens in ROM bootloader.
+    // Do NOT allow key revocation while verifying application
+    trusted_key_digests.allow_key_revoke = false;
    int sb_result = ets_secure_boot_verify_signature(sig_block, image_digest, &trusted_key_digests, verified_digest);
 #endif
    if (sb_result != SB_SUCCESS) {
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -38,6 +38,8 @@ if(CONFIG_BT_ENABLED)
         "common/osi/buffer.c"
         "common/osi/config.c"
         "common/osi/fixed_queue.c"
+         "common/osi/pkt_queue.c"
+         "common/osi/fixed_pkt_queue.c"
         "common/osi/future.c"
         "common/osi/hash_functions.c"
         "common/osi/hash_map.c"
--- a/components/bt/common/api/include/api/esp_blufi_api.h
+++ b/components/bt/common/api/include/api/esp_blufi_api.h
@ -114,9 +114,9 @@ typedef struct {
 } esp_blufi_ap_record_t;

 /// Bluetooth address length
-#define ESP_BD_ADDR_LEN     6
+#define ESP_BLUFI_BD_ADDR_LEN     6
 /// Bluetooth device address
-typedef uint8_t esp_bd_addr_t[ESP_BD_ADDR_LEN];
+typedef uint8_t esp_blufi_bd_addr_t[ESP_BLUFI_BD_ADDR_LEN];

 /**
 * @brief BLUFI callback parameters union
@ -147,7 +147,7 @@ typedef union {
     * @brief ESP_BLUFI_EVENT_CONNECT
 	 */
    struct blufi_connect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
        uint8_t    server_if;                       /*!< server interface */
        uint16_t   conn_id;                         /*!< Connection id */
    } connect;									    /*!< Blufi callback param of ESP_BLUFI_EVENT_CONNECT */
@ -156,7 +156,7 @@ typedef union {
     * @brief ESP_BLUFI_EVENT_DISCONNECT
 	 */
    struct blufi_disconnect_evt_param {
-        esp_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
+        esp_blufi_bd_addr_t remote_bda;                   /*!< Blufi Remote bluetooth device address */
    } disconnect;									/*!< Blufi callback param of ESP_BLUFI_EVENT_DISCONNECT */

    /* ESP_BLUFI_EVENT_REQ_WIFI_CONNECT */          /* No callback param */
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@ -62,6 +62,10 @@
 #endif /* #if CLASSIC_BT_INCLUDED */
 #endif

+#if (BLE_INCLUDED == TRUE)
+#include "btc_gap_ble.h"
+#endif
+
 #if CONFIG_BLE_MESH
 #include "btc_ble_mesh_ble.h"
 #include "btc_ble_mesh_prov.h"
@ -77,6 +81,9 @@
 #define BTC_TASK_STACK_SIZE             (BT_BTC_TASK_STACK_SIZE + BT_TASK_EXTRA_STACK_SIZE)	//by menuconfig
 #define BTC_TASK_NAME                   "BTC_TASK"
 #define BTC_TASK_PRIO                   (BT_TASK_MAX_PRIORITIES - 6)
+#define BTC_TASK_WORKQUEUE_NUM          (2)
+#define BTC_TASK_WORKQUEUE0_LEN         (0)
+#define BTC_TASK_WORKQUEUE1_LEN         (5)

 osi_thread_t *btc_thread;

@ -207,16 +214,7 @@ static void btc_thread_handler(void *arg)

 static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 {
-    btc_msg_t *lmsg;
-
-    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
-    if (lmsg == NULL) {
-        return BT_STATUS_NOMEM;
-    }
-
-    memcpy(lmsg, msg, sizeof(btc_msg_t));
-
-    if (osi_thread_post(btc_thread, btc_thread_handler, lmsg, 0, timeout) == false) {
+    if (osi_thread_post(btc_thread, btc_thread_handler, msg, 0, timeout) == false) {
        return BT_STATUS_BUSY;
    }

@ -234,30 +232,37 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 */
 bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg_deep_copy_t copy_func)
 {
-    btc_msg_t lmsg;
+    btc_msg_t* lmsg;

-    if (msg == NULL) {
+    //                              arg XOR arg_len
+    if ((msg == NULL) || ((arg == NULL) == !(arg_len == 0))) {
        return BT_STATUS_PARM_INVALID;
    }

    BTC_TRACE_DEBUG("%s msg %u %u %u %p\n", __func__, msg->sig, msg->pid, msg->act, arg);

-    memcpy(&lmsg, msg, sizeof(btc_msg_t));
-    if (arg) {
-        lmsg.arg = (void *)osi_malloc(arg_len);
-        if (lmsg.arg == NULL) {
-            return BT_STATUS_NOMEM;
-        }
-        memset(lmsg.arg, 0x00, arg_len);    //important, avoid arg which have no length
-        memcpy(lmsg.arg, arg, arg_len);
-        if (copy_func) {
-            copy_func(&lmsg, lmsg.arg, arg);
-        }
-    } else {
-        lmsg.arg = NULL;
+    lmsg = (btc_msg_t *)osi_malloc(sizeof(btc_msg_t));
+    if (lmsg == NULL) {
+        return BT_STATUS_NOMEM;
    }

-    return btc_task_post(&lmsg, OSI_THREAD_MAX_TIMEOUT);
+    memcpy(lmsg, msg, sizeof(btc_msg_t));
+    if (arg) {
+        lmsg->arg = (void *)osi_malloc(arg_len);
+        if (lmsg->arg == NULL) {
+            osi_free(lmsg);
+            return BT_STATUS_NOMEM;
+        }
+        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        memcpy(lmsg->arg, arg, arg_len);
+        if (copy_func) {
+            copy_func(lmsg, lmsg->arg, arg);
+        }
+    } else {
+        lmsg->arg = NULL;
+    }
+
+    return btc_task_post(lmsg, OSI_THREAD_MAX_TIMEOUT);

 }

@ -410,7 +415,9 @@ error_exit:;

 bt_status_t btc_init(void)
 {
-    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE, 2);
+    const size_t workqueue_len[] = {BTC_TASK_WORKQUEUE0_LEN, BTC_TASK_WORKQUEUE1_LEN};
+    btc_thread = osi_thread_create(BTC_TASK_NAME, BTC_TASK_STACK_SIZE, BTC_TASK_PRIO, BTC_TASK_PINNED_TO_CORE,
+                                   BTC_TASK_WORKQUEUE_NUM, workqueue_len);
    if (btc_thread == NULL) {
        return BT_STATUS_NOMEM;
    }
@ -423,6 +430,7 @@ bt_status_t btc_init(void)

 #if (BLE_INCLUDED == TRUE)
    btc_gap_callback_init();
+    btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE

 #if SCAN_QUEUE_CONGEST_CHECK
@ -440,7 +448,9 @@ void btc_deinit(void)

    osi_thread_free(btc_thread);
    btc_thread = NULL;
-
+#if (BLE_INCLUDED == TRUE)
+    btc_gap_ble_deinit();
+#endif  ///BLE_INCLUDED == TRUE
 #if SCAN_QUEUE_CONGEST_CHECK
    btc_adv_list_deinit();
 #endif
@ -459,3 +469,8 @@ int get_btc_work_queue_size(void)
 {
    return osi_thread_queue_wait_size(btc_thread, 0);
 }
+
+osi_thread_t *btc_get_current_thread(void)
+{
+    return btc_thread;
+}
--- a/components/bt/common/btc/include/btc/btc_task.h
+++ b/components/bt/common/btc/include/btc/btc_task.h
@ -130,6 +130,13 @@ void btc_deinit(void);
 bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);

+/**
+ * get the BTC thread handle
+ * @return           NULL: fail
+ *                   others: pointer of osi_thread structure of BTC
+ */
+osi_thread_t *btc_get_current_thread(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
@ -295,7 +295,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                        BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                        p_data->conn.reason, p_data->conn.conn_id);

-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.conn_id = p_data->conn.conn_id;
        blufi_env.is_connected = true;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
@ -303,7 +303,7 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_CONNECT;
-        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(param.connect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        param.connect.conn_id = BTC_GATT_GET_CONN_ID(p_data->conn.conn_id);
        conn_id = param.connect.conn_id;
        server_if = p_data->conn.server_if;
@ -320,15 +320,21 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
                        BT_BD_ADDR_HEX(p_data->conn.remote_bda), p_data->conn.server_if,
                        p_data->conn.reason, p_data->conn.conn_id);

-        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.conn_id = p_data->conn.conn_id;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
        blufi_env.sec_mode = 0x0;
+        blufi_env.offset = 0;
+
+        if (blufi_env.aggr_buf != NULL) {
+            osi_free(blufi_env.aggr_buf);
+            blufi_env.aggr_buf = NULL;
+        }

        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, sizeof(esp_bd_addr_t));
+        memcpy(param.disconnect.remote_bda, p_data->conn.remote_bda, ESP_BLUFI_BD_ADDR_LEN);
        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);
        break;
    }
--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@ -256,7 +256,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)

            rc = ble_gap_conn_find(event->connect.conn_handle, &desc);
            assert(rc == 0);
-            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, sizeof(esp_bd_addr_t));
+            memcpy(param.connect.remote_bda, desc.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);

            param.connect.conn_id = event->connect.conn_handle;
            /* save connection handle */
@ -270,17 +270,24 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
        return 0;
    case BLE_GAP_EVENT_DISCONNECT:
        ESP_LOGI(TAG, "disconnect; reason=%d\n", event->disconnect.reason);
-        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
+        memcpy(blufi_env.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
        blufi_env.is_connected = false;
        blufi_env.recv_seq = blufi_env.send_seq = 0;
        blufi_env.sec_mode = 0x0;
+        blufi_env.offset = 0;
+
+        if (blufi_env.aggr_buf != NULL) {
+            osi_free(blufi_env.aggr_buf);
+            blufi_env.aggr_buf = NULL;
+        }
+
        btc_msg_t msg;
        esp_blufi_cb_param_t param;

        msg.sig = BTC_SIG_API_CB;
        msg.pid = BTC_PID_BLUFI;
        msg.act = ESP_BLUFI_EVENT_BLE_DISCONNECT;
-        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, sizeof(esp_bd_addr_t));
+        memcpy(param.disconnect.remote_bda, event->disconnect.conn.peer_id_addr.val, ESP_BLUFI_BD_ADDR_LEN);
        btc_transfer_context(&msg, &param, sizeof(esp_blufi_cb_param_t), NULL);

        return 0;
--- a/components/bt/common/include/bt_common.h
+++ b/components/bt/common/include/bt_common.h
@ -62,6 +62,12 @@
 #define BTC_DYNAMIC_MEMORY         FALSE
 #endif

+#if UC_BT_BLUEDROID_MEM_DEBUG
+#define HEAP_MEMORY_DEBUG   TRUE
+#else
+#define HEAP_MEMORY_DEBUG   FALSE
+#endif
+
 #ifndef BT_BLE_DYNAMIC_ENV_MEMORY
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -93,4 +93,11 @@
 #define UC_BT_BLUFI_ENABLE                  FALSE
 #endif

+//MEMORY DEBUG
+#ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
+#define UC_BT_BLUEDROID_MEM_DEBUG TRUE
+#else
+#define UC_BT_BLUEDROID_MEM_DEBUG FALSE
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */
--- a/components/bt/common/osi/alarm.c
+++ b/components/bt/common/osi/alarm.c
@ -143,7 +143,7 @@ static void alarm_cb_handler(struct alarm_t *alarm)
        OSI_TRACE_WARNING("%s, invalid state %d\n", __func__, alarm_state);
        return;
    }
-    btc_msg_t msg;
+    btc_msg_t msg = {0};
    btc_alarm_args_t arg;
    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_ALARM;
@ -173,7 +173,7 @@ osi_alarm_t *osi_alarm_new(const char *alarm_name, osi_alarm_callback_t callback
        goto end;
    }

-    esp_timer_create_args_t tca;
+    esp_timer_create_args_t tca = {0};
    tca.callback = (esp_timer_cb_t)alarm_cb_handler;
    tca.arg = timer_id;
    tca.dispatch_method = ESP_TIMER_TASK;
--- a/components/bt/common/osi/config.c
+++ b/components/bt/common/osi/config.c
@ -550,10 +550,12 @@ static void config_parse(nvs_handle_t fp, config_t *config)
    const size_t keyname_bufsz = sizeof(CONFIG_KEY) + 5 + 1; // including log10(sizeof(i))
    char *keyname = osi_calloc(keyname_bufsz);
    int buf_size = get_config_size_from_flash(fp);
-    char *buf = osi_calloc(buf_size);
+    char *buf = NULL;
+
    if(buf_size == 0) { //First use nvs
        goto error;
    }
+    buf = osi_calloc(buf_size);
    if (!line || !section || !buf || !keyname) {
        err_code |= 0x01;
        goto error;
--- a/components/bt/common/osi/fixed_pkt_queue.c
+++ b/components/bt/common/osi/fixed_pkt_queue.c
@ -0,0 +1,161 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/allocator.h"
+#include "osi/pkt_queue.h"
+#include "osi/fixed_pkt_queue.h"
+#include "osi/osi.h"
+#include "osi/semaphore.h"
+
+typedef struct fixed_pkt_queue_t {
+    struct pkt_queue *pkt_list;
+    osi_sem_t enqueue_sem;
+    osi_sem_t dequeue_sem;
+    size_t capacity;
+    fixed_pkt_queue_cb dequeue_ready;
+} fixed_pkt_queue_t;
+
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity)
+{
+    fixed_pkt_queue_t *ret = osi_calloc(sizeof(fixed_pkt_queue_t));
+    if (!ret) {
+        goto error;
+    }
+
+    ret->capacity = capacity;
+    ret->pkt_list = pkt_queue_create();
+    if (!ret->pkt_list) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->enqueue_sem, capacity, capacity);
+    if (!ret->enqueue_sem) {
+        goto error;
+    }
+
+    osi_sem_new(&ret->dequeue_sem, capacity, 0);
+    if (!ret->dequeue_sem) {
+        goto error;
+    }
+
+    return ret;
+
+error:
+    fixed_pkt_queue_free(ret, NULL);
+    return NULL;
+}
+
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    fixed_pkt_queue_unregister_dequeue(queue);
+
+    pkt_queue_destroy(queue->pkt_list, (pkt_queue_free_cb)free_cb);
+    queue->pkt_list = NULL;
+
+    if (queue->enqueue_sem) {
+        osi_sem_free(&queue->enqueue_sem);
+    }
+    if (queue->dequeue_sem) {
+        osi_sem_free(&queue->dequeue_sem);
+    }
+    osi_free(queue);
+}
+
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return true;
+    }
+
+    return pkt_queue_is_empty(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return pkt_queue_length(queue->pkt_list);
+}
+
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    return queue->capacity;
+}
+
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout)
+{
+    bool ret = false;
+
+    assert(queue != NULL);
+    assert(linked_pkt != NULL);
+
+    if (osi_sem_take(&queue->enqueue_sem, timeout) != 0) {
+        return false;
+    }
+
+    ret = pkt_queue_enqueue(queue->pkt_list, linked_pkt);
+
+    assert(ret == true);
+    osi_sem_give(&queue->dequeue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout)
+{
+    pkt_linked_item_t *ret = NULL;
+
+    assert(queue != NULL);
+
+    if (osi_sem_take(&queue->dequeue_sem, timeout) != 0) {
+        return NULL;
+    }
+    ret = pkt_queue_dequeue(queue->pkt_list);
+
+    osi_sem_give(&queue->enqueue_sem);
+
+    return ret;
+}
+
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    return pkt_queue_try_peek_first(queue->pkt_list);
+}
+
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb)
+{
+    assert(queue != NULL);
+    assert(ready_cb != NULL);
+
+    queue->dequeue_ready = ready_cb;
+}
+
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    queue->dequeue_ready = NULL;
+}
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue)
+{
+    assert(queue != NULL);
+
+    if (queue->dequeue_ready) {
+        queue->dequeue_ready(queue);
+    }
+}
--- a/components/bt/common/osi/include/osi/fixed_pkt_queue.h
+++ b/components/bt/common/osi/include/osi/fixed_pkt_queue.h
@ -0,0 +1,79 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _FIXED_PKT_QUEUE_H_
+#define _FIXED_PKT_QUEUE_H_
+
+
+#include "osi/pkt_queue.h"
+#include "osi/semaphore.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef FIXED_PKT_QUEUE_SIZE_MAX
+#define FIXED_PKT_QUEUE_SIZE_MAX                    254
+#endif
+
+#define FIXED_PKT_QUEUE_MAX_TIMEOUT                 OSI_SEM_MAX_TIMEOUT
+
+struct fixed_pkt_queue_t;
+
+typedef struct fixed_pkt_queue_t fixed_pkt_queue_t;
+
+typedef void (*fixed_pkt_queue_free_cb)(pkt_linked_item_t *data);
+typedef void (*fixed_pkt_queue_cb)(fixed_pkt_queue_t *queue);
+
+// Creates a new fixed queue with the given |capacity|. If more elements than
+// |capacity| are added to the queue, the caller is blocked until space is
+// made available in the queue. Returns NULL on failure. The caller must free
+// the returned queue with |fixed_pkt_queue_free|.
+fixed_pkt_queue_t *fixed_pkt_queue_new(size_t capacity);
+
+// Freeing a queue that is currently in use (i.e. has waiters
+// blocked on it) results in undefined behaviour.
+void fixed_pkt_queue_free(fixed_pkt_queue_t *queue, fixed_pkt_queue_free_cb free_cb);
+
+// Returns a value indicating whether the given |queue| is empty. If |queue|
+// is NULL, the return value is true.
+bool fixed_pkt_queue_is_empty(fixed_pkt_queue_t *queue);
+
+// Returns the length of the |queue|. If |queue| is NULL, the return value
+// is 0.
+size_t fixed_pkt_queue_length(fixed_pkt_queue_t *queue);
+
+// Returns the maximum number of elements this queue may hold. |queue| may
+// not be NULL.
+size_t fixed_pkt_queue_capacity(fixed_pkt_queue_t *queue);
+
+// Enqueues the given |data| into the |queue|. The caller will be blocked or immediately return or wait for timeout according to the parameter timeout.
+// If enqueue failed, it will return false, otherwise return true
+bool fixed_pkt_queue_enqueue(fixed_pkt_queue_t *queue, pkt_linked_item_t *linked_pkt, uint32_t timeout);
+
+// Dequeues the next element from |queue|. If the queue is currently empty,
+// this function will block the caller until an item is enqueued or immediately return or wait for timeout according to the parameter timeout.
+// If dequeue failed, it will return NULL, otherwise return a point.
+pkt_linked_item_t *fixed_pkt_queue_dequeue(fixed_pkt_queue_t *queue, uint32_t timeout);
+
+// Returns the first element from |queue|, if present, without dequeuing it.
+// This function will never block the caller. Returns NULL if there are no
+// elements in the queue or |queue| is NULL.
+pkt_linked_item_t *fixed_pkt_queue_try_peek_first(fixed_pkt_queue_t *queue);
+
+// Registers |queue| with |reactor| for dequeue operations. When there is an element
+// in the queue, ready_cb will be called. The |context| parameter is passed, untouched,
+// to the callback routine. Neither |queue|, nor |reactor|, nor |read_cb| may be NULL.
+// |context| may be NULL.
+void fixed_pkt_queue_register_dequeue(fixed_pkt_queue_t *queue, fixed_pkt_queue_cb ready_cb);
+
+// Unregisters the dequeue ready callback for |queue| from whichever reactor
+// it is registered with, if any. This function is idempotent.
+void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);
+
+void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);
+
+#endif
--- a/components/bt/common/osi/include/osi/pkt_queue.h
+++ b/components/bt/common/osi/include/osi/pkt_queue.h
@ -0,0 +1,88 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef _PKT_LIST_H_
+#define _PKT_LIST_H_
+
+#include "sys/queue.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct pkt_queue;
+
+typedef struct pkt_linked_item {
+    STAILQ_ENTRY(pkt_linked_item) next;
+    uint8_t data[];
+} pkt_linked_item_t;
+
+#define BT_PKT_LINKED_HDR_SIZE (sizeof (pkt_linked_item_t))
+
+typedef void (*pkt_queue_free_cb)(pkt_linked_item_t *item);
+
+/*
+ * brief: create a pkt_queue instance. pkt_queue is a wrapper class of a FIFO implemented by single linked list.
+ *        The enqueue and dequeue operations of the FIFO are protected against race conditions of multiple tasks
+ * return: NULL if not enough memory, otherwise a valid pointer
+ */
+struct pkt_queue *pkt_queue_create(void);
+
+/*
+ * brief: enqueue one item to the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * param item: the item to be enqueued to the FIFO
+ * return: true if enqueued successfully, false when the arguments passed in are invalid
+ */
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item);
+
+/*
+ * brief: dequeue one item for the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of type pkt_linked_item_t dequeued, NULL if the queue is empty or upon exception
+ */
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue);
+
+/*
+ * brief: get the pointer of the first item from the FIFO but not get it dequeued
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: pointer of the first item in the FIFO, NULL if the FIFO is empty
+ */
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the number of items existing in the FIFO
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: total number of items in the FIFO
+ */
+size_t pkt_queue_length(const struct pkt_queue *queue);
+
+/*
+ * brief: retrieve the status whether the FIFO is empty
+ * param queue: pkt_queue instance created using pkt_queue_create
+ * return: false if the FIFO is not empty, otherwise true
+ */
+bool pkt_queue_is_empty(const struct pkt_queue *queue);
+
+/*
+ * brief: delete the item in the FIFO one by one
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+/*
+ * brief: delete the items in the FIFO and then destroy the pkt_queue instance.
+ * param free_cb: destructor function for each item in the FIFO, if set to NULL, will use osi_free_func by default
+ */
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/components/bt/common/osi/include/osi/thread.h
+++ b/components/bt/common/osi/include/osi/thread.h
@ -28,6 +28,7 @@
 #define OSI_THREAD_MAX_TIMEOUT OSI_SEM_MAX_TIMEOUT

 struct osi_thread;
+struct osi_event;

 typedef struct osi_thread osi_thread_t;

@ -48,7 +49,7 @@ typedef enum {
 * param work_queue_num: speicify queue number, the queue[0] has highest priority, and the priority is decrease by index
 * return : if create successfully, return thread handler; otherwise return NULL.
 */
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num);
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[]);

 /*
 * brief: Destroy a thread or task
@ -88,4 +89,42 @@ const char *osi_thread_name(osi_thread_t *thread);
 */
 int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx);

+/*
+ * brief: Create an osi_event struct and register the handler function and its argument
+ *        An osi_event is a kind of work that can be posted to the workqueue of osi_thread to process,
+ *        but the work can have at most one instance the thread workqueue before it is processed. This
+ *        allows the "single post, multiple data processing" jobs.
+ * param func: the handler to process the job
+ * param context: the argument to be passed to the handler function when the job is being processed
+ * return: NULL if no memory, otherwise a valid struct pointer
+ */
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context);
+
+/*
+ * brief: Bind an osi_event to a specific work queue for an osi_thread.
+ *        After binding is completed, a function call of API osi_thread_post_event will send a work
+ *        to the workqueue of the thread, with specified queue index.
+ * param func: event: the pointer to osi_event that is created using osi_event_create
+ * param thread: the pointer to osi_thread that is created using osi_thread_create
+ * param queue_idx: the index of the workqueue of the specified osi_thread, with range starting from 0 to work_queue_num - 1
+ * return: true if osi_event binds to the thread's workqueue successfully, otherwise false
+ */
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx);
+
+/*
+ * brief: Destroy the osi_event struct created by osi_event_create and free the allocated memory
+ * param event: the pointer to osi_event
+ */
+void osi_event_delete(struct osi_event* event);
+
+/*
+ * brief: try sending a work to the binded thread's workqueue, so that it can be handled by the worker thread
+ * param event: pointer to osi_event, created by osi_event_create
+ * param timeout: post timeout, OSI_THREAD_MAX_TIMEOUT means blocking forever, 0 means never blocking, others means block millisecond
+ * return: true if the message is enqueued to the thread workqueue, otherwise failed
+ * note: if the return value of function is false, it is the case that the workqueue of the thread is full, and users
+ *       are expected to post the event sometime later to get the work handled.
+ */
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout);
+
 #endif /* __THREAD_H__ */
--- a/components/bt/common/osi/pkt_queue.c
+++ b/components/bt/common/osi/pkt_queue.c
@ -0,0 +1,144 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "osi/pkt_queue.h"
+#include "osi/allocator.h"
+#include "osi/mutex.h"
+
+
+STAILQ_HEAD(pkt_queue_header, pkt_linked_item);
+
+struct pkt_queue {
+    osi_mutex_t lock;
+    size_t length;
+    struct pkt_queue_header header;
+} pkt_queue_t;
+
+struct pkt_queue *pkt_queue_create(void)
+{
+    struct pkt_queue *queue = calloc(1, sizeof(struct pkt_queue));
+    if (queue == NULL) {
+        return NULL;
+    }
+    if (osi_mutex_new(&queue->lock) != 0) {
+        osi_free(queue);
+    }
+    struct pkt_queue_header *p = &queue->header;
+    STAILQ_INIT(p);
+
+    return queue;
+}
+
+static void pkt_queue_cleanup(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item = STAILQ_FIRST(header);
+    pkt_linked_item_t *tmp;
+
+    pkt_queue_free_cb free_func = (free_cb != NULL) ? free_cb : (pkt_queue_free_cb)osi_free_func;
+
+    while (item != NULL) {
+        tmp = STAILQ_NEXT(item, next);
+        free_func(item);
+        item = tmp;
+        queue->length--;
+    }
+    STAILQ_INIT(header);
+    queue->length = 0;
+}
+
+void pkt_queue_flush(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+}
+
+void pkt_queue_destroy(struct pkt_queue *queue, pkt_queue_free_cb free_cb)
+{
+    if (queue == NULL) {
+        return;
+    }
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    pkt_queue_cleanup(queue, free_cb);
+    osi_mutex_unlock(&queue->lock);
+
+    osi_mutex_free(&queue->lock);
+    osi_free(queue);
+}
+
+pkt_linked_item_t *pkt_queue_dequeue(struct pkt_queue *queue)
+{
+    if (queue == NULL || queue->length == 0) {
+        return NULL;
+    }
+
+    struct pkt_linked_item *item;
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    item = STAILQ_FIRST(header);
+    if (item != NULL) {
+        STAILQ_REMOVE_HEAD(header, next);
+        if (queue->length > 0) {
+            queue->length--;
+        }
+    }
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}
+
+bool pkt_queue_enqueue(struct pkt_queue *queue, pkt_linked_item_t *item)
+{
+    if (queue == NULL || item == NULL) {
+        return false;
+    }
+
+    struct pkt_queue_header *header;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    header = &queue->header;
+    STAILQ_INSERT_TAIL(header, item, next);
+    queue->length++;
+    osi_mutex_unlock(&queue->lock);
+
+    return true;
+}
+
+size_t pkt_queue_length(const struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return 0;
+    }
+    return queue->length;
+}
+
+bool pkt_queue_is_empty(const struct pkt_queue *queue)
+{
+    return pkt_queue_length(queue) == 0;
+}
+
+pkt_linked_item_t *pkt_queue_try_peek_first(struct pkt_queue *queue)
+{
+    if (queue == NULL) {
+        return NULL;
+    }
+
+    struct pkt_queue_header *header = &queue->header;
+    pkt_linked_item_t *item;
+    osi_mutex_lock(&queue->lock, OSI_MUTEX_MAX_TIMEOUT);
+    item = STAILQ_FIRST(header);
+    osi_mutex_unlock(&queue->lock);
+
+    return item;
+}
--- a/components/bt/common/osi/thread.c
+++ b/components/bt/common/osi/thread.c
@ -19,16 +19,28 @@
 #include <string.h>

 #include "osi/allocator.h"
-#include "osi/fixed_queue.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/queue.h"
 #include "osi/semaphore.h"
 #include "osi/thread.h"
+#include "osi/mutex.h"
+
+struct work_item {
+    osi_thread_func_t func;
+    void *context;
+};
+
+struct work_queue {
+    QueueHandle_t queue;
+    size_t capacity;
+};

 struct osi_thread {
  void *thread_handle;                  /*!< Store the thread object */
  int  thread_id;                       /*!< May for some OS, such as Linux */
  bool stop;
  uint8_t work_queue_num;               /*!< Work queue number */
-  fixed_queue_t **work_queues;          /*!< Point to queue array, and the priority inverse array index */
+  struct work_queue **work_queues;      /*!< Point to queue array, and the priority inverse array index */
  osi_sem_t work_sem;
  osi_sem_t stop_sem;
 };
@ -39,13 +51,98 @@ struct osi_thread_start_arg {
  int error;
 };

-typedef struct {
-  osi_thread_func_t func;
-  void *context;
-} work_item_t;
+struct osi_event {
+    struct work_item item;
+    osi_mutex_t lock;
+    uint16_t is_queued;
+    uint16_t queue_idx;
+    osi_thread_t *thread;
+};

 static const size_t DEFAULT_WORK_QUEUE_CAPACITY = 100;

+static struct work_queue *osi_work_queue_create(size_t capacity)
+{
+    if (capacity == 0) {
+        return NULL;
+    }
+
+    struct work_queue *wq = (struct work_queue *)osi_malloc(sizeof(struct work_queue));
+    if (wq != NULL) {
+        wq->queue = xQueueCreate(capacity, sizeof(struct work_item));
+        if (wq->queue != 0) {
+            wq->capacity = capacity;
+            return wq;
+        } else {
+            osi_free(wq);
+        }
+    }
+
+    return NULL;
+}
+
+static void osi_work_queue_delete(struct work_queue *wq)
+{
+    if (wq != NULL) {
+        if (wq->queue != 0) {
+            vQueueDelete(wq->queue);
+        }
+        wq->queue = 0;
+        wq->capacity = 0;
+        osi_free(wq);
+    }
+    return;
+}
+
+static bool osi_thead_work_queue_get(struct work_queue *wq, struct work_item *item)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    if (pdTRUE == xQueueReceive(wq->queue, item, 0)) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+static bool osi_thead_work_queue_put(struct work_queue *wq, const struct work_item *item, uint32_t timeout)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (item != NULL);
+
+    bool ret = true;
+    if (timeout ==  OSI_SEM_MAX_TIMEOUT) {
+        if (xQueueSend(wq->queue, item, portMAX_DELAY) != pdTRUE) {
+            ret = false;
+        }
+    } else {
+        if (xQueueSend(wq->queue, item, timeout / portTICK_PERIOD_MS) != pdTRUE) {
+            ret = false;
+        }
+    }
+
+    return ret;
+}
+
+static size_t osi_thead_work_queue_len(struct work_queue *wq)
+{
+    assert (wq != NULL);
+    assert (wq->queue != 0);
+    assert (wq->capacity != 0);
+
+    size_t available_spaces = (size_t)uxQueueSpacesAvailable(wq->queue);
+
+    if (available_spaces <= wq->capacity) {
+        return wq->capacity - available_spaces;
+    } else {
+        assert (0);
+    }
+    return 0;
+}
+
 static void osi_thread_run(void *arg)
 {
    struct osi_thread_start_arg *start = (struct osi_thread_start_arg *)arg;
@ -62,11 +159,10 @@ static void osi_thread_run(void *arg)
            break;
        }

+        struct work_item item;
        while (!thread->stop && idx < thread->work_queue_num) {
-            work_item_t *item = fixed_queue_dequeue(thread->work_queues[idx], 0);
-            if (item) {
-                item->func(item->context);
-                osi_free(item);
+            if (osi_thead_work_queue_get(thread->work_queues[idx], &item) == true) {
+                item.func(item.context);
                idx = 0;
                continue;
            } else {
@ -107,32 +203,32 @@ static void osi_thread_stop(osi_thread_t *thread)
 }

 //in linux, the stack_size, priority and core may not be set here, the code will be ignore the arguments
-osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num)
+osi_thread_t *osi_thread_create(const char *name, size_t stack_size, int priority, osi_thread_core_t core, uint8_t work_queue_num, const size_t work_queue_len[])
 {
    int ret;
-    osi_thread_t *thread;
    struct osi_thread_start_arg start_arg = {0};

    if (stack_size <= 0 ||
            core < OSI_THREAD_CORE_0 || core > OSI_THREAD_CORE_AFFINITY ||
-            work_queue_num <= 0) {
+            work_queue_num <= 0 || work_queue_len == NULL) {
        return NULL;
    }

-    thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
+    osi_thread_t *thread = (osi_thread_t *)osi_malloc(sizeof(osi_thread_t));
    if (thread == NULL) {
        goto _err;
    }

    thread->stop = false;
    thread->work_queue_num = work_queue_num;
-    thread->work_queues = (fixed_queue_t **)osi_malloc(sizeof(fixed_queue_t *) * work_queue_num);
+    thread->work_queues = (struct work_queue **)osi_malloc(sizeof(struct work_queue *) * work_queue_num);
    if (thread->work_queues == NULL) {
        goto _err;
    }

    for (int i = 0; i < thread->work_queue_num; i++) {
-        thread->work_queues[i] = fixed_queue_new(DEFAULT_WORK_QUEUE_CAPACITY);
+        size_t queue_len = work_queue_len[i] ? work_queue_len[i] : DEFAULT_WORK_QUEUE_CAPACITY;
+        thread->work_queues[i] = osi_work_queue_create(queue_len);
        if (thread->work_queues[i] == NULL) {
            goto _err;
        }
@ -176,12 +272,14 @@ _err:

        for (int i = 0; i < thread->work_queue_num; i++) {
            if (thread->work_queues[i]) {
-                fixed_queue_free(thread->work_queues[i], osi_free_func);
+                osi_work_queue_delete(thread->work_queues[i]);
            }
+            thread->work_queues[i] = NULL;
        }

        if (thread->work_queues) {
            osi_free(thread->work_queues);
+            thread->work_queues = NULL;
        }

        if (thread->work_sem) {
@ -207,12 +305,14 @@ void osi_thread_free(osi_thread_t *thread)

    for (int i = 0; i < thread->work_queue_num; i++) {
        if (thread->work_queues[i]) {
-            fixed_queue_free(thread->work_queues[i], osi_free_func);
+            osi_work_queue_delete(thread->work_queues[i]);
+            thread->work_queues[i] = NULL;
        }
    }

    if (thread->work_queues) {
        osi_free(thread->work_queues);
+        thread->work_queues = NULL;
    }

    if (thread->work_sem) {
@ -236,15 +336,12 @@ bool osi_thread_post(osi_thread_t *thread, osi_thread_func_t func, void *context
        return false;
    }

-    work_item_t *item = (work_item_t *)osi_malloc(sizeof(work_item_t));
-    if (item == NULL) {
-        return false;
-    }
-    item->func = func;
-    item->context = context;
+    struct work_item item;

-    if (fixed_queue_enqueue(thread->work_queues[queue_idx], item, timeout) == false) {
-        osi_free(item);
+    item.func = func;
+    item.context = context;
+
+    if (osi_thead_work_queue_put(thread->work_queues[queue_idx], &item, timeout) == false) {
        return false;
    }

@ -274,5 +371,83 @@ int osi_thread_queue_wait_size(osi_thread_t *thread, int wq_idx)
        return -1;
    }

-    return fixed_queue_length(thread->work_queues[wq_idx]);
+    return (int)(osi_thead_work_queue_len(thread->work_queues[wq_idx]));
+}
+
+
+struct osi_event *osi_event_create(osi_thread_func_t func, void *context)
+{
+    struct osi_event *event = osi_calloc(sizeof(struct osi_event));
+    if (event != NULL) {
+        if (osi_mutex_new(&event->lock) == 0) {
+            event->item.func = func;
+            event->item.context = context;
+            return event;
+        }
+        osi_free(event);
+    }
+
+    return NULL;
+}
+
+void osi_event_delete(struct osi_event* event)
+{
+    if (event != NULL) {
+        osi_mutex_free(&event->lock);
+        memset(event, 0, sizeof(struct osi_event));
+        osi_free(event);
+    }
+}
+
+bool osi_event_bind(struct osi_event* event, osi_thread_t *thread, int queue_idx)
+{
+    if (event == NULL || event->thread != NULL) {
+        return false;
+    }
+
+    if (thread == NULL || queue_idx >= thread->work_queue_num) {
+        return false;
+    }
+
+    event->thread = thread;
+    event->queue_idx = queue_idx;
+
+    return true;
+}
+
+static void osi_thread_generic_event_handler(void *context)
+{
+    struct osi_event *event = (struct osi_event *)context;
+    if (event != NULL && event->item.func != NULL) {
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued = 0;
+        osi_mutex_unlock(&event->lock);
+        event->item.func(event->item.context);
+    }
+}
+
+bool osi_thread_post_event(struct osi_event *event, uint32_t timeout)
+{
+    assert(event != NULL && event->thread != NULL);
+    assert(event->queue_idx >= 0 && event->queue_idx < event->thread->work_queue_num);
+    bool ret = false;
+    if (event->is_queued == 0) {
+        uint16_t acquire_cnt = 0;
+        osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+        event->is_queued += 1;
+        acquire_cnt = event->is_queued;
+        osi_mutex_unlock(&event->lock);
+
+        if (acquire_cnt == 1) {
+            ret = osi_thread_post(event->thread, osi_thread_generic_event_handler, event, event->queue_idx, timeout);
+            if (!ret) {
+                // clear "is_queued" when post failure, to allow for following event posts
+                osi_mutex_lock(&event->lock, OSI_MUTEX_MAX_TIMEOUT);
+                event->is_queued = 0;
+                osi_mutex_unlock(&event->lock);
+            }
+        }
+    }
+
+    return ret;
 }
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@ -348,7 +348,7 @@ config BTDM_SCAN_DUPL_CACHE_SIZE
    int "Maximum number of devices in scan duplicate filter"
    depends on BTDM_BLE_SCAN_DUPL
    range 10 1000
-    default 200
+    default 100
    help
        Maximum number of devices which can be recorded in scan duplicate filter.
        When the maximum amount of device in the filter is reached, the cache will be refreshed.
@ -364,7 +364,7 @@ config BTDM_MESH_DUPL_SCAN_CACHE_SIZE
    int "Maximum number of Mesh adv packets in scan duplicate filter"
    depends on BTDM_BLE_MESH_SCAN_DUPL_EN
    range 10 1000
-    default 200
+    default 100
    help
        Maximum number of adv packets which can be recorded in duplicate scan cache for BLE Mesh.
        When the maximum amount of device in the filter is reached, the cache will be refreshed.
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@ -35,6 +35,7 @@
 #include "soc/dport_reg.h"
 #include "esp32/clk.h"
 #include "esp_coexist_internal.h"
+#include "esp_timer.h"
 #if !CONFIG_FREERTOS_UNICORE
 #include "esp_ipc.h"
 #endif
@ -90,11 +91,6 @@ do{\
 #define OSI_VERSION              0x00010003
 #define OSI_MAGIC_VALUE          0xFADEBEAD

-/* SPIRAM Configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
-#define BTDM_MAX_QUEUE_NUM       (6)
-#endif
-
 /* Types definition
 ************************************************************************
 */
@ -112,14 +108,10 @@ typedef struct {
    intptr_t end;
 } btdm_dram_available_region_t;

-/* PSRAM configuration */
-#if CONFIG_SPIRAM_USE_MALLOC
 typedef struct {
-    QueueHandle_t handle;
+    void *handle;
    void *storage;
-    void *buffer;
 } btdm_queue_item_t;
-#endif

 /* OSI function */
 struct osi_funcs_t {
@ -239,6 +231,8 @@ extern uint8_t coex_schm_curr_period_get(void);
 extern void * coex_schm_curr_phase_get(void);
 extern int coex_wifi_channel_get(uint8_t *primary, uint8_t *secondary);
 extern int coex_register_wifi_channel_change_callback(void *cb);
+/* Shutdown */
+extern void esp_bt_controller_shutdown(void);

 extern char _bss_start_btdm;
 extern char _bss_end_btdm;
@ -263,11 +257,6 @@ extern uint32_t _btdm_data_end;
 /* Local Function Declare
 *********************************************************************
 */
-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue);
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue);
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
-
 #if CONFIG_BTDM_CTRL_HLI
 static xt_handler set_isr_hlevel_wrapper(int n, xt_handler f, void *arg);
 static void IRAM_ATTR interrupt_hlevel_disable(void);
@ -447,11 +436,6 @@ SOC_RESERVE_MEMORY_REGION(SOC_MEM_BT_DATA_START, SOC_MEM_BT_DATA_END,

 static DRAM_ATTR struct osi_funcs_t *osi_funcs_p;

-#if CONFIG_SPIRAM_USE_MALLOC
-static DRAM_ATTR btdm_queue_item_t btdm_queue_table[BTDM_MAX_QUEUE_NUM];
-static DRAM_ATTR SemaphoreHandle_t btdm_queue_table_mux = NULL;
-#endif /* #if CONFIG_SPIRAM_USE_MALLOC */
-
 /* Static variable declare */
 // timestamp when PHY/RF was switched on
 static DRAM_ATTR int64_t s_time_phy_rf_just_enabled = 0;
@ -503,52 +487,6 @@ static inline void btdm_check_and_init_bb(void)
    }
 }

-#if CONFIG_SPIRAM_USE_MALLOC
-static bool btdm_queue_generic_register(const btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return NULL;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == NULL) {
-            memcpy(item, queue, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-static bool btdm_queue_generic_deregister(btdm_queue_item_t *queue)
-{
-    if (!btdm_queue_table_mux || !queue) {
-        return false;
-    }
-
-    bool ret = false;
-    btdm_queue_item_t *item;
-    xSemaphoreTake(btdm_queue_table_mux, portMAX_DELAY);
-    for (int i = 0; i < BTDM_MAX_QUEUE_NUM; ++i) {
-        item = &btdm_queue_table[i];
-        if (item->handle == queue->handle) {
-            memcpy(queue, item, sizeof(btdm_queue_item_t));
-            memset(item, 0, sizeof(btdm_queue_item_t));
-            ret = true;
-            break;
-        }
-    }
-    xSemaphoreGive(btdm_queue_table_mux);
-    return ret;
-}
-
-#endif /* CONFIG_SPIRAM_USE_MALLOC */
-
 #if CONFIG_BTDM_CTRL_HLI
 struct interrupt_hlevel_cb{
    uint32_t status;
@ -621,6 +559,9 @@ static void IRAM_ATTR task_yield_from_isr(void)

 static void *semphr_create_wrapper(uint32_t max, uint32_t init)
 {
+    btdm_queue_item_t *semphr = heap_caps_calloc(1, sizeof(btdm_queue_item_t), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
+    assert(semphr);
+
    void *handle = NULL;

 #if !CONFIG_SPIRAM_USE_MALLOC
@ -629,112 +570,94 @@ static void *semphr_create_wrapper(uint32_t max, uint32_t init)
    StaticQueue_t *queue_buffer = NULL;

    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    assert(queue_buffer);
+    semphr->storage = queue_buffer;

    handle = (void *)xSemaphoreCreateCountingStatic(max, init, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
 #endif
+    assert(handle);

 #if CONFIG_BTDM_CTRL_HLI
    SemaphoreHandle_t downstream_semaphore = handle;
    assert(downstream_semaphore);
    hli_queue_handle_t s_semaphore = hli_semaphore_create(max, downstream_semaphore);
-    assert(downstream_semaphore);
-    return s_semaphore;
+    assert(s_semaphore);
+    semphr->handle = (void *)s_semaphore;
 #else
-    return handle;
+    semphr->handle =  handle;
 #endif /* CONFIG_BTDM_CTRL_HLI */

-#if CONFIG_SPIRAM_USE_MALLOC
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
-#endif
+    return semphr;
 }

 static void semphr_delete_wrapper(void *semphr)
 {
+    if (semphr == NULL) {
+        return;
+    }
+
+    btdm_queue_item_t *semphr_item = (btdm_queue_item_t *)semphr;
    void *handle = NULL;
 #if CONFIG_BTDM_CTRL_HLI
-    if (((hli_queue_handle_t)semphr)->downstream != NULL) {
-        handle = ((hli_queue_handle_t)semphr)->downstream;
-     }
-
-    hli_queue_delete(semphr);
+    if (semphr_item->handle) {
+        handle = ((hli_queue_handle_t)(semphr_item->handle))->downstream;
+        hli_queue_delete((hli_queue_handle_t)(semphr_item->handle));
+    }
 #else
-    handle = semphr;
+    handle = semphr_item->handle;
 #endif /* CONFIG_BTDM_CTRL_HLI */

-#if !CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(handle);
-#else
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
+    if (handle) {
+        vSemaphoreDelete(handle);
+    }
+#ifdef CONFIG_SPIRAM_USE_MALLOC
+    if (semphr_item->storage) {
+        free(semphr_item->storage);
    }
 #endif
+
+    free(semphr);
 }

 static int32_t IRAM_ATTR semphr_take_from_isr_wrapper(void *semphr, void *hptw)
 {
 #if CONFIG_BTDM_CTRL_HLI
-    return (int32_t)xSemaphoreTakeFromISR(((hli_queue_handle_t)semphr)->downstream, hptw);
+    // Not support it
+    assert(0);
+    return 0;
 #else
-    return (int32_t)xSemaphoreTakeFromISR(semphr, hptw);
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
+    return (int32_t)xSemaphoreTakeFromISR(handle, hptw);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }

 static int32_t IRAM_ATTR semphr_give_from_isr_wrapper(void *semphr, void *hptw)
 {
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
    UNUSED(hptw);
    assert(xPortGetCoreID() == CONFIG_BTDM_CTRL_PINNED_TO_CORE);
-    return hli_semaphore_give(semphr);
+    return hli_semaphore_give(handle);
 #else
-    return (int32_t)xSemaphoreGiveFromISR(semphr, hptw);
+    return (int32_t)xSemaphoreGiveFromISR(handle, hptw);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }

 static int32_t semphr_take_wrapper(void *semphr, uint32_t block_time_ms)
 {
    bool ret;
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xSemaphoreTake(((hli_queue_handle_t)semphr)->downstream, portMAX_DELAY);
+        ret = xSemaphoreTake(((hli_queue_handle_t)handle)->downstream, portMAX_DELAY);
    } else {
-        ret = xSemaphoreTake(((hli_queue_handle_t)semphr)->downstream, block_time_ms / portTICK_PERIOD_MS);
+        ret = xSemaphoreTake(((hli_queue_handle_t)handle)->downstream, block_time_ms / portTICK_PERIOD_MS);
    }
 #else
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xSemaphoreTake(semphr, portMAX_DELAY);
+        ret = xSemaphoreTake(handle, portMAX_DELAY);
    } else {
-        ret = xSemaphoreTake(semphr, block_time_ms / portTICK_PERIOD_MS);
+        ret = xSemaphoreTake(handle, block_time_ms / portTICK_PERIOD_MS);
    }
 #endif /* CONFIG_BTDM_CTRL_HLI */
    return (int32_t)ret;
@ -742,72 +665,22 @@ static int32_t semphr_take_wrapper(void *semphr, uint32_t block_time_ms)

 static int32_t semphr_give_wrapper(void *semphr)
 {
+    void *handle = ((btdm_queue_item_t *)semphr)->handle;
 #if CONFIG_BTDM_CTRL_HLI
-    return (int32_t)xSemaphoreGive(((hli_queue_handle_t)semphr)->downstream);
+    return (int32_t)xSemaphoreGive(((hli_queue_handle_t)handle)->downstream);
 #else
-    return (int32_t)xSemaphoreGive(semphr);
+    return (int32_t)xSemaphoreGive(handle);
 #endif /* CONFIG_BTDM_CTRL_HLI */
 }

 static void *mutex_create_wrapper(void)
 {
-#if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    QueueHandle_t handle = NULL;
-
-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
-
-    handle = xSemaphoreCreateMutexStatic(queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = NULL,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-    return handle;
-
- error:
-    if (handle) {
-        vSemaphoreDelete(handle);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
-#else
    return (void *)xSemaphoreCreateMutex();
-#endif
 }

 static void mutex_delete_wrapper(void *mutex)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
    vSemaphoreDelete(mutex);
-#else
-    btdm_queue_item_t item = {
-        .handle = mutex,
-        .storage = NULL,
-        .buffer = NULL,
-    };
-
-    if (btdm_queue_generic_deregister(&item)) {
-        vSemaphoreDelete(item.handle);
-        free(item.buffer);
-    }
-
-    return;
-#endif
 }

 static int32_t mutex_lock_wrapper(void *mutex)
@ -822,109 +695,93 @@ static int32_t mutex_unlock_wrapper(void *mutex)

 static void *queue_create_wrapper(uint32_t queue_len, uint32_t item_size)
 {
+    btdm_queue_item_t *queue = NULL;
+
+    queue = (btdm_queue_item_t*)heap_caps_malloc(sizeof(btdm_queue_item_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue);
+
 #if CONFIG_SPIRAM_USE_MALLOC
-    StaticQueue_t *queue_buffer = NULL;
-    uint8_t *queue_storage = NULL;
-    QueueHandle_t handle = NULL;

-    queue_buffer = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_buffer) {
-        goto error;
-    }
+    queue->storage = heap_caps_calloc(1, sizeof(StaticQueue_t) + (queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue->storage);

-    queue_storage = heap_caps_malloc((queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
-    if (!queue_storage ) {
-        goto error;
-    }
+    queue->handle = xQueueCreateStatic( queue_len, item_size, ((uint8_t*)(queue->storage)) + sizeof(StaticQueue_t), (StaticQueue_t*)(queue->storage));
+    assert(queue->handle);

-    handle = xQueueCreateStatic(queue_len, item_size, queue_storage, queue_buffer);
-    if (!handle) {
-        goto error;
-    }
-
-    btdm_queue_item_t item = {
-        .handle = handle,
-        .storage = queue_storage,
-        .buffer = queue_buffer,
-    };
-
-    if (!btdm_queue_generic_register(&item)) {
-        goto error;
-    }
-
-    return handle;
-
- error:
-    if (handle) {
-        vQueueDelete(handle);
-    }
-    if (queue_storage) {
-        free(queue_storage);
-    }
-    if (queue_buffer) {
-        free(queue_buffer);
-    }
-
-    return NULL;
 #else
-    return (void *)xQueueCreate(queue_len, item_size);
+    queue->handle = xQueueCreate( queue_len, item_size);
+    assert(queue->handle);
 #endif
+
+    return queue;
 }

 static void queue_delete_wrapper(void *queue)
 {
-#if !CONFIG_SPIRAM_USE_MALLOC
-    vQueueDelete(queue);
-#else
-    btdm_queue_item_t item = {
-        .handle = queue,
-        .storage = NULL,
-        .buffer = NULL,
-    };
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+    if (queue_item) {
+        if(queue_item->handle){
+            vQueueDelete(queue_item->handle);
+        }

-    if (btdm_queue_generic_deregister(&item)) {
-        vQueueDelete(item.handle);
-        free(item.storage);
-        free(item.buffer);
-    }
-
-    return;
+#if CONFIG_SPIRAM_USE_MALLOC
+        if (queue_item->storage) {
+            free(queue_item->storage);
+        }
 #endif
+
+        free(queue_item);
+    }
 }

 #if CONFIG_BTDM_CTRL_HLI
 static void *queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t item_size)
 {
-    QueueHandle_t downstream_queue = queue_create_wrapper(queue_len, item_size);
-    assert(downstream_queue);
+    btdm_queue_item_t *queue_item = queue_create_wrapper(queue_len, item_size);
+    assert(queue_item);
+    QueueHandle_t downstream_queue = queue_item->handle;
+    assert(queue_item->handle);
    hli_queue_handle_t queue = hli_queue_create(queue_len, item_size, downstream_queue);
    assert(queue);
-    return queue;
+    queue_item->handle = queue;
+    return (void *)queue_item;
 }

 static void *customer_queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t item_size)
 {
-    QueueHandle_t downstream_queue = queue_create_wrapper(queue_len, item_size);
-    assert(downstream_queue);
+    btdm_queue_item_t *queue_item = queue_create_wrapper(queue_len, item_size);
+    assert(queue_item);
+    QueueHandle_t downstream_queue = queue_item->handle;
+    assert(queue_item->handle);
    hli_queue_handle_t queue = hli_customer_queue_create(queue_len, item_size, downstream_queue);
    assert(queue);
-    return queue;
+    queue_item->handle = queue;
+    return (void *)queue_item;
 }

 static void queue_delete_hlevel_wrapper(void *queue)
 {
-    if (((hli_queue_handle_t)queue)->downstream != NULL) {
-        queue_delete_wrapper(((hli_queue_handle_t)queue)->downstream);
+    if (queue == NULL) {
+        return;
+    }
+
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+
+    if (queue_item->handle) {
+        void *handle = ((hli_queue_handle_t)(queue_item->handle))->downstream;
+        hli_queue_delete(queue_item->handle);
+        queue_item->handle = handle;
+        queue_delete_wrapper(queue_item);
    }
-    hli_queue_delete(queue);
 }

 static int32_t queue_send_hlevel_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueSend(((hli_queue_handle_t)queue)->downstream, item, portMAX_DELAY);
+        return (int32_t)xQueueSend(((hli_queue_handle_t)handle)->downstream, item, portMAX_DELAY);
    } else {
-        return (int32_t)xQueueSend(((hli_queue_handle_t)queue)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueSend(((hli_queue_handle_t)handle)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
    }
 }

@ -943,16 +800,18 @@ static int32_t IRAM_ATTR queue_send_from_isr_hlevel_wrapper(void *queue, void *i
 {
    UNUSED(hptw);
    assert(xPortGetCoreID() == CONFIG_BTDM_CTRL_PINNED_TO_CORE);
-    return hli_queue_put(queue, item);
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
+    return hli_queue_put(handle, item);
 }

 static int32_t queue_recv_hlevel_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
    bool ret;
+    void *handle = ((btdm_queue_item_t *)queue)->handle;
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xQueueReceive(((hli_queue_handle_t)queue)->downstream, item, portMAX_DELAY);
+        ret = xQueueReceive(((hli_queue_handle_t)handle)->downstream, item, portMAX_DELAY);
    } else {
-        ret = xQueueReceive(((hli_queue_handle_t)queue)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
+        ret = xQueueReceive(((hli_queue_handle_t)handle)->downstream, item, block_time_ms / portTICK_PERIOD_MS);
    }

    return (int32_t)ret;
@ -960,7 +819,9 @@ static int32_t queue_recv_hlevel_wrapper(void *queue, void *item, uint32_t block

 static int32_t IRAM_ATTR queue_recv_from_isr_hlevel_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueReceiveFromISR(((hli_queue_handle_t)queue)->downstream, item, hptw);
+    // Not support it
+    assert(0);
+    return 0;
 }

 #else
@ -968,24 +829,24 @@ static int32_t IRAM_ATTR queue_recv_from_isr_hlevel_wrapper(void *queue, void *i
 static int32_t queue_send_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int32_t)xQueueSend(queue, item, portMAX_DELAY);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
    } else {
-        return (int32_t)xQueueSend(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int32_t)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
    }
 }

 static int32_t IRAM_ATTR queue_send_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueSendFromISR(queue, item, hptw);
+    return (int32_t)xQueueSendFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }

 static int32_t queue_recv_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
    bool ret;
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        ret = xQueueReceive(queue, item, portMAX_DELAY);
+        ret = xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
    } else {
-        ret = xQueueReceive(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        ret = xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
    }

    return (int32_t)ret;
@ -993,7 +854,7 @@ static int32_t queue_recv_wrapper(void *queue, void *item, uint32_t block_time_m

 static int32_t IRAM_ATTR queue_recv_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int32_t)xQueueReceiveFromISR(queue, item, hptw);
+    return (int32_t)xQueueReceiveFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }
 #endif /* CONFIG_BTDM_CTRL_HLI */

@ -1611,20 +1472,14 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

    ESP_LOGI(BTDM_LOG_TAG, "BT controller compile version [%s]", btdm_controller_get_compile_version());

-#if CONFIG_SPIRAM_USE_MALLOC
-    btdm_queue_table_mux = xSemaphoreCreateMutex();
-    if (btdm_queue_table_mux == NULL) {
-        return ESP_ERR_NO_MEM;
-    }
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
-
    s_wakeup_req_sem = semphr_create_wrapper(1, 0);
    if (s_wakeup_req_sem == NULL) {
        err = ESP_ERR_NO_MEM;
        goto error;
    }

+    esp_phy_pd_mem_init();
+
    esp_bt_power_domain_on();

    btdm_controller_mem_init();
@ -1758,20 +1613,23 @@ esp_err_t esp_bt_controller_deinit(void)
        esp_pm_lock_delete(s_light_sleep_pm_lock);
        s_light_sleep_pm_lock = NULL;
    }
-    esp_timer_stop(s_btdm_slp_tmr);
-    esp_timer_delete(s_btdm_slp_tmr);
-    s_btdm_slp_tmr = NULL;
+
+    if (s_pm_lock != NULL) {
+        esp_pm_lock_delete(s_pm_lock);
+        s_pm_lock = NULL;
+    }
+
+    if (s_btdm_slp_tmr != NULL) {
+        esp_timer_stop(s_btdm_slp_tmr);
+        esp_timer_delete(s_btdm_slp_tmr);
+        s_btdm_slp_tmr = NULL;
+    }
+
    s_pm_lock_acquired = false;
 #endif
    semphr_delete_wrapper(s_wakeup_req_sem);
    s_wakeup_req_sem = NULL;

-#if CONFIG_SPIRAM_USE_MALLOC
-    vSemaphoreDelete(btdm_queue_table_mux);
-    btdm_queue_table_mux = NULL;
-    memset(btdm_queue_table, 0, sizeof(btdm_queue_item_t) * BTDM_MAX_QUEUE_NUM);
-#endif
-
    free(osi_funcs_p);
    osi_funcs_p = NULL;

@ -1782,18 +1640,28 @@ esp_err_t esp_bt_controller_deinit(void)

    esp_bt_power_domain_off();

+    esp_phy_pd_mem_deinit();
+
    return ESP_OK;
 }

+static void bt_controller_shutdown(void* arg)
+{
+    esp_bt_controller_shutdown();
+}
+
 static void bt_shutdown(void)
 {
-    esp_err_t ret = ESP_OK;
-    ESP_LOGD(BTDM_LOG_TAG, "stop Bluetooth");
-
-    ret = esp_bt_controller_disable();
-    if (ESP_OK != ret) {
-        ESP_LOGW(BTDM_LOG_TAG, "controller disable ret=%d", ret);
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
+        return;
    }
+#if !CONFIG_FREERTOS_UNICORE
+    esp_ipc_call_blocking(CONFIG_BTDM_CTRL_PINNED_TO_CORE, bt_controller_shutdown, NULL);
+#else
+    bt_controller_shutdown(NULL);
+#endif
+    esp_phy_disable();
+
    return;
 }

--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@ -66,6 +66,13 @@ config BT_CTRL_HW_CCA
    help
        It enables HW CCA feature in controller

+config BT_CTRL_HW_CCA_VAL
+    int "CCA threshold value"
+    range 20 60
+    default 20
+    help
+        It is the threshold value of HW CCA, if the value is 30, it means CCA threshold is -30 dBm.
+
 config BT_CTRL_HW_CCA_EFF
    int
    default 1 if BT_CTRL_HW_CCA
@ -131,8 +138,6 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
    help
        Specify default Tx power level

-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N24
        bool "-24dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N21
@ -163,26 +168,28 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
        bool "+15dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
        bool "+18dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
+        bool "+21dBm"
 endchoice

 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
    int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
+    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
+    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
+    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
+    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
+    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
+    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
+    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
+    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
+    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
+    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
+    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
+    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
    default 0

 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
@ -344,9 +351,9 @@ menu "MODEM SLEEP Options"
            bool "Main crystal"
            help
                Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
+                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, and
+                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
+                than other bluetooth low power clock sources.
        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
            bool "External 32kHz crystal"
            depends on ESP32C3_RTC_CLK_SRC_EXT_CRYS
@ -361,9 +368,18 @@ menu "MODEM SLEEP Options"
            help
                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
    endchoice
+
+    config BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        bool "power up main XTAL during light sleep"
+        depends on (BT_CTRL_LPCLK_SEL_MAIN_XTAL || BT_CTRL_LPCLK_SEL_EXT_32K_XTAL) && FREERTOS_USE_TICKLESS_IDLE
+        default n
+        help
+            If this option is selected, the main crystal will power up during light sleep when the low power clock
+            selects an external 32kHz crystal but the external 32kHz crystal does not exist or the low power clock
+            selects the main crystal.
+
+
 endmenu

 config BT_CTRL_SLEEP_MODE_EFF
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@ -37,6 +37,7 @@
 #include "esp32c3/rom/rom_layout.h"
 #include "esp_timer.h"
 #include "esp_sleep.h"
+#include "phy.h"

 #if CONFIG_BT_ENABLED

@ -70,7 +71,8 @@ typedef union {
        uint32_t mac_bb_pd               :  1; // whether hardware(MAC, BB) force-power-down is required during sleep
        uint32_t wakeup_timer_required   :  1; // whether system timer is needed
        uint32_t no_light_sleep          :  1; // do not allow system to enter light sleep after bluetooth is enabled
-        uint32_t reserved                : 26; // reserved
+        uint32_t main_xtal_pu            :  1; // power up main XTAL
+        uint32_t reserved                : 25; // reserved
    };
    uint32_t val;
 } btdm_lpcntl_t;
@ -233,11 +235,13 @@ extern int ble_txpwr_get(int power_type);

 extern uint16_t l2c_ble_link_get_tx_buf_num(void);
 extern int coex_core_ble_conn_dyn_prio_get(bool *low, bool *high);
+extern void coex_pti_v2(void);

 extern bool btdm_deep_sleep_mem_init(void);
 extern void btdm_deep_sleep_mem_deinit(void);
 extern void btdm_ble_power_down_dma_copy(bool copy);
 extern uint8_t btdm_sleep_clock_sync(void);
+extern void sdk_config_extend_set_pll_track(bool enable);

 #if CONFIG_MAC_BB_PD
 extern void esp_mac_bb_power_down(void);
@ -902,25 +906,21 @@ void esp_release_wifi_and_coex_mem(void)
    ESP_ERROR_CHECK(try_heap_caps_add_region((intptr_t)ets_rom_layout_p->data_start_interface_coexist,(intptr_t)ets_rom_layout_p->bss_end_interface_pp));
 }

-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if CONFIG_MAC_BB_PD
 static void IRAM_ATTR btdm_mac_bb_power_down_cb(void)
 {
    if (s_lp_cntl.mac_bb_pd && s_lp_stat.mac_bb_pd == 0) {
-#if (CONFIG_MAC_BB_PD)
        btdm_ble_power_down_dma_copy(true);
-#endif
        s_lp_stat.mac_bb_pd = 1;
    }
 }

 static void IRAM_ATTR btdm_mac_bb_power_up_cb(void)
 {
-#if (CONFIG_MAC_BB_PD)
    if (s_lp_cntl.mac_bb_pd && s_lp_stat.mac_bb_pd) {
        btdm_ble_power_down_dma_copy(false);
        s_lp_stat.mac_bb_pd = 0;
    }
-#endif
 }
 #endif

@ -964,9 +964,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    // overwrite some parameters
    cfg->magic = ESP_BT_CTRL_CONFIG_MAGIC_VAL;

+    sdk_config_extend_set_pll_track(false);
+
 #if CONFIG_MAC_BB_PD
    esp_mac_bb_pd_mem_init();
 #endif
+    esp_phy_pd_mem_init();
    esp_bt_power_domain_on();

    btdm_controller_mem_init();
@ -1000,15 +1003,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // set default values for global states or resources
        s_lp_stat.val = 0;
        s_lp_cntl.val = 0;
+        s_lp_cntl.main_xtal_pu = 0;
        s_wakeup_req_sem = NULL;
        s_btdm_slp_tmr = NULL;

        // configure and initialize resources
        s_lp_cntl.enable = (cfg->sleep_mode == ESP_BT_SLEEP_MODE_1) ? 1 : 0;
-        s_lp_cntl.no_light_sleep = 1;
+        s_lp_cntl.no_light_sleep = 0;

        if (s_lp_cntl.enable) {
-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
            if (!btdm_deep_sleep_mem_init()) {
                err = ESP_ERR_NO_MEM;
                goto error;
@ -1048,33 +1052,41 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // check whether or not EXT_CRYS is working
        if (rtc_clk_slow_freq_get() == RTC_SLOW_FREQ_32K_XTAL) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32 kHz XTAL
-            s_lp_cntl.no_light_sleep = 0;
        } else {
-            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
+            ESP_LOGW(BTDM_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
        }
+#elif (CONFIG_BT_CTRL_LPCLK_SEL_MAIN_XTAL)
+        ESP_LOGI(BTDM_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        s_lp_cntl.no_light_sleep = 1;
+#endif
 #elif (CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW)
-        // check whether or not EXT_CRYS is working
+        // check whether or not internal 150 kHz RC oscillator is working
        if (rtc_clk_slow_freq_get() == RTC_SLOW_FREQ_RTC) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_RTC_SLOW; // Internal 150 kHz RC oscillator
            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
                 "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
        } else {
-            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
+            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
            assert(0);
        }
-#else
-        s_lp_cntl.no_light_sleep = 1;
 #endif

        bool select_src_ret __attribute__((unused));
        bool set_div_ret __attribute__((unused));
        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
+            s_lp_cntl.main_xtal_pu = 1;
+#endif
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-            set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 2);
+            set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get());
            assert(select_src_ret && set_div_ret);
            btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-            btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+            btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
        } else if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL32K) {
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
            set_div_ret = btdm_lpclk_set_div(0);
@ -1093,6 +1105,9 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
            err = ESP_ERR_INVALID_ARG;
            goto error;
        }
+#if CONFIG_SW_COEXIST_ENABLE
+        coex_update_lpclk_interval();
+#endif

 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
@ -1100,6 +1115,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
                err = ESP_ERR_NO_MEM;
                goto error;
            }
+            ESP_LOGW(BTDM_LOG_TAG, "Light sleep mode will not be able to apply when bluetooth is enabled.");
        }
        if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
            err = ESP_ERR_NO_MEM;
@ -1115,6 +1131,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif

    periph_module_enable(PERIPH_BT_MODULE);
+    periph_module_reset(PERIPH_BT_MODULE);

    esp_phy_enable();
    s_lp_stat.phy_enabled = 1;
@ -1123,6 +1140,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        err = ESP_ERR_NO_MEM;
        goto error;
    }
+    coex_pti_v2();

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;

@ -1155,7 +1173,7 @@ error:
            s_btdm_slp_tmr = NULL;
        }

-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
        if (s_lp_cntl.mac_bb_pd) {
            btdm_deep_sleep_mem_deinit();
            s_lp_cntl.mac_bb_pd = 0;
@ -1168,6 +1186,22 @@ error:
                s_wakeup_req_sem = NULL;
            }
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@ -1201,7 +1235,7 @@ esp_err_t esp_bt_controller_deinit(void)

    // deinit low power control resources
    do {
-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
        btdm_deep_sleep_mem_deinit();
 #endif

@ -1230,6 +1264,21 @@ esp_err_t esp_bt_controller_deinit(void)
            semphr_delete_wrapper(s_wakeup_req_sem);
            s_wakeup_req_sem = NULL;
        }
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@ -1237,13 +1286,21 @@ esp_err_t esp_bt_controller_deinit(void)
    esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
 #endif

+    /* Fix the issue caused by the power off the bt power domain.
+     * This issue is only on ESP32C3.
+     */
+    phy_init_flag();
+
    esp_bt_power_domain_off();
+#if CONFIG_MAC_BB_PD
+    esp_mac_bb_pd_mem_deinit();
+#endif
+    esp_phy_pd_mem_deinit();

    free(osi_funcs_p);
    osi_funcs_p = NULL;

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
-    btdm_lpcycle_us = 0;
    return ESP_OK;
 }

--- a/components/bt/controller/esp32s3/Kconfig.in
+++ b/components/bt/controller/esp32s3/Kconfig.in
@ -81,6 +81,13 @@ config BT_CTRL_HW_CCA
    help
        It enables HW CCA feature in controller

+config BT_CTRL_HW_CCA_VAL
+    int "CCA threshold value"
+    range 20 60
+    default 20
+    help
+        It is the threshold value of HW CCA, if the value is 30, it means CCA threshold is -30 dBm.
+
 config BT_CTRL_HW_CCA_EFF
    int
    default 1 if BT_CTRL_HW_CCA
@ -146,8 +153,6 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
    help
        Specify default Tx power level

-    config BT_CTRL_DFT_TX_POWER_LEVEL_N27
-        bool "-27dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N24
        bool "-24dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_N21
@ -178,27 +183,29 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
        bool "+15dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
        bool "+18dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
+        bool "+21dBm"

 endchoice

 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
    int
-    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N27
-    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
-    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
-    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
-    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
-    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
-    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
-    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
-    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
-    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
-    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
-    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
-    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
-    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
-    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 0 if BT_CTRL_DFT_TX_POWER_LEVEL_N24
+    default 1 if BT_CTRL_DFT_TX_POWER_LEVEL_N21
+    default 2 if BT_CTRL_DFT_TX_POWER_LEVEL_N18
+    default 3 if BT_CTRL_DFT_TX_POWER_LEVEL_N15
+    default 4 if BT_CTRL_DFT_TX_POWER_LEVEL_N12
+    default 5 if BT_CTRL_DFT_TX_POWER_LEVEL_N9
+    default 6 if BT_CTRL_DFT_TX_POWER_LEVEL_N6
+    default 7 if BT_CTRL_DFT_TX_POWER_LEVEL_N3
+    default 8 if BT_CTRL_DFT_TX_POWER_LEVEL_N0
+    default 9 if BT_CTRL_DFT_TX_POWER_LEVEL_P3
+    default 10 if BT_CTRL_DFT_TX_POWER_LEVEL_P6
+    default 11 if BT_CTRL_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
+    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
+    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21

    default 0

@ -361,9 +368,9 @@ menu "MODEM SLEEP Options"
            bool "Main crystal"
            help
                Main crystal can be used as low power clock for bluetooth modem sleep. If this option is
-                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, but
-                cannot work when light sleep is enabled. Main crystal has a relatively better performance than
-                other bluetooth low power clock sources.
+                selected, bluetooth modem sleep can work under Dynamic Frequency Scaling(DFS) enabled, and
+                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
+                than other bluetooth low power clock sources.
        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
            bool "External 32kHz crystal"
            depends on ESP32S3_RTC_CLK_SRC_EXT_CRYS
@ -378,9 +385,17 @@ menu "MODEM SLEEP Options"
            help
                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
-
-
    endchoice
+
+    config BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+        bool "power up main XTAL during light sleep"
+        depends on (BT_CTRL_LPCLK_SEL_MAIN_XTAL || BT_CTRL_LPCLK_SEL_EXT_32K_XTAL) && FREERTOS_USE_TICKLESS_IDLE
+        default n
+        help
+            If this option is selected, the main crystal will power up during light sleep when the low power clock
+            selects an external 32kHz crystal but the external 32kHz crystal does not exist or the low power clock
+            selects the main crystal.
+
 endmenu

 config BT_CTRL_SLEEP_MODE_EFF
--- a/components/bt/controller/esp32s3/bt.c
+++ b/components/bt/controller/esp32s3/bt.c
@ -70,7 +70,8 @@ typedef union {
        uint32_t mac_bb_pd               :  1; // whether hardware(MAC, BB) force-power-down is required during sleep
        uint32_t wakeup_timer_required   :  1; // whether system timer is needed
        uint32_t no_light_sleep          :  1; // do not allow system to enter light sleep after bluetooth is enabled
-        uint32_t reserved                : 26; // reserved
+        uint32_t main_xtal_pu            :  1; // power up main XTAL
+        uint32_t reserved                : 25; // reserved
    };
    uint32_t val;
 } btdm_lpcntl_t;
@ -130,6 +131,11 @@ typedef struct {
    intptr_t end;
 } btdm_dram_available_region_t;

+typedef struct {
+    void *handle;
+    void *storage;
+} btdm_queue_item_t;
+
 typedef void (* osi_intr_handler)(void);

 /* OSI function */
@ -232,11 +238,13 @@ extern int ble_txpwr_get(int power_type);

 extern uint16_t l2c_ble_link_get_tx_buf_num(void);
 extern int coex_core_ble_conn_dyn_prio_get(bool *low, bool *high);
+extern void coex_pti_v2(void);

 extern bool btdm_deep_sleep_mem_init(void);
 extern void btdm_deep_sleep_mem_deinit(void);
 extern void btdm_ble_power_down_dma_copy(bool copy);
 extern uint8_t btdm_sleep_clock_sync(void);
+extern void sdk_config_extend_set_pll_track(bool enable);

 #if CONFIG_MAC_BB_PD
 extern void esp_mac_bb_power_down(void);
@ -478,36 +486,64 @@ static void IRAM_ATTR task_yield_from_isr(void)

 static void *semphr_create_wrapper(uint32_t max, uint32_t init)
 {
-    return (void *)xSemaphoreCreateCounting(max, init);
+    btdm_queue_item_t *semphr = heap_caps_calloc(1, sizeof(btdm_queue_item_t), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
+    assert(semphr);
+
+#if !CONFIG_SPIRAM_USE_MALLOC
+    semphr->handle = (void *)xSemaphoreCreateCounting(max, init);
+#else
+
+    semphr->storage = heap_caps_malloc(sizeof(StaticQueue_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(semphr->storage);
+
+    semphr->handle = (void *)xSemaphoreCreateCountingStatic(max, init, semphr->storage);
+#endif
+    assert(semphr->handle);
+    return semphr;
 }

 static void semphr_delete_wrapper(void *semphr)
 {
-    vSemaphoreDelete(semphr);
+    if (semphr == NULL) {
+        return;
+    }
+
+    btdm_queue_item_t *semphr_item = (btdm_queue_item_t *)semphr;
+
+    if (semphr_item->handle) {
+        vSemaphoreDelete(semphr_item->handle);
+    }
+#ifdef CONFIG_SPIRAM_USE_MALLOC
+    if (semphr_item->storage) {
+        free(semphr_item->storage);
+    }
+#endif
+
+    free(semphr);
 }

 static int IRAM_ATTR semphr_take_from_isr_wrapper(void *semphr, void *hptw)
 {
-    return (int)xSemaphoreTakeFromISR(semphr, hptw);
+    return (int)xSemaphoreTakeFromISR(((btdm_queue_item_t *)semphr)->handle, hptw);
 }

 static int IRAM_ATTR semphr_give_from_isr_wrapper(void *semphr, void *hptw)
 {
-    return (int)xSemaphoreGiveFromISR(semphr, hptw);
+    return (int)xSemaphoreGiveFromISR(((btdm_queue_item_t *)semphr)->handle, hptw);
 }

 static int semphr_take_wrapper(void *semphr, uint32_t block_time_ms)
 {
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int)xSemaphoreTake(semphr, portMAX_DELAY);
+        return (int)xSemaphoreTake(((btdm_queue_item_t *)semphr)->handle, portMAX_DELAY);
    } else {
-        return (int)xSemaphoreTake(semphr, block_time_ms / portTICK_PERIOD_MS);
+        return (int)xSemaphoreTake(((btdm_queue_item_t *)semphr)->handle, block_time_ms / portTICK_PERIOD_MS);
    }
 }

 static int semphr_give_wrapper(void *semphr)
 {
-    return (int)xSemaphoreGive(semphr);
+    return (int)xSemaphoreGive(((btdm_queue_item_t *)semphr)->handle);
 }

 static void *mutex_create_wrapper(void)
@ -532,40 +568,71 @@ static int mutex_unlock_wrapper(void *mutex)

 static void *queue_create_wrapper(uint32_t queue_len, uint32_t item_size)
 {
-    return (void *)xQueueCreate(queue_len, item_size);
+    btdm_queue_item_t *queue = NULL;
+
+    queue = (btdm_queue_item_t*)heap_caps_malloc(sizeof(btdm_queue_item_t), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue);
+
+#if CONFIG_SPIRAM_USE_MALLOC
+
+    queue->storage = heap_caps_calloc(1, sizeof(StaticQueue_t) + (queue_len*item_size), MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT);
+    assert(queue->storage);
+
+    queue->handle = xQueueCreateStatic( queue_len, item_size, ((uint8_t*)(queue->storage)) + sizeof(StaticQueue_t), (StaticQueue_t*)(queue->storage));
+    assert(queue->handle);
+
+#else
+    queue->handle = xQueueCreate( queue_len, item_size);
+    assert(queue->handle);
+#endif
+
+    return queue;
 }

 static void queue_delete_wrapper(void *queue)
 {
-    vQueueDelete(queue);
+    btdm_queue_item_t *queue_item = (btdm_queue_item_t *)queue;
+    if (queue_item) {
+        if(queue_item->handle){
+            vQueueDelete(queue_item->handle);
+        }
+
+#if CONFIG_SPIRAM_USE_MALLOC
+        if (queue_item->storage) {
+            free(queue_item->storage);
+        }
+#endif
+
+        free(queue_item);
+    }
 }

 static int queue_send_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int)xQueueSend(queue, item, portMAX_DELAY);
+        return (int)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
    } else {
-        return (int)xQueueSend(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int)xQueueSend(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
    }
 }

 static int IRAM_ATTR queue_send_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int)xQueueSendFromISR(queue, item, hptw);
+    return (int)xQueueSendFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }

 static int queue_recv_wrapper(void *queue, void *item, uint32_t block_time_ms)
 {
    if (block_time_ms == OSI_FUNCS_TIME_BLOCKING) {
-        return (int)xQueueReceive(queue, item, portMAX_DELAY);
+        return (int)xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, portMAX_DELAY);
    } else {
-        return (int)xQueueReceive(queue, item, block_time_ms / portTICK_PERIOD_MS);
+        return (int)xQueueReceive(((btdm_queue_item_t*)queue)->handle, item, block_time_ms / portTICK_PERIOD_MS);
    }
 }

 static int IRAM_ATTR queue_recv_from_isr_wrapper(void *queue, void *item, void *hptw)
 {
-    return (int)xQueueReceiveFromISR(queue, item, hptw);
+    return (int)xQueueReceiveFromISR(((btdm_queue_item_t*)queue)->handle, item, hptw);
 }

 static int task_create_wrapper(void *task_func, const char *name, uint32_t stack_depth, void *param, uint32_t prio, void *task_handle, uint32_t core_id)
@ -870,25 +937,21 @@ esp_err_t esp_bt_mem_release(esp_bt_mode_t mode)
    return ESP_OK;
 }

-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if CONFIG_MAC_BB_PD
 static void IRAM_ATTR btdm_mac_bb_power_down_cb(void)
 {
    if (s_lp_cntl.mac_bb_pd && s_lp_stat.mac_bb_pd == 0) {
-#if (CONFIG_MAC_BB_PD)
        btdm_ble_power_down_dma_copy(true);
-#endif
        s_lp_stat.mac_bb_pd = 1;
    }
 }

 static void IRAM_ATTR btdm_mac_bb_power_up_cb(void)
 {
-#if (CONFIG_MAC_BB_PD)
    if (s_lp_cntl.mac_bb_pd && s_lp_stat.mac_bb_pd) {
        btdm_ble_power_down_dma_copy(false);
        s_lp_stat.mac_bb_pd = 0;
    }
-#endif
 }
 #endif

@ -932,9 +995,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    // overwrite some parameters
    cfg->magic = ESP_BT_CTRL_CONFIG_MAGIC_VAL;

+    sdk_config_extend_set_pll_track(false);
+
 #if CONFIG_MAC_BB_PD
    esp_mac_bb_pd_mem_init();
 #endif
+    esp_phy_pd_mem_init();
    esp_bt_power_domain_on();

    btdm_controller_mem_init();
@ -968,15 +1034,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // set default values for global states or resources
        s_lp_stat.val = 0;
        s_lp_cntl.val = 0;
+        s_lp_cntl.main_xtal_pu = 0;
        s_wakeup_req_sem = NULL;
        s_btdm_slp_tmr = NULL;

        // configure and initialize resources
        s_lp_cntl.enable = (cfg->sleep_mode == ESP_BT_SLEEP_MODE_1) ? 1 : 0;
-        s_lp_cntl.no_light_sleep = 1;
+        s_lp_cntl.no_light_sleep = 0;

        if (s_lp_cntl.enable) {
-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
            if (!btdm_deep_sleep_mem_init()) {
                err = ESP_ERR_NO_MEM;
                goto error;
@ -1016,33 +1083,41 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        // check whether or not EXT_CRYS is working
        if (rtc_clk_slow_freq_get() == RTC_SLOW_FREQ_32K_XTAL) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_XTAL32K; // External 32 kHz XTAL
-            s_lp_cntl.no_light_sleep = 0;
        } else {
-            ESP_LOGW(BT_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock\n"
-                 "light sleep mode will not be able to apply when bluetooth is enabled");
+            ESP_LOGW(BT_LOG_TAG, "32.768kHz XTAL not detected, fall back to main XTAL as Bluetooth sleep clock");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
        }
-#elif (CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW)
-        // check whether or not EXT_CRYS is working
+#elif CONFIG_BT_CTRL_LPCLK_SEL_MAIN_XTAL
+        ESP_LOGI(BT_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
+#if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            s_lp_cntl.no_light_sleep = 1;
+#endif
+#elif CONFIG_BT_CTRL_LPCLK_SEL_RTC_SLOW
+        // check whether or not internal 150 kHz RC oscillator is working
        if (rtc_clk_slow_freq_get() == RTC_SLOW_FREQ_RTC) {
            s_lp_cntl.lpclk_sel = BTDM_LPCLK_SEL_RTC_SLOW; // Internal 150 kHz RC oscillator
-            ESP_LOGW(BTDM_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
+            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC osciallator. The accuracy of this clock is a lot larger than 500ppm which is "
                 "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
        } else {
            ESP_LOGW(BT_LOG_TAG, "Internal 150kHz RC oscillator not detected.");
            assert(0);
        }
-#else
-        s_lp_cntl.no_light_sleep = 1;
 #endif

        bool select_src_ret __attribute__((unused));
        bool set_div_ret __attribute__((unused));
        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
+            s_lp_cntl.main_xtal_pu = 1;
+#endif
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
-            set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get() * 2);
+            set_div_ret = btdm_lpclk_set_div(rtc_clk_xtal_freq_get());
            assert(select_src_ret && set_div_ret);
            btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
-            btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
+            btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
        } else if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL32K) {
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
            set_div_ret = btdm_lpclk_set_div(0);
@ -1061,6 +1136,9 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
            err = ESP_ERR_INVALID_ARG;
            goto error;
        }
+#if CONFIG_SW_COEXIST_ENABLE
+        coex_update_lpclk_interval();
+#endif

 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
@ -1068,6 +1146,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
                err = ESP_ERR_NO_MEM;
                goto error;
            }
+            ESP_LOGW(BT_LOG_TAG, "light sleep mode will not be able to apply when bluetooth is enabled.");
        }
        if ((err = esp_pm_lock_create(ESP_PM_APB_FREQ_MAX, 0, "bt", &s_pm_lock)) != ESP_OK) {
            err = ESP_ERR_NO_MEM;
@ -1083,6 +1162,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif

    periph_module_enable(PERIPH_BT_MODULE);
+    periph_module_reset(PERIPH_BT_MODULE);

    esp_phy_enable();
    s_lp_stat.phy_enabled = 1;
@ -1091,6 +1171,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
        err = ESP_ERR_NO_MEM;
        goto error;
    }
+    coex_pti_v2();

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;

@ -1123,7 +1204,7 @@ error:
            s_btdm_slp_tmr = NULL;
        }

-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
        if (s_lp_cntl.mac_bb_pd) {
            btdm_deep_sleep_mem_deinit();
            s_lp_cntl.mac_bb_pd = 0;
@ -1136,6 +1217,22 @@ error:
                s_wakeup_req_sem = NULL;
            }
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
@ -1144,8 +1241,6 @@ error:
    esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
 #endif

-    esp_bt_power_domain_off();
-
    if (osi_funcs_p != NULL) {
        free(osi_funcs_p);
        osi_funcs_p = NULL;
@ -1171,7 +1266,7 @@ esp_err_t esp_bt_controller_deinit(void)

    // deinit low power control resources
    do {
-#if (CONFIG_MAC_BB_PD)
+#if CONFIG_MAC_BB_PD
        btdm_deep_sleep_mem_deinit();
 #endif

@ -1200,17 +1295,39 @@ esp_err_t esp_bt_controller_deinit(void)
            semphr_delete_wrapper(s_wakeup_req_sem);
            s_wakeup_req_sem = NULL;
        }
+
+        if (s_lp_cntl.lpclk_sel == BTDM_LPCLK_SEL_XTAL) {
+#ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
+            if (s_lp_cntl.main_xtal_pu) {
+                ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_OFF));
+                s_lp_cntl.main_xtal_pu = 0;
+            }
+#endif
+            btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
+            btdm_lpclk_set_div(0);
+#if CONFIG_SW_COEXIST_ENABLE
+            coex_update_lpclk_interval();
+#endif
+        }
+
+        btdm_lpcycle_us = 0;
    } while (0);

 #if CONFIG_MAC_BB_PD
    esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
    esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
 #endif
+
+    esp_bt_power_domain_off();
+#if CONFIG_MAC_BB_PD
+    esp_mac_bb_pd_mem_deinit();
+#endif
+    esp_phy_pd_mem_deinit();
+
    free(osi_funcs_p);
    osi_funcs_p = NULL;

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;
-    btdm_lpcycle_us = 0;
    return ESP_OK;
 }

--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@ -803,6 +803,13 @@ if BLE_MESH
            help
                Maximum number of groups to which the LPN can subscribe.

+        config BLE_MESH_LPN_SUB_ALL_NODES_ADDR
+            bool "Automatically subscribe all nodes address"
+            default n
+            help
+                Automatically subscribe all nodes address when friendship
+                established.
+
    endif # BLE_MESH_LOW_POWER

    config BLE_MESH_FRIEND
@ -1094,6 +1101,13 @@ if BLE_MESH
            lets the state to be changed at any time.
            If IV Update test mode is going to be used, this option should be enabled.

+    config BLE_MESH_DISCARD_OLD_SEQ_AUTH
+        bool
+        default y
+        help
+            This option is used to decide whether discarding the old SeqAuth when
+            receiving a segmented message.
+
    menu "BLE Mesh specific test option"

        config BLE_MESH_SELF_TEST
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_ble_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2020 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>
 #include <string.h>
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>

--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_local_data_operation_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>
 #include <string.h>
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_low_power_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>

--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_networking_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>
 #include <string.h>
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_provisioning_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>
 #include <string.h>
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
@ -1,16 +1,8 @@
-// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 #include <stdint.h>
 #include <string.h>
--- a/Show More
+++ b/Show More