change(version): Update version to 5.2.1

Merge branch 'ci/full_fetch_while_check_version_v5.2' into 'release/v5.2'
ci: use full fetch while checking git tags (v5.2) See merge request espressif/esp-idf!29427
2024-03-05 16:58:26 +01:00 · 2024-03-05 23:46:50 +08:00 · 2024-03-05 15:40:01 +01:00 · 2024-03-04 15:20:20 +08:00 · 2024-03-04 10:19:47 +08:00 · 2024-03-01 10:56:35 +08:00
1532 changed files with 37788 additions and 14988 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -3,8 +3,8 @@ workflow:
    # Disable those non-protected push triggered pipelines
    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && $CI_PIPELINE_SOURCE == "push"'
      when: never
-    # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
-    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
+    # when running merged result pipelines, CI_COMMIT_SHA represents the temp commit it created.
+    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha of the original commit.
    - if: $CI_OPEN_MERGE_REQUESTS != null
      variables:
        PIPELINE_COMMIT_SHA: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@ -2,228 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.github/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.github/dependabot.yml               @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.gitlab/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/fatfs/**/*.py             @esp-idf-codeowners/tools
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/en/api-guides/jtag-debugging/     @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb* @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-/docs/**/migration-guides/              @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-/tools/test_apps/README.md    @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@ -59,7 +59,7 @@
 - `example_test[_esp32/esp32s2/...]`
 - `fuzzer_test`
 - `host_test`
- `integration_test[_wifi/ble]`
+- `integration_test`
 - `iperf_stress_test`
 - `macos`
 - `macos_test`
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@ -21,8 +21,7 @@
  needs:
    - job: fast_template_app
      artifacts: false
-    - job: mr_variables
-      optional: true  # only MR pipelines would have this
+    - pipeline_variables
  artifacts:
    paths:
      # The other artifacts patterns are defined under tools/ci/artifacts_handler.py
@ -46,9 +45,10 @@
        examples/bluetooth/esp_ble_mesh/ble_mesh_console
        examples/bluetooth/hci/controller_hci_uart_esp32
        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
+    - python tools/ci/artifacts_handler.py upload

 .build_cmake_clang_template:
  extends:
@ -64,10 +64,10 @@
      --copy-sdkconfig
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
      $TEST_BUILD_OPTS_EXTRA
-    - upload_artifacts_to_s3
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_template:
  extends:
@ -81,9 +81,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_no_jtag_template:
  extends:
@ -97,9 +97,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_jtag_template:
  extends:
@ -113,9 +113,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 build_pytest_examples_esp32:
  extends:
@ -263,9 +263,9 @@ build_only_components_apps:
      -t all
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 build_pytest_test_apps_esp32:
  extends:
@ -335,9 +335,9 @@ build_only_tools_test_apps:
      -t all
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_template_app_template:
  extends:
@ -516,8 +516,10 @@ build_clang_test_apps_esp32c6:
  script:
    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
    - cd ${IDF_PATH}/tools/test_build_system
+    - python ${IDF_PATH}/tools/ci/get_known_failure_cases_file.py
    - pytest --parallel-count ${CI_NODE_TOTAL:-1} --parallel-index ${CI_NODE_INDEX:-1}
      --work-dir ${CI_PROJECT_DIR}/test_build_system --junitxml=${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}

 pytest_build_system:
  extends: .test_build_system_template
--- a/.gitlab/ci/common.yml
+++ b/.gitlab/ci/common.yml
@ -6,9 +6,9 @@ stages:
  - pre_check
  - build
  - assign_test
-  - build_doc
  - target_test
  - host_test
+  - build_doc
  - test_deploy
  - deploy
  - post_deploy
@ -20,16 +20,27 @@ variables:
  MAKEFLAGS: "-j5 --no-keep-going"

 # GitLab-CI environment
-
-  # XXX_ATTEMPTS variables (https://docs.gitlab.com/ee/ci/runners/configure_runners.html#job-stages-attempts) are not defined here.
-  # Use values from  "CI / CD Settings" - "Variables".
-
-  # GIT_STRATEGY is not defined here.
-  # Use an option from  "CI / CD Settings" - "General pipelines".
-
+  # Thanks to pack-objects cache, clone strategy should behave faster than fetch
+  #   so we pick "clone" as default git strategy
+  # Shiny runners by default remove the CI_PROJECT_DIR every time at the beginning of one job
+  #   and clone with a --depth=1
+  # Brew runners will fetch from locally mirror first, and cache the local CI_PROJECT_DIR
+  # In conclusion
+  # - set GIT_STRATEGY: "clone" to shiny runners
+  # - set GIT_STRATEGY: "fetch" to brew runners
+  GIT_STRATEGY: clone
  # we will download archive for each submodule instead of clone.
  # we don't do "recursive" when fetch submodule as they're not used in CI now.
  GIT_SUBMODULE_STRATEGY: none
+  # since we're using merged-result pipelines, the last commit should work for most cases
+  GIT_DEPTH: 1
+  # --no-recurse-submodules: we use cache for submodules
+  # --prune --prune-tags: in case remote branch or tag is force pushed
+  GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
+  # we're using .cache folder for caches
+  GIT_CLEAN_FLAGS: -ffdx -e .cache/
+  LATEST_GIT_TAG: v5.2.1
+
  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
  # by default we will fetch all submodules
  # jobs can overwrite this variable to only fetch submodules they required
@ -39,20 +50,18 @@ variables:
  IDF_SKIP_CHECK_SUBMODULES: 1

  IDF_PATH: "$CI_PROJECT_DIR"
-  BATCH_BUILD: "1"
  V: "0"
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
  PYTHON_VER: 3.8.17

  # Docker images
-  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.2:2"
-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.2:2-1"
+  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.2:2"
+  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.2:2-1"
  QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.2:2-20230522"
-  TARGET_TEST_ENV_IMAGE: "$CI_DOCKER_REGISTRY/target-test-env-v5.2:2"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.2:2"

  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
-
-  PRE_COMMIT_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"
+  PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"

  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
@ -77,6 +86,9 @@ variables:
  # This is used only if CI_PYTHON_TOOL_REPO is not empty.
  CI_PYTHON_TOOL_BRANCH: ""

+  # Set this variable to specify the file name for the known failure cases.
+  KNOWN_FAILURE_CASES_FILE_NAME: "5.2.txt"
+
  IDF_CI_BUILD: 1

 ################################################
@ -92,6 +104,7 @@ variables:

  if echo "$CI_MERGE_REQUEST_LABELS" | egrep "(^|,)include_nightly_run(,|$)"; then
    export INCLUDE_NIGHTLY_RUN="1"
+    export NIGHTLY_RUN="1"
  fi

  # configure cmake related flags
@ -137,6 +150,10 @@ variables:
    $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
  fi

+  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
+  # Needed for pytest junit reports.
+  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
+
  source ./export.sh

  # Custom clang
@ -168,6 +185,11 @@ variables:
  # Show ccache statistics if enabled globally
  test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats || true

+.upload_failed_job_log_artifacts: &upload_failed_job_log_artifacts |
+  if [ $CI_JOB_STATUS = "failed" ]; then
+    python tools/ci/artifacts_handler.py upload --type logs
+  fi
+
 .before_script:minimal:
  before_script:
    - *common-before_scripts
@ -194,6 +216,101 @@ variables:
 .after_script:build:ccache:
  after_script:
    - *show_ccache_statistics
+    - *upload_failed_job_log_artifacts
+
+##############################
+# Git Strategy Job Templates #
+##############################
+.git_init: &git_init |
+  mkdir -p "${CI_PROJECT_DIR}"
+  cd "${CI_PROJECT_DIR}"
+  git init
+
+.git_fetch_from_mirror_url_if_exists: &git_fetch_from_mirror_url_if_exists |
+  # check if set mirror
+  if [ -n "${LOCAL_GITLAB_HTTPS_HOST:-}" ] && [ -n "${ESPCI_TOKEN:-}" ]; then
+    MIRROR_REPO_URL="https://bot:${ESPCI_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"
+  elif [ -n "${LOCAL_GIT_MIRROR:-}" ]; then
+    MIRROR_REPO_URL="${LOCAL_GIT_MIRROR}/${CI_PROJECT_PATH}"
+  fi
+
+  # fetch from mirror first if set
+  if [ -n "${MIRROR_REPO_URL:-}" ]; then
+    if git remote -v | grep origin; then
+      git remote set-url origin "${MIRROR_REPO_URL}"
+    else
+      git remote add origin "${MIRROR_REPO_URL}"
+    fi
+    # mirror url may fail with authentication issue
+    git fetch origin --no-recurse-submodules || true
+  fi
+
+  # set remote url to CI_REPOSITORY_URL
+  if git remote -v | grep origin; then
+    git remote set-url origin "${CI_REPOSITORY_URL}"
+  else
+    git remote add origin "${CI_REPOSITORY_URL}"
+  fi
+
+.git_checkout_fetch_head: &git_checkout_fetch_head |
+  git checkout FETCH_HEAD
+  git clean ${GIT_CLEAN_FLAGS}
+
+# git diff requires two commits, with different CI env var
+#
+# By default, we use git strategy "clone" with depth 1 to speed up the clone process.
+# But for jobs requires running `git diff`, we need to fetch more commits to get the correct diffs.
+#
+# Since there's no way to get the correct git_depth before the job starts,
+# we can't set `GIT_DEPTH` in the job definition.
+#
+# Set git strategy to "none" and fetch manually instead.
+.before_script:fetch:git_diff:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    - *git_init
+    - *git_fetch_from_mirror_url_if_exists
+    - |
+      # merged results pipelines, by default
+      if [[ -n $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA ]]; then
+        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA)
+      # merge request pipelines, when the mr got conflicts
+      elif [[ -n $CI_MERGE_REQUEST_DIFF_BASE_SHA ]]; then
+        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_COMMIT_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_COMMIT_SHA)
+      # other pipelines, like the protected branches pipelines
+      elif [[ "$CI_COMMIT_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]]; then
+        git fetch origin $CI_COMMIT_BEFORE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_COMMIT_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA)
+      else
+        # pipeline source could be web, scheduler, etc.
+        git fetch origin $CI_COMMIT_SHA --depth=2 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_COMMIT_SHA~1 $CI_COMMIT_SHA)
+      fi
+    - *git_checkout_fetch_head
+    - *common-before_scripts
+    - *setup_tools_and_idf_python_venv
+    - add_gitlab_ssh_keys
+
+# target test runners may locate in different places
+# for runners set git mirror, we fetch from the mirror first, then fetch the HEAD commit
+.before_script:fetch:target_test:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    - *git_init
+    - *git_fetch_from_mirror_url_if_exists
+    - git fetch origin "${CI_COMMIT_SHA}" --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+    - *git_checkout_fetch_head
+    - *common-before_scripts
+    - *setup_tools_and_idf_python_venv
+    - add_gitlab_ssh_keys
+    # no submodules

 #############
 # `default` #
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@ -83,16 +83,6 @@
    - "build:{0}"
    - build:target_test

-build:integration_test:
-  labels:
-    - build
-  patterns:
-    - build_components
-    - build_system
-  included_in:
-    - build:target_test
-
-
 ####################
 # Target Test Jobs #
 ####################
@ -173,23 +163,6 @@ build:integration_test:
    - "build:example_test"
    - build:target_test

-"test:integration_test_{0}":
-  matrix:
-    - - wifi
-      - ble
-  labels:
-    - integration_test_{0}
-    - integration_test
-    - target_test
-  patterns:
-    - integration_test-{0}
-    - target_test-{0}
-    # - maybe others
-  included_in:
-    - test:integration_test
-    - build:integration_test
-    - build:target_test
-
 "test:host_test":
  labels:
    - host_test
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@ -1,8 +1,7 @@
 .deploy_job_template:
  stage: deploy
  image: $ESP_ENV_IMAGE
-  tags:
-    - deploy
+  tags: [ deploy ]

 # Check this before push_to_github
 check_submodule_sync:
@ -10,11 +9,11 @@ check_submodule_sync:
    - .deploy_job_template
    - .rules:test:submodule
  stage: test_deploy
-  tags:
-    - github_sync
+  tags: [ brew, github_sync ]
  retry: 2
  variables:
-    GIT_STRATEGY: clone
+    # for brew runners, we always set GIT_STRATEGY to fetch
+    GIT_STRATEGY: fetch
    SUBMODULES_TO_FETCH: "none"
    PUBLIC_IDF_URL: "https://github.com/espressif/esp-idf.git"
  dependencies: []
@ -35,6 +34,12 @@ push_to_github:
    - .rules:push_to_github
  needs:
    - check_submodule_sync
+  tags: [ brew, github_sync ]
+  variables:
+    # for brew runners, we always set GIT_STRATEGY to fetch
+    GIT_STRATEGY: fetch
+    # github also need full record of commits
+    GIT_DEPTH: 0
  script:
    - add_github_ssh_keys
    - git remote remove github &>/dev/null || true
@ -47,6 +52,9 @@ deploy_update_SHA_in_esp-dockerfiles:
    - .before_script:minimal
    - .rules:protected-no_label-always
  dependencies: []
+  variables:
+    GIT_DEPTH: 2
+  tags: [ shiny, build ]
  script:
    - 'curl --header "PRIVATE-TOKEN: ${ESPCI_SCRIPTS_TOKEN}" -o create_MR_in_esp_dockerfile.sh $GITLAB_HTTP_SERVER/api/v4/projects/1260/repository/files/create_MR_in_esp_dockerfile%2Fcreate_MR_in_esp_dockerfile.sh/raw\?ref\=master'
    - chmod +x create_MR_in_esp_dockerfile.sh
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@ -37,16 +37,25 @@
 .if-dev-push: &if-dev-push
  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'

+.if-schedule: &if-schedule
+  if: '$CI_PIPELINE_SOURCE == "schedule"'
+
 .doc-rules:build:docs-full:
  rules:
    - <<: *if-qa-test-tag
      when: never
-    - <<: *if-protected
+    - <<: *if-schedule
    - <<: *if-label-build_docs
    - <<: *if-label-docs_full
    - <<: *if-dev-push
      changes: *patterns-docs-full

+.doc-rules:build:docs-full-prod:
+  rules:
+    - <<: *if-qa-test-tag
+      when: never
+    - <<: *if-protected-no_label
+
 .doc-rules:build:docs-partial:
  rules:
    - <<: *if-qa-test-tag
@ -83,11 +92,8 @@ check_docs_lang_sync:
  stage: build_doc
  tags:
    - build_docs
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
  script:
+    - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
    - cd docs
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
  parallel:
@ -110,6 +116,24 @@ build_docs_html_full:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
+  artifacts:
+    when: always
+    paths:
+      - docs/_build/*/*/*.txt
+      - docs/_build/*/*/html/*
+    expire_in: 4 days
+  variables:
+    DOC_BUILDERS: "html"
+
+build_docs_html_full_prod:
+  extends:
+    - .build_docs_template
+    - .doc-rules:build:docs-full-prod
+  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
    when: always
    paths:
@ -123,6 +147,10 @@ build_docs_html_partial:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-partial
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
  artifacts:
    when: always
    paths:
@ -142,6 +170,23 @@ build_docs_pdf:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
+  artifacts:
+    when: always
+    paths:
+      - docs/_build/*/*/latex/*
+    expire_in: 4 days
+  variables:
+    DOC_BUILDERS: "latex"
+
+build_docs_pdf_prod:
+  extends:
+    - .build_docs_template
+    - .doc-rules:build:docs-full-prod
+  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
    when: always
    paths:
@ -194,13 +239,12 @@ deploy_docs_production:
  # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
  extends:
    - .deploy_docs_template
-  rules:
-    - <<: *if-protected-no_label
+    - .doc-rules:build:docs-full-prod
  stage: post_deploy
  dependencies:  # set dependencies to null to avoid missing artifacts issue
  needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full
-    - build_docs_pdf
+    - build_docs_html_full_prod
+    - build_docs_pdf_prod
    - job: push_to_github
      artifacts: false
  variables:
@ -215,8 +259,7 @@ deploy_docs_production:
 check_doc_links:
  extends:
    - .build_docs_template
-  rules:
-    - <<: *if-protected-no_label
+    - .doc-rules:build:docs-full-prod
  stage: post_deploy
  needs:
    - job: deploy_docs_production
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@ -13,8 +13,7 @@
    - job: upload-submodules-cache
      optional: true
      artifacts: false
-    - job: mr_variables
-      optional: true  # only MR pipelines would have this
+    - pipeline_variables

 test_nvs_on_host:
  extends: .host_test_template
@ -208,14 +207,6 @@ test_mkdfu:
    - cd ${IDF_PATH}/tools/test_mkdfu
    - ./test_mkdfu.py

-test_sbom:
-  extends:
-    - .host_test_template
-    - .rules:patterns:sbom
-  script:
-    - cd ${IDF_PATH}/tools/test_sbom
-    - pytest
-
 test_autocomplete:
  extends:
    - .host_test_template
@ -314,15 +305,15 @@ test_pytest_qemu:
      --pytest-apps
      -m qemu
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/get_known_failure_cases_file.py
    - run_cmd pytest
      --target $IDF_TARGET
      -m qemu
      --embedded-services idf,qemu
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --app-info-filepattern \"list_job_*.txt\"

 test_pytest_linux:
@ -334,6 +325,7 @@ test_pytest_linux:
    paths:
      - XUNIT_RESULT.xml
      - pytest_embedded_log/
+      - "**/build*/build_log.txt"
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
@ -343,12 +335,12 @@ test_pytest_linux:
      --pytest-apps
      -m host_test
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/get_known_failure_cases_file.py
    - run_cmd pytest
      --target linux
      -m host_test
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --app-info-filepattern \"list_job_*.txt\"
--- a/.gitlab/ci/integration_test.yml
+++ b/.gitlab/ci/integration_test.yml
@ -8,7 +8,7 @@
  - "tools/**/*"
  - ".gitlab-ci.yml"
  - ".gitlab/ci/common.yml"
-  - ".gitlab/ci/integration-test.yml"
+  - ".gitlab/ci/integration_test.yml"
  - ".gitmodules"
  - "CMakeLists.txt"
  - "install.sh"
@ -22,6 +22,10 @@
    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      changes: *patterns-integration_test
+    # support trigger by ci labels
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build(?:,[^,\n\r]+)*$/i'

 gen_integration_pipeline:
  extends:
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@ -5,27 +5,17 @@
    - host_test
  dependencies: []

-.check_pre_commit_template:
+check_pre_commit:
  extends:
    - .pre_check_template
    - .before_script:minimal
  image: $PRE_COMMIT_IMAGE
-
-check_pre_commit_master_release:
-  extends:
-    - .check_pre_commit_template
-    - .rules:protected
+  needs:
+    - pipeline_variables
  script:
    - fetch_submodules
-    - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files
-
-check_pre_commit_MR:
-  extends:
-    - .check_pre_commit_template
-    - .rules:mr
-  script:
-    - fetch_submodules
-    - python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs pre-commit run --files
+    - pre-commit run --files $MODIFIED_FILES
+    - pre-commit run --hook-stage post-commit validate-sbom-manifest

 check_MR_style_dangerjs:
  extends:
@ -60,6 +50,13 @@ check_version:
  extends:
    - .pre_check_template
    - .rules:protected
+  tags: [ brew, github_sync ]
+  variables:
+    # need a full clone to get the latest tag
+    # the --shallow-since=$(git log -1 --format=%as $LATEST_GIT_TAG) option is not accurate
+    GIT_STRATEGY: fetch
+    SUBMODULES_TO_FETCH: "none"
+    GIT_DEPTH: 0
  script:
    - export IDF_PATH=$PWD
    - tools/ci/check_idf_version.sh
@ -148,10 +145,18 @@ check_esp_system:

 # For release tag pipelines only, make sure the tag was created with 'git tag -a' so it will update
 # the version returned by 'git describe'
+# Don't forget to update the env var `LATEST_GIT_TAG` in .gitlab/ci/common.yml
 check_version_tag:
  extends:
    - .pre_check_template
    - .rules:tag:release
+  tags: [ brew, github_sync ]
+  variables:
+    # need a full clone to get the latest tag
+    # the --shallow-since=$(git log -1 --format=%as $LATEST_GIT_TAG) option is not accurate
+    GIT_STRATEGY: fetch
+    SUBMODULES_TO_FETCH: "none"
+    GIT_DEPTH: 0
  script:
    - (git cat-file -t $CI_COMMIT_REF_NAME | grep tag) || (echo "ESP-IDF versions must be annotated tags." && exit 1)

@ -179,22 +184,23 @@ check_configure_ci_environment_parsing:
    - cd tools/ci
    - python -m unittest ci_build_apps.py

-mr_variables:
+pipeline_variables:
  extends:
    - .pre_check_template
-    - .rules:mr
-    - .before_script:minimal
+    - .before_script:fetch:git_diff
  tags:
    - build
  script:
-    - echo "MR_MODIFIED_FILES=$(python tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs)" >> mr.env
-    - echo "MR_MODIFIED_COMPONENTS=$(python tools/ci/ci_get_mr_info.py components ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs)" >> mr.env
-    - >
+    - MODIFIED_FILES=$(echo "$GIT_DIFF_OUTPUT" | xargs)
+    - echo "MODIFIED_FILES=$MODIFIED_FILES" >> pipeline.env
+    - echo "MODIFIED_COMPONENTS=$(run_cmd python tools/ci/ci_get_mr_info.py components --modified-files $MODIFIED_FILES | xargs)" >> pipeline.env
+    - |
      if echo "$CI_MERGE_REQUEST_LABELS" | egrep "(^|,)BUILD_AND_TEST_ALL_APPS(,|$)"; then
-        echo "BUILD_AND_TEST_ALL_APPS=1" >> mr.env
+        echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
      fi
-    - cat mr.env
+    - cat pipeline.env
+    - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
  artifacts:
    reports:
-      dotenv: mr.env
+      dotenv: pipeline.env
    expire_in: 4 days
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@ -67,9 +67,6 @@
  - "tools/ci/ci_build_apps.py"
  - "tools/test_build_system/**/*"

-.patterns-sbom: &patterns-sbom
-  - "tools/test_sbom/*"
-
 .patterns-custom_test: &patterns-custom_test
  - "tools/ci/idf_pytest/**/*"
  - "tools/ci/python_packages/gitlab_api.py"
@ -112,22 +109,6 @@
 .patterns-component_ut-wifi: &patterns-component_ut-wifi
  - "components/esp_wifi/**/*"

-.patterns-integration_test-ble: &patterns-integration_test-ble
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-  - "components/bt/controller/lib_esp32"
-  - "components/bt/controller/lib_esp32c3_family"
-  - "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"
-  - "components/bt/host/nimble/nimble"
-  - "components/esp_phy/lib"
-  - "components/esp_coex/??[!s][!t]*/**/*"
-  - "components/esp_coex/???/**/*"
-  - "components/esp_coex/*"
-
-.patterns-integration_test-wifi: &patterns-integration_test-wifi
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-
 .patterns-build_macos: &patterns-build_macos
  - "tools/ci/test_configure_ci_environment.sh"

@ -201,7 +182,6 @@
  - "components/esp_phy/lib"
  - "components/esp_wifi/lib"
  - "components/esp_coex/lib"
-  - "components/ieee802154/lib"
  - "components/json/cJSON"
  - "components/lwip/lwip"
  - "components/mbedtls/mbedtls"
@ -213,6 +193,7 @@
  - "components/unity/unity"
  - "components/heap/tlsf"
  - "components/bt/controller/lib_esp32c6/esp32c6-bt-lib"
+  - "components/bt/esp_ble_mesh/lib/lib"
  - ".gitmodules"

 .patterns-danger-npm: &patterns-danger-npm
@ -461,14 +442,6 @@
    - <<: *if-dev-push
      changes: *patterns-sonarqube-files

-.rules:patterns:sbom:
-  rules:
-    - <<: *if-protected
-    - <<: *if-dev-push
-      changes: *patterns-sbom
-    - <<: *if-dev-push
-      changes: *patterns-submodule
-
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 # DO NOT place comments or maintain any code from this line
 #
@ -571,15 +544,6 @@
 .if-label-host_test: &if-label-host_test
  if: '$BOT_LABEL_HOST_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*host_test(?:,[^,\n\r]+)*$/i'

-.if-label-integration_test: &if-label-integration_test
-  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_ble: &if-label-integration_test_ble
-  if: '$BOT_LABEL_INTEGRATION_TEST_BLE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_ble(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_wifi: &if-label-integration_test_wifi
-  if: '$BOT_LABEL_INTEGRATION_TEST_WIFI || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_wifi(?:,[^,\n\r]+)*$/i'
-
 .if-label-macos: &if-label-macos
  if: '$BOT_LABEL_MACOS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*macos(?:,[^,\n\r]+)*$/i'

@ -1584,9 +1548,6 @@
    - <<: *if-label-example_test_esp32p4
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
-    - <<: *if-label-integration_test_ble
-    - <<: *if-label-integration_test_wifi
    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
@ -1634,10 +1595,6 @@
      changes: *patterns-example_test-usb
    - <<: *if-dev-push
      changes: *patterns-example_test-wifi
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-ble
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-wifi
    - <<: *if-dev-push
      changes: *patterns-target_test-adc
    - <<: *if-dev-push
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@ -20,6 +20,8 @@ check_pylint:
  extends:
    - .pre_check_template
    - .rules:patterns:python-files
+  needs:
+    - pipeline_variables
  artifacts:
    when: always
    reports:
@ -28,9 +30,9 @@ check_pylint:
  script:
    - |
      if [ -n "$CI_MERGE_REQUEST_IID" ]; then
-        export files=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | grep ".py$");
+        export files=$(echo "$GIT_DIFF_OUTPUT" | grep ".py$" | xargs);
      else
-        export files=$(find . -iname "*.py" -print);
+        export files=$(git ls-files "*.py" | xargs);
      fi
    - if [ -z "$files" ]; then echo "No python files found"; exit 0; fi
    - run_cmd pylint --exit-zero --load-plugins=pylint_gitlab --output-format=gitlab-codeclimate:pylint.json $files
@ -82,7 +84,7 @@ code_quality_check:
  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
                       # we don't want to block ci when critical issues founded
  script:
-    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits ${CI_COMMIT_REF_NAME} | tr '\n' ',')
+    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits --src-branch ${CI_COMMIT_REF_NAME} | tr '\n' ',')
    # test if this branch have merge request, if not, exit 0
    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@ -1,17 +1,18 @@
 .target_test_template:
  image: $TARGET_TEST_ENV_IMAGE
+  extends:
+    - .before_script:fetch:target_test
  stage: target_test
  timeout: 1 hour
  dependencies: []
-  variables:
-    GIT_DEPTH: 1
-    SUBMODULES_TO_FETCH: "none"
  cache:
    # Usually do not need submodule-cache in target_test
    - key: pip-cache
      paths:
        - .cache/pip
      policy: pull
+  after_script:
+    - python tools/ci/artifacts_handler.py upload --type logs junit_reports

 .pytest_template:
  extends:
@ -25,7 +26,7 @@
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -45,7 +46,7 @@
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -469,7 +470,7 @@ pytest_examples_esp32_ethernet_ip101:
  needs:
    - job: build_pytest_examples_esp32
      artifacts: false
-  tags: [ esp32, ip101 ]
+  tags: [ esp32, eth_ip101 ]

 pytest_examples_esp32_ethernet_bridge:
  extends:
@ -730,7 +731,7 @@ pytest_components_esp32_ip101:
  needs:
    - job: build_pytest_components_esp32
      artifacts: false
-  tags: [ esp32, ip101 ]
+  tags: [ esp32, eth_ip101 ]

 pytest_components_esp32_lan8720:
  extends:
@ -1278,7 +1279,7 @@ pytest_examples_openthread_br:
      artifacts: false
  tags: [ esp32c6, openthread_br ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1293,7 +1294,7 @@ pytest_examples_openthread_br:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -1312,7 +1313,7 @@ pytest_examples_openthread_bbr:
      artifacts: false
  tags: [ esp32c6, openthread_bbr ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1327,7 +1328,7 @@ pytest_examples_openthread_bbr:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -1344,7 +1345,7 @@ pytest_examples_openthread_sleep:
      artifacts: false
  tags: [ esp32c6, openthread_sleep ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1358,7 +1359,7 @@ pytest_examples_openthread_sleep:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
--- a/.gitmodules
+++ b/.gitmodules
@ -49,12 +49,12 @@
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
-	sbom-version = 1.7.16
+	sbom-version = 1.7.17
 	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = cb8693b058ba302f4829ec6d03f609ac6f848546
+	sbom-hash = 87d8f0961a01bf09bef98ff89bae9fdec42181ee

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
@ -120,10 +120,6 @@
 	path = components/openthread/lib
 	url = ../../espressif/esp-thread-lib.git

-[submodule "components/ieee802154/lib"]
-	path = components/ieee802154/lib
-	url = ../../espressif/esp-ieee802154-lib.git
-
 [submodule "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"]
 	path = components/bt/controller/lib_esp32h2/esp32h2-bt-lib
 	url = ../../espressif/esp32h2-bt-lib.git
@ -143,3 +139,7 @@
 [submodule "components/esp_coex/lib"]
 	path = components/esp_coex/lib
 	url = ../../espressif/esp-coex-lib.git
+
+[submodule "components/bt/esp_ble_mesh/lib/lib"]
+	path = components/bt/esp_ble_mesh/lib/lib
+	url = ../../espressif/esp-ble-mesh-lib.git
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -1,6 +1,8 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks

+default_stages: [commit]
+
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.0.1
@ -39,11 +41,12 @@ repos:
    hooks:
      - id: flake8
        args: ['--config=.flake8', '--tee', '--benchmark']
-  - repo: https://github.com/pycqa/isort
-    rev: 5.12.0  # python 3.8 compatible
+  - repo: https://github.com/asottile/reorder-python-imports
+    rev: v3.12.0
    hooks:
-      - id: isort
-        name: isort (python)
+      - id: reorder-python-imports
+        name: Reorder Python imports
+        args: [--py38-plus]
        exclude: >
          (?x)^(
              .*_pb2.py
@ -67,7 +70,7 @@ repos:
        entry: tools/ci/check_kconfigs.py
        language: python
        additional_dependencies:
-          - esp-idf-kconfig
+          - esp-idf-kconfig>=1.4.2,<2.0.0
        files: '^Kconfig$|Kconfig.*$'
      - id: check-deprecated-kconfigs-options
        name: Check if any Kconfig Options Deprecated
@ -177,12 +180,6 @@ repos:
        always_run: true
        pass_filenames: false
        require_serial: true
-      - id: submodule-sbom-hash-check
-        name: Check if sbom-hash values for submodules in .gitmodules match submodules checkout hash in git tree
-        entry: python tools/test_sbom/test_submodules.py
-        language: python
-        always_run: true
-        pass_filenames: false
      - id: cleanup-ignore-lists
        name: Remove non-existing patterns from ignore lists
        entry: tools/ci/cleanup_ignore_lists.py
@ -205,7 +202,7 @@ repos:
      - id: conventional-precommit-linter
        stages: [commit-msg]
  - repo: https://github.com/espressif/astyle_py.git
-    rev: v1.0.2
+    rev: v1.0.5
    hooks:
      - id: astyle_py
        # If you are modifying astyle version, update tools/format.sh as well
@ -221,3 +218,8 @@ repos:
      name: shellcheck dash (export.sh)
      args: ['--shell', 'dash', '-x']
      files: 'export.sh'
+  - repo: https://github.com/espressif/esp-idf-sbom.git
+    rev: v0.13.0
+    hooks:
+      - id: validate-sbom-manifest
+        stages: [post-commit]
--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@ -199,13 +199,18 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
        return ESP_ERR_INVALID_ARG;
    }

+    if (size == 0) {
+        ESP_LOGD(TAG, "write data size is 0");
+        return ESP_OK;
+    }
+
    // find ota handle in linked list
    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
        if (it->handle == handle) {
            if (it->need_erase) {
                // must erase the partition before writing to it
-                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE;
-                uint32_t last_sector = (it->wrote_size + size) / SPI_FLASH_SEC_SIZE;
+                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE; // first affected sector
+                uint32_t last_sector = (it->wrote_size + size - 1) / SPI_FLASH_SEC_SIZE; // last affected sector

                ret = ESP_OK;
                if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
@ -960,6 +965,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
    }

    const esp_partition_t *running_app_part = esp_ota_get_running_partition();
+    esp_err_t ret = ESP_FAIL;
 #ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
    esp_ota_img_states_t running_app_state;
    ret = esp_ota_get_state_partition(running_app_part, &running_app_state);
@ -974,7 +980,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
 #endif

    esp_secure_boot_key_digests_t trusted_keys;
-    esp_err_t ret = esp_secure_boot_read_key_digests(&trusted_keys);
+    ret = esp_secure_boot_read_key_digests(&trusted_keys);
    if (ret != ESP_OK) {
        ESP_LOGE(TAG, "Could not read the secure boot key digests from efuse. Aborting..");
        return ESP_FAIL;
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -111,7 +111,7 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
 * @param size    Size of data buffer in bytes.
 *
 * @return
- *    - ESP_OK: Data was written to flash successfully.
+ *    - ESP_OK: Data was written to flash successfully, or size = 0
 *    - ESP_ERR_INVALID_ARG: handle is invalid.
 *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
 *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
--- a/components/app_update/test_apps/CMakeLists.txt
+++ b/components/app_update/test_apps/CMakeLists.txt
@ -2,6 +2,7 @@
 cmake_minimum_required(VERSION 3.16)

 set(EXTRA_COMPONENT_DIRS "$ENV{IDF_PATH}/tools/unit-test-app/components")
+set(COMPONENTS main)

 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 project(app_update_test)
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@ -23,7 +23,6 @@ menu "Bootloader config"
            - The default "Size" setting will add the -0s flag to CFLAGS.
            - The "Debug" setting will add the -Og flag to CFLAGS.
            - The "Performance" setting will add the -O2 flag to CFLAGS.
-            - The "None" setting will add the -O0 flag to CFLAGS.

            Note that custom optimization levels may be unsupported.

@ -34,7 +33,9 @@ menu "Bootloader config"
        config BOOTLOADER_COMPILER_OPTIMIZATION_PERF
            bool "Optimize for performance (-O2)"
        config BOOTLOADER_COMPILER_OPTIMIZATION_NONE
-            bool "Debug without optimization (-O0)"
+            bool "Debug without optimization (-O0) (Deprecated, will be removed in IDF v6.0)"
+            depends on IDF_TARGET_ARCH_XTENSA || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32C2
+
    endchoice

    choice BOOTLOADER_LOG_LEVEL
@ -139,7 +140,7 @@ menu "Bootloader config"

        config BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
            bool
-            default y if ESPTOOLPY_OCT_FLASH && SPI_FLASH_32BIT_ADDRESS
+            default y if ESPTOOLPY_OCT_FLASH && BOOTLOADER_FLASH_32BIT_ADDR
            default n

    endmenu
@ -458,6 +459,21 @@ menu "Bootloader config"
            (The application and bootoloader must be compiled with the same option).
            The RTC FAST memory has access only through PRO_CPU.

+    config BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
+        bool "Include custom memory in the CRC calculation"
+        depends on BOOTLOADER_CUSTOM_RESERVE_RTC
+        default n
+        help
+            This option allows the customer to use the legacy bootloader behavior when the
+            RTC FAST memory CRC calculation takes place. When this option is enabled, the
+            allocated user custom data will be taken into account in the CRC calculcation.
+            This means that any change to the custom data would need a CRC update to prevent
+            the bootloader from marking this data as corrupted.
+            If this option is disabled, the custom data will not be taken into account when
+            calculating the RTC FAST memory CRC. The user custom data can be changed freely,
+            without the need to update the CRC.
+            THIS OPTION MUST BE THE SAME FOR BOTH THE BOOTLOADER AND THE APPLICATION BUILDS.
+
    config BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE
        hex "Size in bytes for custom purposes"
        default 0
@ -833,7 +849,6 @@ menu "Security features"
        bool "Enable flash encryption on boot (READ DOCS FIRST)"
        default N
        select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
-        select NVS_ENCRYPTION
        help
            If this option is set, flash contents will be encrypted by the bootloader on first boot.

@ -1072,6 +1087,22 @@ menu "Security features"
                DIS_DOWNLOAD_MANUAL_ENCRYPT, DIS_USB_JTAG, DIS_USB_SERIAL_JTAG, STRAP_JTAG_SEL, USB_PHY_SEL.
    endmenu  # Potentially Insecure

+    config SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
+        bool "Encrypt only the app image that is present in the partition of type app"
+        depends on SECURE_FLASH_ENC_ENABLED && !SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+        default n
+        help
+            If set, optimise encryption time for the partition of type APP,
+            by only encrypting the app image that is present in the partition,
+            instead of the whole partition.
+            The image length used for encryption is derived from the image metadata, which
+            includes the size of the app image, checksum, hash and also the signature sector
+            when secure boot is enabled.
+
+            If not set (default), the whole partition of type APP would be encrypted,
+            which increases the encryption time but might be useful if there
+            is any custom data appended to the firmware image.
+
    config SECURE_FLASH_CHECK_ENC_EN_IN_APP
        bool "Check Flash Encryption enabled on app startup"
        depends on SECURE_FLASH_ENC_ENABLED
--- a/components/bootloader/subproject/main/ld/esp32p4/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32p4/bootloader.ld
@ -9,9 +9,9 @@
 *  Make sure the bootloader can load into main memory without overwriting itself.
 *
 *  ESP32-P4 ROM static data usage is as follows:
- *  - 0x4086ad08 - 0x4087c610: Shared buffers, used in UART/USB/SPI download mode only
- *  - 0x4087c610 - 0x4087e610: CPU1 stack, can be reclaimed as heap after RTOS startup
- *  - 0x4087e610 - 0x40880000: ROM .bss and .data (not easily reclaimable)
+ *  - 0x4ff296b8 - 0x4ff3afc0: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x4ff3afc0 - 0x4ff3fba4: CPU1 stack, can be reclaimed as heap after RTOS startup
+ *  - 0x4ff3fba4 - 0x4ff40000: ROM .bss and .data (not easily reclaimable)
 *
 *  The 2nd stage bootloader can take space up to the end of ROM shared
 *  buffers area (0x4087c610).
@ -217,34 +217,38 @@ SECTIONS
 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- * 0x4086ad08 ------------------> _dram0_0_start
+ * 0x4ff296b8 ------------------> _dram0_0_start
 *            |               |
 *            |               |
 *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
 *            |               |
 *            |               |
- * 0x4087c610 ------------------> __stack_sentry
+ * 0x4ff3afc0 ------------------> __stack_sentry
 *            |               |
 *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
 *            |               |
- * 0x4087e610 ------------------> __stack (pro cpu)
+ * 0x4ff3cfc0 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x4ff3efc0 ------------------> __stack_app (app cpu)
 *            |               |
 *            |               |
 *            |               |   3. Shared memory only used in startup code or nonos/early boot*
 *            |               |      (can be freed when IDF runs)
 *            |               |
 *            |               |
- * 0x4087f564 ------------------> _dram0_rtos_reserved_start
+ * 0x4ff3fba4 ------------------> _dram0_rtos_reserved_start
 *            |               |
 *            |               |
 *            |               |   4. Shared memory used in startup code and when IDF runs
 *            |               |
 *            |               |
- * 0x4087fab0 ------------------> _dram0_rtos_reserved_end
+ * 0x4ff3ff94 ------------------> _dram0_rtos_reserved_end
 *            |               |
- * 0x4087fce8 ------------------> _data_start_interface
+ * 0x4ff3ffc8 ------------------> _data_start_interface
 *            |               |
 *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
 *            |               |
- * 0x40880000 ------------------> _data_end_interface
+ * 0x4ff40000 ------------------> _data_end_interface
 */
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@ -33,6 +33,7 @@ typedef struct {
  uint32_t segment_data[ESP_IMAGE_MAX_SEGMENTS]; /* Data offsets for each segment */
  uint32_t image_len; /* Length of image on flash, in bytes */
  uint8_t image_digest[32]; /* appended SHA-256 digest */
+  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
 } esp_image_metadata_t;

 typedef enum {
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@ -121,7 +121,7 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,
 #if CONFIG_BOOTLOADER_RESERVE_RTC_MEM

 static uint32_t rtc_retain_mem_size(void) {
-#ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
+#if CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC && !CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
    /* A custom memory has been reserved by the user, do not consider this memory into CRC calculation as it may change without
     * the have the user updating the CRC. Return the offset of the custom field, which is equivalent to size of the structure
     * minus the size of everything after (including) `custom` */
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -18,6 +18,9 @@
 #include "esp32s2/rom/usb/cdc_acm.h"
 #include "esp32s2/rom/usb/usb_common.h"
 #endif
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+#include "hal/usb_fsls_phy_ll.h"
+#endif
 #include "esp_rom_gpio.h"
 #include "esp_rom_uart.h"
 #include "esp_rom_sys.h"
@ -35,6 +38,7 @@ void bootloader_console_init(void)
 void bootloader_console_init(void)
 {
    const int uart_num = CONFIG_ESP_CONSOLE_UART_NUM;
+    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused)); // To avoid build errors/warnings about __DECLARE_RCC_ATOMIC_ENV

    // Install rom uart printf as console.
    esp_rom_install_uart_printf();
@ -56,8 +60,8 @@ void bootloader_console_init(void)
            uart_tx_gpio != UART_NUM_0_TXD_DIRECT_GPIO_NUM ||
            uart_rx_gpio != UART_NUM_0_RXD_DIRECT_GPIO_NUM) {
        // Change default UART pins back to GPIOs
-        gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_U0RXD_U, PIN_FUNC_GPIO);
-        gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_U0TXD_U, PIN_FUNC_GPIO);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[UART_NUM_0_RXD_DIRECT_GPIO_NUM], PIN_FUNC_GPIO);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[UART_NUM_0_TXD_DIRECT_GPIO_NUM], PIN_FUNC_GPIO);
        // Route GPIO signals to/from pins
        const uint32_t tx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_TX_PIN_IDX);
        const uint32_t rx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_RX_PIN_IDX);
@ -68,7 +72,11 @@ void bootloader_console_init(void)
        esp_rom_gpio_connect_in_signal(uart_rx_gpio, rx_idx, 0);
        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
        // Enable the peripheral
-        periph_ll_enable_clk_clear_rst(PERIPH_UART0_MODULE + uart_num);
+        uart_ll_enable_bus_clock(uart_num, true);
+        uart_ll_reset_register(uart_num);
+        // Reset TX and RX FIFOs
+        uart_ll_txfifo_rst(UART_LL_GET_HW(uart_num));
+        uart_ll_rxfifo_rst(UART_LL_GET_HW(uart_num));
    }
 #endif // CONFIG_ESP_CONSOLE_UART_CUSTOM

@ -77,7 +85,6 @@ void bootloader_console_init(void)
 #if ESP_ROM_UART_CLK_IS_XTAL
    clock_hz = (uint32_t)rtc_clk_xtal_freq_get() * MHZ; // From esp32-s3 on, UART clk source is selected to XTAL in ROM
 #endif
-    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused)); // To avoid build errors/warnings about __DECLARE_RCC_ATOMIC_ENV
    esp_rom_uart_set_clock_baudrate(uart_num, clock_hz, CONFIG_ESP_CONSOLE_UART_BAUDRATE);
 }
 #endif // CONFIG_ESP_CONSOLE_UART
@ -98,6 +105,10 @@ void bootloader_console_init(void)
    esp_rom_uart_usb_acm_init(s_usb_cdc_buf, sizeof(s_usb_cdc_buf));
    esp_rom_uart_set_as_console(ESP_ROM_USB_OTG_NUM);
    esp_rom_install_channel_putc(1, bootloader_console_write_char_usb);
+#if SOC_USB_SERIAL_JTAG_SUPPORTED
+    usb_fsls_phy_ll_usb_wrap_pad_enable(&USB_WRAP, true);
+    usb_fsls_phy_ll_int_otg_enable(&USB_WRAP);
+#endif
 }
 #endif //CONFIG_ESP_CONSOLE_USB_CDC

--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -19,6 +19,8 @@
 #include "bootloader_util.h"
 #include "bootloader_common.h"
 #include "esp_rom_sys.h"
+#include "esp_efuse.h"
+#include "esp_app_desc.h"
 #include "bootloader_memory_utils.h"
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
@ -89,10 +91,10 @@ static bool should_map(uint32_t load_addr);

 static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
 /* Load or verify a segment */
-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);

 /* split segment and verify if data_len is too long */
-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);

 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
@ -240,6 +242,21 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
        cache_ll_writeback_all(CACHE_LL_LEVEL_INT_MEM, CACHE_TYPE_DATA, CACHE_LL_ID_ALL);
 #endif
    }
+
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    /* For anti-rollback case, reconfirm security version of the application to prevent FI attacks */
+    bool sec_ver = false;
+    if (do_load) {
+        sec_ver = esp_efuse_check_secure_version(data->secure_version);
+        if (!sec_ver) {
+            err = ESP_FAIL;
+            goto err;
+        }
+    }
+    /* Ensure that the security version check passes for image loading scenario */
+    ESP_FAULT_ASSERT(!do_load || sec_ver == true);
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
 #endif // BOOTLOADER_BUILD

    // Success!
@ -522,7 +539,7 @@ static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool
    for (int i = 0; i < data->image.segment_count; i++) {
        esp_image_segment_header_t *header = &data->segments[i];
        ESP_LOGV(TAG, "loading segment header %d at offset 0x%"PRIx32, i, next_addr);
-        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum));
+        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum, data));
        next_addr += sizeof(esp_image_segment_header_t);
        data->segment_data[i] = next_addr;
        next_addr += header->data_len;
@ -543,7 +560,7 @@ err:
    return err;
 }

-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
    esp_err_t err;

@ -601,7 +618,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
        data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
-        CHECK_ERR(process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum));
+        CHECK_ERR(process_segment_data(index, load_addr, data_addr, data_len, do_load, sha_handle, checksum, metadata));
        data_addr += data_len;
        data_len_remain -= data_len;
    }
@ -616,7 +633,42 @@ err:
    return err;
 }

-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+/* The __attribute__((optimize("O0"))) is used to disable optimizations for this function,
+ * preventing the compiler from potentially optimizing data_buffer and reading data directly from src.
+ * This is crucial as we want to read from Flash only once, ensuring the integrity of the data.
+ */
+__attribute__((optimize("O0")))
+static size_t process_esp_app_desc_data(const uint32_t *src, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
+{
+    /* Using data_buffer here helps to securely read secure_version
+     * (for anti-rollback) from esp_app_desc_t, preventing FI attack.
+     * We read data from Flash into this buffer, which is covered by sha256.
+     * Therefore, if the flash is under attackers control and contents are modified
+     * the sha256 comparison will fail.
+     *
+     * The esp_app_desc_t structure is located in DROM and is always in segment #0.
+     *
+     * esp_app_desc_t is always at #0 segment (index==0).
+     * secure_version field of esp_app_desc_t is located at #2 word (w_i==1).
+     */
+    uint32_t data_buffer[2];
+    memcpy(data_buffer, src, sizeof(data_buffer));
+    assert(data_buffer[0] == ESP_APP_DESC_MAGIC_WORD);
+    metadata->secure_version = data_buffer[1];
+    if (checksum != NULL) {
+        *checksum ^= data_buffer[0] ^ data_buffer[1];
+    }
+    if (sha_handle != NULL) {
+        bootloader_sha256_data(sha_handle, data_buffer, sizeof(data_buffer));
+    }
+    ESP_FAULT_ASSERT(memcmp(data_buffer, src, sizeof(data_buffer)) == 0);
+    ESP_FAULT_ASSERT(memcmp(&metadata->secure_version, &src[1], sizeof(uint32_t)) == 0);
+    return sizeof(data_buffer);
+}
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
    // If we are not loading, and the checksum is empty, skip processing this
    // segment for data
@ -649,10 +701,24 @@ static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, ui
 #endif
    }
    uint32_t *dest = (uint32_t *)load_addr;
-#endif
+#endif // BOOTLOADER_BUILD

    const uint32_t *src = data;

+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    // Case I: Bootloader verifying application
+    // Case II: Bootloader verifying bootloader
+    // Anti-rollback check should handle only Case I from above.
+    if (segment == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+        ESP_LOGD(TAG, "additional anti-rollback check 0x%"PRIx32, data_addr);
+        // The esp_app_desc_t structure is located in DROM and is always in segment #0.
+        size_t len = process_esp_app_desc_data(src, sha_handle, checksum, metadata);
+        data_len -= len;
+        src += len / 4;
+        // In BOOTLOADER_BUILD, for DROM (segment #0) we do not load it into dest (only map it), do_load = false.
+    }
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
    for (size_t i = 0; i < data_len; i += 4) {
        int w_i = i / 4; // Word index
        uint32_t w = src[w_i];
@ -932,9 +998,13 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
        return ESP_ERR_IMAGE_INVALID;
    }

-#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
    // Adjust image length result to include the appended signature
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
    data->image_len = end - data->start_addr + sizeof(ets_secure_boot_signature_t);
+#elif defined(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+    if (data->start_addr != ESP_BOOTLOADER_OFFSET) {
+        data->image_len = end - data->start_addr + sizeof(esp_secure_boot_sig_block_t);
+    }
 #endif

 #endif // SECURE_BOOT_CHECK_SIGNATURE
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@ -393,14 +393,21 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
 {
    esp_err_t err;
    bool should_encrypt = (partition->flags & PART_FLAG_ENCRYPTED);
+    uint32_t size = partition->pos.size;

    if (partition->type == PART_TYPE_APP) {
        /* check if the partition holds a valid unencrypted app */
-        esp_image_metadata_t data_ignored;
+        esp_image_metadata_t image_data = {};
        err = esp_image_verify(ESP_IMAGE_VERIFY,
                               &partition->pos,
-                               &data_ignored);
+                               &image_data);
        should_encrypt = (err == ESP_OK);
+#ifdef SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
+        if (should_encrypt) {
+            // Encrypt only the app image instead of encrypting the whole partition
+            size = image_data.image_len;
+        }
+#endif
    } else if ((partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA)
                || (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_NVS_KEYS)) {
        /* check if we have ota data partition and the partition should be encrypted unconditionally */
@ -411,9 +418,9 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
        return ESP_OK;
    } else {
        /* should_encrypt */
-        ESP_LOGI(TAG, "Encrypting partition %d at offset 0x%x (length 0x%x)...", index, partition->pos.offset, partition->pos.size);
+        ESP_LOGI(TAG, "Encrypting partition %d at offset 0x%x (length 0x%x)...", index, partition->pos.offset, size);

-        err = esp_flash_encrypt_region(partition->pos.offset, partition->pos.size);
+        err = esp_flash_encrypt_region(partition->pos.offset, size);
        ESP_LOGI(TAG, "Done encrypting");
        if (err != ESP_OK) {
            ESP_LOGE(TAG, "Failed to encrypt partition %d", index);
--- a/components/bootloader_support/test_apps/.build-test-rules.yml
+++ b/components/bootloader_support/test_apps/.build-test-rules.yml
@ -4,7 +4,3 @@ components/bootloader_support/test_apps/rtc_custom_section:
  enable:
    - if: SOC_RTC_MEM_SUPPORTED == 1
      reason: this feature is supported on chips that have RTC memory
-  disable:
-    - if: IDF_TARGET == "esp32p4"
-      temporary: true
-      reason: this feature on esp32p4 isn't supported yet # TODO: IDF-8069
--- a/components/bootloader_support/test_apps/rtc_custom_section/README.md
+++ b/components/bootloader_support/test_apps/rtc_custom_section/README.md
@ -1,2 +1,2 @@
-| Supported Targets | ESP32 | ESP32-C3 | ESP32-C6 | ESP32-H2 | ESP32-S2 | ESP32-S3 |
-| ----------------- | ----- | -------- | -------- | -------- | -------- | -------- |
+| Supported Targets | ESP32 | ESP32-C3 | ESP32-C6 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- | -------- | -------- | -------- |
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -45,15 +45,17 @@ set(ble_mesh_include_dirs
    "esp_ble_mesh/api/core/include"
    "esp_ble_mesh/api/models/include"
    "esp_ble_mesh/api"
+    "esp_ble_mesh/lib/include"
    "esp_ble_mesh/v1.1/api/core/include"
    "esp_ble_mesh/v1.1/api/models/include"
    "esp_ble_mesh/v1.1/btc/include"
-    "esp_ble_mesh/v1.1/include"
 )

 set(bluedroid_include_dirs host/bluedroid/api/include/api)

+if(CONFIG_BT_CONTROLLER_ENABLED OR CONFIG_IDF_DOC_BUILD)
 set(nimble_hci_include_dirs host/nimble/esp-hci/include)
+endif()

 if(CONFIG_IDF_DOC_BUILD)
    list(APPEND include_dirs
@ -70,31 +72,36 @@ if(CONFIG_BT_ENABLED)
    set(srcs "")
    set(include_dirs "")
    set(ldfragments "linker.lf")
+    if(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_IDF_TARGET_ESP32)
+            list(APPEND srcs "controller/esp32/bt.c"
+                             "controller/esp32/hli_api.c"
+                             "controller/esp32/hli_vectors.S")

-    if(CONFIG_IDF_TARGET_ESP32)
-        list(APPEND srcs "controller/esp32/bt.c"
-                         "controller/esp32/hli_api.c"
-                         "controller/esp32/hli_vectors.S")
+        elseif(CONFIG_IDF_TARGET_ESP32C3)
+            list(APPEND srcs "controller/esp32c3/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32S3)
+            list(APPEND srcs "controller/esp32c3/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C2)
-        set(ldfragments "linker.lf.esp32c2")
-        list(APPEND srcs "controller/esp32c2/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            set(ldfragments "linker.lf.esp32c2")
+            list(APPEND srcs "controller/esp32c2/bt.c")

-    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        list(APPEND srcs "controller/esp32c6/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C6)
+            list(APPEND srcs "controller/esp32c6/bt.c")
+
+        elseif(CONFIG_IDF_TARGET_ESP32H2)
+            list(APPEND srcs "controller/esp32h2/bt.c")
+        endif()
+
+        list(APPEND include_dirs ${target_specific_include_dirs})

-    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        list(APPEND srcs "controller/esp32h2/bt.c")
    endif()

-    list(APPEND include_dirs ${target_specific_include_dirs})
-
    # Common
    list(APPEND include_dirs common/osi/include)

@ -174,6 +181,7 @@ if(CONFIG_BT_ENABLED)

        list(APPEND srcs "host/bluedroid/api/esp_a2dp_api.c"
                   "host/bluedroid/api/esp_avrc_api.c"
+                   "host/bluedroid/api/esp_bluedroid_hci.c"
                   "host/bluedroid/api/esp_bt_device.c"
                   "host/bluedroid/api/esp_bt_main.c"
                   "host/bluedroid/api/esp_gap_ble_api.c"
@ -509,7 +517,6 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/core/rpl.c"
                    "esp_ble_mesh/core/scan.c"
                    "esp_ble_mesh/core/test.c"
-                    "esp_ble_mesh/core/transport.c"
                    "esp_ble_mesh/models/common/device_property.c"
                    "esp_ble_mesh/models/common/model_common.c"
                    "esp_ble_mesh/models/client/client_common.c"
@ -545,7 +552,13 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_rpr_model.c"
                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
-                    "esp_ble_mesh/v1.1/ext.c")
+                    "esp_ble_mesh/lib/ext.c")
+
+        if(CONFIG_BLE_MESH_SAR_ENHANCEMENT)
+            list(APPEND srcs "esp_ble_mesh/core/transport.enh.c")
+        else()
+            list(APPEND srcs "esp_ble_mesh/core/transport.c")
+        endif()
    endif()


@ -556,6 +569,11 @@ if(CONFIG_BT_ENABLED)
                    "porting/nimble/src/os_msys_init.c"
            )

+            if(CONFIG_BT_CONTROLLER_DISABLED)
+                list(APPEND srcs
+                        "host/nimble/nimble/porting/nimble/src/hal_uart.c"
+                    )
+            endif()
            list(APPEND include_dirs
                    porting/include
                    porting/nimble/include
@ -597,6 +615,7 @@ if(CONFIG_BT_ENABLED)
        list(APPEND include_dirs

                    host/nimble/nimble/nimble/host/include
+                    host/nimble/nimble/nimble/include
                    host/nimble/nimble/nimble/host/services/ans/include
                    host/nimble/nimble/nimble/host/services/bas/include
                    host/nimble/nimble/nimble/host/services/dis/include
@ -608,7 +627,10 @@ if(CONFIG_BT_ENABLED)
                    host/nimble/nimble/nimble/host/services/ipss/include
                    host/nimble/nimble/nimble/host/services/lls/include
                    host/nimble/nimble/nimble/host/services/prox/include
+                    host/nimble/nimble/nimble/host/services/cts/include
                    host/nimble/nimble/nimble/host/services/tps/include
+                    host/nimble/nimble/nimble/host/services/hid/include
+                    host/nimble/nimble/nimble/host/services/sps/include
                    host/nimble/nimble/nimble/host/util/include
                    host/nimble/nimble/nimble/host/store/ram/include
                    host/nimble/nimble/nimble/host/store/config/include
@ -628,6 +650,9 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/nimble/host/services/dis/src/ble_svc_dis.c"
                    "host/nimble/nimble/nimble/host/services/lls/src/ble_svc_lls.c"
                    "host/nimble/nimble/nimble/host/services/prox/src/ble_svc_prox.c"
+                    "host/nimble/nimble/nimble/host/services/cts/src/ble_svc_cts.c"
+                    "host/nimble/nimble/nimble/host/services/hid/src/ble_svc_hid.c"
+                    "host/nimble/nimble/nimble/host/services/sps/src/ble_svc_sps.c"
                    "host/nimble/nimble/nimble/host/src/ble_hs_conn.c"
                    "host/nimble/nimble/nimble/host/src/ble_store_util.c"
                    "host/nimble/nimble/nimble/host/src/ble_sm.c"
@ -676,11 +701,21 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/nimble/host/store/ram/src/ble_store_ram.c"
                    "host/nimble/nimble/nimble/host/store/config/src/ble_store_config.c"
                    "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
+                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
+                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
                )

+            if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
+                list(APPEND srcs
+                        "host/nimble/nimble/nimble/transport/uart_ll/src/hci_uart.c"
+                        "host/nimble/nimble/nimble/transport/common/hci_h4/src/hci_h4.c"
+                )
+            endif()
+
            list(APPEND srcs
                "host/nimble/nimble/porting/nimble/src/nimble_port.c"
                "host/nimble/nimble/porting/npl/freertos/src/nimble_port_freertos.c"
+                "host/nimble/port/src/nvs_port.c"
            )
            list(APPEND include_dirs
                porting/include
@ -689,6 +724,12 @@ if(CONFIG_BT_ENABLED)
                host/nimble/nimble/nimble/transport/include
            )

+            if(CONFIG_BT_CONTROLLER_DISABLED)
+                list(APPEND include_dirs
+                    host/nimble/nimble/nimble/transport/common/hci_h4/include
+                )
+            endif()
+
        if(NOT CONFIG_BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT)
            list(APPEND srcs
                    "host/nimble/nimble/porting/nimble/src/endian.c"
@ -698,6 +739,13 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/porting/nimble/src/os_msys_init.c"
                    "host/nimble/nimble/porting/npl/freertos/src/npl_os_freertos.c"
                    )
+
+            if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
+                list(APPEND srcs
+                    "host/nimble/nimble/porting/nimble/src/hal_uart.c"
+                )
+            endif()
+
            list(APPEND include_dirs
                    host/nimble/nimble/porting/npl/freertos/include
                    host/nimble/nimble/porting/nimble/include
@ -705,7 +753,7 @@ if(CONFIG_BT_ENABLED)
            )
        endif()

-        if(CONFIG_BT_NIMBLE_LEGACY_VHCI_ENABLE)
+        if(CONFIG_BT_NIMBLE_LEGACY_VHCI_ENABLE AND CONFIG_BT_CONTROLLER_ENABLED)
            list(APPEND srcs
                "host/nimble/esp-hci/src/esp_nimble_hci.c"
            )
@ -813,20 +861,20 @@ endif()

 if(CONFIG_BLE_MESH)
    if(CONFIG_IDF_TARGET_ESP32)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32s3/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32c3/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32c6/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32h2/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    endif()
 endif()

--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@ -1,9 +1,8 @@
 menu "Bluetooth"
-    visible if SOC_BT_SUPPORTED

    config BT_ENABLED
        bool "Bluetooth"
-        depends on SOC_BT_SUPPORTED && !APP_NO_BLOBS
+        depends on !APP_NO_BLOBS
        help
            Select this option to enable Bluetooth and show the submenu with Bluetooth configuration choices.

@ -26,6 +25,7 @@ menu "Bluetooth"
                This option is recommended for BLE only usecases to save on memory

        config BT_CONTROLLER_ONLY
+            depends on SOC_BT_SUPPORTED
            bool "Disabled"
            help
                This option is recommended when you want to communicate directly with the
@ -42,6 +42,7 @@ menu "Bluetooth"
            This helps to choose Bluetooth controller stack

        config BT_CONTROLLER_ENABLED
+            depends on SOC_BT_SUPPORTED
            bool "Enabled"
            help
                This option is recommended for Bluetooth controller usecases
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -29,6 +29,12 @@
 #define UC_BT_STACK_NO_LOG               FALSE
 #endif

+#ifdef CONFIG_BT_CONTROLLER_ENABLED
+#define UC_BT_CONTROLLER_INCLUDED        TRUE
+#else
+#define UC_BT_CONTROLLER_INCLUDED        FALSE
+#endif
+
 /**********************************************************
 * Thread/Task reference
 **********************************************************/
--- a/components/bt/common/osi/config.c
+++ b/components/bt/common/osi/config.c
@ -264,13 +264,13 @@ bool config_update_newest_section(config_t *config, const char *section)
        return false;
    }
    section_t *first_sec = list_node(first_node);
-    if (!strcmp(first_sec->name, section)) {
+    if (strcmp(first_sec->name, section) == 0) {
        return true;
    }

    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
        section_t *sec = list_node(node);
-        if (!strcmp(sec->name, section)) {
+        if (strcmp(sec->name, section) == 0) {
            list_delete(config->sections, sec);
            list_prepend(config->sections, sec);
            return true;
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@ -356,7 +356,7 @@ config BTDM_SCAN_DUPL_CACHE_SIZE
    default 100
    help
        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
+        When the maximum amount of device in the filter is reached, the oldest device will be refreshed.

 config BTDM_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@ -16,8 +16,8 @@
 #include "freertos/task.h"
 #include "freertos/queue.h"
 #include "freertos/semphr.h"
-#include "freertos/xtensa_api.h"
 #include "freertos/portmacro.h"
+#include "xtensa_api.h" // Replace with interrupt allocator API (IDF-3891)
 #include "xtensa/core-macros.h"
 #include "esp_types.h"
 #include "esp_mac.h"
@ -35,7 +35,7 @@
 #include "soc/rtc.h"
 #include "soc/soc_memory_layout.h"
 #include "soc/dport_reg.h"
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #include "esp_timer.h"
 #if !CONFIG_FREERTOS_UNICORE
 #include "esp_ipc.h"
@ -1197,23 +1197,12 @@ static int coex_register_wifi_channel_change_callback_wrapper(void *cb)
 static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch)
 {
 #if CONFIG_SW_COEXIST_ENABLE
-    const char *ver_str = esp_coex_version_get();
-    if (ver_str != NULL) {
-        unsigned int _major = 0, _minor = 0, _patch = 0;
-        if (sscanf(ver_str, "%u.%u.%u", &_major, &_minor, &_patch) != 3) {
-            return -1;
-        }
-        if (major != NULL) {
-            *major = _major;
-        }
-        if (minor != NULL) {
-            *minor = _minor;
-        }
-        if (patch != NULL) {
-            *patch = _patch;
-        }
-        return 0;
-    }
+    coex_version_t version;
+    ESP_ERROR_CHECK(coex_version_get_value(&version));
+    *major = (unsigned int)version.major;
+    *minor = (unsigned int)version.minor;
+    *patch = (unsigned int)version.patch;
+    return 0;
 #endif
    return -1;
 }
--- a/components/bt/controller/esp32/hli_vectors.S
+++ b/components/bt/controller/esp32/hli_vectors.S
@ -8,7 +8,7 @@
 #include <xtensa/coreasm.h>
 #include <xtensa/corebits.h>
 #include <xtensa/config/system.h>
-#include "freertos/xtensa_context.h"
+#include "xtensa_context.h"
 #include "sdkconfig.h"
 #include "soc/soc.h"

--- a/components/bt/controller/esp32c2/Kconfig.in
+++ b/components/bt/controller/esp32c2/Kconfig.in
@ -253,7 +253,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -264,21 +264,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@ -24,7 +24,7 @@
 #endif

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif

 #include "nimble/nimble_npl_os.h"
@ -78,7 +78,6 @@
 #define ACL_DATA_MBUF_LEADINGSPCAE    4
 #endif // CONFIG_BT_BLUEDROID_ENABLED

-
 /* Types definition
 ************************************************************************
 */
@ -127,6 +126,7 @@ extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
 extern int ble_log_deinit_async(void);
 extern void ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@ -201,7 +201,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {2048, 1024, 1024};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

 /* This variable tells if BLE is running */
@ -644,6 +644,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    coex_init();
 #endif

+    ret = ble_controller_init(cfg);
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
+        goto modem_deint;
+    }
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    interface_func_t bt_controller_log_interface;
    bt_controller_log_interface = esp_bt_controller_log_interface;
@ -661,16 +667,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #endif // CONFIG_BT_CONTROLLER_LOG_DUMP
    if (ret != ESP_OK) {
        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
-        goto modem_deint;
+        goto controller_init_err;
    }
 #endif // CONFIG_BT_CONTROLLER_LOG_ENABLED

-    ret = ble_controller_init(cfg);
-    if (ret != ESP_OK) {
-        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
-        goto modem_deint;
-    }
-
    ret = controller_sleep_init();
    if (ret != ESP_OK) {
        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "controller_sleep_init failed %d", ret);
@ -691,11 +691,12 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    return ESP_OK;
 free_controller:
    controller_sleep_deinit();
-    ble_controller_deinit();
-modem_deint:
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+controller_init_err:
    ble_log_deinit_async();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+    ble_controller_deinit();
+modem_deint:
    esp_phy_modem_deinit();
    periph_module_disable(PERIPH_BT_MODULE);
 #if CONFIG_BT_NIMBLE_ENABLED
@ -1003,7 +1004,7 @@ uint8_t esp_ble_get_chip_rev_version(void)
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
@ -1012,23 +1013,22 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b

 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;

    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
    BT_ASSERT_PRINT("\r\n[DUMP_START:");
    ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
    portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

-#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)
-
+#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+#if CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #define BLE_SM_KEY_ERR 0x17
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 #include "mbedtls/aes.h"
-
 #if CONFIG_BT_LE_SM_SC
 #include "mbedtls/cipher.h"
 #include "mbedtls/entropy.h"
@ -1036,7 +1036,9 @@ void esp_ble_controller_log_dump_all(bool output)
 #include "mbedtls/cmac.h"
 #include "mbedtls/ecdh.h"
 #include "mbedtls/ecp.h"
-#endif
+
+static mbedtls_ecp_keypair keypair;
+#endif // CONFIG_BT_LE_SM_SC

 #else
 #include "tinycrypt/aes.h"
@ -1046,15 +1048,15 @@ void esp_ble_controller_log_dump_all(bool output)
 #if CONFIG_BT_LE_SM_SC
 #include "tinycrypt/cmac_mode.h"
 #include "tinycrypt/ecc_dh.h"
-#endif
+#endif // CONFIG_BT_LE_SM_SC
+#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

-#endif
-
-#if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
-#if CONFIG_BT_LE_SM_SC
-static mbedtls_ecp_keypair keypair;
-#endif
-#endif
+/* Based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
+static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
+    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
+    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
+    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
+};

 int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                         const uint8_t *our_priv_key, uint8_t *out_dhkey)
@ -1101,8 +1103,7 @@ int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_
    }

    /* Set PRNG */
-    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
-                                    NULL, 0)) != 0) {
+    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0)) != 0) {
        goto exit;
    }

@ -1146,19 +1147,12 @@ exit:
    if (rc == TC_CRYPTO_FAIL) {
        return BLE_SM_KEY_ERR;
    }
-#endif
+#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

    swap_buf(out_dhkey, dh, 32);
    return 0;
 }

-/* based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
-static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
-    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
-    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
-    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
-};
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 static int mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
 {
@ -1204,7 +1198,7 @@ exit:

    return 0;
 }
-#endif
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

 /**
 * pub: 64 bytes
@ -1220,7 +1214,6 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
    uint8_t pk[64];

    do {
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
        if (mbedtls_gen_keypair(pk, priv) != 0) {
            return BLE_SM_KEY_ERR;
@ -1229,17 +1222,17 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
        if (uECC_make_key(pk, priv, &curve_secp256r1) != TC_CRYPTO_SUCCESS) {
            return BLE_SM_KEY_ERR;
        }
-#endif
-
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
        /* Make sure generated key isn't debug key. */
    } while (memcmp(priv, ble_sm_alg_dbg_priv_key, 32) == 0);

    swap_buf(pub, pk, 32);
    swap_buf(&pub[32], &pk[32], 32);
    swap_in_place(priv, 32);
-#endif
-
+#endif // CONFIG_BT_LE_SM_SC_DEBUG_KEYS
    return 0;
 }

-#endif
+#endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
+#endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
--- a/components/bt/controller/esp32c2/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c2/esp_bt_cfg.h
@ -40,6 +40,11 @@ extern "C" {
    #define DEFAULT_BT_NIMBLE_WHITELIST_SIZE MYNEWT_VAL(BLE_LL_WHITELIST_SIZE)
    #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
    #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif

 #else

@ -114,6 +119,11 @@ extern "C" {
    #else
        #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT (8)
    #endif
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif

 #endif

--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@ -467,3 +467,11 @@ config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
        Disable active scan backoff. The bluetooth spec requires that scanners should run a backoff procedure to
        minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
        scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
+
+config BT_BLE_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero"
+    default n
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -34,7 +34,7 @@
 #include "soc/rtc.h"
 #include "soc/rtc_cntl_reg.h"
 #include "soc/soc_memory_layout.h"
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #include "esp_timer.h"
 #include "esp_sleep.h"
 #include "esp_rom_sys.h"
@ -43,8 +43,6 @@
 #include "riscv/interrupt.h"
 #include "esp32c3/rom/rom_layout.h"
 #else //CONFIG_IDF_TARGET_ESP32S3
-#include "freertos/xtensa_api.h"
-#include "xtensa/core-macros.h"
 #include "esp32s3/rom/rom_layout.h"
 #endif
 #if CONFIG_BT_ENABLED
@ -654,7 +652,7 @@ static bool IRAM_ATTR is_in_isr_wrapper(void)

 static void *malloc_internal_wrapper(size_t size)
 {
-    void *p = heap_caps_malloc(size, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA);
+    void *p = heap_caps_malloc(size, MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA);
    if(p == NULL) {
        ESP_LOGE(BT_LOG_TAG, "Malloc failed");
    }
@ -723,19 +721,26 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
        return;
    }

-    // start a timer to wake up and acquire the pm_lock before modem_sleep awakes
    uint32_t us_to_sleep = btdm_lpcycles_2_hus(lpcycles, NULL) >> 1;

 #define BTDM_MIN_TIMER_UNCERTAINTY_US      (1800)
+#define BTDM_RTC_SLOW_CLK_RC_DRIFT_PERCENT 7
    assert(us_to_sleep > BTDM_MIN_TIMER_UNCERTAINTY_US);
    // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
    // and set the timer in advance
    uint32_t uncertainty = (us_to_sleep >> 11);
+#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+    if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
+        uncertainty = us_to_sleep * BTDM_RTC_SLOW_CLK_RC_DRIFT_PERCENT / 100;
+    }
+#endif
+
    if (uncertainty < BTDM_MIN_TIMER_UNCERTAINTY_US) {
        uncertainty = BTDM_MIN_TIMER_UNCERTAINTY_US;
    }

    assert (s_lp_stat.wakeup_timer_started == 0);
+    // start a timer to wake up and acquire the pm_lock before modem_sleep awakes
    if (esp_timer_start_once(s_btdm_slp_tmr, us_to_sleep - uncertainty) == ESP_OK) {
        s_lp_stat.wakeup_timer_started = 1;
    } else {
@ -754,12 +759,12 @@ static void btdm_sleep_enter_phase2_wrapper(void)
            assert(0);
        }

-        if (s_lp_stat.pm_lock_released == 0) {
 #ifdef CONFIG_PM_ENABLE
+        if (s_lp_stat.pm_lock_released == 0) {
            esp_pm_lock_release(s_pm_lock);
-#endif
            s_lp_stat.pm_lock_released = 1;
        }
+#endif
    }
 }

@ -1155,18 +1160,6 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

    btdm_controller_mem_init();

-#if CONFIG_MAC_BB_PD
-    if (esp_register_mac_bb_pd_callback(btdm_mac_bb_power_down_cb) != 0) {
-        err = ESP_ERR_INVALID_ARG;
-        goto error;
-    }
-
-    if (esp_register_mac_bb_pu_callback(btdm_mac_bb_power_up_cb) != 0) {
-        err = ESP_ERR_INVALID_ARG;
-        goto error;
-    }
-#endif
-
    osi_funcs_p = (struct osi_funcs_t *)malloc_internal_wrapper(sizeof(struct osi_funcs_t));
    if (osi_funcs_p == NULL) {
        return ESP_ERR_NO_MEM;
@ -1407,11 +1400,6 @@ static void bt_controller_deinit_internal(void)
        btdm_lpcycle_us = 0;
    } while (0);

-#if CONFIG_MAC_BB_PD
-    esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
-    esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
-#endif
-
    esp_bt_power_domain_off();
 #if CONFIG_MAC_BB_PD
    esp_mac_bb_pd_mem_deinit();
@ -1460,6 +1448,18 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
        s_lp_stat.pm_lock_released = 0;
 #endif

+#if CONFIG_MAC_BB_PD
+        if (esp_register_mac_bb_pd_callback(btdm_mac_bb_power_down_cb) != 0) {
+            ret = ESP_ERR_INVALID_ARG;
+            goto error;
+        }
+
+        if (esp_register_mac_bb_pu_callback(btdm_mac_bb_power_up_cb) != 0) {
+            ret = ESP_ERR_INVALID_ARG;
+            goto error;
+        }
+#endif
+
        if (s_lp_cntl.enable) {
            btdm_controller_enable_sleep(true);
        }
@ -1482,6 +1482,11 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 error:
    // disable low power mode
    do {
+#if CONFIG_MAC_BB_PD
+        esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
+        esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
+#endif
+
        btdm_controller_enable_sleep(false);
 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
@ -1528,6 +1533,11 @@ esp_err_t esp_bt_controller_disable(void)

    // disable low power mode
    do {
+#if CONFIG_MAC_BB_PD
+        esp_unregister_mac_bb_pd_callback(btdm_mac_bb_power_down_cb);
+        esp_unregister_mac_bb_pu_callback(btdm_mac_bb_power_up_cb);
+#endif
+
 #ifdef CONFIG_PM_ENABLE
        if (s_lp_cntl.no_light_sleep) {
            esp_pm_lock_release(s_light_sleep_pm_lock);
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@ -212,6 +212,15 @@ menu "Memory Settings"
        help
            Dynamic memory size of block 2

+    config BT_LE_MSYS_BUF_FROM_HEAP
+        bool "Get Msys Mbuf from heap"
+        default y
+        depends on BT_LE_MSYS_INIT_IN_CONTROLLER
+        help
+            This option sets the source of the shared msys mbuf memory between
+            the Host and the Controller. Allocate the memory from the heap if
+            this option is sets, from the mempool otherwise.
+
    config BT_LE_ACL_BUF_COUNT
        int "ACL Buffer count"
        default 10
@ -260,7 +269,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -271,21 +280,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
@ -352,7 +382,7 @@ config BT_LE_WHITELIST_SIZE

 config BT_LE_LL_DUP_SCAN_LIST_COUNT
    int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
    default 20
    help
        config the max count of duplicate scan list
@ -513,15 +543,6 @@ config BT_LE_SCAN_DUPL_TYPE
    default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
    default 0

-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
    depends on BT_LE_SCAN_DUPL
@ -539,5 +560,5 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
        again.

 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
    default y
--- a/components/bt/controller/esp32c6/bt.c
+++ b/components/bt/controller/esp32c6/bt.c
@ -24,7 +24,7 @@
 #endif // ESP_PLATFORM

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif // CONFIG_SW_COEXIST_ENABLE

 #include "nimble/nimble_npl_os.h"
@ -123,10 +123,11 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
-extern int ble_log_deinit_async(void);
-extern void ble_log_async_select_dump_buffers(uint8_t buffers);
-extern void ble_log_async_output_dump_all(bool output);
+extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_deinit_async(void);
+extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
+extern void r_ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@ -139,8 +140,8 @@ extern void esp_unregister_npl_funcs (void);
 extern void npl_freertos_mempool_deinit(void);
 extern uint32_t r_os_cputime_get32(void);
 extern uint32_t r_os_cputime_ticks_to_usecs(uint32_t ticks);
-extern void ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
-                                        void *w_arg, uint32_t us_to_enabled);
+extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
+                                          void *w_arg, uint32_t us_to_enabled);
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
@ -156,6 +157,7 @@ extern int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv);
 extern int ble_txpwr_set(esp_ble_enhanced_power_type_t power_type, uint16_t handle, int power_level);
 extern int ble_txpwr_get(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 extern int ble_get_npl_element_info(esp_bt_controller_config_t *cfg, ble_npl_count_info_t * npl_info);
+extern char *ble_controller_get_compile_version(void);
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _bt_controller_bss_start;
@ -202,7 +204,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {6144, 1024, 2048};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

 /* This variable tells if BLE is running */
@ -488,9 +490,6 @@ IRAM_ATTR void controller_sleep_cb(uint32_t enable_tick, void *arg)
    }
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
    r_ble_rtc_wake_up_state_clr();
-#if SOC_PM_RETENTION_HAS_CLOCK_BUG
-    sleep_retention_do_extra_retention(true);
-#endif // SOC_PM_RETENTION_HAS_CLOCK_BUG
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
    esp_phy_disable(PHY_MODEM_BT);
 #ifdef CONFIG_PM_ENABLE
@ -507,9 +506,6 @@ IRAM_ATTR void controller_wakeup_cb(void *arg)
 #ifdef CONFIG_PM_ENABLE
    esp_pm_lock_acquire(s_pm_lock);
    r_ble_rtc_wake_up_state_clr();
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE && SOC_PM_RETENTION_HAS_CLOCK_BUG
-    sleep_retention_do_extra_retention(false);
-#endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE && SOC_PM_RETENTION_HAS_CLOCK_BUG */
 #endif //CONFIG_PM_ENABLE
    esp_phy_enable(PHY_MODEM_BT);
    s_ble_active = true;
@ -546,10 +542,10 @@ esp_err_t controller_sleep_init(void)
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
    ESP_LOGW(NIMBLE_PORT_LOG_TAG, "BLE modem sleep is enabled");
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-    ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
+    r_ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
                                BLE_RTC_DELAY_US_LIGHT_SLEEP);
 #else
-    ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
+    r_ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
                                BLE_RTC_DELAY_US_MODEM_SLEEP);
 #endif /* FREERTOS_USE_TICKLESS_IDLE */
 #endif // CONFIG_BT_LE_SLEEP_ENABLE
@ -570,12 +566,21 @@ esp_err_t controller_sleep_init(void)
    if (rc != ESP_OK) {
        goto error;
    }
+
+#if SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
+    sleep_modem_register_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
+                                                   sleep_modem_mac_bb_power_up_prepare);
+#endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
    return rc;

 error:

 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
+    sleep_modem_unregister_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
+                                                     sleep_modem_mac_bb_power_up_prepare);
+#endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
    esp_sleep_disable_bt_wakeup();
    esp_pm_unregister_inform_out_light_sleep_overhead_callback(sleep_modem_light_sleep_overhead_set);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
@ -592,6 +597,10 @@ error:
 void controller_sleep_deinit(void)
 {
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
+#if SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
+    sleep_modem_unregister_mac_bb_module_prepare_callback(sleep_modem_mac_bb_power_down_prepare,
+                                                     sleep_modem_mac_bb_power_up_prepare);
+#endif // SOC_PM_RETENTION_HAS_CLOCK_BUG && CONFIG_MAC_BB_PD
    r_ble_rtc_wake_up_state_clr();
    esp_sleep_disable_bt_wakeup();
    sleep_modem_ble_mac_modem_state_deinit();
@ -616,16 +625,16 @@ typedef enum {
 }disc_duplicate_mode_t;


-extern void filter_duplicate_mode_enable(disc_duplicate_mode_t mode);
-extern void filter_duplicate_mode_disable(disc_duplicate_mode_t mode);
-extern void filter_duplicate_set_ring_list_max_num(uint32_t max_num);
-extern void scan_duplicate_cache_refresh_set_time(uint32_t period_time);
+extern void r_filter_duplicate_mode_enable(disc_duplicate_mode_t mode);
+extern void r_filter_duplicate_mode_disable(disc_duplicate_mode_t mode);
+extern void r_filter_duplicate_set_ring_list_max_num(uint32_t max_num);
+extern void r_scan_duplicate_cache_refresh_set_time(uint32_t period_time);

 int
 ble_vhci_disc_duplicate_mode_enable(int mode)
 {
    // TODO: use vendor hci to update
-    filter_duplicate_mode_enable(mode);
+    r_filter_duplicate_mode_enable(mode);
    return true;
 }

@ -633,19 +642,19 @@ int
 ble_vhci_disc_duplicate_mode_disable(int mode)
 {
    // TODO: use vendor hci to update
-    filter_duplicate_mode_disable(mode);
+    r_filter_duplicate_mode_disable(mode);
    return true;
 }

 int ble_vhci_disc_duplicate_set_max_cache_size(int max_cache_size){
    // TODO: use vendor hci to update
-    filter_duplicate_set_ring_list_max_num(max_cache_size);
+    r_filter_duplicate_set_ring_list_max_num(max_cache_size);
    return true;
 }

 int ble_vhci_disc_duplicate_set_period_refresh_time(int refresh_period_time){
    // TODO: use vendor hci to update
-    scan_duplicate_cache_refresh_set_time(refresh_period_time);
+    r_scan_duplicate_cache_refresh_set_time(refresh_period_time);
    return true;
 }

@ -657,7 +666,7 @@ void ble_controller_scan_duplicate_config(void)
    uint32_t duplicate_mode = FILTER_DUPLICATE_DEFAULT;
    uint32_t cache_size = 100;
 #if CONFIG_BT_LE_SCAN_DUPL == true
-    cache_size = CONFIG_BT_LE_SCAN_DUPL_CACHE_SIZE;
+    cache_size = CONFIG_BT_LE_LL_DUP_SCAN_LIST_COUNT;
    if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 0) {
        duplicate_mode = FILTER_DUPLICATE_ADDRESS | FILTER_DUPLICATE_PDUTYPE;
    } else if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 1) {
@ -771,6 +780,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    coex_init();
 #endif // CONFIG_SW_COEXIST_ENABLE

+    ret = ble_controller_init(cfg);
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
+        goto modem_deint;
+    }
+
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    interface_func_t bt_controller_log_interface;
    bt_controller_log_interface = esp_bt_controller_log_interface;
@ -782,22 +798,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    ret = ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
+    ret = r_ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
 #else
-    ret = ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
+    ret = r_ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
 #endif // CONFIG_BT_CONTROLLER_LOG_DUMP
    if (ret != ESP_OK) {
        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
-        goto modem_deint;
+        goto controller_init_err;
    }
 #endif // CONFIG_BT_CONTROLLER_LOG_ENABLED

-    ret = ble_controller_init(cfg);
-    if (ret != ESP_OK) {
-        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
-        goto modem_deint;
-    }
-
    esp_ble_change_rtc_freq(slow_clk_freq);

    ble_controller_scan_duplicate_config();
@ -825,12 +835,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

 free_controller:
    controller_sleep_deinit();
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+controller_init_err:
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    os_msys_deinit();
    ble_controller_deinit();
 modem_deint:
-#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    esp_phy_modem_deinit();
    modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
    modem_clock_module_disable(PERIPH_BT_MODULE);
@ -862,7 +873,7 @@ esp_err_t esp_bt_controller_deinit(void)
    modem_clock_module_disable(PERIPH_BT_MODULE);

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ble_log_deinit_async();
+    r_ble_log_deinit_async();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    ble_controller_deinit();

@ -902,9 +913,9 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
        esp_pm_lock_acquire(s_pm_lock);
 #endif  // CONFIG_PM_ENABLE
        esp_phy_enable(PHY_MODEM_BT);
-        esp_btbb_enable();
        s_ble_active = true;
    }
+    esp_btbb_enable();
 #if CONFIG_SW_COEXIST_ENABLE
    coex_enable();
 #endif // CONFIG_SW_COEXIST_ENABLE
@ -920,8 +931,8 @@ error:
 #if CONFIG_SW_COEXIST_ENABLE
    coex_disable();
 #endif
+    esp_btbb_disable();
    if (s_ble_active) {
-        esp_btbb_disable();
        esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
        esp_pm_lock_release(s_pm_lock);
@ -943,18 +954,13 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
    coex_disable();
 #endif
+    esp_btbb_disable();
    if (s_ble_active) {
-        esp_btbb_disable();
        esp_phy_disable(PHY_MODEM_BT);
 #if CONFIG_PM_ENABLE
        esp_pm_lock_release(s_pm_lock);
 #endif  // CONFIG_PM_ENABLE
        s_ble_active = false;
-    } else {
-#if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-        /* Avoid consecutive backup of register cause assertion */
-        sleep_retention_module_deinit();
-#endif // CONFIG_FREERTOS_USE_TICKLESS_IDLE
    }
    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
    return ESP_OK;
@ -1173,7 +1179,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
@ -1182,20 +1188,20 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b

 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;

    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
    BT_ASSERT_PRINT("\r\n[DUMP_START:");
-    ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    r_ble_log_async_output_dump_all(output);
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
    portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

-
-#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)
+#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+#if CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #define BLE_SM_KEY_ERR 0x17
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 #include "mbedtls/aes.h"
 #if CONFIG_BT_LE_SM_SC
@ -1205,22 +1211,27 @@ void esp_ble_controller_log_dump_all(bool output)
 #include "mbedtls/cmac.h"
 #include "mbedtls/ecdh.h"
 #include "mbedtls/ecp.h"
+
+static mbedtls_ecp_keypair keypair;
 #endif // CONFIG_BT_LE_SM_SC
+
 #else
 #include "tinycrypt/aes.h"
 #include "tinycrypt/constants.h"
 #include "tinycrypt/utils.h"
+
 #if CONFIG_BT_LE_SM_SC
 #include "tinycrypt/cmac_mode.h"
 #include "tinycrypt/ecc_dh.h"
 #endif // CONFIG_BT_LE_SM_SC
 #endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

-#if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
-#if CONFIG_BT_LE_SM_SC
-static mbedtls_ecp_keypair keypair;
-#endif // CONFIG_BT_LE_SM_SC
-#endif// CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+/* Based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
+static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
+    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
+    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
+    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
+};

 int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                         const uint8_t *our_priv_key, uint8_t *out_dhkey)
@ -1267,8 +1278,7 @@ int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_
    }

    /* Set PRNG */
-    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
-                                    NULL, 0)) != 0) {
+    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0)) != 0) {
        goto exit;
    }

@ -1318,19 +1328,10 @@ exit:
    return 0;
 }

-/* based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
-static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
-    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
-    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
-    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
-};
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 static int mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
 {
    int rc = BLE_SM_KEY_ERR;
-    size_t olen = 0;
-    uint8_t pub[65] = {0};
    mbedtls_entropy_context entropy = {0};
    mbedtls_ctr_drbg_context ctr_drbg = {0};

@ -1352,11 +1353,11 @@ static int mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
        goto exit;
    }

+    size_t olen = 0;
+    uint8_t pub[65] = {0};

-    if ((rc = mbedtls_ecp_point_write_binary(&keypair.MBEDTLS_PRIVATE(grp),
-                                             &keypair.MBEDTLS_PRIVATE(Q),
-                                             MBEDTLS_ECP_PF_UNCOMPRESSED,
-                                             &olen, pub, 65)) != 0) {
+    if ((rc = mbedtls_ecp_point_write_binary(&keypair.MBEDTLS_PRIVATE(grp), &keypair.MBEDTLS_PRIVATE(Q), MBEDTLS_ECP_PF_UNCOMPRESSED,
+              &olen, pub, 65)) != 0) {
        goto exit;
    }

@ -1372,7 +1373,7 @@ exit:

    return 0;
 }
-#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

 /**
 * pub: 64 bytes
@ -1396,7 +1397,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
        if (uECC_make_key(pk, priv, &curve_secp256r1) != TC_CRYPTO_SUCCESS) {
            return BLE_SM_KEY_ERR;
        }
-#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
        /* Make sure generated key isn't debug key. */
    } while (memcmp(priv, ble_sm_alg_dbg_priv_key, 32) == 0);

@ -1404,7 +1405,9 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
    swap_buf(&pub[32], &pk[32], 32);
    swap_in_place(priv, 32);
 #endif // CONFIG_BT_LE_SM_SC_DEBUG_KEYS
-
    return 0;
 }
-#endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)
+
+#endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
+#endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@ -40,6 +40,11 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
    #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
    #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #else

    #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@ -119,6 +124,11 @@ extern "C" {
    #else
        #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED (0)
    #endif
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #endif

 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
--- a/components/bt/controller/esp32h2/Kconfig.in
+++ b/components/bt/controller/esp32h2/Kconfig.in
@ -260,7 +260,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -271,21 +271,42 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
@ -352,7 +373,7 @@ config BT_LE_WHITELIST_SIZE

 config BT_LE_LL_DUP_SCAN_LIST_COUNT
    int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
    default 20
    help
        config the max count of duplicate scan list
@ -514,16 +535,6 @@ config BT_LE_SCAN_DUPL_TYPE
    default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
    default 0

-
-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
    depends on BT_LE_SCAN_DUPL
--- a/components/bt/controller/esp32h2/bt.c
+++ b/components/bt/controller/esp32h2/bt.c
@ -24,7 +24,7 @@
 #endif // ESP_PLATFORM

 #if CONFIG_SW_COEXIST_ENABLE
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #endif // CONFIG_SW_COEXIST_ENABLE

 #include "nimble/nimble_npl_os.h"
@ -117,10 +117,11 @@ typedef void (*interface_func_t) (uint32_t len, const uint8_t*addr, bool end);
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int ble_controller_init(esp_bt_controller_config_t *cfg);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-extern int ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
-extern int ble_log_deinit_async(void);
-extern void ble_log_async_select_dump_buffers(uint8_t buffers);
-extern void ble_log_async_output_dump_all(bool output);
+extern int r_ble_log_init_async(interface_func_t bt_controller_log_interface, bool task_create, uint8_t buffers, uint32_t *bufs_size);
+extern int r_ble_log_deinit_async(void);
+extern void r_ble_log_async_select_dump_buffers(uint8_t buffers);
+extern void r_ble_log_async_output_dump_all(bool output);
+extern void esp_panic_handler_reconfigure_wdts(uint32_t timeout_ms);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
@ -138,8 +139,8 @@ extern const sleep_retention_entries_config_t *esp_ble_mac_retention_link_get(ui
 extern void esp_ble_set_wakeup_overhead(uint32_t overhead);
 #endif /* CONFIG_FREERTOS_USE_TICKLESS_IDLE */
 extern void esp_ble_change_rtc_freq(uint32_t freq);
-extern void ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
-                                        void *w_arg, uint32_t us_to_enabled);
+extern void r_ble_lll_rfmgmt_set_sleep_cb(void *s_cb, void *w_cb, void *s_arg,
+                                          void *w_arg, uint32_t us_to_enabled);
 extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
@ -150,6 +151,7 @@ extern int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv);
 extern int ble_txpwr_set(esp_ble_enhanced_power_type_t power_type, uint16_t handle, int power_level);
 extern int ble_txpwr_get(esp_ble_enhanced_power_type_t power_type, uint16_t handle);
 extern int ble_get_npl_element_info(esp_bt_controller_config_t *cfg, ble_npl_count_info_t * npl_info);
+extern char *ble_controller_get_compile_version(void);
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _bt_controller_bss_start;
@ -196,7 +198,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 static DRAM_ATTR esp_bt_controller_status_t ble_controller_status = ESP_BT_CONTROLLER_STATUS_IDLE;

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-const static uint32_t log_bufs_size[] = {6144, 1024, 2048};
+const static uint32_t log_bufs_size[] = {CONFIG_BT_LE_LOG_CTRL_BUF1_SIZE, CONFIG_BT_LE_LOG_HCI_BUF_SIZE, CONFIG_BT_LE_LOG_CTRL_BUF2_SIZE};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

 /* This variable tells if BLE is running */
@ -528,10 +530,10 @@ esp_err_t controller_sleep_init(void)
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
    ESP_LOGW(NIMBLE_PORT_LOG_TAG, "BLE modem sleep is enabled");
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
-    ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
+    r_ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
                                BLE_RTC_DELAY_US_LIGHT_SLEEP);
 #else
-    ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
+    r_ble_lll_rfmgmt_set_sleep_cb(controller_sleep_cb, controller_wakeup_cb, 0, 0,
                                BLE_RTC_DELAY_US_MODEM_SLEEP);
 #endif /* FREERTOS_USE_TICKLESS_IDLE */
 #endif // CONFIG_BT_LE_SLEEP_ENABLE
@ -598,16 +600,16 @@ typedef enum {
 }disc_duplicate_mode_t;


-extern void filter_duplicate_mode_enable(disc_duplicate_mode_t mode);
-extern void filter_duplicate_mode_disable(disc_duplicate_mode_t mode);
-extern void filter_duplicate_set_ring_list_max_num(uint32_t max_num);
-extern void scan_duplicate_cache_refresh_set_time(uint32_t period_time);
+extern void r_filter_duplicate_mode_enable(disc_duplicate_mode_t mode);
+extern void r_filter_duplicate_mode_disable(disc_duplicate_mode_t mode);
+extern void r_filter_duplicate_set_ring_list_max_num(uint32_t max_num);
+extern void r_scan_duplicate_cache_refresh_set_time(uint32_t period_time);

 int
 ble_vhci_disc_duplicate_mode_enable(int mode)
 {
    // TODO: use vendor hci to update
-    filter_duplicate_mode_enable(mode);
+    r_filter_duplicate_mode_enable(mode);
    return true;
 }

@ -615,19 +617,19 @@ int
 ble_vhci_disc_duplicate_mode_disable(int mode)
 {
    // TODO: use vendor hci to update
-    filter_duplicate_mode_disable(mode);
+    r_filter_duplicate_mode_disable(mode);
    return true;
 }

 int ble_vhci_disc_duplicate_set_max_cache_size(int max_cache_size){
    // TODO: use vendor hci to update
-    filter_duplicate_set_ring_list_max_num(max_cache_size);
+    r_filter_duplicate_set_ring_list_max_num(max_cache_size);
    return true;
 }

 int ble_vhci_disc_duplicate_set_period_refresh_time(int refresh_period_time){
    // TODO: use vendor hci to update
-    scan_duplicate_cache_refresh_set_time(refresh_period_time);
+    r_scan_duplicate_cache_refresh_set_time(refresh_period_time);
    return true;
 }

@ -639,7 +641,7 @@ void ble_controller_scan_duplicate_config(void)
    uint32_t duplicate_mode = FILTER_DUPLICATE_DEFAULT;
    uint32_t cache_size = 100;
 #if CONFIG_BT_LE_SCAN_DUPL == true
-    cache_size = CONFIG_BT_LE_SCAN_DUPL_CACHE_SIZE;
+    cache_size = CONFIG_BT_LE_LL_DUP_SCAN_LIST_COUNT;
    if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 0) {
        duplicate_mode = FILTER_DUPLICATE_ADDRESS | FILTER_DUPLICATE_PDUTYPE;
    } else if (CONFIG_BT_LE_SCAN_DUPL_TYPE == 1) {
@ -751,6 +753,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    coex_init();
 #endif // CONFIG_SW_COEXIST_ENABLE

+    ret = ble_controller_init(cfg);
+    if (ret != ESP_OK) {
+        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
+        goto modem_deint;
+    }
+
+    ESP_LOGI(NIMBLE_PORT_LOG_TAG, "ble controller commit:[%s]", ble_controller_get_compile_version());
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    interface_func_t bt_controller_log_interface;
    bt_controller_log_interface = esp_bt_controller_log_interface;
@ -762,22 +771,16 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    buffers |= ESP_BLE_LOG_BUF_HCI;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    ret = ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
+    ret = r_ble_log_init_async(bt_controller_log_interface, false, buffers, (uint32_t *)log_bufs_size);
 #else
-    ret = ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
+    ret = r_ble_log_init_async(bt_controller_log_interface, true, buffers, (uint32_t *)log_bufs_size);
 #endif // CONFIG_BT_CONTROLLER_LOG_DUMP
    if (ret != ESP_OK) {
        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_log_init failed %d", ret);
-        goto modem_deint;
+        goto controller_init_err;
    }
 #endif // CONFIG_BT_CONTROLLER_LOG_ENABLED

-    ret = ble_controller_init(cfg);
-    if (ret != ESP_OK) {
-        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "ble_controller_init failed %d", ret);
-        goto modem_deint;
-    }
-
    esp_ble_change_rtc_freq(slow_clk_freq);

    ble_controller_scan_duplicate_config();
@ -806,12 +809,13 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

 free_controller:
    controller_sleep_deinit();
+#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
+controller_init_err:
+    r_ble_log_deinit_async();
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    os_msys_deinit();
    ble_controller_deinit();
 modem_deint:
-#if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    modem_clock_deselect_lp_clock_source(PERIPH_BT_MODULE);
    modem_clock_module_disable(PERIPH_BT_MODULE);
 #if CONFIG_BT_NIMBLE_ENABLED
@ -841,7 +845,7 @@ esp_err_t esp_bt_controller_deinit(void)
    modem_clock_module_disable(PERIPH_BT_MODULE);

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-    ble_log_deinit_async();
+    r_ble_log_deinit_async();
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
    ble_controller_deinit();

@ -1147,7 +1151,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
    }
    if (end) {
        esp_rom_printf("\n");
@ -1156,20 +1160,20 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b

 void esp_ble_controller_log_dump_all(bool output)
 {
-    portMUX_TYPE spinlock;
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;

    portENTER_CRITICAL_SAFE(&spinlock);
+    esp_panic_handler_reconfigure_wdts(5000);
    BT_ASSERT_PRINT("\r\n[DUMP_START:");
-    ble_log_async_output_dump_all(output);
-    BT_ASSERT_PRINT("]\r\n");
+    r_ble_log_async_output_dump_all(output);
+    BT_ASSERT_PRINT(":DUMP_END]\r\n");
    portEXIT_CRITICAL_SAFE(&spinlock);
 }
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

-
-#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)
+#if (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+#if CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #define BLE_SM_KEY_ERR 0x17
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 #include "mbedtls/aes.h"
 #if CONFIG_BT_LE_SM_SC
@ -1179,22 +1183,27 @@ void esp_ble_controller_log_dump_all(bool output)
 #include "mbedtls/cmac.h"
 #include "mbedtls/ecdh.h"
 #include "mbedtls/ecp.h"
+
+static mbedtls_ecp_keypair keypair;
 #endif // CONFIG_BT_LE_SM_SC
+
 #else
 #include "tinycrypt/aes.h"
 #include "tinycrypt/constants.h"
 #include "tinycrypt/utils.h"
+
 #if CONFIG_BT_LE_SM_SC
 #include "tinycrypt/cmac_mode.h"
 #include "tinycrypt/ecc_dh.h"
 #endif // CONFIG_BT_LE_SM_SC
 #endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

-#if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
-#if CONFIG_BT_LE_SM_SC
-static mbedtls_ecp_keypair keypair;
-#endif // CONFIG_BT_LE_SM_SC
-#endif// CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+/* Based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
+static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
+    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
+    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
+    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
+};

 int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                         const uint8_t *our_priv_key, uint8_t *out_dhkey)
@ -1241,8 +1250,7 @@ int ble_sm_alg_gen_dhkey(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_
    }

    /* Set PRNG */
-    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
-                                    NULL, 0)) != 0) {
+    if ((rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0)) != 0) {
        goto exit;
    }

@ -1292,19 +1300,10 @@ exit:
    return 0;
 }

-/* based on Core Specification 4.2 Vol 3. Part H 2.3.5.6.1 */
-static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
-    0x3f, 0x49, 0xf6, 0xd4, 0xa3, 0xc5, 0x5f, 0x38, 0x74, 0xc9, 0xb3, 0xe3,
-    0xd2, 0x10, 0x3f, 0x50, 0x4a, 0xff, 0x60, 0x7b, 0xeb, 0x40, 0xb7, 0x99,
-    0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
-};
-
 #if CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
 static int mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
 {
    int rc = BLE_SM_KEY_ERR;
-    size_t olen = 0;
-    uint8_t pub[65] = {0};
    mbedtls_entropy_context entropy = {0};
    mbedtls_ctr_drbg_context ctr_drbg = {0};

@ -1326,11 +1325,11 @@ static int mbedtls_gen_keypair(uint8_t *public_key, uint8_t *private_key)
        goto exit;
    }

+    size_t olen = 0;
+    uint8_t pub[65] = {0};

-    if ((rc = mbedtls_ecp_point_write_binary(&keypair.MBEDTLS_PRIVATE(grp),
-                                             &keypair.MBEDTLS_PRIVATE(Q),
-                                             MBEDTLS_ECP_PF_UNCOMPRESSED,
-                                             &olen, pub, 65)) != 0) {
+    if ((rc = mbedtls_ecp_point_write_binary(&keypair.MBEDTLS_PRIVATE(grp), &keypair.MBEDTLS_PRIVATE(Q), MBEDTLS_ECP_PF_UNCOMPRESSED,
+              &olen, pub, 65)) != 0) {
        goto exit;
    }

@ -1346,7 +1345,7 @@ exit:

    return 0;
 }
-#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS

 /**
 * pub: 64 bytes
@ -1370,7 +1369,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
        if (uECC_make_key(pk, priv, &curve_secp256r1) != TC_CRYPTO_SUCCESS) {
            return BLE_SM_KEY_ERR;
        }
-#endif // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
+#endif  // CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS
        /* Make sure generated key isn't debug key. */
    } while (memcmp(priv, ble_sm_alg_dbg_priv_key, 32) == 0);

@ -1378,7 +1377,9 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
    swap_buf(&pub[32], &pk[32], 32);
    swap_in_place(priv, 32);
 #endif // CONFIG_BT_LE_SM_SC_DEBUG_KEYS
-
    return 0;
 }
-#endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED == true)
+
+#endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
+#endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
--- a/components/bt/controller/esp32h2/esp_bt_cfg.h
+++ b/components/bt/controller/esp32h2/esp_bt_cfg.h
@ -40,6 +40,11 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
    #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
    #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #else

    #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@ -119,6 +124,12 @@ extern "C" {
    #else
        #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED (0)
    #endif
+
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #endif

 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@ -6,6 +6,15 @@ if BLE_MESH
        help
            It is a temporary solution and needs further modifications.

+    config BLE_MESH_RANDOM_ADV_INTERVAL
+        bool "Support using random adv interval for mesh packets"
+        select BT_BLE_HIGH_DUTY_ADV_INTERVAL if BT_BLUEDROID_ENABLED
+        default n
+        help
+            Enable this option to allow using random advertising interval
+            for mesh packets. And this could help avoid collision of
+            advertising packets.
+
    config BLE_MESH_USE_DUPLICATE_SCAN
        bool "Support Duplicate Scan in BLE Mesh"
        select BTDM_BLE_SCAN_DUPL if IDF_TARGET_ESP32
@ -14,6 +23,7 @@ if BLE_MESH
        select BT_CTRL_BLE_MESH_SCAN_DUPL_EN if IDF_TARGET_ESP32C3
        select BT_LE_SCAN_DUPL if IDF_TARGET_ESP32C6
        select BT_LE_SCAN_DUPL if IDF_TARGET_ESP32H2
+        select BT_NIMBLE_VS_SUPPORT if BT_NIMBLE_ENABLED
        default y
        help
            Enable this option to allow using specific duplicate scan filter
@ -614,6 +624,21 @@ if BLE_MESH
            Provisioner can provision up to 20 nodes and each node contains two elements,
            then the replay protection list size of Provisioner should be at least 40.

+    config BLE_MESH_NOT_RELAY_REPLAY_MSG
+        bool "Not relay replayed messages in a mesh network"
+        depends on BLE_MESH_EXPERIMENTAL
+        default n
+        help
+            There may be many expired messages in a complex mesh network that would be
+            considered replayed messages.
+            Enable this option will refuse to relay such messages, which could help to
+            reduce invalid packets in the mesh network.
+            However, it should be noted that enabling this option may result in packet
+            loss in certain environments.
+            Therefore, users need to decide whether to enable this option according to
+            the actual usage situation.
+
+
    config BLE_MESH_MSG_CACHE_SIZE
        int "Network message cache size"
        default 10
@ -678,6 +703,13 @@ if BLE_MESH
            When the above situation is encountered, this option can be used to decide whether
            to perform the IV index recovery procedure.

+    config BLE_MESH_SAR_ENHANCEMENT
+        bool "Segmentation and reassembly enhancement"
+        default n
+        help
+            Enable this option to use the enhanced segmentation and reassembly
+            mechanism introduced in Bluetooth Mesh Protocol 1.1.
+
    config BLE_MESH_TX_SEG_MSG_COUNT
        int "Maximum number of simultaneous outgoing segmented messages"
        default 1
@ -1091,6 +1123,16 @@ if BLE_MESH
                help
                    Maximum number of Bridging Table entries that the Bridge Configuration Server can support.

+            config BLE_MESH_BRIDGE_CRPL
+                int "Maximum capacity of bridge replay protection list"
+                default 5
+                range 1 255
+                help
+                    This option specifies the maximum capacity of the bridge replay
+                    protection list. The bridge replay protection list is used to
+                    prevent a bridged subnet from replay attack, which will store the
+                    source address and sequence number of the received bridge messages.
+
        endif #BLE_MESH_BRC_SRV

        config BLE_MESH_PRB_CLI
@ -1424,7 +1466,7 @@ if BLE_MESH

        config BLE_MESH_MBT_CLI
            bool "BLOB Transfer Client model"
-            default y
+            default n
            help
                Enable support for BLOB Transfer Client model.

@ -1442,7 +1484,7 @@ if BLE_MESH

        config BLE_MESH_MBT_SRV
            bool "BLOB Transfer Server model"
-            default y
+            default n
            help
                Enable support for BLOB Transfer Server model.

@ -1474,6 +1516,7 @@ if BLE_MESH

        config BLE_MESH_BQB_TEST
            bool "Enable BLE Mesh specific internal test"
+            select BLE_MESH_IV_UPDATE_TEST
            default n
            help
                This option is used to enable some internal functions for auto-pts test.
@ -1579,4 +1622,12 @@ if BLE_MESH

    endmenu

+    config BLE_MESH_EXPERIMENTAL
+        bool "Make BLE Mesh experimental features visible"
+        default n
+        help
+            Make BLE Mesh Experimental features visible.
+            Experimental features list:
+            - CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+
 endif # BLE_MESH
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_common_api.c
@ -65,7 +65,9 @@ esp_err_t esp_ble_mesh_init(esp_ble_mesh_prov_t *prov, esp_ble_mesh_comp_t *comp
 esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)
 {
    btc_ble_mesh_prov_args_t arg = {0};
+    SemaphoreHandle_t semaphore = NULL;
    btc_msg_t msg = {0};
+    esp_err_t ret = ESP_OK;

    if (param == NULL) {
        return ESP_ERR_INVALID_ARG;
@ -73,13 +75,36 @@ esp_err_t esp_ble_mesh_deinit(esp_ble_mesh_deinit_param_t *param)

    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);

+    // Create a semaphore
+    if ((semaphore = xSemaphoreCreateCounting(1, 0)) == NULL) {
+        BT_ERR("Failed to create semaphore");
+        return ESP_ERR_NO_MEM;
+    }
+
    arg.mesh_deinit.param.erase_flash = param->erase_flash;
+    /* Transport semaphore pointer to BTC layer, and will give the semaphore in the BTC task */
+    arg.mesh_deinit.semaphore = semaphore;

    msg.sig = BTC_SIG_API_CALL;
    msg.pid = BTC_PID_PROV;
    msg.act = BTC_BLE_MESH_ACT_DEINIT_MESH;

-    return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL)
-            == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+    if (btc_transfer_context(&msg, &arg, sizeof(btc_ble_mesh_prov_args_t), NULL, NULL) != BT_STATUS_SUCCESS) {
+        vSemaphoreDelete(semaphore);
+        BT_ERR("Failed to start mesh deinit");
+        return ESP_FAIL;
+    }
+
+    /* Take the Semaphore, wait BLE Mesh de-initialization to finish. */
+    xSemaphoreTake(semaphore, portMAX_DELAY);
+    /* Don't forget to delete the semaphore at the end. */
+    vSemaphoreDelete(semaphore);
+
+    ret = bt_mesh_host_deinit();
+    if (ret != ESP_OK) {
+        return ret;
+    }
+
+    return ESP_OK;
 }
 #endif /* CONFIG_BLE_MESH_DEINIT */
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
@ -53,6 +53,34 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }

+#if CONFIG_BLE_MESH_PRB_SRV
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
+
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
                                            esp_ble_mesh_addr_type_t addr_type,
                                            uint16_t net_idx)
--- a/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
+++ b/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
@ -48,6 +48,30 @@ esp_err_t esp_ble_mesh_proxy_gatt_enable(void);
 */
 esp_err_t esp_ble_mesh_proxy_gatt_disable(void);

+/**
+ * @brief   Enable advertising with Private Node Identity.
+ *
+ * @note    This API requires that GATT Proxy support be enabled. Once called,
+ *          each subnet starts advertising using Private Node Identity for the
+ *          next 60 seconds, and after 60s Private Network ID will be advertised.
+ *          Under normal conditions, the BLE Mesh Proxy Node Identity, Network
+ *          ID advertising, Proxy Private Node Identity and Private Network
+ *          ID advertising will be enabled automatically by BLE Mesh stack
+ *          after the device is provisioned.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void);
+
+/**
+ * @brief   Disable advertising with Private Node Identity.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void);
+
 /**
 * @brief        Proxy Client creates a connection with the Proxy Server.
 *
--- a/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
+++ b/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
@ -71,6 +71,14 @@ typedef uint8_t esp_ble_mesh_octet8_t[ESP_BLE_MESH_OCTET8_LEN];
 #define ESP_BLE_MESH_KEY_PRIMARY                            0x0000
 #define ESP_BLE_MESH_KEY_ANY                                0xFFFF

+/*!< Internal macros used to initialize array members */
+#define ESP_BLE_MESH_KEY_UNUSED_ELT_(IDX, _) ESP_BLE_MESH_KEY_UNUSED
+#define ESP_BLE_MESH_ADDR_UNASSIGNED_ELT_(IDX, _) ESP_BLE_MESH_ADDR_UNASSIGNED
+#define ESP_BLE_MESH_MODEL_KEYS_UNUSED            \
+    { LISTIFY(CONFIG_BLE_MESH_MODEL_KEY_COUNT, ESP_BLE_MESH_KEY_UNUSED_ELT_, (,)) }
+#define ESP_BLE_MESH_MODEL_GROUPS_UNASSIGNED      \
+    { LISTIFY(CONFIG_BLE_MESH_MODEL_GROUP_COUNT, ESP_BLE_MESH_ADDR_UNASSIGNED_ELT_, (,)) }
+
 /*!< Primary Network Key index */
 #define ESP_BLE_MESH_NET_PRIMARY                            0x000

@ -286,26 +294,24 @@ typedef enum {
 #define ESP_BLE_MESH_SIG_MODEL(_id, _op, _pub, _user_data)          \
 {                                                                   \
    .model_id = (_id),                                              \
-    .op = _op,                                                      \
-    .keys = { [0 ... (CONFIG_BLE_MESH_MODEL_KEY_COUNT - 1)] =       \
-            ESP_BLE_MESH_KEY_UNUSED },                              \
    .pub = _pub,                                                    \
-    .groups = { [0 ... (CONFIG_BLE_MESH_MODEL_GROUP_COUNT - 1)] =   \
-            ESP_BLE_MESH_ADDR_UNASSIGNED },                         \
+    .keys = ESP_BLE_MESH_MODEL_KEYS_UNUSED,                         \
+    .groups = ESP_BLE_MESH_MODEL_GROUPS_UNASSIGNED,                 \
+    .op = _op,                                                      \
    .user_data = _user_data,                                        \
 }

 /*!< This macro is associated with BLE_MESH_MODEL_VND_CB in mesh_access.h */
 #define ESP_BLE_MESH_VENDOR_MODEL(_company, _id, _op, _pub, _user_data) \
 {                                                                       \
-    .vnd.company_id = (_company),                                       \
-    .vnd.model_id = (_id),                                              \
-    .op = _op,                                                          \
+    .vnd = {                                                            \
+        .company_id = (_company),                                       \
+        .model_id = (_id),                                              \
+    },                                                                  \
    .pub = _pub,                                                        \
-    .keys = { [0 ... (CONFIG_BLE_MESH_MODEL_KEY_COUNT - 1)] =           \
-            ESP_BLE_MESH_KEY_UNUSED },                                  \
-    .groups = { [0 ... (CONFIG_BLE_MESH_MODEL_GROUP_COUNT - 1)] =       \
-            ESP_BLE_MESH_ADDR_UNASSIGNED },                             \
+    .keys = ESP_BLE_MESH_MODEL_KEYS_UNUSED,                             \
+    .groups = ESP_BLE_MESH_MODEL_GROUPS_UNASSIGNED,                     \
+    .op = _op,                                                          \
    .user_data = _user_data,                                            \
 }

@ -324,8 +330,8 @@ typedef enum {
 {                                                       \
    .location         = (_loc),                         \
    .sig_model_count  = ARRAY_SIZE(_mods),              \
-    .sig_models       = (_mods),                        \
    .vnd_model_count  = ARRAY_SIZE(_vnd_mods),          \
+    .sig_models       = (_mods),                        \
    .vnd_models       = (_vnd_mods),                    \
 }

@ -492,8 +498,9 @@ typedef struct {
 #define ESP_BLE_MESH_MODEL_PUB_DEFINE(_name, _msg_len, _role) \
    NET_BUF_SIMPLE_DEFINE_STATIC(bt_mesh_pub_msg_##_name, _msg_len); \
    static esp_ble_mesh_model_pub_t _name = { \
-        .update = (uint32_t)NULL, \
        .msg = &bt_mesh_pub_msg_##_name, \
+        .update = (uint32_t)NULL, \
+        .dev_role = _role, \
    }

 /** @def ESP_BLE_MESH_MODEL_OP
@ -916,6 +923,8 @@ typedef enum {
    ESP_BLE_MESH_NODE_PROV_INPUT_NUMBER_COMP_EVT,               /*!< Node input number completion event */
    ESP_BLE_MESH_NODE_PROV_INPUT_STRING_COMP_EVT,               /*!< Node input string completion event */
    ESP_BLE_MESH_NODE_PROXY_IDENTITY_ENABLE_COMP_EVT,           /*!< Enable BLE Mesh Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT,   /*!< Enable BLE Mesh Private Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT,  /*!< Disable BLE Mesh Private Proxy Identity advertising completion event */
    ESP_BLE_MESH_NODE_PROXY_GATT_ENABLE_COMP_EVT,               /*!< Enable BLE Mesh GATT Proxy Service completion event */
    ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT,              /*!< Disable BLE Mesh GATT Proxy Service completion event */
    ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT,               /*!< Node add NetKey locally completion event */
@ -1109,6 +1118,18 @@ typedef union {
    struct ble_mesh_proxy_gatt_disable_comp_param {
        int err_code;                           /*!< Indicate the result of disabling Mesh Proxy Service */
    } node_proxy_gatt_disable_comp;             /*!< Event parameter of ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_enable_comp_param {
+        int err_code;                           /*!< Indicate the result of enabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_enable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_disable_comp_param {
+        int err_code;                           /*!< Indicate the result of disabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_disable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT */
    /**
     * @brief ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT
     */
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
@ -2368,6 +2368,16 @@ void btc_ble_mesh_prov_call_handler(btc_msg_t *msg)
        act = ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT;
        param.node_proxy_gatt_disable_comp.err_code = bt_mesh_proxy_server_gatt_disable();
        break;
+#if CONFIG_BLE_MESH_PRB_SRV
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT;
+        param.node_private_proxy_identity_enable_comp.err_code = bt_mesh_proxy_private_identity_enable();
+        break;
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT;
+        param.node_private_proxy_identity_disable_comp.err_code = bt_mesh_proxy_private_identity_disable();
+        break;
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #endif /* (CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_GATT) || CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #if CONFIG_BLE_MESH_PROVISIONER
@ -2815,6 +2825,8 @@ void btc_ble_mesh_prov_call_handler(btc_msg_t *msg)
    case BTC_BLE_MESH_ACT_DEINIT_MESH:
        act = ESP_BLE_MESH_DEINIT_MESH_COMP_EVT;
        param.deinit_mesh_comp.err_code = bt_mesh_deinit((struct bt_mesh_deinit_param *)&arg->mesh_deinit.param);
+        /* Give the semaphore when BLE Mesh de-initialization is finished. */
+        xSemaphoreGive(arg->mesh_deinit.semaphore);
        break;
 #endif /* CONFIG_BLE_MESH_DEINIT */
    default:
--- a/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
+++ b/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
@ -28,6 +28,8 @@ typedef enum {
    BTC_BLE_MESH_ACT_INPUT_STRING,
    BTC_BLE_MESH_ACT_SET_DEVICE_NAME,
    BTC_BLE_MESH_ACT_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE,
    BTC_BLE_MESH_ACT_PROXY_GATT_ENABLE,
    BTC_BLE_MESH_ACT_PROXY_GATT_DISABLE,
    BTC_BLE_MESH_ACT_NODE_ADD_LOCAL_NET_KEY,
@ -339,6 +341,7 @@ typedef union {
    } model_unsub_group_addr;
    struct ble_mesh_deinit_args {
        esp_ble_mesh_deinit_param_t param;
+        SemaphoreHandle_t semaphore;
    } mesh_deinit;
 } btc_ble_mesh_prov_args_t;

--- a/components/bt/esp_ble_mesh/common/common.c
+++ b/components/bt/esp_ble_mesh/common/common.c
@ -85,3 +85,8 @@ int bt_mesh_rand(void *buf, size_t len)

    return 0;
 }
+
+uint32_t bt_mesh_get_rand(void)
+{
+    return esp_random();
+}
--- a/components/bt/esp_ble_mesh/common/include/mesh/buf.h
+++ b/components/bt/esp_ble_mesh/common/include/mesh/buf.h
@ -840,22 +840,22 @@ struct net_buf_pool {
 #if CONFIG_BLE_MESH_NET_BUF_POOL_USAGE
 #define NET_BUF_POOL_INITIALIZER(_pool, _alloc, _bufs, _count, _destroy) \
    {                                                                   \
-        .alloc = _alloc,                                                \
-        .__bufs = (struct net_buf *)_bufs,                              \
        .buf_count = _count,                                            \
        .uninit_count = _count,                                         \
        .avail_count = _count,                                          \
-        .destroy = _destroy,                                            \
        .name = STRINGIFY(_pool),                                       \
+        .destroy = _destroy,                                            \
+        .alloc = _alloc,                                                \
+        .__bufs = (struct net_buf *)_bufs,                              \
    }
 #else
 #define NET_BUF_POOL_INITIALIZER(_pool, _alloc, _bufs, _count, _destroy) \
    {                                                                   \
-        .alloc = _alloc,                                                \
-        .__bufs = (struct net_buf *)_bufs,                              \
        .buf_count = _count,                                            \
        .uninit_count = _count,                                         \
        .destroy = _destroy,                                            \
+        .alloc = _alloc,                                                \
+        .__bufs = (struct net_buf *)_bufs,                              \
    }
 #endif /* CONFIG_BLE_MESH_NET_BUF_POOL_USAGE */

--- a/components/bt/esp_ble_mesh/common/include/mesh/common.h
+++ b/components/bt/esp_ble_mesh/common/include/mesh/common.h
@ -53,6 +53,8 @@ void bt_mesh_free_buf(struct net_buf_simple *buf);

 int bt_mesh_rand(void *buf, size_t len);

+uint32_t bt_mesh_get_rand(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/esp_ble_mesh/common/include/mesh/utils.h
+++ b/components/bt/esp_ble_mesh/common/include/mesh/utils.h
@ -17,6 +17,7 @@
 #include <stddef.h>
 #include "esp_bit_defs.h"
 #include "mesh/types.h"
+#include "utils_loops.h"

 #ifdef __cplusplus
 extern "C" {
@ -180,6 +181,40 @@ extern "C" {
 */
 #define Z_IS_ENABLED3(ignore_this, val, ...) val

+/* Used to remove brackets from around a single argument. */
+#define __DEBRACKET(...) __VA_ARGS__
+
+#define UTIL_CAT(a, ...) UTIL_PRIMITIVE_CAT(a, __VA_ARGS__)
+#define UTIL_PRIMITIVE_CAT(a, ...) a##__VA_ARGS__
+
+/**
+ * @brief Generates a sequence of code with configurable separator.
+ *
+ * Example:
+ *
+ *     #define FOO(i, _) MY_PWM ## i
+ *     { LISTIFY(PWM_COUNT, FOO, (,)) }
+ *
+ * The above two lines expand to:
+ *
+ *    { MY_PWM0 , MY_PWM1 }
+ *
+ * @param LEN The length of the sequence. Must be an integer literal less
+ *            than 255.
+ * @param F A macro function that accepts at least two arguments:
+ *          <tt>F(i, ...)</tt>. @p F is called repeatedly in the expansion.
+ *          Its first argument @p i is the index in the sequence, and
+ *          the variable list of arguments passed to LISTIFY are passed
+ *          through to @p F.
+ *
+ * @param sep Separator (e.g. comma or semicolon). Must be in parentheses;
+ *            this is required to enable providing a comma as separator.
+ *
+ * @note Calling LISTIFY with undefined arguments has undefined
+ * behavior.
+ */
+#define LISTIFY(LEN, F, sep, ...) UTIL_CAT(Z_UTIL_LISTIFY_, LEN)(F, sep, __VA_ARGS__)
+
 const char *bt_hex(const void *buf, size_t len);

 void mem_rcopy(uint8_t *dst, uint8_t const *src, uint16_t len);
--- a/components/bt/esp_ble_mesh/common/include/mesh/utils_loops.h
+++ b/components/bt/esp_ble_mesh/common/include/mesh/utils_loops.h
--- a/components/bt/esp_ble_mesh/common/timer.c
+++ b/components/bt/esp_ble_mesh/common/timer.c
@ -207,7 +207,7 @@ int k_delayed_work_free(struct k_delayed_work *work)

    alarm = hash_map_get(bm_alarm_hash_map, work);
    if (alarm == NULL) {
-        BT_WARN("Free, alarm not found");
+        BT_DBG("Free, alarm not found");
        bt_mesh_alarm_unlock();
        return -EINVAL;
    }
--- a/components/bt/esp_ble_mesh/core/access.c
+++ b/components/bt/esp_ble_mesh/core/access.c
@ -964,6 +964,9 @@ int bt_mesh_model_publish(struct bt_mesh_model *model)
    ctx.send_ttl = pub->ttl;
    ctx.send_cred = pub->cred ? BLE_MESH_FRIENDSHIP_CRED : BLE_MESH_FLOODING_CRED;
    ctx.send_szmic = pub->send_szmic;
+#if 0
+    ctx.send_tag |= BLE_MESH_TAG_IMMUTABLE_CRED;
+#endif
    if (pub->send_rel) {
        /* Tag with send-segmented */
        ctx.send_tag |= BLE_MESH_TAG_SEND_SEGMENTED;
--- a/components/bt/esp_ble_mesh/core/adv.c
+++ b/components/bt/esp_ble_mesh/core/adv.c
@ -32,8 +32,11 @@
 /* Pre-5.0 controllers enforce a minimum interval of 100ms
 * whereas 5.0+ controllers can go down to 20ms.
 */
-#define ADV_INT_DEFAULT_MS  100
-#define ADV_INT_FAST_MS     20
+#if CONFIG_BLE_MESH_HCI_5_0
+#define ADV_ITVL_MIN        20
+#else
+#define ADV_ITVL_MIN        100
+#endif

 static const uint8_t adv_type[] = {
    [BLE_MESH_ADV_PROV]   = BLE_MESH_DATA_MESH_PROV,
@ -141,10 +144,19 @@ static inline void adv_send_end(int err, const struct bt_mesh_send_cb *cb,
    }
 }

+uint16_t bt_mesh_pdu_duration(uint8_t xmit)
+{
+    uint16_t duration = 0U;
+    uint16_t adv_int = 0U;
+
+    adv_int = MAX(ADV_ITVL_MIN, BLE_MESH_TRANSMIT_INT(xmit));
+    duration = (BLE_MESH_TRANSMIT_COUNT(xmit) + 1) * (adv_int + 10);
+
+    return duration;
+}
+
 static inline int adv_send(struct net_buf *buf)
 {
-    const int32_t adv_int_min = ((bt_mesh_dev.hci_version >= BLE_MESH_HCI_VERSION_5_0) ?
-                                  ADV_INT_FAST_MS : ADV_INT_DEFAULT_MS);
    const struct bt_mesh_send_cb *cb = BLE_MESH_ADV(buf)->cb;
    void *cb_data = BLE_MESH_ADV(buf)->cb_data;
    struct bt_mesh_adv_param param = {0};
@ -158,7 +170,7 @@ static inline int adv_send(struct net_buf *buf)
 #if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
    if (BLE_MESH_ADV(buf)->type != BLE_MESH_ADV_BLE) {
 #endif
-        adv_int = MAX(adv_int_min,
+        adv_int = MAX(ADV_ITVL_MIN,
                      BLE_MESH_TRANSMIT_INT(BLE_MESH_ADV(buf)->xmit));
        duration = (BLE_MESH_TRANSMIT_COUNT(BLE_MESH_ADV(buf)->xmit) + 1) *
                   (adv_int + 10);
@ -180,7 +192,7 @@ static inline int adv_send(struct net_buf *buf)
            bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
            struct bt_mesh_adv_data solic_ad[3] = {
                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
-                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x29, 0x18),
+                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
                BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
            };
            err = bt_le_adv_start(&param, solic_ad, 3, NULL, 0);
--- a/components/bt/esp_ble_mesh/core/adv.h
+++ b/components/bt/esp_ble_mesh/core/adv.h
@ -25,6 +25,8 @@ extern "C" {

 #define BLE_MESH_ADV(buf)               (*(struct bt_mesh_adv **)net_buf_user_data(buf))

+uint16_t bt_mesh_pdu_duration(uint8_t xmit);
+
 typedef struct bt_mesh_msg {
    bool     relay;     /* Flag indicates if the packet is a relayed one */
    void    *arg;       /* Pointer to the struct net_buf */
--- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
@ -30,6 +30,7 @@
 #include "mesh/common.h"
 #include "prov_pvnr.h"
 #include "net.h"
+#include "beacon.h"

 #include "mesh_v1.1/utils.h"

@ -106,6 +107,11 @@ int bt_mesh_host_init(void)
    return 0;
 }

+int bt_mesh_host_deinit(void)
+{
+    return 0;
+}
+
 void bt_mesh_hci_init(void)
 {
    const uint8_t *features = controller_get_interface()->get_features_ble()->as_array;
@ -323,6 +329,7 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
    tBLE_ADDR_TYPE addr_type_own = 0U;
    tBLE_BD_ADDR p_dir_bda = {0};
    tBTM_BLE_AFP adv_fil_pol = 0U;
+    uint16_t interval = 0U;
    uint8_t adv_type = 0U;
    int err = 0;

@ -369,7 +376,15 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
    }

 #if CONFIG_BLE_MESH_PRB_SRV
-    addr_type_own = bt_mesh_private_beacon_update_addr_type(ad);
+    /* NOTE: When a Mesh Private beacon is advertised, the Mesh Private beacon shall
+     * use a resolvable private address or a non-resolvable private address in the
+     * AdvA field of the advertising PDU.
+     */
+    if (ad->type == BLE_MESH_DATA_MESH_BEACON && ad->data[0] == BEACON_TYPE_PRIVATE) {
+        addr_type_own = BLE_MESH_ADDR_RANDOM;
+    } else {
+        addr_type_own = BLE_MESH_ADDR_PUBLIC;
+    }
 #else
    addr_type_own = BLE_MESH_ADDR_PUBLIC;
 #endif
@ -378,9 +393,24 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
    adv_fil_pol = BLE_MESH_AP_SCAN_CONN_ALL;
    p_start_adv_cb = start_adv_completed_cb;

+    interval = param->interval_min;
+
+#if CONFIG_BLE_MESH_RANDOM_ADV_INTERVAL
+    /* If non-connectable mesh packets are transmitted with an adv interval
+     * not smaller than 10ms, then we will use a random adv interval between
+     * [interval / 2, interval] for them.
+     */
+    if (adv_type == BLE_MESH_ADV_NONCONN_IND && interval >= 16) {
+        interval >>= 1;
+        interval += (bt_mesh_get_rand() % (interval + 1));
+
+        BT_INFO("%u->%u", param->interval_min, interval);
+    }
+#endif
+
    /* Check if we can start adv using BTM_BleSetAdvParamsStartAdvCheck */
    BLE_MESH_BTM_CHECK_STATUS(
-        BTM_BleSetAdvParamsAll(param->interval_min, param->interval_max, adv_type,
+        BTM_BleSetAdvParamsAll(interval, interval, adv_type,
                               addr_type_own, &p_dir_bda,
                               channel_map, adv_fil_pol, p_start_adv_cb));
    BLE_MESH_BTM_CHECK_STATUS(BTM_BleStartAdv());
@ -1978,7 +2008,7 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)

    if ((sub_code > BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN) ||
        (sub_code < BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
-         type > BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV) ||
+         type >= BLE_MESH_EXCEP_LIST_TYPE_MAX) ||
        (sub_code == BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
         !(type & BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST))) {
        BT_ERR("%s, Invalid parameter", __func__);
@ -1990,6 +2020,16 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
            BT_ERR("Invalid Provisioning Link ID");
            return -EINVAL;
        }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
        sys_memcpy_swap(value, info, sizeof(uint32_t));
    }

--- a/components/bt/esp_ble_mesh/core/cfg_srv.c
+++ b/components/bt/esp_ble_mesh/core/cfg_srv.c
@ -2,7 +2,7 @@

 /*
 * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -2514,7 +2514,7 @@ static void node_identity_set(struct bt_mesh_model *model,
                 * any subnet is 0x01, then the value of the Private Node
                 * Identity state shall be Disable (0x00).
                 */
-                disable_all_private_node_identity();
+                bt_mesh_proxy_private_identity_disable();
 #endif
                bt_mesh_proxy_server_identity_start(sub);
            } else {
@ -3575,6 +3575,17 @@ uint8_t bt_mesh_net_transmit_get(void)
    return 0;
 }

+void bt_mesh_relay_local_set(bool enable)
+{
+    if (conf && conf->relay != BLE_MESH_RELAY_NOT_SUPPORTED) {
+        if (enable) {
+            conf->relay = BLE_MESH_RELAY_ENABLED;
+        } else {
+            conf->relay = BLE_MESH_RELAY_DISABLED;
+        }
+    }
+}
+
 uint8_t bt_mesh_relay_get(void)
 {
    if (conf) {
--- a/components/bt/esp_ble_mesh/core/foundation.h
+++ b/components/bt/esp_ble_mesh/core/foundation.h
@ -246,10 +246,10 @@ extern "C" {
 /* Defines the status codes for Opcodes Aggregator messages. */
 #define AGG_STATUS_SUCCESS                          0x00
 #define AGG_STATUS_INVALID_ADDRESS                  0x01
-#define AGG_STATUS_INVALID_MODEL                    0x02
-#define AGG_STATUS_WRONG_ACCESS_KEY                 0x03
-#define AGG_STATUS_WRONG_OPCODE                     0x04
-#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x05
+#define AGG_STATUS_WRONG_ACCESS_KEY                 0x02
+#define AGG_STATUS_WRONG_OPCODE                     0x03
+#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x04
+#define AGG_STATUS_RESPONSE_OVERFLOW                0x05

 enum {
    BLE_MESH_VA_CHANGED,    /* Label information changed */
--- a/components/bt/esp_ble_mesh/core/include/mesh/access.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/access.h
@ -4,7 +4,7 @@

 /*
 * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -54,8 +54,8 @@ extern "C" {
 {                                               \
    .loc              = (_loc),                 \
    .model_count      = ARRAY_SIZE(_mods),      \
-    .models           = (_mods),                \
    .vnd_model_count  = ARRAY_SIZE(_vnd_mods),  \
+    .models           = (_mods),                \
    .vnd_models       = (_vnd_mods),            \
 }

@ -306,14 +306,12 @@ struct bt_mesh_model_op {
 #define BLE_MESH_MODEL_CB(_id, _op, _pub, _user_data, _cb)          \
 {                                                                   \
    .id = (_id),                                                    \
-    .op = (_op),                                                    \
-    .keys = { [0 ... (CONFIG_BLE_MESH_MODEL_KEY_COUNT - 1)] =       \
-            BLE_MESH_KEY_UNUSED },                                  \
    .pub = (_pub),                                                  \
-    .groups = { [0 ... (CONFIG_BLE_MESH_MODEL_GROUP_COUNT - 1)] =   \
-            BLE_MESH_ADDR_UNASSIGNED },                             \
-    .user_data = (_user_data),                                      \
+    .keys = ESP_BLE_MESH_MODEL_KEYS_UNUSED,                         \
+    .groups = ESP_BLE_MESH_MODEL_GROUPS_UNASSIGNED,                 \
+    .op = (_op),                                                    \
    .cb = (_cb),                                                    \
+    .user_data = (_user_data),                                      \
 }

 /** @def BLE_MESH_MODEL_VND_CB
@ -331,14 +329,12 @@ struct bt_mesh_model_op {
 {                                                                   \
    .vnd.company = (_company),                                      \
    .vnd.id = (_id),                                                \
-    .op = (_op),                                                    \
    .pub = (_pub),                                                  \
-    .keys = { [0 ... (CONFIG_BLE_MESH_MODEL_KEY_COUNT - 1)] =       \
-            BLE_MESH_KEY_UNUSED },                                  \
-    .groups = { [0 ... (CONFIG_BLE_MESH_MODEL_GROUP_COUNT - 1)] =   \
-            BLE_MESH_ADDR_UNASSIGNED },                             \
-    .user_data = (_user_data),                                      \
+    .keys = ESP_BLE_MESH_MODEL_KEYS_UNUSED,                         \
+    .groups = ESP_BLE_MESH_MODEL_GROUPS_UNASSIGNED,                 \
+    .op = (_op),                                                    \
    .cb = (_cb),                                                    \
+    .user_data = (_user_data),                                      \
 }

 /** @def BLE_MESH_TRANSMIT
@ -475,8 +471,8 @@ struct bt_mesh_model_pub {
 #define BLE_MESH_MODEL_PUB_DEFINE(_name, _update, _msg_len) \
    NET_BUF_SIMPLE_DEFINE_STATIC(bt_mesh_pub_msg_##_name, _msg_len); \
    static struct bt_mesh_model_pub _name = { \
-        .update = _update, \
        .msg = &bt_mesh_pub_msg_##_name, \
+        .update = _update, \
    }

 /** Model callback functions. */
--- a/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
@ -596,9 +596,9 @@ struct bt_mesh_gatt_attr {
 #define BLE_MESH_GATT_PRIMARY_SERVICE(_service)     \
 {                                                   \
    .uuid = BLE_MESH_UUID_GATT_PRIMARY,             \
-    .perm = BLE_MESH_GATT_PERM_READ,                \
    .read = bt_mesh_gatts_attr_read_service,        \
    .user_data = _service,                          \
+    .perm = BLE_MESH_GATT_PERM_READ,                \
 }

 /** @def BLE_MESH_GATT_SECONDARY_SERVICE
@ -611,9 +611,9 @@ struct bt_mesh_gatt_attr {
 #define BLE_MESH_GATT_SECONDARY_SERVICE(_service)   \
 {                                                   \
    .uuid = BLE_MESH_UUID_GATT_SECONDARY,           \
-    .perm = BLE_MESH_GATT_PERM_READ,                \
    .read = bt_mesh_gatts_attr_read_service,        \
    .user_data = _service,                          \
+    .perm = BLE_MESH_GATT_PERM_READ,                \
 }

 /** @def BLE_MESH_GATT_INCLUDE_SERVICE
@ -626,9 +626,9 @@ struct bt_mesh_gatt_attr {
 #define BLE_MESH_GATT_INCLUDE_SERVICE(_service_incl)    \
 {                                                       \
    .uuid = BLE_MESH_UUID_GATT_INCLUDE,                 \
-    .perm = BLE_MESH_GATT_PERM_READ,                    \
    .read = bt_mesh_gatts_attr_read_included,           \
    .user_data = _service_incl,                         \
+    .perm = BLE_MESH_GATT_PERM_READ,                    \
 }

 /** @def BLE_MESH_GATT_CHARACTERISTIC
@ -642,10 +642,10 @@ struct bt_mesh_gatt_attr {
 #define BLE_MESH_GATT_CHARACTERISTIC(_uuid, _props)             \
 {                                                               \
    .uuid = BLE_MESH_UUID_GATT_CHRC,                            \
-    .perm = BLE_MESH_GATT_PERM_READ,                            \
    .read = bt_mesh_gatts_attr_read_chrc,                       \
    .user_data = (&(struct bt_mesh_gatt_char) { .uuid = _uuid,  \
                           .properties = _props, }),            \
+    .perm = BLE_MESH_GATT_PERM_READ,                            \
 }

 /** @def BLE_MESH_GATT_DESCRIPTOR
@ -662,10 +662,10 @@ struct bt_mesh_gatt_attr {
 #define BLE_MESH_GATT_DESCRIPTOR(_uuid, _perm, _read, _write, _value)   \
 {                           \
    .uuid = _uuid,          \
-    .perm = _perm,          \
    .read = _read,          \
    .write = _write,        \
    .user_data = _value,    \
+    .perm = _perm,          \
 }

 /** @def BLE_MESH_GATT_SERVICE
@ -682,6 +682,7 @@ struct bt_mesh_gatt_attr {
 }

 int bt_mesh_host_init(void);
+int bt_mesh_host_deinit(void);

 int bt_le_adv_start(const struct bt_mesh_adv_param *param,
                    const struct bt_mesh_adv_data *ad, size_t ad_len,
@ -810,6 +811,9 @@ enum {
    BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON,
    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV,
    BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_SOLIC_PDU,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_URI,
+    BLE_MESH_EXCEP_LIST_TYPE_MAX,
 };

 #define BLE_MESH_EXCEP_LIST_CLEAN_ADDR_LIST              BIT(0)
@ -817,8 +821,10 @@ enum {
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_BEACON_LIST       BIT(2)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROV_ADV_LIST     BIT(3)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROXY_ADV_LIST    BIT(4)
-#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | \
-                                                          BIT(2) | BIT(3) | BIT(4))
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_SOLIC_PDU_LIST    BIT(5)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_URI_LIST          BIT(6)
+#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | BIT(2) | BIT(3) | \
+                                                          BIT(4) | BIT(5) | BIT(6))

 int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info);

--- a/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
@ -212,6 +212,8 @@ typedef union {
    } cfg_net_transmit_set;
 } bt_mesh_cfg_server_state_change_t;

+void bt_mesh_relay_local_set(bool enable);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
@ -141,6 +141,11 @@ struct bt_mesh_uuid_128 {
 */
 #define BLE_MESH_UUID_MESH_PROXY                BLE_MESH_UUID_DECLARE_16(0x1828)
 #define BLE_MESH_UUID_MESH_PROXY_VAL            0x1828
+/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
+ *  @brief Mesh Proxy Solicitation UUID
+ */
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC          BLE_MESH_UUID_DECLARE_16(0x1859)
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x1859
 /** @def BLE_MESH_UUID_GATT_PRIMARY
 *  @brief GATT Primary Service
 */
@ -466,10 +471,6 @@ struct bt_mesh_uuid_128 {
 */
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT       BLE_MESH_UUID_DECLARE_16(0x2ade)
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT_VAL   0x2ade
-/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
- *  @brief Mesh Proxy Solicitation UUID
- */
-#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x7fcb

 /*
 * Protocol UUIDs
--- a/components/bt/esp_ble_mesh/core/local.c
+++ b/components/bt/esp_ble_mesh/core/local.c
@ -148,10 +148,9 @@ int bt_mesh_enable_directed_forwarding(uint16_t net_idx, bool directed_forwardin

    return 0;
 }
+#endif /* CONFIG_BLE_MESH_DF_SRV */

-#endif
 #if CONFIG_BLE_MESH_NODE
-
 const uint8_t *bt_mesh_node_get_local_net_key(uint16_t net_idx)
 {
    struct bt_mesh_subnet *sub = NULL;
@ -369,5 +368,4 @@ int bt_mesh_node_bind_app_key_to_model(uint16_t elem_addr, uint16_t mod_id,
    BT_ERR("Model bound is full!");
    return -ENOMEM;
 }
-
 #endif /* CONFIG_BLE_MESH_NODE */
--- a/components/bt/esp_ble_mesh/core/lpn.c
+++ b/components/bt/esp_ble_mesh/core/lpn.c
@ -238,6 +238,20 @@ static void clear_friendship(bool force, bool disable)
        lpn_cb(lpn->frnd, false);
    }

+    /* If the Low Power node supports directed forwarding functionality when
+     * the friendship is established in a subnet, the Low Power node shall
+     * store the current value of the Directed Forwarding state and shall set
+     * the state to 0x00 for that subnet. When that friendship is terminated,
+     * the Low Power node shall set the Directed Forwarding state to the stored
+     * value.
+     */
+#if CONFIG_BLE_MESH_DF_SRV
+    if (lpn->established) {
+        bt_mesh_restore_directed_forwarding_state(bt_mesh.sub[0].net_idx,
+                                                  lpn->old_directed_forwarding);
+    }
+#endif
+
    lpn->frnd = BLE_MESH_ADDR_UNASSIGNED;
    lpn->fsn = 0U;
    lpn->req_attempts = 0U;
@ -1027,9 +1041,9 @@ int bt_mesh_lpn_friend_update(struct bt_mesh_net_rx *rx,
         * the Low Power node shall set the Directed Forwarding state to the stored
         * value.
         */
-        /* TODO:
-         * Store - clear - restore directed forwarding state value of the subnet.
-         */
+#if CONFIG_BLE_MESH_DF_SRV
+        lpn->old_directed_forwarding = bt_mesh_get_and_disable_directed_forwarding_state(sub);
+#endif
    }

    friend_response_received(lpn);
--- a/components/bt/esp_ble_mesh/core/main.c
+++ b/components/bt/esp_ble_mesh/core/main.c
@ -109,6 +109,11 @@ void bt_mesh_node_reset(void)
        return;
    }

+    if (bt_mesh_prov_active()) {
+        BT_WARN("%s, link is still active", __func__);
+        return;
+    }
+
    bt_mesh.iv_index = 0U;
    bt_mesh.seq = 0U;

--- a/components/bt/esp_ble_mesh/core/net.c
+++ b/components/bt/esp_ble_mesh/core/net.c
@ -606,6 +606,13 @@ bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, uint8_t new_kr, bool new_key)
        case BLE_MESH_KR_PHASE_2:
            BT_INFO("KR Phase 0x%02x -> Normal", sub->kr_phase);

+#if CONFIG_BLE_MESH_PRB_SRV
+            /* In this case, consider that kr_flag has changed, so
+             * need to modify the content of the random field.
+             */
+            bt_mesh_private_beacon_update_random(sub);
+#endif
+
            sub->kr_phase = BLE_MESH_KR_NORMAL;
            bt_mesh_net_revoke_keys(sub);

@ -669,13 +676,26 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
 {
    int i;

+    /* If a node in Normal Operation receives a Secure Network beacon or
+     * a Mesh Private beacon with an IV index less than the last known
+     * IV Index or greater than the last known IV Index + 42, the Secure
+     * Network beacon or the Mesh Private beacon shall be ignored.
+     */
+    if (iv_index < bt_mesh.iv_index ||
+        iv_index > bt_mesh.iv_index + 42) {
+        BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
+                iv_index, bt_mesh.iv_index);
+        return false;
+    }
+
    if (bt_mesh_atomic_test_bit(bt_mesh.flags, BLE_MESH_IVU_IN_PROGRESS)) {
        /* We're currently in IV Update mode */
-
-        if (iv_index != bt_mesh.iv_index) {
-            BT_WARN("IV Index mismatch: 0x%08x != 0x%08x",
-                    iv_index, bt_mesh.iv_index);
-            return false;
+        if (iv_index >= bt_mesh.iv_index + 1) {
+            BT_WARN("Performing IV Index Recovery");
+            (void)memset(bt_mesh.rpl, 0, sizeof(bt_mesh.rpl));
+            bt_mesh.iv_index = iv_index;
+            bt_mesh.seq = 0U;
+            goto do_update;
        }

        if (iv_update) {
@ -691,18 +711,6 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
            return false;
        }

-        /* If a node in Normal Operation receives a Secure Network beacon or
-         * a Mesh Private beacon with an IV index less than the last known
-         * IV Index or greater than the last known IV Index + 42, the Secure
-         * Network beacon or the Mesh Private beacon shall be ignored.
-         */
-        if (iv_index < bt_mesh.iv_index ||
-            iv_index > bt_mesh.iv_index + 42) {
-            BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
-                   iv_index, bt_mesh.iv_index);
-            return false;
-        }
-
        /* If a node in Normal Operation receives a Secure Network beacon
         * or a Mesh Private beacon with an IV index greater than the
         * last known IV Index + 1, it may initiate an IV Index Recovery
@ -1027,6 +1035,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
        tx->ctx->send_ttl = bt_mesh_default_ttl_get();
    }

+#if 0
    /* The output filter of the interface connected to advertising
     * or GATT bearers shall drop all messages with the TTL value
     * set to 1 unless they contain a network PDU that is tagged
@ -1038,6 +1047,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
        err = -EIO;
        goto done;
    }
+#endif

    /* Spec:
     * If the message security material is not set by the network
@ -1246,7 +1256,7 @@ int net_decrypt(struct bt_mesh_subnet *sub, const uint8_t *enc,

    rx->ctx.addr = BLE_MESH_NET_HDR_SRC(buf->data);
    if (!BLE_MESH_ADDR_IS_UNICAST(rx->ctx.addr)) {
-        BT_INFO("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
+        BT_DBG("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
        return -EINVAL;
    }

@ -1397,7 +1407,8 @@ static bool relay_to_adv(enum bt_mesh_net_if net_if)
    case BLE_MESH_NET_IF_ADV:
        return (bt_mesh_relay_get() == BLE_MESH_RELAY_ENABLED);
    case BLE_MESH_NET_IF_PROXY:
-        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED);
+        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
+                bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED);
    default:
        return false;
    }
@ -1465,6 +1476,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
        return;
    }

+#if CONFIG_BLE_MESH_BRC_SRV
+    if (rx->sbr_rpl) {
+        BT_ERR("Bridge RPL attack");
+        goto done;
+    }
+#endif
+
    if (cred != BLE_MESH_FLOODING_CRED
 #if CONFIG_BLE_MESH_DF_SRV
         && cred != BLE_MESH_DIRECTED_CRED
@ -1474,8 +1492,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
        return;
    }

-    if (rx->ctx.recv_ttl == 0x01 && bt_mesh_tag_relay(tag) == false) {
-        BT_DBG("Ignore PDU with TTL=1 but not tagged as relay");
+    if (rx->ctx.recv_ttl == 0x01) {
+        BT_DBG("Ignore PDU with TTL = 1");
+        return;
+    }
+
+    if (rx->ctx.recv_ttl == 0x02 && bt_mesh_tag_relay(tag) == false) {
+        BT_DBG("Ignore PDU with TTL = 2 but not tagged as relay");
        return;
    }

@ -1519,7 +1542,7 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 #endif

    if (!buf) {
-        BT_ERR("Out of relay buffers");
+        BT_INFO("Out of relay buffers");
        return;
    }

@ -1553,10 +1576,11 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,

    BT_DBG("Relaying packet. TTL is now %u", BLE_MESH_NET_HDR_TTL(buf->data));

-    /* 1. Update NID if RX or RX was with friend credentials.
+    /* 1. Update NID if RX or RX was with friend credentials(included by case 3).
     * 2. Update NID if the net_key has changed.
+     * 3. Update NID if credential has changed.
     */
-    if (rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED || netkey_changed) {
+    if (netkey_changed || cred != rx->ctx.recv_cred) {
        buf->data[0] &= 0x80; /* Clear everything except IVI */
        buf->data[0] |= nid;
    }
@ -1600,19 +1624,6 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
    if (((bearer & BLE_MESH_ADV_BEARER) && relay_to_adv(rx->net_if)) ||
        netkey_changed ||
        rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED) {
-        /* NOTE: temporary add for case MESH/NODE/SBR/NET/BV-01-C */
-#if CONFIG_BLE_MESH_BRC_SRV
-        if (bt_mesh_bridge_rpl_check(rx, NULL) && netkey_changed) {
-            BT_ERR("It is RPL attack, not bridge");
-            /**
-             * @todo:/NODE/DF/INIT/BV-TBD-C,
-             * The message from LT2 was double-checked,
-             * so the message was mistaken for an RPL attack.
-            */
-            goto done;
-        }
-#endif
-
 #if !CONFIG_BLE_MESH_RELAY_ADV_BUF
        bt_mesh_adv_send(buf, xmit, NULL, NULL);
 #else
@ -1844,7 +1855,11 @@ void bt_mesh_net_recv(struct net_buf_simple *data, int8_t rssi,
     * was neither a local element nor an LPN we're Friends for.
     */
    if (!BLE_MESH_ADDR_IS_UNICAST(rx.ctx.recv_dst) ||
-        (!rx.local_match && !rx.friend_match)) {
+        (!rx.local_match && !rx.friend_match
+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+        && !rx.replay_msg
+#endif
+        )) {
        net_buf_simple_restore(&buf, &state);
        bt_mesh_net_relay(&buf, &rx);
    }
--- a/components/bt/esp_ble_mesh/core/net.h
+++ b/components/bt/esp_ble_mesh/core/net.h
@ -58,7 +58,6 @@ struct bt_mesh_subnet {
    uint8_t  mpb_flags_last;            /* Flags of last sent private beacon */
    uint8_t  mpb_ivi_last: 1;           /* IV Index of last sent private beacon */
    uint8_t  mpb_random[13];            /* Random of current private beacon */
-    uint8_t  mpb_random_last[13];       /* Random of last sent private beacon */

    uint8_t  private_node_id;           /* Private Node Identity State */
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -274,6 +273,10 @@ struct bt_mesh_lpn {
    /* Previous Friend of this LPN */
    uint16_t old_friend;

+#if CONFIG_BLE_MESH_DF_SRV
+    uint8_t  old_directed_forwarding;
+#endif
+
    /* Duration reported for last advertising packet */
    uint16_t adv_duration;

@ -381,13 +384,17 @@ struct bt_mesh_net_rx {
    struct bt_mesh_subnet *sub;
    struct bt_mesh_msg_ctx ctx;
    uint32_t seq;            /* Sequence Number */
-    uint8_t  old_iv:1,       /* iv_index - 1 was used */
+    uint16_t old_iv:1,       /* iv_index - 1 was used */
             new_key:1,      /* Data was encrypted with updated key */
             friend_cred:1 __attribute__((deprecated)), /* Data was encrypted with friend cred */
             ctl:1,          /* Network Control */
             net_if:2,       /* Network interface */
             local_match:1,  /* Matched a local element */
-             friend_match:1; /* Matched an LPN we're friends for */
+             friend_match:1, /* Matched an LPN we're friends for */
+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+             replay_msg:1,   /* Replayed messages */
+#endif
+             sbr_rpl:1;      /* Bridge RPL attacker */
    uint16_t msg_cache_idx;  /* Index of entry in message cache */
 };

@ -406,7 +413,7 @@ extern struct bt_mesh_net bt_mesh;

 #define BLE_MESH_NET_IVI_TX         (bt_mesh.iv_index - \
                                     bt_mesh_atomic_test_bit(bt_mesh.flags, \
-                                     BLE_MESH_IVU_IN_PROGRESS))
+                                                             BLE_MESH_IVU_IN_PROGRESS))
 #define BLE_MESH_NET_IVI_RX(rx)     (bt_mesh.iv_index - (rx)->old_iv)

 #define BLE_MESH_NET_HDR_LEN        9
--- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
@ -81,14 +81,15 @@ static struct bt_mesh_conn_cb *bt_mesh_gatts_conn_cb;
 static uint8_t bt_mesh_gatts_addr[6];
 #endif /* CONFIG_BLE_MESH_NODE */

+static bool g_host_init = false;
+
 int bt_mesh_host_init(void)
 {
-    static bool init = false;
    int rc;

-    if (init == true) {
+    if (g_host_init  == true) {
        BT_WARN("Already initialized host for mesh!");
-        return 0;
+        return -EALREADY;
    }

    rc = btc_init();
@ -102,7 +103,30 @@ int bt_mesh_host_init(void)
    }

    osi_alarm_init();
-    init = true;
+    g_host_init  = true;
+
+    return 0;
+}
+
+int bt_mesh_host_deinit(void)
+{
+    int rc;
+
+    if (g_host_init == false) {
+        return -EALREADY;
+    }
+
+    osi_alarm_deinit();
+
+    rc = osi_alarm_delete_mux();
+    if (rc != 0) {
+        return -1;
+    }
+
+    btc_deinit();
+
+    g_host_init = false;
+
    return 0;
 }

@ -758,15 +782,17 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
                    const struct bt_mesh_adv_data *ad, size_t ad_len,
                    const struct bt_mesh_adv_data *sd, size_t sd_len)
 {
+    struct ble_gap_adv_params adv_params;
+    uint8_t buf[BLE_HS_ADV_MAX_SZ];
+    uint16_t interval = 0;
+    uint8_t buf_len = 0;
+    int err;
+
 #if BLE_MESH_DEV
    if (bt_mesh_atomic_test_bit(bt_mesh_dev.flags, BLE_MESH_DEV_ADVERTISING)) {
        return -EALREADY;
    }
 #endif
-    uint8_t buf[BLE_HS_ADV_MAX_SZ];
-    uint8_t buf_len = 0;
-    int err;
-    struct ble_gap_adv_params adv_params;

    err = set_ad(ad, ad_len, buf, &buf_len);
    if (err) {
@ -797,8 +823,6 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
    }

    memset(&adv_params, 0, sizeof adv_params);
-    adv_params.itvl_min = param->interval_min;
-    adv_params.itvl_max = param->interval_max;

    if (param->options & BLE_MESH_ADV_OPT_CONNECTABLE) {
        adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
@ -811,6 +835,25 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
        adv_params.disc_mode = BLE_GAP_DISC_MODE_NON;
    }

+    interval = param->interval_min;
+
+#if CONFIG_BLE_MESH_RANDOM_ADV_INTERVAL
+    /* If non-connectable mesh packets are transmitted with an adv interval
+     * not smaller than 10ms, then we will use a random adv interval between
+     * [interval / 2, interval] for them.
+     */
+    if (adv_params.conn_mode == BLE_GAP_CONN_MODE_NON &&
+        adv_params.disc_mode == BLE_GAP_DISC_MODE_NON && interval >= 16) {
+        interval >>= 1;
+        interval += (bt_mesh_get_rand() % (interval + 1));
+
+        BT_INFO("%u->%u", param->interval_min, interval);
+    }
+#endif
+
+    adv_params.itvl_min = interval;
+    adv_params.itvl_max = interval;
+
 again:
    err = ble_gap_adv_start(BLE_OWN_ADDR_PUBLIC, NULL, BLE_HS_FOREVER, &adv_params,
                            gap_event_cb, NULL);
@ -876,7 +919,7 @@ int bt_mesh_ble_adv_start(const struct bt_mesh_ble_adv_param *param,
        break;
    case BLE_MESH_ADV_NONCONN_IND:
        adv_params.conn_mode = BLE_GAP_CONN_MODE_NON;
-        adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
+        adv_params.disc_mode = BLE_GAP_DISC_MODE_NON;
        break;
    case BLE_MESH_ADV_DIRECT_IND_LOW_DUTY:
        adv_params.conn_mode = BLE_GAP_CONN_MODE_DIR;
@ -1940,10 +1983,6 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
    uint8_t value[6] =  {0};
    int rc = 0;

-#if MYNEWT_VAL(BLE_HCI_VS)
-    struct ble_hci_vs_duplicate_exception_list_cp cmd;
-#endif
-
    if ((sub_code > BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN) ||
        (sub_code < BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
         type > BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV) ||
@ -1958,18 +1997,23 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
            BT_ERR("Invalid Provisioning Link ID");
            return -EINVAL;
        }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
        sys_memcpy_swap(value, info, sizeof(uint32_t));
    }

    BT_DBG("%s exceptional list, type 0x%08x", sub_code ? "Remove" : "Add", type);

 #if MYNEWT_VAL(BLE_HCI_VS)
-    cmd.operation = sub_code;
-    cmd.type = htole32(type);
-    memcpy(&cmd.device_info, value, 6);
-
-    rc = ble_hs_hci_send_vs_cmd(BLE_HCI_OCF_VS_DUPLICATE_EXCEPTION_LIST,
-                                &cmd, sizeof(cmd), NULL, 0);
+    rc = ble_gap_duplicate_exception_list(sub_code, type, value, NULL);
 #endif

    return rc;
--- a/components/bt/esp_ble_mesh/core/prov_common.c
+++ b/components/bt/esp_ble_mesh/core/prov_common.c
@ -141,6 +141,11 @@ bool bt_mesh_prov_pdu_check(uint8_t type, uint16_t length, uint8_t *reason)
 #define XACT_SEG_DATA(link, _seg)   (&link->rx.buf->data[20 + (((_seg) - 1) * 23)])
 #define XACT_SEG_RECV(link, _seg)   (link->rx.seg &= ~(1 << (_seg)))

+static uint8_t bt_mesh_prov_buf_type_get(struct net_buf_simple *buf)
+{
+    return buf->data[PROV_BUF_HEADROOM];
+}
+
 uint8_t node_next_xact_id(struct bt_mesh_prov_link *link)
 {
    if (link->tx.id != 0 && link->tx.id != 0xFF) {
@ -677,6 +682,13 @@ int bt_mesh_prov_send(struct bt_mesh_prov_link *link, struct net_buf_simple *buf
 #endif /* CONFIG_BLE_MESH_PB_GATT */

 #if CONFIG_BLE_MESH_PB_ADV
+    if (bt_mesh_prov_buf_type_get(buf) == PROV_FAILED) {
+        /* For case MESH/NODE/PROV/BV-10-C, Node must send Transaction
+         * ACK before Provisioning Failed message is transmitted.
+         */
+        bt_mesh_gen_prov_ack_send(link, link->rx.id);
+    }
+
    return bt_mesh_prov_send_adv(link, buf);
 #endif /* CONFIG_BLE_MESH_PB_ADV */

--- a/components/bt/esp_ble_mesh/core/prov_common.h
+++ b/components/bt/esp_ble_mesh/core/prov_common.h
@ -62,8 +62,8 @@ extern "C" {
 #define REC_RSP_REC_NOT_PRESENT         0x01
 #define REC_RSP_OFFSET_OUT_OF_BOUND     0x02

-#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT_MASK(7))
-#define PROV_REC_SUPPORT(oob)           ((oob) & BIT_MASK(8))
+#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT(7))
+#define PROV_REC_SUPPORT(oob)           ((oob) & BIT(8))

 #if CONFIG_BLE_MESH_PROV_EPA
 #define PROV_ENC_SIZE(link)             ((link)->algorithm == PROV_ALG_P256_HMAC_SHA256 ? 32 : 16)
--- a/components/bt/esp_ble_mesh/core/prov_node.c
+++ b/components/bt/esp_ble_mesh/core/prov_node.c
@ -179,12 +179,6 @@ static void prov_send_fail_msg(uint8_t err)
 {
    PROV_BUF(buf, 2);

-    /**
-     * For the case MESH/NODE/PROV/BV-10-C, Node must send Transaction ACK
-     * before Provisioning Failed message is transmitted.
-     */
-    bt_mesh_gen_prov_ack_send(&prov_link, prov_link.rx.id);
-
    bt_mesh_prov_buf_init(&buf, PROV_FAILED);
    net_buf_simple_add_u8(&buf, err);

--- a/components/bt/esp_ble_mesh/core/prov_pvnr.c
+++ b/components/bt/esp_ble_mesh/core/prov_pvnr.c
@ -371,8 +371,7 @@ static int provisioner_start_prov_pb_adv(const uint8_t uuid[16], const bt_mesh_a

    for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
        if (!bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
-            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)
-            ) {
+            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)) {
            memcpy(prov_links[i].uuid, uuid, 16);
            prov_links[i].oob_info = oob_info;
            if (addr) {
@ -1070,14 +1069,24 @@ static void reset_adv_link(struct bt_mesh_prov_link *link, uint8_t reason)

 static void send_link_open(struct bt_mesh_prov_link *link)
 {
+    uint8_t count;
    int i;

-    /* Generate link ID, and may need to check if this id is
-     * currently being used, which may will not happen ever.
-     */
-    bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+    link->link_id = 0;

    while (1) {
+        count = 0;
+
+        /* Make sure the generated Link ID is not 0 */
+        while(link->link_id == 0) {
+            bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+            if (count++ > 10) {
+                BT_ERR("Link ID error: all zero");
+                return;
+            }
+        }
+
+        /* Check if the generated Link ID is the same with other links */
        for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
            if (bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
                prov_links[i].link_id == link->link_id) {
@ -1085,6 +1094,7 @@ static void send_link_open(struct bt_mesh_prov_link *link)
                break;
            }
        }
+
        if (i == CONFIG_BLE_MESH_PBA_SAME_TIME) {
            break;
        }
@ -3037,8 +3047,8 @@ void bt_mesh_provisioner_prov_adv_recv(struct net_buf_simple *buf,

    uuid = buf->data;
    net_buf_simple_pull(buf, 16);
-    /* Mesh beacon uses big-endian to send beacon data */
-    oob_info = net_buf_simple_pull_be16(buf);
+    /* According CSS, all the field within adv data shall be little-endian */
+    oob_info = net_buf_simple_pull_le16(buf);

    if (provisioner_check_unprov_dev_info(uuid, BLE_MESH_PROV_GATT)) {
        return;
--- a/components/bt/esp_ble_mesh/core/proxy_server.c
+++ b/components/bt/esp_ble_mesh/core/proxy_server.c
@ -35,7 +35,8 @@ _Static_assert(!(IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) && IS_ENABLED(CON

 #define ADV_OPT     (BLE_MESH_ADV_OPT_CONNECTABLE | BLE_MESH_ADV_OPT_ONE_TIME)

-#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && \
+    (CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX)
 #define RAND_UPDATE_INTERVAL    K_MINUTES(10)

 /* The Random field of Private Network Identity
@ -438,12 +439,12 @@ static int beacon_send(struct bt_mesh_proxy_client *client, struct bt_mesh_subne

 #if CONFIG_BLE_MESH_PROXY_PRIVACY
    if (client->proxy_privacy == BLE_MESH_PROXY_PRIVACY_ENABLED) {
-        bt_mesh_private_beacon_create(sub, &buf);
-
        /* NOTE: Each time a Mesh Private beacon for a subnet is sent to a Proxy Client,
         * the Random field in the Mesh Private beacon shall be regenerated.
         */
        bt_mesh_private_beacon_update_random(sub);
+
+        bt_mesh_private_beacon_create(sub, &buf);
    } else
 #endif
    {
@ -476,22 +477,9 @@ static void proxy_send_beacons(struct k_work *work)
    for (i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];

-#if 0
-        if (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
-            sub->node_id == BLE_MESH_NODE_IDENTITY_RUNNING) {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_DISABLED;
-        } else if (true) {
-#if CONFIG_BLE_MESH_PRB_SRV
-            /* TODO: Check if Private GATT Proxy or Private Node Identity is enabled */
-#endif
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_ENABLED;
-        } else {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_NOT_SUPPORTED;
-        }
-#endif
-
        if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
            beacon_send(client, sub);
+
 #if CONFIG_BLE_MESH_DF_SRV
            if (sub->directed_proxy != BLE_MESH_DIRECTED_PROXY_NOT_SUPPORTED) {
                bt_mesh_directed_proxy_server_directed_proxy_caps_status_send(client->conn, sub);
@ -630,16 +618,58 @@ static bool is_exist_private_node_id_enable(void)
    return false;
 }

-void disable_all_private_node_identity(void)
+int bt_mesh_proxy_private_identity_disable(void)
 {
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
    for (size_t i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
        /* NOTE: Set private node identity state of all valid subnets disabled */
        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];

-        if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
-            bt_mesh_proxy_server_private_identity_stop(sub);
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
        }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_stop(sub);
    }
+
+    return 0;
+}
+
+int bt_mesh_proxy_private_identity_enable(void)
+{
+    int count = 0;
+
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
+    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
+        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
+
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
+        }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_start(sub);
+        count++;
+    }
+
+    if (count) {
+        bt_mesh_adv_update();
+    }
+
+    return 0;
 }
 #endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* GATT_PROXY */
@ -1373,7 +1403,7 @@ static const struct bt_mesh_adv_data net_id_ad[] = {
    BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, proxy_svc_data, NET_ID_LEN),
 };

-#if CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX
 static const struct bt_mesh_adv_data private_node_id_ad[] = {
    BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
    BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x28, 0x18),
@ -1533,23 +1563,6 @@ static int private_node_id_adv(struct bt_mesh_subnet *sub)

    return 0;
 }
-
-void bt_mesh_prb_pnid_adv_local_set(bool start)
-{
-    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
-        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
-
-        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
-            continue;
-        }
-
-        if (start) {
-            bt_mesh_proxy_server_private_identity_start(sub);
-        } else {
-            bt_mesh_proxy_server_private_identity_stop(sub);
-        }
-    }
-}
 #endif /* CONFIG_BLE_MESH_PRB_SRV */

 #if (CONFIG_BLE_MESH_PRB_SRV || \
@ -1751,7 +1764,8 @@ static size_t gatt_prov_adv_create(struct bt_mesh_adv_data prov_sd[2])
    }

    memcpy(prov_svc_data + 2, bt_mesh_prov_get()->uuid, 16);
-    sys_put_be16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);
+    /* According CSS, all the field within adv data shall be little-endian */
+    sys_put_le16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);

    if (bt_mesh_prov_get()->uri) {
        size_t uri_len = strlen(bt_mesh_prov_get()->uri);
--- a/components/bt/esp_ble_mesh/core/proxy_server.h
+++ b/components/bt/esp_ble_mesh/core/proxy_server.h
@ -107,9 +107,9 @@ void bt_mesh_disable_private_gatt_proxy(void);

 bool bt_mesh_proxy_server_is_node_id_enable(void);

-void disable_all_private_node_identity(void);
+int bt_mesh_proxy_private_identity_disable(void);

-void bt_mesh_prb_pnid_adv_local_set(bool start);
+int bt_mesh_proxy_private_identity_enable(void);
 #endif /* CONFIG_BLE_MESH_PRB_SRV */

 void bt_mesh_proxy_server_identity_start(struct bt_mesh_subnet *sub);
--- a/components/bt/esp_ble_mesh/core/rpl.c
+++ b/components/bt/esp_ble_mesh/core/rpl.c
@ -64,6 +64,10 @@ static bool rpl_check_and_store(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **
                return false;
            }

+#if CONFIG_BLE_MESH_NOT_RELAY_REPLAY_MSG
+            rx->replay_msg = 1;
+#endif
+
            return true;
        }
    }
@ -87,11 +91,6 @@ bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
    return rpl_check_and_store(rx, match);
 }

-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
-{
-    return rpl_check_and_store(rx, match);
-}
-
 void bt_mesh_rpl_update(void)
 {
    /* Discard "old old" IV Index entries from RPL and flag
--- a/components/bt/esp_ble_mesh/core/rpl.h
+++ b/components/bt/esp_ble_mesh/core/rpl.h
@ -20,8 +20,6 @@ void bt_mesh_update_rpl(struct bt_mesh_rpl *rpl, struct bt_mesh_net_rx *rx);

 bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);

-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);
-
 void bt_mesh_rpl_update(void);

 void bt_mesh_rpl_reset_single(uint16_t src, bool erase);
--- a/components/bt/esp_ble_mesh/core/transport.c
+++ b/components/bt/esp_ble_mesh/core/transport.c
@ -90,7 +90,7 @@ static struct seg_tx {
    uint8_t                tag;         /* Additional metadata */
    const struct bt_mesh_send_cb *cb;
    void                  *cb_data;
-    struct k_delayed_work  retransmit;  /* Retransmit timer */
+    struct k_delayed_work  rtx_timer;   /* Segment Retransmission timer */
 } seg_tx[CONFIG_BLE_MESH_TX_SEG_MSG_COUNT];

 static struct seg_rx {
@ -106,7 +106,7 @@ static struct seg_rx {
    uint16_t               dst;
    uint32_t               block;
    uint32_t               last;
-    struct k_delayed_work  ack;
+    struct k_delayed_work  ack_timer;
    struct net_buf_simple  buf;
 } seg_rx[CONFIG_BLE_MESH_RX_SEG_MSG_COUNT] = {
    [0 ... (CONFIG_BLE_MESH_RX_SEG_MSG_COUNT - 1)] = {
@ -145,7 +145,7 @@ uint8_t bt_mesh_get_seg_rtx_num(void)
    return SEG_RETRANSMIT_ATTEMPTS;
 }

-int32_t bt_mesh_get_seg_rtx_timeout(uint8_t ttl)
+int32_t bt_mesh_get_seg_rtx_timeout(uint16_t dst, uint8_t ttl)
 {
    /* This function will be used when a client model sending an
     * acknowledged message. And if the dst of a message is not
@ -322,7 +322,7 @@ static void seg_tx_reset(struct seg_tx *tx)

    bt_mesh_seg_tx_lock();

-    k_delayed_work_cancel(&tx->retransmit);
+    k_delayed_work_cancel(&tx->rtx_timer);

    tx->cb = NULL;
    tx->cb_data = NULL;
@ -360,6 +360,8 @@ static inline void seg_tx_complete(struct seg_tx *tx, int err)

    seg_tx_reset(tx);

+    /* TODO: notify the completion of sending segmented message */
+
    if (cb && cb->end) {
        cb->end(err, cb_data);
    }
@ -377,7 +379,7 @@ static void schedule_retransmit(struct seg_tx *tx)
        return;
    }

-    k_delayed_work_submit(&tx->retransmit, SEG_RETRANSMIT_TIMEOUT(tx));
+    k_delayed_work_submit(&tx->rtx_timer, SEG_RETRANSMIT_TIMEOUT(tx));
 }

 static void seg_first_send_start(uint16_t duration, int err, void *user_data)
@ -471,7 +473,7 @@ static void seg_tx_send_unacked(struct seg_tx *tx)

 static void seg_retransmit(struct k_work *work)
 {
-    struct seg_tx *tx = CONTAINER_OF(work, struct seg_tx, retransmit);
+    struct seg_tx *tx = CONTAINER_OF(work, struct seg_tx, rtx_timer);

    seg_tx_send_unacked(tx);
 }
@ -511,10 +513,6 @@ static int send_seg(struct bt_mesh_net_tx *net_tx, struct net_buf_simple *sdu,
    }

    tx->dst = net_tx->ctx->addr;
-    /* TODO:
-     * When SAR Transmitter is introduced, the xmit may be
-     * updated with "bt_mesh_get_sar_seg_transmit()".
-     */
    if (sdu->len) {
        tx->seg_n = (sdu->len - 1) / seg_len(!!ctl_op);
    } else {
@ -784,6 +782,12 @@ static int sdu_recv(struct bt_mesh_net_rx *rx, uint32_t seq, uint8_t hdr,
                   rx->ctl, rx->ctx.recv_ttl, rx->ctx.addr, rx->ctx.recv_dst,
                   bt_hex(sdu->data, sdu->len));

+            /* When the Device Key Candidate is available, and an access message
+             * is decrypted using the Device Key Candidate that was delivered to
+             * the access layer, then the node shall revoke the device key, the
+             * Device Key Candidate shall become the device key, and the Device
+             * Key Candidate shall become unavailable.
+             */
            revoke_dev_key(dev_key);

            rx->ctx.app_idx = BLE_MESH_KEY_DEV;
@ -942,7 +946,7 @@ static int trans_ack(struct bt_mesh_net_rx *rx, uint8_t hdr,
        return -EINVAL;
    }

-    k_delayed_work_cancel(&tx->retransmit);
+    k_delayed_work_cancel(&tx->rtx_timer);

    while ((bit = find_lsb_set(ack))) {
        if (tx->seg[bit - 1]) {
@ -1216,11 +1220,9 @@ static int send_ack(struct bt_mesh_subnet *sub, uint16_t src, uint16_t dst,

 static void seg_rx_reset(struct seg_rx *rx, bool full_reset)
 {
-    BT_DBG("rx %p", rx);
-
    bt_mesh_seg_rx_lock();

-    k_delayed_work_cancel(&rx->ack);
+    k_delayed_work_cancel(&rx->ack_timer);

    if (IS_ENABLED(CONFIG_BLE_MESH_FRIEND) && rx->obo &&
        rx->block != BLOCK_COMPLETE(rx->seg_n)) {
@ -1267,9 +1269,7 @@ static uint32_t incomplete_timeout(struct seg_rx *rx)

 static void seg_ack(struct k_work *work)
 {
-    struct seg_rx *rx = CONTAINER_OF(work, struct seg_rx, ack);
-
-    BT_DBG("rx %p", rx);
+    struct seg_rx *rx = CONTAINER_OF(work, struct seg_rx, ack_timer);

    bt_mesh_seg_rx_lock();

@ -1291,14 +1291,14 @@ static void seg_ack(struct k_work *work)
    send_ack(rx->sub, rx->dst, rx->src, rx->ttl, &rx->seq_auth,
             rx->block, rx->obo);

-    k_delayed_work_submit(&rx->ack, ack_timeout(rx));
+    k_delayed_work_submit(&rx->ack_timer, ack_timeout(rx));

    bt_mesh_seg_rx_unlock();
 }

 static inline bool sdu_len_is_ok(bool ctl, uint8_t seg_n)
 {
-    return ((seg_n * seg_len(ctl) + 1) <= CONFIG_BLE_MESH_RX_SDU_MAX);
+    return ((seg_n + 1) * seg_len(ctl) <= CONFIG_BLE_MESH_RX_SDU_MAX);
 }

 static struct seg_rx *seg_rx_find(struct bt_mesh_net_rx *net_rx,
@ -1568,9 +1568,9 @@ found_rx:
    /* Reset the Incomplete Timer */
    rx->last = k_uptime_get_32();

-    if (!k_delayed_work_remaining_get(&rx->ack) &&
+    if (!k_delayed_work_remaining_get(&rx->ack_timer) &&
        !bt_mesh_lpn_established()) {
-        k_delayed_work_submit(&rx->ack, ack_timeout(rx));
+        k_delayed_work_submit(&rx->ack_timer, ack_timeout(rx));
    }

    /* Location in buffer can be calculated based on seg_o & rx->ctl */
@ -1594,7 +1594,7 @@ found_rx:

    *pdu_type = BLE_MESH_FRIEND_PDU_COMPLETE;

-    k_delayed_work_cancel(&rx->ack);
+    k_delayed_work_cancel(&rx->ack_timer);

    send_ack(net_rx->sub, net_rx->ctx.recv_dst, net_rx->ctx.addr,
             net_rx->ctx.send_ttl, seq_auth, rx->block, rx->obo);
@ -1754,11 +1754,11 @@ void bt_mesh_trans_init(void)
    bt_mesh_sar_init();

    for (i = 0; i < ARRAY_SIZE(seg_tx); i++) {
-        k_delayed_work_init(&seg_tx[i].retransmit, seg_retransmit);
+        k_delayed_work_init(&seg_tx[i].rtx_timer, seg_retransmit);
    }

    for (i = 0; i < ARRAY_SIZE(seg_rx); i++) {
-        k_delayed_work_init(&seg_rx[i].ack, seg_ack);
+        k_delayed_work_init(&seg_rx[i].ack_timer, seg_ack);
        seg_rx[i].buf.__buf = (seg_rx_buf_data +
                               (i * CONFIG_BLE_MESH_RX_SDU_MAX));
        seg_rx[i].buf.data = seg_rx[i].buf.__buf;
@ -1778,11 +1778,11 @@ void bt_mesh_trans_deinit(bool erase)
    bt_mesh_rpl_reset(erase);

    for (i = 0; i < ARRAY_SIZE(seg_tx); i++) {
-        k_delayed_work_free(&seg_tx[i].retransmit);
+        k_delayed_work_free(&seg_tx[i].rtx_timer);
    }

    for (i = 0; i < ARRAY_SIZE(seg_rx); i++) {
-        k_delayed_work_free(&seg_rx[i].ack);
+        k_delayed_work_free(&seg_rx[i].ack_timer);
    }

    bt_mesh_mutex_free(&seg_tx_lock);
--- a/components/bt/esp_ble_mesh/core/transport.enh.c
+++ b/components/bt/esp_ble_mesh/core/transport.enh.c
--- a/components/bt/esp_ble_mesh/core/transport.h
+++ b/components/bt/esp_ble_mesh/core/transport.h
@ -96,7 +96,7 @@ struct bt_mesh_ctl_friend_sub_confirm {

 uint8_t bt_mesh_get_seg_rtx_num(void);

-int32_t bt_mesh_get_seg_rtx_timeout(uint8_t ttl);
+int32_t bt_mesh_get_seg_rtx_timeout(uint16_t dst, uint8_t ttl);

 struct bt_mesh_app_key *bt_mesh_app_key_get(uint16_t app_idx);

--- a/components/bt/esp_ble_mesh/v1.1/ext.c
+++ b/components/bt/esp_ble_mesh/v1.1/ext.c
@ -76,6 +76,7 @@
 #define CLI_PARAM(a)    ((bt_mesh_client_common_param_t *)(a))
 #define CLI_NODE(a)     ((bt_mesh_client_node_t *)(a))
 #define ADV_DATA(a)     ((const struct bt_mesh_adv_data *)(a))
+#define RPL(a)          ((struct bt_mesh_rpl *)(a))
 #define VOID(a)         ((void *)(a))

 /* Sys utilities */
@ -739,6 +740,11 @@ size_t bt_mesh_ext_comp_get_elem_count(const void *comp)
    return COMP(comp)->elem_count;
 }

+void *bt_mesh_ext_comp_get_elem_s(const void *comp)
+{
+    return COMP(comp)->elem;
+}
+
 void *bt_mesh_ext_comp_get_elem(const void *comp, uint8_t index)
 {
    return &COMP(comp)->elem[index];
@ -1305,13 +1311,13 @@ void bt_mesh_ext_prov_clear_tx(void *link, bool cancel)

 uint8_t bt_mesh_ext_prov_node_next_xact_id(void *link)
 {
-#if CONFIG_BLE_MESH_NODE
+#if CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_ADV
    extern uint8_t node_next_xact_id(struct bt_mesh_prov_link *link);
    return node_next_xact_id(link);
 #else
    assert(0);
    return 0;
-#endif /* CONFIG_BLE_MESH_NODE */
+#endif /* CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_ADV */
 }

 void *bt_mesh_ext_prov_node_get_link(void)
@ -2228,6 +2234,56 @@ bool bt_mesh_ext_lpn_match(uint16_t addr)
 #endif /* CONFIG_BLE_MESH_LOW_POWER */
 }

+uint16_t bt_mesh_ext_lpn_frnd(void)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return bt_mesh.lpn.frnd;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+/* RPL */
+uint16_t bt_mesh_ext_rpl_get_src(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->src;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+bool bt_mesh_ext_rpl_get_old_iv(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->old_iv;
+#else
+    assert(0);
+    return false;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+uint32_t bt_mesh_ext_rpl_get_seq(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->seq;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+void bt_mesh_ext_update_rpl(void *rpl, void *rx)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    bt_mesh_update_rpl(RPL(rpl), NET_RX(rx));
+#else
+    assert(0);
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
 /* Adv */
 uint8_t bt_mesh_ext_adv_data_get_type(const void *ad)
 {
@ -2558,16 +2614,6 @@ uint8_t *bt_mesh_ext_sub_get_mpb_random(void *sub)
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
 }

-uint8_t *bt_mesh_ext_sub_get_mpb_random_last(void *sub)
-{
-#if CONFIG_BLE_MESH_PRIVATE_BEACON
-    return SUBNET(sub)->mpb_random_last;
-#else
-    assert(0);
-    return NULL;
-#endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
-}
-
 uint8_t bt_mesh_ext_sub_get_private_node_id(void *sub)
 {
 #if CONFIG_BLE_MESH_PRIVATE_BEACON
@ -3419,6 +3465,21 @@ void bt_mesh_ext_net_rx_set_net_if(void *rx, uint8_t net_if)
    NET_RX(rx)->net_if = net_if;
 }

+bool bt_mesh_ext_net_rx_get_old_iv(void *rx)
+{
+    return NET_RX(rx)->old_iv;
+}
+
+bool bt_mesh_ext_net_rx_get_sbr_rpl(void *rx)
+{
+    return NET_RX(rx)->sbr_rpl;
+}
+
+void bt_mesh_ext_net_rx_set_sbr_rpl(void *rx, bool sbr_rpl)
+{
+    NET_RX(rx)->sbr_rpl = sbr_rpl;
+}
+
 /* struct bt_mesh_msg_ctx */
 uint16_t bt_mesh_ext_msg_ctx_get_net_idx(void *ctx)
 {
@ -3674,12 +3735,6 @@ int bt_mesh_ext_client_send_msg(void *param, struct net_buf_simple *msg,
    return bt_mesh_client_send_msg(param, msg, need_ack, VOID(timeout_cb));
 }

-/* Bridge Configuration */
-bool bt_mesh_ext_bridge_rpl_check(void *rx, void **match)
-{
-    return bt_mesh_bridge_rpl_check(rx, (struct bt_mesh_rpl **)match);
-}
-
 #if CONFIG_BLE_MESH_BRC_SRV
 struct bt_mesh_subnet_bridge_table {
    uint8_t  bridge_direction;
@ -3695,6 +3750,8 @@ struct bt_mesh_bridge_cfg_srv {
    uint16_t bridging_table_size;
    struct bt_mesh_subnet_bridge_table bridge_table[CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT];
 };
+
+static struct bt_mesh_rpl bridge_rpl[CONFIG_BLE_MESH_BRIDGE_CRPL];
 #endif /* CONFIG_BLE_MESH_BRC_SRV */

 void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
@ -3707,6 +3764,16 @@ void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 }

+void *bt_mesh_ext_brc_srv_get_bridge_rpl(uint8_t index)
+{
+#if CONFIG_BLE_MESH_BRC_SRV
+    return &bridge_rpl[index];
+#else
+    assert(0);
+    return NULL;
+#endif /* CONFIG_BLE_MESH_BRC_SRV */
+}
+
 /* BTC */
 void bt_mesh_ext_agg_client_cb_evt_to_btc(uint32_t opcode, uint8_t event,
                                          void *model, void *ctx,
@ -3935,6 +4002,7 @@ typedef struct {
    uint16_t config_ble_mesh_proxy_solic_rx_crpl;
    uint16_t config_ble_mesh_proxy_solic_tx_src_count;
    uint16_t config_ble_mesh_max_bridging_table_entry_count;
+    uint16_t config_ble_mesh_bridge_crpl;
    uint16_t config_ble_mesh_max_disc_table_entry_count;
    uint16_t config_ble_mesh_max_forward_table_entry_count;
    uint16_t config_ble_mesh_max_deps_nodes_per_path;
@ -4105,6 +4173,7 @@ static const bt_mesh_ext_config_t bt_mesh_ext_cfg = {
 #endif /* CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX */
 #if CONFIG_BLE_MESH_BRC_SRV
    .config_ble_mesh_max_bridging_table_entry_count = CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT,
+    .config_ble_mesh_bridge_crpl                    = CONFIG_BLE_MESH_BRIDGE_CRPL,
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 #if CONFIG_BLE_MESH_DF_SRV
    .config_ble_mesh_max_disc_table_entry_count     = CONFIG_BLE_MESH_MAX_DISC_TABLE_ENTRY_COUNT,
@ -4328,6 +4397,7 @@ typedef struct {

 /* CONFIG_BLE_MESH_LOW_POWER */
    bool (*_bt_mesh_ext_lpn_match)(uint16_t addr);
+    uint16_t (*_bt_mesh_ext_lpn_frnd)(void);
 /* CONFIG_BLE_MESH_LOW_POWER */

 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@ -4448,7 +4518,6 @@ typedef struct {
    uint8_t (*_bt_mesh_ext_sub_get_mpb_ivi_last)(void *sub);
    void (*_bt_mesh_ext_sub_set_mpb_ivi_last)(void *sub, uint8_t mpb_ivi_last);
    uint8_t *(*_bt_mesh_ext_sub_get_mpb_random)(void *sub);
-    uint8_t *(*_bt_mesh_ext_sub_get_mpb_random_last)(void *sub);
    uint8_t (*_bt_mesh_ext_sub_get_private_node_id)(void *sub);
    uint8_t *(*_bt_mesh_ext_sub_get_keys_private_beacon)(void *sub, uint8_t index);
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -4457,6 +4526,7 @@ typedef struct {
    uint16_t (*_bt_mesh_ext_sub_get_sbr_net_idx)(void *sub);
    void (*_bt_mesh_ext_sub_set_sbr_net_idx)(void *sub, uint16_t sbr_net_idx);
    void *(*_bt_mesh_ext_brc_srv_get_bridge_table_entry)(void *srv, uint8_t index);
+    void *(*_bt_mesh_ext_brc_srv_get_bridge_rpl)(uint8_t index);
 /* CONFIG_BLE_MESH_BRC_SRV */

 /* CONFIG_BLE_MESH_AGG_CLI */
@ -4649,6 +4719,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {

 /* CONFIG_BLE_MESH_LOW_POWER */
    ._bt_mesh_ext_lpn_match                             = bt_mesh_ext_lpn_match,
+    ._bt_mesh_ext_lpn_frnd                              = bt_mesh_ext_lpn_frnd,
 /* CONFIG_BLE_MESH_LOW_POWER */

 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@ -4770,7 +4841,6 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
    ._bt_mesh_ext_sub_get_mpb_ivi_last                  = bt_mesh_ext_sub_get_mpb_ivi_last,
    ._bt_mesh_ext_sub_set_mpb_ivi_last                  = bt_mesh_ext_sub_set_mpb_ivi_last,
    ._bt_mesh_ext_sub_get_mpb_random                    = bt_mesh_ext_sub_get_mpb_random,
-    ._bt_mesh_ext_sub_get_mpb_random_last               = bt_mesh_ext_sub_get_mpb_random_last,
    ._bt_mesh_ext_sub_get_private_node_id               = bt_mesh_ext_sub_get_private_node_id,
    ._bt_mesh_ext_sub_get_keys_private_beacon           = bt_mesh_ext_sub_get_keys_private_beacon,
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@ -4779,6 +4849,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
    ._bt_mesh_ext_sub_get_sbr_net_idx                   = bt_mesh_ext_sub_get_sbr_net_idx,
    ._bt_mesh_ext_sub_set_sbr_net_idx                   = bt_mesh_ext_sub_set_sbr_net_idx,
    ._bt_mesh_ext_brc_srv_get_bridge_table_entry        = bt_mesh_ext_brc_srv_get_bridge_table_entry,
+    ._bt_mesh_ext_brc_srv_get_bridge_rpl                = bt_mesh_ext_brc_srv_get_bridge_rpl,
 /* CONFIG_BLE_MESH_BRC_SRV */

 /* CONFIG_BLE_MESH_AGG_CLI */
--- a/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
+++ b/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
@ -119,6 +119,11 @@ int bt_mesh_directed_update_dependent_node(void *sub, uint8_t type,
 int bt_mesh_directed_forwarding_ctl_recv(uint8_t ctl_op, void *rx,
                                         struct net_buf_simple *buf);

+void bt_mesh_restore_directed_forwarding_state(uint16_t net_idx,
+                                               uint8_t directed_forwarding);
+
+uint8_t bt_mesh_get_and_disable_directed_forwarding_state(void *sub);
+
 int bt_mesh_directed_forwarding_sub_init(void *sub);

 int bt_mesh_recovery_directed_forwarding_table(void *sub);
@ -182,6 +187,8 @@ bool bt_mesh_bridge_change_net_key(void *rx, const uint8_t **enc,
                                   const uint8_t **priv,
                                   uint8_t *nid, uint8_t cred);

+int bt_mesh_print_subnet_bridge_table(void);
+
 void bt_mesh_disable_directed_proxy_state(uint16_t net_idx);

 void bt_mesh_disable_directed_friend_state(uint16_t net_idx);
@ -241,6 +248,30 @@ uint8_t bt_mesh_net_retrans_match(void *rx, uint8_t *cred, uint8_t *tag);

 bool bt_mesh_dev_key_ca_valid(void);

+uint8_t bt_mesh_get_sar_sis(void);
+
+uint8_t bt_mesh_get_sar_urc(void);
+
+uint8_t bt_mesh_get_sar_urwpc(void);
+
+uint8_t bt_mesh_get_sar_uris(void);
+
+uint8_t bt_mesh_get_sar_urii(void);
+
+uint8_t bt_mesh_get_sar_mrc(void);
+
+uint8_t bt_mesh_get_sar_mris(void);
+
+uint8_t bt_mesh_get_sar_st(void);
+
+uint8_t bt_mesh_get_sar_adi(void);
+
+uint8_t bt_mesh_get_sar_arc(void);
+
+uint8_t bt_mesh_get_sar_dt(void);
+
+uint8_t bt_mesh_get_sar_rsis(void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bt/esp_ble_mesh/lib/lib
+++ b/components/bt/esp_ble_mesh/lib/lib
--- a/components/bt/esp_ble_mesh/models/client/client_common.c
+++ b/components/bt/esp_ble_mesh/models/client/client_common.c
@ -198,7 +198,7 @@ static int32_t bt_mesh_client_calc_timeout(struct bt_mesh_msg_ctx *ctx,
         * All the messages sent from here are access messages.
         */
        seg_rtx_num = bt_mesh_get_seg_rtx_num();
-        seg_rtx_to = bt_mesh_get_seg_rtx_timeout(ctx->send_ttl);
+        seg_rtx_to = bt_mesh_get_seg_rtx_timeout(ctx->addr, ctx->send_ttl);
        seg_count = (msg->len + mic_size - 1) / 12U + 1U;

        duration = bt_mesh_get_adv_duration(ctx);
--- a/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_rpr_model_api.h
+++ b/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_rpr_model_api.h
@ -238,6 +238,11 @@ typedef union {
    esp_ble_mesh_rpr_link_report_t      link_report;        /*!< For ESP_BLE_MESH_MODEL_OP_RPR_LINK_REPORT */
 } esp_ble_mesh_rpr_client_recv_cb_t;

+/** This enum value is the event type of the performed action */
+typedef enum {
+    ESP_BLE_MESH_START_RPR_COMP_SUB_EVT,
+} esp_ble_mesh_rpr_client_act_evt_t;
+
 /** Remote Provisioning Client model callback parameters */
 typedef union {
    /** Event parameters of sending messages */
@ -252,10 +257,7 @@ typedef union {
    } recv;                                             /*!< Event parameters of receiving messages */
    /** Event parameters of performed actions */
    struct {
-        /** Event type of the performed action */
-        enum {
-            ESP_BLE_MESH_START_RPR_COMP_SUB_EVT,
-        } sub_evt;                                      /*!< Event type of the performed action */
+        esp_ble_mesh_rpr_client_act_evt_t sub_evt;      /*!< Event type of the performed action */
        /**
         * @brief ESP_BLE_MESH_START_RPR_COMP_SUB_EVT
         */
--- a/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
+++ b/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
@ -63,15 +63,16 @@ typedef struct {
            sar_unicast_retrans_interval_step:4;            /*!< SAR Unicast Retransmissions Interval Step state */
    uint8_t sar_unicast_retrans_interval_increment:4,       /*!< SAR Unicast Retransmissions Interval Increment state */
            sar_multicast_retrans_count:4;                  /*!< SAR Multicast Retransmissions Count state */
-    uint8_t sar_multicast_retrans_interval:4;               /*!< SAR Multicast Retransmissions Interval state */
+    uint8_t sar_multicast_retrans_interval_step:4;          /*!< SAR Multicast Retransmissions Interval state */
 } esp_ble_mesh_sar_transmitter_set_t;

 /** Parameters of SAR Receiver Set */
 typedef struct {
    uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
            sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_set_t;

 /**
@ -90,15 +91,16 @@ typedef struct {
            sar_unicast_retrans_interval_step:4;            /*!< SAR Unicast Retransmissions Interval Step state */
    uint8_t sar_unicast_retrans_interval_increment:4,       /*!< SAR Unicast Retransmissions Interval Increment state */
            sar_multicast_retrans_count:4;                  /*!< SAR Multicast Retransmissions Count state */
-    uint8_t sar_multicast_retrans_interval:4;               /*!< SAR Multicast Retransmissions Interval state */
+    uint8_t sar_multicast_retrans_interval_step:4;          /*!< SAR Multicast Retransmissions Interval state */
 } esp_ble_mesh_sar_transmitter_status_t;

 /** Parameters of SAR Receiver Status */
 typedef struct {
    uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
            sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_status_t;

 /** Result of sending SAR Configuration Client messages */
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a
--- a/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a
+++ b/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a
--- a/Show More
+++ b/Show More