change(version): Update version to 5.2.5

Merge branch 'change/support_rssi_comp_in_esp32h2_ble' into 'release/v5.2'
feat(ble): support rssi comp for esp32h2 See merge request espressif/esp-idf!37146
2025-02-26 18:01:09 +08:00 · 2025-02-25 10:34:55 +08:00 · 2025-02-21 17:24:45 +08:00 · 2025-02-21 11:50:38 +08:00 · 2025-02-19 23:17:56 +08:00 · 2025-02-19 09:56:52 +08:00
3230 changed files with 174914 additions and 327909 deletions
--- a/.gitignore
+++ b/.gitignore
@ -100,6 +100,8 @@ dependencies.lock
 managed_components

 # pytest log
+pytest-embedded/
+# legacy one
 pytest_embedded_log/
 list_job_*.txt
 size_info.txt
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -3,8 +3,8 @@ workflow:
    # Disable those non-protected push triggered pipelines
    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && $CI_PIPELINE_SOURCE == "push"'
      when: never
-    # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
-    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
+    # when running merged result pipelines, CI_COMMIT_SHA represents the temp commit it created.
+    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha of the original commit.
    - if: $CI_OPEN_MERGE_REQUESTS != null
      variables:
        PIPELINE_COMMIT_SHA: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@ -2,228 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.github/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.github/dependabot.yml               @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.gitlab/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/fatfs/**/*.py             @esp-idf-codeowners/tools
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                  @esp-idf-codeowners/docs
-/docs/en/api-guides/jtag-debugging/     @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/         @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb* @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
-/docs/**/api-reference/system/          @esp-idf-codeowners/system
-/docs/**/security/                      @esp-idf-codeowners/security
-/docs/**/migration-guides/              @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-/tools/test_apps/README.md    @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@ -59,7 +59,7 @@
 - `example_test[_esp32/esp32s2/...]`
 - `fuzzer_test`
 - `host_test`
- `integration_test[_wifi/ble]`
+- `integration_test`
 - `iperf_stress_test`
 - `macos`
 - `macos_test`
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@ -1,7 +1,7 @@
 .build_template:
  stage: build
  extends:
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
  image: $ESP_ENV_IMAGE
  tags:
    - build
@ -16,13 +16,12 @@
  extends:
    - .build_template
    - .before_script:build
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
  dependencies: # set dependencies to null to avoid missing artifacts issue
  needs:
    - job: fast_template_app
      artifacts: false
-    - job: mr_variables
-      optional: true  # only MR pipelines would have this
+    - pipeline_variables
  artifacts:
    paths:
      # The other artifacts patterns are defined under tools/ci/artifacts_handler.py
@ -46,9 +45,10 @@
        examples/bluetooth/esp_ble_mesh/ble_mesh_console
        examples/bluetooth/hci/controller_hci_uart_esp32
        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
+    - python tools/ci/artifacts_handler.py upload

 .build_cmake_clang_template:
  extends:
@ -64,10 +64,10 @@
      --copy-sdkconfig
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
      $TEST_BUILD_OPTS_EXTRA
-    - upload_artifacts_to_s3
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_template:
  extends:
@ -81,9 +81,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_no_jtag_template:
  extends:
@ -97,9 +97,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_pytest_jtag_template:
  extends:
@ -113,9 +113,9 @@
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 build_pytest_examples_esp32:
  extends:
@ -263,9 +263,9 @@ build_only_components_apps:
      -t all
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 build_pytest_test_apps_esp32:
  extends:
@ -335,9 +335,9 @@ build_only_tools_test_apps:
      -t all
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - upload_artifacts_to_s3
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/artifacts_handler.py upload

 .build_template_app_template:
  extends:
@ -516,8 +516,14 @@ build_clang_test_apps_esp32c6:
  script:
    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
    - cd ${IDF_PATH}/tools/test_build_system
-    - pytest --parallel-count ${CI_NODE_TOTAL:-1} --parallel-index ${CI_NODE_INDEX:-1}
-      --work-dir ${CI_PROJECT_DIR}/test_build_system --junitxml=${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+    - python ${IDF_PATH}/tools/ci/get_known_failure_cases_file.py
+    - pytest
+      --cleanup-idf-copy
+      --parallel-count ${CI_NODE_TOTAL:-1}
+      --parallel-index ${CI_NODE_INDEX:-1}
+      --work-dir ${CI_PROJECT_DIR}/test_build_system
+      --junitxml ${CI_PROJECT_DIR}/XUNIT_RESULT.xml
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}

 pytest_build_system:
  extends: .test_build_system_template
@ -535,6 +541,7 @@ pytest_build_system_macos:
  extends:
    - .test_build_system_template
    - .before_script:build:macos
+    - .after_script:build:macos:upload-failed-job-logs:ccache-show-stats
    - .rules:build:macos
  tags:
    - macos_shell
@ -547,7 +554,11 @@ pytest_build_system_macos:
    expire_in: 2 days
    reports:
      junit: XUNIT_RESULT.xml
-
+  variables:
+    PYENV_VERSION: "3.8"
+    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
+    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
+    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
 build_docker:
  extends:
    - .before_script:minimal
--- a/.gitlab/ci/common.yml
+++ b/.gitlab/ci/common.yml
@ -14,22 +14,33 @@ stages:
  - post_deploy

 variables:
-# System environment
+  # System environment

  # Common parameters for the 'make' during CI tests
  MAKEFLAGS: "-j5 --no-keep-going"

-# GitLab-CI environment
-
-  # XXX_ATTEMPTS variables (https://docs.gitlab.com/ee/ci/runners/configure_runners.html#job-stages-attempts) are not defined here.
-  # Use values from  "CI / CD Settings" - "Variables".
-
-  # GIT_STRATEGY is not defined here.
-  # Use an option from  "CI / CD Settings" - "General pipelines".
-
+  # GitLab-CI environment
+  # Thanks to pack-objects cache, clone strategy should behave faster than fetch
+  #   so we pick "clone" as default git strategy
+  # Shiny runners by default remove the CI_PROJECT_DIR every time at the beginning of one job
+  #   and clone with a --depth=1
+  # Brew runners will fetch from locally mirror first, and cache the local CI_PROJECT_DIR
+  # In conclusion
+  # - set GIT_STRATEGY: "clone" to shiny runners
+  # - set GIT_STRATEGY: "fetch" to brew runners
+  GIT_STRATEGY: clone
  # we will download archive for each submodule instead of clone.
  # we don't do "recursive" when fetch submodule as they're not used in CI now.
  GIT_SUBMODULE_STRATEGY: none
+  # since we're using merged-result pipelines, the last commit should work for most cases
+  GIT_DEPTH: 1
+  # --no-recurse-submodules: we use cache for submodules
+  # --prune --prune-tags: in case remote branch or tag is force pushed
+  GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
+  # we're using .cache folder for caches
+  GIT_CLEAN_FLAGS: -ffdx -e .cache/
+  LATEST_GIT_TAG: v5.2.5
+
  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
  # by default we will fetch all submodules
  # jobs can overwrite this variable to only fetch submodules they required
@ -39,20 +50,17 @@ variables:
  IDF_SKIP_CHECK_SUBMODULES: 1

  IDF_PATH: "$CI_PROJECT_DIR"
-  BATCH_BUILD: "1"
  V: "0"
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
-  PYTHON_VER: 3.8.17

  # Docker images
-  ESP_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-env-v5.2:2"
-  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env-v5.2:2-1"
+  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.2:2"
+  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.2:2-1"
  QEMU_IMAGE: "${CI_DOCKER_REGISTRY}/qemu-v5.2:2-20230522"
-  TARGET_TEST_ENV_IMAGE: "$CI_DOCKER_REGISTRY/target-test-env-v5.2:2"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.2:2"

  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
-
-  PRE_COMMIT_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"
+  PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"

  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
@ -77,6 +85,9 @@ variables:
  # This is used only if CI_PYTHON_TOOL_REPO is not empty.
  CI_PYTHON_TOOL_BRANCH: ""

+  # Set this variable to specify the file name for the known failure cases.
+  KNOWN_FAILURE_CASES_FILE_NAME: "5.2.txt"
+
  IDF_CI_BUILD: 1

 ################################################
@ -92,6 +103,7 @@ variables:

  if echo "$CI_MERGE_REQUEST_LABELS" | egrep "(^|,)include_nightly_run(,|$)"; then
    export INCLUDE_NIGHTLY_RUN="1"
+    export NIGHTLY_RUN="1"
  fi

  # configure cmake related flags
@ -137,6 +149,10 @@ variables:
    $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
  fi

+  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
+  # Needed for pytest junit reports.
+  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
+
  source ./export.sh

  # Custom clang
@ -168,12 +184,21 @@ variables:
  # Show ccache statistics if enabled globally
  test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats || true

+.upload_failed_job_log_artifacts: &upload_failed_job_log_artifacts |
+  if [ $CI_JOB_STATUS = "failed" ]; then
+    python tools/ci/artifacts_handler.py upload --type logs
+  fi
+
 .before_script:minimal:
  before_script:
    - *common-before_scripts

 .before_script:build:macos:
  before_script:
+    # macos is running shell executor, which means it would use
+    # the system installed /usr/local/bin/python3 by default.
+    # Ensure pyenv and PYENV_VERSION installed
+    - eval "$(pyenv init -)"
    - *common-before_scripts
    # On macOS, these tools need to be installed
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
@ -182,6 +207,15 @@ variables:
    - *setup_tools_and_idf_python_venv
    - fetch_submodules

+.after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
+  after_script:
+    # macos is running shell executor, which means it would use
+    # the system installed /usr/local/bin/python3 by default.
+    # Ensure pyenv and PYENV_VERSION installed
+    - eval "$(pyenv init -)"
+    - *upload_failed_job_log_artifacts
+    - *show_ccache_statistics
+
 .before_script:build:
  before_script:
    - *common-before_scripts
@ -191,9 +225,104 @@ variables:
    - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}

-.after_script:build:ccache:
+.after_script:build:ccache-show-stats:
  after_script:
    - *show_ccache_statistics
+    - *upload_failed_job_log_artifacts
+
+##############################
+# Git Strategy Job Templates #
+##############################
+.git_init: &git_init |
+  mkdir -p "${CI_PROJECT_DIR}"
+  cd "${CI_PROJECT_DIR}"
+  git init
+
+.git_fetch_from_mirror_url_if_exists: &git_fetch_from_mirror_url_if_exists |
+  # check if set mirror
+  if [ -n "${LOCAL_GITLAB_HTTPS_HOST:-}" ] && [ -n "${ESPCI_TOKEN:-}" ]; then
+    MIRROR_REPO_URL="https://bot:${ESPCI_TOKEN}@${LOCAL_GITLAB_HTTPS_HOST}/${CI_PROJECT_PATH}"
+  elif [ -n "${LOCAL_GIT_MIRROR:-}" ]; then
+    MIRROR_REPO_URL="${LOCAL_GIT_MIRROR}/${CI_PROJECT_PATH}"
+  fi
+
+  # fetch from mirror first if set
+  if [ -n "${MIRROR_REPO_URL:-}" ]; then
+    if git remote -v | grep origin; then
+      git remote set-url origin "${MIRROR_REPO_URL}"
+    else
+      git remote add origin "${MIRROR_REPO_URL}"
+    fi
+    # mirror url may fail with authentication issue
+    git fetch origin --no-recurse-submodules || true
+  fi
+
+  # set remote url to CI_REPOSITORY_URL
+  if git remote -v | grep origin; then
+    git remote set-url origin "${CI_REPOSITORY_URL}"
+  else
+    git remote add origin "${CI_REPOSITORY_URL}"
+  fi
+
+.git_checkout_fetch_head: &git_checkout_fetch_head |
+  git checkout FETCH_HEAD
+  git clean ${GIT_CLEAN_FLAGS}
+
+# git diff requires two commits, with different CI env var
+#
+# By default, we use git strategy "clone" with depth 1 to speed up the clone process.
+# But for jobs requires running `git diff`, we need to fetch more commits to get the correct diffs.
+#
+# Since there's no way to get the correct git_depth before the job starts,
+# we can't set `GIT_DEPTH` in the job definition.
+#
+# Set git strategy to "none" and fetch manually instead.
+.before_script:fetch:git_diff:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    - *git_init
+    - *git_fetch_from_mirror_url_if_exists
+    - |
+      # merged results pipelines, by default
+      if [[ -n $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA ]]; then
+        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA)
+      # merge request pipelines, when the mr got conflicts
+      elif [[ -n $CI_MERGE_REQUEST_DIFF_BASE_SHA ]]; then
+        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_COMMIT_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_COMMIT_SHA)
+      # other pipelines, like the protected branches pipelines
+      elif [[ "$CI_COMMIT_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]]; then
+        git fetch origin $CI_COMMIT_BEFORE_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        git fetch origin $CI_COMMIT_SHA --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA)
+      else
+        # pipeline source could be web, scheduler, etc.
+        git fetch origin $CI_COMMIT_SHA --depth=2 ${GIT_FETCH_EXTRA_FLAGS}
+        export GIT_DIFF_OUTPUT=$(git diff --name-only $CI_COMMIT_SHA~1 $CI_COMMIT_SHA)
+      fi
+    - *git_checkout_fetch_head
+    - *common-before_scripts
+    - *setup_tools_and_idf_python_venv
+    - add_gitlab_ssh_keys
+
+# target test runners may locate in different places
+# for runners set git mirror, we fetch from the mirror first, then fetch the HEAD commit
+.before_script:fetch:target_test:
+  variables:
+    GIT_STRATEGY: none
+  before_script:
+    - *git_init
+    - *git_fetch_from_mirror_url_if_exists
+    - git fetch origin "${CI_COMMIT_SHA}" --depth=1 ${GIT_FETCH_EXTRA_FLAGS}
+    - *git_checkout_fetch_head
+    - *common-before_scripts
+    - *setup_tools_and_idf_python_venv
+    - add_gitlab_ssh_keys
+    # no submodules

 #############
 # `default` #
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@ -83,16 +83,6 @@
    - "build:{0}"
    - build:target_test

-build:integration_test:
-  labels:
-    - build
-  patterns:
-    - build_components
-    - build_system
-  included_in:
-    - build:target_test
-
-
 ####################
 # Target Test Jobs #
 ####################
@ -173,23 +163,6 @@ build:integration_test:
    - "build:example_test"
    - build:target_test

-"test:integration_test_{0}":
-  matrix:
-    - - wifi
-      - ble
-  labels:
-    - integration_test_{0}
-    - integration_test
-    - target_test
-  patterns:
-    - integration_test-{0}
-    - target_test-{0}
-    # - maybe others
-  included_in:
-    - test:integration_test
-    - build:integration_test
-    - build:target_test
-
 "test:host_test":
  labels:
    - host_test
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@ -1,8 +1,7 @@
 .deploy_job_template:
  stage: deploy
  image: $ESP_ENV_IMAGE
-  tags:
-    - deploy
+  tags: [ deploy ]

 # Check this before push_to_github
 check_submodule_sync:
@ -10,11 +9,11 @@ check_submodule_sync:
    - .deploy_job_template
    - .rules:test:submodule
  stage: test_deploy
-  tags:
-    - github_sync
+  tags: [ brew, github_sync ]
  retry: 2
  variables:
-    GIT_STRATEGY: clone
+    # for brew runners, we always set GIT_STRATEGY to fetch
+    GIT_STRATEGY: fetch
    SUBMODULES_TO_FETCH: "none"
    PUBLIC_IDF_URL: "https://github.com/espressif/esp-idf.git"
  dependencies: []
@ -35,6 +34,12 @@ push_to_github:
    - .rules:push_to_github
  needs:
    - check_submodule_sync
+  tags: [ brew, github_sync ]
+  variables:
+    # for brew runners, we always set GIT_STRATEGY to fetch
+    GIT_STRATEGY: fetch
+    # github also need full record of commits
+    GIT_DEPTH: 0
  script:
    - add_github_ssh_keys
    - git remote remove github &>/dev/null || true
@ -47,6 +52,9 @@ deploy_update_SHA_in_esp-dockerfiles:
    - .before_script:minimal
    - .rules:protected-no_label-always
  dependencies: []
+  variables:
+    GIT_DEPTH: 2
+  tags: [ shiny, build ]
  script:
    - 'curl --header "PRIVATE-TOKEN: ${ESPCI_SCRIPTS_TOKEN}" -o create_MR_in_esp_dockerfile.sh $GITLAB_HTTP_SERVER/api/v4/projects/1260/repository/files/create_MR_in_esp_dockerfile%2Fcreate_MR_in_esp_dockerfile.sh/raw\?ref\=master'
    - chmod +x create_MR_in_esp_dockerfile.sh
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@ -88,6 +88,7 @@ check_docs_lang_sync:
      artifacts: false
      optional: true
  script:
+    - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
    - cd docs
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
  parallel:
@ -147,6 +148,7 @@ build_docs_pdf:
    paths:
      - docs/_build/*/*/latex/*
    expire_in: 4 days
+  allow_failure: true # TODO IDFCI-2216
  variables:
    DOC_BUILDERS: "latex"

--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@ -13,8 +13,7 @@
    - job: upload-submodules-cache
      optional: true
      artifacts: false
-    - job: mr_variables
-      optional: true  # only MR pipelines would have this
+    - pipeline_variables

 test_nvs_on_host:
  extends: .host_test_template
@ -208,14 +207,6 @@ test_mkdfu:
    - cd ${IDF_PATH}/tools/test_mkdfu
    - ./test_mkdfu.py

-test_sbom:
-  extends:
-    - .host_test_template
-    - .rules:patterns:sbom
-  script:
-    - cd ${IDF_PATH}/tools/test_sbom
-    - pytest
-
 test_autocomplete:
  extends:
    - .host_test_template
@ -300,7 +291,7 @@ test_pytest_qemu:
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest_embedded_log/
+      - pytest-embedded/
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
@ -314,15 +305,15 @@ test_pytest_qemu:
      --pytest-apps
      -m qemu
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/get_known_failure_cases_file.py
    - run_cmd pytest
      --target $IDF_TARGET
      -m qemu
      --embedded-services idf,qemu
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --app-info-filepattern \"list_job_*.txt\"

 test_pytest_linux:
@ -333,7 +324,8 @@ test_pytest_linux:
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest_embedded_log/
+      - pytest-embedded/
+      - "**/build*/build_log.txt"
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
@ -343,12 +335,12 @@ test_pytest_linux:
      --pytest-apps
      -m host_test
      --collect-app-info "list_job_${CI_JOB_NAME_SLUG}.txt"
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+      --modified-components ${MODIFIED_COMPONENTS}
+      --modified-files ${MODIFIED_FILES}
+    - python tools/ci/get_known_failure_cases_file.py
    - run_cmd pytest
      --target linux
      -m host_test
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --app-info-filepattern \"list_job_*.txt\"
--- a/.gitlab/ci/integration_test.yml
+++ b/.gitlab/ci/integration_test.yml
@ -8,7 +8,7 @@
  - "tools/**/*"
  - ".gitlab-ci.yml"
  - ".gitlab/ci/common.yml"
-  - ".gitlab/ci/integration-test.yml"
+  - ".gitlab/ci/integration_test.yml"
  - ".gitmodules"
  - "CMakeLists.txt"
  - "install.sh"
@ -22,6 +22,10 @@
    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      changes: *patterns-integration_test
+    # support trigger by ci labels
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build(?:,[^,\n\r]+)*$/i'

 gen_integration_pipeline:
  extends:
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@ -5,27 +5,17 @@
    - host_test
  dependencies: []

-.check_pre_commit_template:
+check_pre_commit:
  extends:
    - .pre_check_template
    - .before_script:minimal
  image: $PRE_COMMIT_IMAGE
-
-check_pre_commit_master_release:
-  extends:
-    - .check_pre_commit_template
-    - .rules:protected
+  needs:
+    - pipeline_variables
  script:
    - fetch_submodules
-    - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files
-
-check_pre_commit_MR:
-  extends:
-    - .check_pre_commit_template
-    - .rules:mr
-  script:
-    - fetch_submodules
-    - python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs pre-commit run --files
+    - pre-commit run --files $MODIFIED_FILES
+    - pre-commit run --hook-stage post-commit validate-sbom-manifest

 check_MR_style_dangerjs:
  extends:
@ -60,6 +50,13 @@ check_version:
  extends:
    - .pre_check_template
    - .rules:protected
+  tags: [ brew, github_sync ]
+  variables:
+    # need a full clone to get the latest tag
+    # the --shallow-since=$(git log -1 --format=%as $LATEST_GIT_TAG) option is not accurate
+    GIT_STRATEGY: fetch
+    SUBMODULES_TO_FETCH: "none"
+    GIT_DEPTH: 0
  script:
    - export IDF_PATH=$PWD
    - tools/ci/check_idf_version.sh
@ -148,10 +145,18 @@ check_esp_system:

 # For release tag pipelines only, make sure the tag was created with 'git tag -a' so it will update
 # the version returned by 'git describe'
+# Don't forget to update the env var `LATEST_GIT_TAG` in .gitlab/ci/common.yml
 check_version_tag:
  extends:
    - .pre_check_template
    - .rules:tag:release
+  tags: [ brew, github_sync ]
+  variables:
+    # need a full clone to get the latest tag
+    # the --shallow-since=$(git log -1 --format=%as $LATEST_GIT_TAG) option is not accurate
+    GIT_STRATEGY: fetch
+    SUBMODULES_TO_FETCH: "none"
+    GIT_DEPTH: 0
  script:
    - (git cat-file -t $CI_COMMIT_REF_NAME | grep tag) || (echo "ESP-IDF versions must be annotated tags." && exit 1)

@ -179,22 +184,23 @@ check_configure_ci_environment_parsing:
    - cd tools/ci
    - python -m unittest ci_build_apps.py

-mr_variables:
+pipeline_variables:
  extends:
    - .pre_check_template
-    - .rules:mr
-    - .before_script:minimal
+    - .before_script:fetch:git_diff
  tags:
    - build
  script:
-    - echo "MR_MODIFIED_FILES=$(python tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs)" >> mr.env
-    - echo "MR_MODIFIED_COMPONENTS=$(python tools/ci/ci_get_mr_info.py components ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs)" >> mr.env
-    - >
+    - MODIFIED_FILES=$(echo "$GIT_DIFF_OUTPUT" | xargs)
+    - echo "MODIFIED_FILES=$MODIFIED_FILES" >> pipeline.env
+    - echo "MODIFIED_COMPONENTS=$(run_cmd python tools/ci/ci_get_mr_info.py components --modified-files $MODIFIED_FILES | xargs)" >> pipeline.env
+    - |
      if echo "$CI_MERGE_REQUEST_LABELS" | egrep "(^|,)BUILD_AND_TEST_ALL_APPS(,|$)"; then
-        echo "BUILD_AND_TEST_ALL_APPS=1" >> mr.env
+        echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
      fi
-    - cat mr.env
+    - cat pipeline.env
+    - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
  artifacts:
    reports:
-      dotenv: mr.env
+      dotenv: pipeline.env
    expire_in: 4 days
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@ -67,9 +67,6 @@
  - "tools/ci/ci_build_apps.py"
  - "tools/test_build_system/**/*"

-.patterns-sbom: &patterns-sbom
-  - "tools/test_sbom/*"
-
 .patterns-custom_test: &patterns-custom_test
  - "tools/ci/idf_pytest/**/*"
  - "tools/ci/python_packages/gitlab_api.py"
@ -112,22 +109,6 @@
 .patterns-component_ut-wifi: &patterns-component_ut-wifi
  - "components/esp_wifi/**/*"

-.patterns-integration_test-ble: &patterns-integration_test-ble
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-  - "components/bt/controller/lib_esp32"
-  - "components/bt/controller/lib_esp32c3_family"
-  - "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"
-  - "components/bt/host/nimble/nimble"
-  - "components/esp_phy/lib"
-  - "components/esp_coex/??[!s][!t]*/**/*"
-  - "components/esp_coex/???/**/*"
-  - "components/esp_coex/*"
-
-.patterns-integration_test-wifi: &patterns-integration_test-wifi
-  - "tools/ci/python_packages/gitlab_api.py"
-  - "tools/ci/integration_test/**/*"
-
 .patterns-build_macos: &patterns-build_macos
  - "tools/ci/test_configure_ci_environment.sh"

@ -187,6 +168,8 @@

  - "tools/split_paths_by_spaces.py"

+  - "tools/check_python_dependencies.py"
+
 .patterns-docker: &patterns-docker
  - "tools/docker/**/*"

@ -201,7 +184,6 @@
  - "components/esp_phy/lib"
  - "components/esp_wifi/lib"
  - "components/esp_coex/lib"
-  - "components/ieee802154/lib"
  - "components/json/cJSON"
  - "components/lwip/lwip"
  - "components/mbedtls/mbedtls"
@ -213,6 +195,7 @@
  - "components/unity/unity"
  - "components/heap/tlsf"
  - "components/bt/controller/lib_esp32c6/esp32c6-bt-lib"
+  - "components/bt/esp_ble_mesh/lib/lib"
  - ".gitmodules"

 .patterns-danger-npm: &patterns-danger-npm
@ -452,23 +435,6 @@
    - <<: *if-dev-push
      changes: *patterns-python-files

-.rules:patterns:static-code-analysis-preview:
-  rules:
-    - <<: *if-dev-push
-      changes: *patterns-c-files
-    - <<: *if-dev-push
-      changes: *patterns-python-files
-    - <<: *if-dev-push
-      changes: *patterns-sonarqube-files
-
-.rules:patterns:sbom:
-  rules:
-    - <<: *if-protected
-    - <<: *if-dev-push
-      changes: *patterns-sbom
-    - <<: *if-dev-push
-      changes: *patterns-submodule
-
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 # DO NOT place comments or maintain any code from this line
 #
@ -571,15 +537,6 @@
 .if-label-host_test: &if-label-host_test
  if: '$BOT_LABEL_HOST_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*host_test(?:,[^,\n\r]+)*$/i'

-.if-label-integration_test: &if-label-integration_test
-  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_ble: &if-label-integration_test_ble
-  if: '$BOT_LABEL_INTEGRATION_TEST_BLE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_ble(?:,[^,\n\r]+)*$/i'
-
-.if-label-integration_test_wifi: &if-label-integration_test_wifi
-  if: '$BOT_LABEL_INTEGRATION_TEST_WIFI || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_wifi(?:,[^,\n\r]+)*$/i'
-
 .if-label-macos: &if-label-macos
  if: '$BOT_LABEL_MACOS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*macos(?:,[^,\n\r]+)*$/i'

@ -1584,9 +1541,6 @@
    - <<: *if-label-example_test_esp32p4
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
-    - <<: *if-label-integration_test
-    - <<: *if-label-integration_test_ble
-    - <<: *if-label-integration_test_wifi
    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
@ -1634,10 +1588,6 @@
      changes: *patterns-example_test-usb
    - <<: *if-dev-push
      changes: *patterns-example_test-wifi
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-ble
-    - <<: *if-dev-push
-      changes: *patterns-integration_test-wifi
    - <<: *if-dev-push
      changes: *patterns-target_test-adc
    - <<: *if-dev-push
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@ -20,6 +20,8 @@ check_pylint:
  extends:
    - .pre_check_template
    - .rules:patterns:python-files
+  needs:
+    - pipeline_variables
  artifacts:
    when: always
    reports:
@ -28,88 +30,9 @@ check_pylint:
  script:
    - |
      if [ -n "$CI_MERGE_REQUEST_IID" ]; then
-        export files=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | grep ".py$");
+        export files=$(echo "$GIT_DIFF_OUTPUT" | grep ".py$" | xargs);
      else
-        export files=$(find . -iname "*.py" -print);
+        export files=$(git ls-files "*.py" | xargs);
      fi
    - if [ -z "$files" ]; then echo "No python files found"; exit 0; fi
    - run_cmd pylint --exit-zero --load-plugins=pylint_gitlab --output-format=gitlab-codeclimate:pylint.json $files
-
-# build stage
-# Sonarqube related jobs put here for this reason:
-# Here we have two jobs. code_quality_check and code_quality_report.
-#
-# code_quality_check will analyze the code changes between your MR and
-# code repo stored in sonarqube server. The analysis result is only shown in
-# the comments under this MR and won't be transferred to the server.
-#
-# code_quality_report will analyze and transfer both of the newly added code
-# and the analysis result to the server.
-#
-# Put in the front to ensure that the newly merged code can be stored in
-# sonarqube server ASAP, in order to avoid reporting unrelated code issues
-.sonar_scan_template:
-  stage: build
-  extends: .pre_check_template
-  image:
-    name: $SONARQUBE_SCANNER_IMAGE
-  before_script:
-    - source tools/ci/utils.sh
-    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
-    - fetch_submodules
-    # Exclude the submodules, all paths ends with /**
-    - submodules=$(get_all_submodules)
-    # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
-    - custom_excludes=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
-    # Exclude the report dir as well
-    - export EXCLUSIONS="$custom_excludes,$submodules"
-    - export SONAR_SCANNER_OPTS="-Xmx2048m"
-  variables:
-    GIT_DEPTH: 0
-    REPORT_PATTERN: clang_tidy_reports/*.txt
-  artifacts:
-    when: always
-    paths:
-      - $REPORT_PATTERN
-    expire_in: 1 week
-  dependencies:  # Here is not a hard dependency relationship, could be skipped when only python files changed. so we do not use "needs" here.
-    - clang_tidy_check
-
-code_quality_check:
-  extends:
-    - .sonar_scan_template
-    - .rules:patterns:static-code-analysis-preview
-  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits ${CI_COMMIT_REF_NAME} | tr '\n' ',')
-    # test if this branch have merge request, if not, exit 0
-    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
-    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
-    - sonar-scanner
-      -Dsonar.analysis.mode=preview
-      -Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID
-      -Dsonar.gitlab.commit_sha=$CI_MERGE_REQUEST_COMMITS
-      -Dsonar.gitlab.merge_request_discussion=true
-      -Dsonar.gitlab.ref_name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN
-
-code_quality_report:
-  extends:
-    - .sonar_scan_template
-    - .rules:protected
-  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
-                       # we don't want to block ci when critical issues founded
-  script:
-    - sonar-scanner
-      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
-      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
-      -Dsonar.exclusions=$EXCLUSIONS
-      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
-      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
-      -Dsonar.host.url=$SONAR_HOST_URL
-      -Dsonar.login=$SONAR_LOGIN
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@ -1,17 +1,18 @@
 .target_test_template:
  image: $TARGET_TEST_ENV_IMAGE
+  extends:
+    - .before_script:fetch:target_test
  stage: target_test
  timeout: 1 hour
  dependencies: []
-  variables:
-    GIT_DEPTH: 1
-    SUBMODULES_TO_FETCH: "none"
  cache:
    # Usually do not need submodule-cache in target_test
    - key: pip-cache
      paths:
        - .cache/pip
      policy: pull
+  after_script:
+    - python tools/ci/artifacts_handler.py upload --type logs junit_reports

 .pytest_template:
  extends:
@ -20,12 +21,12 @@
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest_embedded_log/
+      - pytest-embedded/
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -45,7 +46,7 @@
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -228,6 +229,15 @@ pytest_examples_esp32c6_generic:
      artifacts: false
  tags: [ esp32c6, generic ]

+pytest_examples_esp32c6_usj_device:
+  extends:
+    - .pytest_examples_dir_template
+    - .rules:test:example_test-esp32c6
+  needs:
+    - job: build_pytest_examples_esp32c6
+      artifacts: false
+  tags: [ esp32c6, usj_device ]
+
 pytest_examples_esp32h2_generic:
  extends:
    - .pytest_examples_dir_template
@ -469,7 +479,7 @@ pytest_examples_esp32_ethernet_ip101:
  needs:
    - job: build_pytest_examples_esp32
      artifacts: false
-  tags: [ esp32, ip101 ]
+  tags: [ esp32, eth_ip101 ]

 pytest_examples_esp32_ethernet_bridge:
  extends:
@ -730,7 +740,7 @@ pytest_components_esp32_ip101:
  needs:
    - job: build_pytest_components_esp32
      artifacts: false
-  tags: [ esp32, ip101 ]
+  tags: [ esp32, eth_ip101 ]

 pytest_components_esp32_lan8720:
  extends:
@ -1278,7 +1288,7 @@ pytest_examples_openthread_br:
      artifacts: false
  tags: [ esp32c6, openthread_br ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1293,7 +1303,7 @@ pytest_examples_openthread_br:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -1312,7 +1322,7 @@ pytest_examples_openthread_bbr:
      artifacts: false
  tags: [ esp32c6, openthread_bbr ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1327,7 +1337,7 @@ pytest_examples_openthread_bbr:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@ -1344,7 +1354,7 @@ pytest_examples_openthread_sleep:
      artifacts: false
  tags: [ esp32c6, openthread_sleep ]
  script:
-    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
+    - python tools/ci/get_known_failure_cases_file.py
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@ -1358,7 +1368,7 @@ pytest_examples_openthread_sleep:
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --ignore-result-files known_failure_cases/known_failure_cases.txt
+      --ignore-result-files ${KNOWN_FAILURE_CASES_FILE_NAME}
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
--- a/.gitmodules
+++ b/.gitmodules
@ -49,12 +49,13 @@
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
-	sbom-version = 1.7.16
+	sbom-version = 1.7.18
 	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = cb8693b058ba302f4829ec6d03f609ac6f848546
+	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
@ -120,10 +121,6 @@
 	path = components/openthread/lib
 	url = ../../espressif/esp-thread-lib.git

-[submodule "components/ieee802154/lib"]
-	path = components/ieee802154/lib
-	url = ../../espressif/esp-ieee802154-lib.git
-
 [submodule "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"]
 	path = components/bt/controller/lib_esp32h2/esp32h2-bt-lib
 	url = ../../espressif/esp32h2-bt-lib.git
@ -143,3 +140,7 @@
 [submodule "components/esp_coex/lib"]
 	path = components/esp_coex/lib
 	url = ../../espressif/esp-coex-lib.git
+
+[submodule "components/bt/esp_ble_mesh/lib/lib"]
+	path = components/bt/esp_ble_mesh/lib/lib
+	url = ../../espressif/esp-ble-mesh-lib.git
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -1,9 +1,11 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks

+default_stages: [commit]
+
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.0.1
+    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
        # note: whitespace exclusions use multiline regex, see https://pre-commit.com/#regular-expressions
@ -39,11 +41,12 @@ repos:
    hooks:
      - id: flake8
        args: ['--config=.flake8', '--tee', '--benchmark']
-  - repo: https://github.com/pycqa/isort
-    rev: 5.12.0  # python 3.8 compatible
+  - repo: https://github.com/asottile/reorder-python-imports
+    rev: v3.12.0
    hooks:
-      - id: isort
-        name: isort (python)
+      - id: reorder-python-imports
+        name: Reorder Python imports
+        args: [--py38-plus]
        exclude: >
          (?x)^(
              .*_pb2.py
@ -67,7 +70,7 @@ repos:
        entry: tools/ci/check_kconfigs.py
        language: python
        additional_dependencies:
-          - esp-idf-kconfig
+          - esp-idf-kconfig>=1.5.0,<2.0.0
        files: '^Kconfig$|Kconfig.*$'
      - id: check-deprecated-kconfigs-options
        name: Check if any Kconfig Options Deprecated
@ -109,10 +112,10 @@ repos:
        name: Check type annotations in python files
        entry: tools/ci/check_type_comments.py
        additional_dependencies:
-          - 'mypy==0.940'
-          - 'mypy-extensions==0.4.3'
-          - 'types-setuptools==57.4.14'
-          - 'types-PyYAML==0.1.9'
+          - 'mypy'
+          - 'mypy-extensions'
+          - 'types-setuptools'
+          - 'types-PyYAML'
        exclude: >
          (?x)^(
              .*_pb2.py
@ -177,12 +180,6 @@ repos:
        always_run: true
        pass_filenames: false
        require_serial: true
-      - id: submodule-sbom-hash-check
-        name: Check if sbom-hash values for submodules in .gitmodules match submodules checkout hash in git tree
-        entry: python tools/test_sbom/test_submodules.py
-        language: python
-        always_run: true
-        pass_filenames: false
      - id: cleanup-ignore-lists
        name: Remove non-existing patterns from ignore lists
        entry: tools/ci/cleanup_ignore_lists.py
@ -205,7 +202,7 @@ repos:
      - id: conventional-precommit-linter
        stages: [commit-msg]
  - repo: https://github.com/espressif/astyle_py.git
-    rev: v1.0.2
+    rev: v1.0.5
    hooks:
      - id: astyle_py
        # If you are modifying astyle version, update tools/format.sh as well
@ -221,3 +218,8 @@ repos:
      name: shellcheck dash (export.sh)
      args: ['--shell', 'dash', '-x']
      files: 'export.sh'
+  - repo: https://github.com/espressif/esp-idf-sbom.git
+    rev: v0.13.0
+    hooks:
+      - id: validate-sbom-manifest
+        stages: [post-commit]
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -134,6 +134,10 @@ if(CONFIG_COMPILER_OPTIMIZATION_ASSERTIONS_DISABLE)
    list(APPEND compile_definitions "-DNDEBUG")
 endif()

+if(CONFIG_COMPILER_NO_MERGE_CONSTANTS)
+    list(APPEND compile_options "-fno-merge-constants")
+endif()
+
 if(CONFIG_COMPILER_STACK_CHECK_MODE_NORM)
    list(APPEND compile_options "-fstack-protector")
 elseif(CONFIG_COMPILER_STACK_CHECK_MODE_STRONG)
@ -146,6 +150,10 @@ if(CONFIG_COMPILER_DUMP_RTL_FILES)
    list(APPEND compile_options "-fdump-rtl-expand")
 endif()

+idf_build_set_property(GDBINIT_FILES_PREFIX_MAP "${BUILD_DIR}/gdbinit/prefix_map")
+file(MAKE_DIRECTORY "${BUILD_DIR}/gdbinit")
+file(WRITE "${BUILD_DIR}/gdbinit/prefix_map" "")
+
 if(NOT ${CMAKE_C_COMPILER_VERSION} VERSION_LESS 8.0.0)
    if(CONFIG_COMPILER_HIDE_PATHS_MACROS)
        list(APPEND compile_options "-fmacro-prefix-map=${CMAKE_SOURCE_DIR}=.")
@ -213,8 +221,35 @@ endif()
 list(APPEND link_options "-fno-lto")

 if(CONFIG_IDF_TARGET_LINUX AND CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin")
+    # Not all versions of the MacOS linker support the -warn_commons flag.
+    # ld version 1053.12 (and above) have been tested to support it.
+    # Hence, we extract the version string from the linker output
+    # before including the flag.
+
+    # Get the ld version, capturing both stdout and stderr
+    execute_process(
+        COMMAND ${CMAKE_LINKER} -v
+        OUTPUT_VARIABLE LD_VERSION_OUTPUT
+        ERROR_VARIABLE LD_VERSION_ERROR
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_STRIP_TRAILING_WHITESPACE
+    )
+
+    # Combine stdout and stderr
+    set(LD_VERSION_OUTPUT "${LD_VERSION_OUTPUT}\n${LD_VERSION_ERROR}")
+
+    # Extract the version string
+    string(REGEX MATCH "PROJECT:(ld|dyld)-([0-9]+)\\.([0-9]+)" LD_VERSION_MATCH "${LD_VERSION_OUTPUT}")
+    set(LD_VERSION_MAJOR_MINOR "${CMAKE_MATCH_2}.${CMAKE_MATCH_3}")
+
+    message(STATUS "Linker Version: ${LD_VERSION_MAJOR_MINOR}")
+
+    # Compare the version with 1053.12
+    if(LD_VERSION_MAJOR_MINOR VERSION_GREATER_EQUAL "1053.12")
+        list(APPEND link_options "-Wl,-warn_commons")
+    endif()
+
    list(APPEND link_options "-Wl,-dead_strip")
-    list(APPEND link_options "-Wl,-warn_commons")
 else()
    list(APPEND link_options "-Wl,--gc-sections")
    list(APPEND link_options "-Wl,--warn-common")
--- a/33
+++ b/33
@ -496,6 +496,15 @@ mainmenu "Espressif IoT Development Framework Configuration"
            help
                Stack smashing protection.

+        config COMPILER_NO_MERGE_CONSTANTS
+            bool "Disable merging const sections"
+            depends on IDF_TOOLCHAIN_GCC
+            help
+                Disable merging identical constants (string/floating-point) across compilation units.
+                This helps in better size analysis of the application binary as the rodata section
+                distribution is more uniform across libraries. On downside, it may increase
+                the binary size and hence should be used during development phase only.
+
        config COMPILER_WARN_WRITE_STRINGS
            bool "Enable -Wwrite-strings warning flag"
            default "n"
@ -570,6 +579,27 @@ mainmenu "Espressif IoT Development Framework Configuration"
            default "gcc" if COMPILER_RT_LIB_GCCLIB
            default "" if COMPILER_RT_LIB_HOST

+        choice COMPILER_ORPHAN_SECTIONS
+            prompt "Orphan sections handling"
+            default COMPILER_ORPHAN_SECTIONS_PLACE
+            depends on !IDF_TARGET_LINUX
+            help
+                If the linker finds orphan sections, it attempts to place orphan sections after sections of the same
+                attribute such as code vs data, loadable vs non-loadable, etc.
+                That means that orphan sections could placed between sections defined in IDF linker scripts.
+                This could lead to corruption of the binary image. Configure the linker action here.
+
+            config COMPILER_ORPHAN_SECTIONS_WARNING
+                bool "Place with warning"
+                help
+                    Places orphan sections with a warning message.
+
+            config COMPILER_ORPHAN_SECTIONS_PLACE
+                bool "Place silently"
+                help
+                    Places orphan sections without a warning/error message.
+        endchoice
+
    endmenu # Compiler Options

    menu "Component config"
@ -590,4 +620,5 @@ mainmenu "Espressif IoT Development Framework Configuration"
            - CONFIG_ESPTOOLPY_FLASHFREQ_120M && CONFIG_ESPTOOLPY_FLASH_SAMPLE_MODE_DTR
            - CONFIG_SPIRAM_SPEED_120M && CONFIG_SPIRAM_MODE_OCT
            - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
-            - CONFIG_MBEDTLS_USE_CRYPTO_ROM_IMPL
+            - CONFIG_USB_HOST_EXT_PORT_SUPPORT_LS
+            - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS
--- a/components/app_trace/gcov/gcov_rtio.c
+++ b/components/app_trace/gcov/gcov_rtio.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -15,7 +15,8 @@
 #include "esp_app_trace.h"
 #include "esp_freertos_hooks.h"
 #include "esp_private/dbg_stubs.h"
-#include "esp_ipc.h"
+#include "esp_private/esp_ipc.h"
+#include "esp_attr.h"
 #include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
@ -80,11 +81,11 @@ void gcov_create_task(void *arg)
 		(void *)&s_gcov_task_running, configMAX_PRIORITIES - 1, NULL, 0);
 }

+static IRAM_ATTR
 void gcov_create_task_tick_hook(void)
 {
-    extern esp_err_t esp_ipc_start_gcov_from_isr(uint32_t cpu_id, esp_ipc_func_t func, void* arg);
    if (s_create_gcov_task) {
-        if (esp_ipc_start_gcov_from_isr(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
+        if (esp_ipc_call_nonblocking(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
            s_create_gcov_task = false;
        }
    }
@ -106,12 +107,16 @@ static int esp_dbg_stub_gcov_entry(void)

 void gcov_rtio_init(void)
 {
-    uint32_t capabilities = 0;
+    uint32_t stub_entry = 0;
    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
-    esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_GCOV, (uint32_t)&esp_dbg_stub_gcov_entry);
-    if (esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &capabilities) == ESP_OK) {
-        esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, capabilities | ESP_DBG_STUB_CAP_GCOV_TASK);
+    assert(esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_GCOV, &stub_entry) == ESP_OK);
+    if (stub_entry != 0) {
+        /* "__gcov_init()" can be called several times. We must avoid multiple tick hook registration */
+        return;
    }
+    esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_GCOV, (uint32_t)&esp_dbg_stub_gcov_entry);
+    assert(esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &stub_entry) == ESP_OK);
+    esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, stub_entry | ESP_DBG_STUB_CAP_GCOV_TASK);
    esp_register_freertos_tick_hook(gcov_create_task_tick_hook);
 }

--- a/components/app_trace/sys_view/ext/heap_trace_module.c
+++ b/components/app_trace/sys_view/ext/heap_trace_module.c
@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif

 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
    .NumEvents = 2,
 };

--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@ -199,13 +199,18 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
        return ESP_ERR_INVALID_ARG;
    }

+    if (size == 0) {
+        ESP_LOGD(TAG, "write data size is 0");
+        return ESP_OK;
+    }
+
    // find ota handle in linked list
    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
        if (it->handle == handle) {
            if (it->need_erase) {
                // must erase the partition before writing to it
-                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE;
-                uint32_t last_sector = (it->wrote_size + size) / SPI_FLASH_SEC_SIZE;
+                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE; // first affected sector
+                uint32_t last_sector = (it->wrote_size + size - 1) / SPI_FLASH_SEC_SIZE; // last affected sector

                ret = ESP_OK;
                if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
@ -960,6 +965,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
    }

    const esp_partition_t *running_app_part = esp_ota_get_running_partition();
+    esp_err_t ret = ESP_FAIL;
 #ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
    esp_ota_img_states_t running_app_state;
    ret = esp_ota_get_state_partition(running_app_part, &running_app_state);
@ -974,7 +980,7 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
 #endif

    esp_secure_boot_key_digests_t trusted_keys;
-    esp_err_t ret = esp_secure_boot_read_key_digests(&trusted_keys);
+    ret = esp_secure_boot_read_key_digests(&trusted_keys);
    if (ret != ESP_OK) {
        ESP_LOGE(TAG, "Could not read the secure boot key digests from efuse. Aborting..");
        return ESP_FAIL;
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -111,7 +111,7 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
 * @param size    Size of data buffer in bytes.
 *
 * @return
- *    - ESP_OK: Data was written to flash successfully.
+ *    - ESP_OK: Data was written to flash successfully, or size = 0
 *    - ESP_ERR_INVALID_ARG: handle is invalid.
 *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
 *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
--- a/components/app_update/test_apps/.build-test-rules.yml
+++ b/components/app_update/test_apps/.build-test-rules.yml
@ -1,7 +0,0 @@
-# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
-
-components/app_update/test_apps:
-  disable:
-    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32p4"]
-      temporary: true
-      reason: target esp32c6, esp32h2, esp32p4 is not supported yet # TODO: IDF-8068
--- a/components/app_update/test_apps/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/pytest_app_update_ut.py
@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
-# SPDX-License-Identifier: Unlicense OR CC0-1.0
-import re
-
-import pytest
-from pytest_embedded import Dut
-
-DEFAULT_TIMEOUT = 20
-TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
-
-
-def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
-    for stage in range(1, stages + 1):
-        dut.write(str(test_case_num))
-        dut.expect(TEST_SUBMENU_PATTERN_PYTEST, timeout=DEFAULT_TIMEOUT)
-        dut.write(str(stage))
-        if stage != stages:
-            dut.expect_exact('Press ENTER to see the list of tests.')
-
-
-@pytest.mark.supported_targets
-@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
-@pytest.mark.generic
-def test_app_update(dut: Dut) -> None:
-    extra_data = dut.parse_test_menu()
-    for test_case in extra_data:
-        if test_case.type != 'multi_stage':
-            dut.write(str(test_case.index))
-        else:
-            run_multiple_stages(dut, test_case.index, len(test_case.subcases))
-        dut.expect_unity_test_output(timeout=90)
-        dut.expect_exact("Enter next test, or 'enter' to see menu")
--- a/components/app_update/test_apps/test_app_update/.build-test-rules.yml
+++ b/components/app_update/test_apps/test_app_update/.build-test-rules.yml
@ -0,0 +1,12 @@
+# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
+
+components/app_update/test_apps:
+  enable:
+    - if: CONFIG_NAME == "defaults" and IDF_TARGET != "linux"
+    - if: CONFIG_NAME == "xip_psram" and IDF_TARGET in ["esp32s2", "esp32s3"]
+    # S2 doesn't have ROM for flash
+    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and IDF_TARGET in ["esp32s3"]
+  disable:
+    - if: IDF_TARGET in ["esp32c6", "esp32h2", "esp32p4"]
+      temporary: true
+      reason: target esp32c6, esp32h2 are not supported yet # TODO: IDF-8068
--- a/components/app_update/test_apps/test_app_update/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/CMakeLists.txt
@ -2,6 +2,7 @@
 cmake_minimum_required(VERSION 3.16)

 set(EXTRA_COMPONENT_DIRS "$ENV{IDF_PATH}/tools/unit-test-app/components")
+set(COMPONENTS main)

 include($ENV{IDF_PATH}/tools/cmake/project.cmake)
 project(app_update_test)
--- a/components/app_update/test_apps/test_app_update/README.md
+++ b/components/app_update/test_apps/test_app_update/README.md
--- a/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
                       PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
                      WHOLE_ARCHIVE)
--- a/components/app_update/test_apps/test_app_update/main/app_main.c
+++ b/components/app_update/test_apps/test_app_update/main/app_main.c
--- a/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
+++ b/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@ -113,3 +114,11 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
    };
    TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
+
+TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
+{
+    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
+    const esp_partition_t* part = esp_ota_get_running_partition();
+    ESP_LOGI("running bin", "0x%p", (void*)part->address);
+    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
+}
--- a/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
+++ b/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
@ -842,7 +842,7 @@ static void test_flow6(void)
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);

 //IDF-5145
-TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
 {
    const esp_partition_t *cur_app = esp_ota_get_running_partition();
    ESP_LOGI(TAG, "copy current app to next part");
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
--- a/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import re
+
+import pytest
+from pytest_embedded import Dut
+
+DEFAULT_TIMEOUT = 20
+TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'defaults',
+    ],
+    indirect=True,
+)
+def test_app_update(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+@pytest.mark.parametrize(
+    'config',
+    [
+        'xip_psram_with_rom_impl',
+    ],
+    indirect=True,
+)
+def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
+    dut.run_all_single_board_cases(timeout=90)
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
@ -0,0 +1,2 @@
+# don't delete.
+# used for CI to compile a default config when 'sdkconfig.ci.xxxx' is exist
--- a/components/spi_flash/test_apps/flash_mmap/sdkconfig.ci.xip_psram_esp32s2
+++ b/components/spi_flash/test_apps/flash_mmap/sdkconfig.ci.xip_psram_esp32s2
@ -1,3 +1,3 @@
-CONFIG_IDF_TARGET="esp32s2"
+CONFIG_SPIRAM=y
 CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
 CONFIG_SPIRAM_RODATA=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
@ -0,0 +1,4 @@
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
+CONFIG_SPIRAM_RODATA=y
+CONFIG_SPI_FLASH_ROM_IMPL=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
@ -0,0 +1,2 @@
+CONFIG_IDF_TARGET="esp32s3"
+CONFIG_BOOTLOADER_NUM_PIN_APP_TEST=18
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@ -23,7 +23,6 @@ menu "Bootloader config"
            - The default "Size" setting will add the -0s flag to CFLAGS.
            - The "Debug" setting will add the -Og flag to CFLAGS.
            - The "Performance" setting will add the -O2 flag to CFLAGS.
-            - The "None" setting will add the -O0 flag to CFLAGS.

            Note that custom optimization levels may be unsupported.

@ -34,7 +33,9 @@ menu "Bootloader config"
        config BOOTLOADER_COMPILER_OPTIMIZATION_PERF
            bool "Optimize for performance (-O2)"
        config BOOTLOADER_COMPILER_OPTIMIZATION_NONE
-            bool "Debug without optimization (-O0)"
+            bool "Debug without optimization (-O0) (Deprecated, will be removed in IDF v6.0)"
+            depends on IDF_TARGET_ARCH_XTENSA || IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32C2
+
    endchoice

    choice BOOTLOADER_LOG_LEVEL
@ -139,7 +140,7 @@ menu "Bootloader config"

        config BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
            bool
-            default y if ESPTOOLPY_OCT_FLASH && SPI_FLASH_32BIT_ADDRESS
+            default y if ESPTOOLPY_OCT_FLASH && BOOTLOADER_FLASH_32BIT_ADDR
            default n

    endmenu
@ -458,6 +459,21 @@ menu "Bootloader config"
            (The application and bootoloader must be compiled with the same option).
            The RTC FAST memory has access only through PRO_CPU.

+    config BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
+        bool "Include custom memory in the CRC calculation"
+        depends on BOOTLOADER_CUSTOM_RESERVE_RTC
+        default n
+        help
+            This option allows the customer to use the legacy bootloader behavior when the
+            RTC FAST memory CRC calculation takes place. When this option is enabled, the
+            allocated user custom data will be taken into account in the CRC calculcation.
+            This means that any change to the custom data would need a CRC update to prevent
+            the bootloader from marking this data as corrupted.
+            If this option is disabled, the custom data will not be taken into account when
+            calculating the RTC FAST memory CRC. The user custom data can be changed freely,
+            without the need to update the CRC.
+            THIS OPTION MUST BE THE SAME FOR BOTH THE BOOTLOADER AND THE APPLICATION BUILDS.
+
    config BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE
        hex "Size in bytes for custom purposes"
        default 0
@ -833,7 +849,6 @@ menu "Security features"
        bool "Enable flash encryption on boot (READ DOCS FIRST)"
        default N
        select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
-        select NVS_ENCRYPTION
        help
            If this option is set, flash contents will be encrypted by the bootloader on first boot.

@ -1072,6 +1087,22 @@ menu "Security features"
                DIS_DOWNLOAD_MANUAL_ENCRYPT, DIS_USB_JTAG, DIS_USB_SERIAL_JTAG, STRAP_JTAG_SEL, USB_PHY_SEL.
    endmenu  # Potentially Insecure

+    config SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
+        bool "Encrypt only the app image that is present in the partition of type app"
+        depends on SECURE_FLASH_ENC_ENABLED && !SECURE_FLASH_REQUIRE_ALREADY_ENABLED
+        default n
+        help
+            If set, optimise encryption time for the partition of type APP,
+            by only encrypting the app image that is present in the partition,
+            instead of the whole partition.
+            The image length used for encryption is derived from the image metadata, which
+            includes the size of the app image, checksum, hash and also the signature sector
+            when secure boot is enabled.
+
+            If not set (default), the whole partition of type APP would be encrypted,
+            which increases the encryption time but might be useful if there
+            is any custom data appended to the firmware image.
+
    config SECURE_FLASH_CHECK_ENC_EN_IN_APP
        bool "Check Flash Encryption enabled on app startup"
        depends on SECURE_FLASH_ENC_ENABLED
@ -1084,6 +1115,44 @@ menu "Security features"

            If not set, the app does not care if the flash encryption eFuse bit is set or not.

+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y
+        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
    config SECURE_ROM_DL_MODE_ENABLED
        bool
        default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -119,6 +119,7 @@ SECTIONS

  .dram0.data : ALIGN(0x10)
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -144,6 +145,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /*  C++ constructor and destructor tables, properly ordered:  */
@ -208,12 +210,55 @@ SECTIONS
   */
  .xt.prop 0 :
  {
-    KEEP (*(.xt.prop .gnu.linkonce.prop.*))
+    KEEP (*(.xt.prop .xt.prop.* .gnu.linkonce.prop.*))
  }

  .xt.lit 0 :
  {
-    KEEP (*(.xt.lit .gnu.linkonce.p.*))
+    KEEP (*(.xt.lit .xt.lit.* .gnu.linkonce.p.*))
  }

+  .xtensa.info 0: { *(.xtensa.info) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
 }
--- a/components/bootloader/subproject/main/ld/esp32c2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c2/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -140,6 +140,7 @@ SECTIONS

  .dram0.data :
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -165,6 +166,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -218,6 +220,57 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  .riscv.attributes 0: { *(.riscv.attributes) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
+  /**
+   * Discarding .rela.* sections results in the following mapping:
+   * .rela.text.* -> .text.*
+   * .rela.data.* -> .data.*
+   * And so forth...
+   */
+  /DISCARD/ : { *(.rela.*) }
 }

 /**
--- a/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -140,6 +140,7 @@ SECTIONS

  .dram0.data :
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -165,6 +166,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -218,6 +220,58 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  .riscv.attributes 0: { *(.riscv.attributes) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
+  /**
+   * Discarding .rela.* sections results in the following mapping:
+   * .rela.text.* -> .text.*
+   * .rela.data.* -> .data.*
+   * And so forth...
+   */
+  /DISCARD/ : { *(.rela.*) }
+
 }


--- a/components/bootloader/subproject/main/ld/esp32c6/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c6/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -138,6 +138,7 @@ SECTIONS

  .dram0.data :
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -163,6 +164,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -216,6 +218,58 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  .riscv.attributes 0: { *(.riscv.attributes) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
+  /**
+   * Discarding .rela.* sections results in the following mapping:
+   * .rela.text.* -> .text.*
+   * .rela.data.* -> .data.*
+   * And so forth...
+   */
+  /DISCARD/ : { *(.rela.*) }
+
 }


--- a/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32h2/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -138,7 +138,7 @@ SECTIONS

  .dram0.data :
  {
-    _data_start = ABSOLUTE(.);
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -164,6 +164,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -217,6 +218,58 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  .riscv.attributes 0: { *(.riscv.attributes) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
+  /**
+   * Discarding .rela.* sections results in the following mapping:
+   * .rela.text.* -> .text.*
+   * .rela.data.* -> .data.*
+   * And so forth...
+   */
+  /DISCARD/ : { *(.rela.*) }
+
 }

 /**
--- a/components/bootloader/subproject/main/ld/esp32p4/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32p4/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -9,9 +9,9 @@
 *  Make sure the bootloader can load into main memory without overwriting itself.
 *
 *  ESP32-P4 ROM static data usage is as follows:
- *  - 0x4086ad08 - 0x4087c610: Shared buffers, used in UART/USB/SPI download mode only
- *  - 0x4087c610 - 0x4087e610: CPU1 stack, can be reclaimed as heap after RTOS startup
- *  - 0x4087e610 - 0x40880000: ROM .bss and .data (not easily reclaimable)
+ *  - 0x4ff296b8 - 0x4ff3afc0: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x4ff3afc0 - 0x4ff3fba4: CPU1 stack, can be reclaimed as heap after RTOS startup
+ *  - 0x4ff3fba4 - 0x4ff40000: ROM .bss and .data (not easily reclaimable)
 *
 *  The 2nd stage bootloader can take space up to the end of ROM shared
 *  buffers area (0x4087c610).
@ -130,9 +130,15 @@ SECTIONS
    _bss_end = ABSOLUTE(.);
  } > dram_seg

-  .dram0.data :
+  .dram0.bootdesc : ALIGN(0x10)
  {
    _data_start = ABSOLUTE(.);
+    *(.data_bootloader_desc .data_bootloader_desc.*)               /* Should be the first.  Bootloader version info.        DO NOT PUT ANYTHING BEFORE IT! */
+  } > dram_seg
+
+  .dram0.data :
+  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -158,6 +164,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -211,40 +218,96 @@ SECTIONS
    _etext = .;
  } > iram_seg

+  .riscv.attributes 0: { *(.riscv.attributes) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
+  /**
+   * Discarding .rela.* sections results in the following mapping:
+   * .rela.text.* -> .text.*
+   * .rela.data.* -> .data.*
+   * And so forth...
+   */
+  /DISCARD/ : { *(.rela.*) }
+
 }


 /**
 *  Appendix: Memory Usage of ROM bootloader
 *
- * 0x4086ad08 ------------------> _dram0_0_start
+ * 0x4ff296b8 ------------------> _dram0_0_start
 *            |               |
 *            |               |
 *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
 *            |               |
 *            |               |
- * 0x4087c610 ------------------> __stack_sentry
+ * 0x4ff3afc0 ------------------> __stack_sentry
 *            |               |
 *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
 *            |               |
- * 0x4087e610 ------------------> __stack (pro cpu)
+ * 0x4ff3cfc0 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |      Startup app cpu stack
+ *            |               |
+ * 0x4ff3efc0 ------------------> __stack_app (app cpu)
 *            |               |
 *            |               |
 *            |               |   3. Shared memory only used in startup code or nonos/early boot*
 *            |               |      (can be freed when IDF runs)
 *            |               |
 *            |               |
- * 0x4087f564 ------------------> _dram0_rtos_reserved_start
+ * 0x4ff3fba4 ------------------> _dram0_rtos_reserved_start
 *            |               |
 *            |               |
 *            |               |   4. Shared memory used in startup code and when IDF runs
 *            |               |
 *            |               |
- * 0x4087fab0 ------------------> _dram0_rtos_reserved_end
+ * 0x4ff3ff94 ------------------> _dram0_rtos_reserved_end
 *            |               |
- * 0x4087fce8 ------------------> _data_start_interface
+ * 0x4ff3ffc8 ------------------> _data_start_interface
 *            |               |
 *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
 *            |               |
- * 0x40880000 ------------------> _data_end_interface
+ * 0x4ff40000 ------------------> _data_end_interface
 */
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -108,6 +108,7 @@ SECTIONS

  .dram0.data :
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -133,6 +134,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /*  C++ constructor and destructor tables, properly ordered:  */
@ -205,4 +207,48 @@ SECTIONS
    KEEP (*(.xt.lit .gnu.linkonce.p.*))
  }

+  .xtensa.info 0: { *(.xtensa.info) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
 }
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -142,6 +142,7 @@ SECTIONS

  .dram0.data :
  {
+    *(.dram1 .dram1.*) /* catch stray DRAM_ATTR */
    *(.data)
    *(.data.*)
    *(.gnu.linkonce.d.*)
@ -167,6 +168,7 @@ SECTIONS
    *(.gcc_except_table)
    *(.gnu.linkonce.e.*)
    *(.gnu.version_r)
+    *(.eh_frame_hdr)
    *(.eh_frame)
    . = (. + 3) & ~ 3;
    /* C++ constructor and destructor tables, properly ordered: */
@ -239,6 +241,50 @@ SECTIONS
    KEEP (*(.xt.lit .gnu.linkonce.p.*))
  }

+  .xtensa.info 0: { *(.xtensa.info) }
+
+  /* DWARF 1 */
+  .debug              0 : { *(.debug) }
+  .line               0 : { *(.line) }
+  /* GNU DWARF 1 extensions */
+  .debug_srcinfo      0 : { *(.debug_srcinfo) }
+  .debug_sfnames      0 : { *(.debug_sfnames) }
+  /* DWARF 1.1 and DWARF 2 */
+  .debug_aranges      0 : { *(.debug_aranges) }
+  .debug_pubnames     0 : { *(.debug_pubnames) }
+  /* DWARF 2 */
+  .debug_info         0 : { *(.debug_info .gnu.linkonce.wi.*) }
+  .debug_abbrev       0 : { *(.debug_abbrev) }
+  .debug_line         0 : { *(.debug_line) }
+  .debug_frame        0 : { *(.debug_frame) }
+  .debug_str          0 : { *(.debug_str) }
+  .debug_loc          0 : { *(.debug_loc) }
+  .debug_macinfo      0 : { *(.debug_macinfo) }
+  .debug_pubtypes     0 : { *(.debug_pubtypes) }
+  /* DWARF 3 */
+  .debug_ranges       0 : { *(.debug_ranges) }
+  /* SGI/MIPS DWARF 2 extensions */
+  .debug_weaknames    0 : { *(.debug_weaknames) }
+  .debug_funcnames    0 : { *(.debug_funcnames) }
+  .debug_typenames    0 : { *(.debug_typenames) }
+  .debug_varnames     0 : { *(.debug_varnames) }
+  /* GNU DWARF 2 extensions */
+  .debug_gnu_pubnames 0 : { *(.debug_gnu_pubnames) }
+  .debug_gnu_pubtypes 0 : { *(.debug_gnu_pubtypes) }
+  /* DWARF 4 */
+  .debug_types        0 : { *(.debug_types) }
+  /* DWARF 5 */
+  .debug_addr         0 : { *(.debug_addr) }
+  .debug_line_str     0 : { *(.debug_line_str) }
+  .debug_loclists     0 : { *(.debug_loclists) }
+  .debug_macro        0 : { *(.debug_macro) }
+  .debug_names        0 : { *(.debug_names) }
+  .debug_rnglists     0 : { *(.debug_rnglists) }
+  .debug_str_offsets  0 : { *(.debug_str_offsets) }
+
+  .comment 0 : { *(.comment) }
+  .note.GNU-stack 0: { *(.note.GNU-stack) }
+
 }

 /**
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -685,7 +685,7 @@ void bootloader_spi_flash_reset(void)
 ******************************************************************************/

 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
-#define XMC_VENDOR_ID 0x20
+#define XMC_VENDOR_ID_1 0x20

 #if BOOTLOADER_BUILD
 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
@ -702,7 +702,7 @@ static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
    uint32_t mfid = BYTESHIFT(rdid, 1);
    uint32_t cpid = BYTESHIFT(rdid, 0);

-    if (vendor_id != XMC_VENDOR_ID) {
+    if (vendor_id != XMC_VENDOR_ID_1) {
        return false;
    }

@ -735,7 +735,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
    // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
    const int sfdp_mfid_addr = 0x10;
    uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
-    if (mf_id != XMC_VENDOR_ID) {
+    if (mf_id != XMC_VENDOR_ID_1) {
        BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
        return ESP_OK;
    }
@ -767,7 +767,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
 {
    uint32_t vendor_id = (rdid >> 16) & 0xFF;
-    return (vendor_id == XMC_VENDOR_ID);
+    return (vendor_id == XMC_VENDOR_ID_1);
 }

 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -181,6 +181,20 @@ uint32_t bootloader_common_get_chip_ver_pkg(void);
 */
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type);

+#if !CONFIG_IDF_TARGET_ESP32
+/**
+ * @brief Check the eFuse block revision
+ *
+ * @param[in] min_rev_full The required minimum revision of the eFuse block
+ * @param[in] max_rev_full The required maximum revision of the eFuse block
+ * @return
+ *          - ESP_OK: The eFuse block revision is in the required range.
+ *          - ESP_OK: DISABLE_BLK_VERSION_MAJOR has been set in the eFuse of the SoC. No requirements shall be checked at this time.
+ *          - ESP_FAIL: The eFuse block revision of this chip does not match the requirement of the current image.
+ */
+esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full);
+#endif  // !CONFIG_IDF_TARGET_ESP32
+
 /**
 * @brief Configure VDDSDIO, call this API to rise VDDSDIO to 1.9V when VDDSDIO regulator is enabled as 1.8V mode.
 */
--- a/components/bootloader_support/include/bootloader_memory_utils.h
+++ b/components/bootloader_support/include/bootloader_memory_utils.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2010-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2010-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -27,7 +27,12 @@ extern "C" {
 */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    bool dram_match_iram = (SOC_DRAM_LOW == SOC_IRAM_LOW) &&
+                             (SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+#if SOC_RTC_FAST_MEM_SUPPORTED
+        dram_match_iram &= (SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW);
+#endif
+    return dram_match_iram;
 }

 /**
@ -81,6 +86,7 @@ __attribute__((always_inline))
 inline static bool esp_ptr_in_diram_iram(const void *p) {
 // TODO: IDF-5980 esp32c6 D/I RAM share the same address
 #if SOC_DIRAM_IRAM_LOW == SOC_DIRAM_DRAM_LOW
+    (void)p;
    return false;
 #else
    return ((intptr_t)p >= SOC_DIRAM_IRAM_LOW && (intptr_t)p < SOC_DIRAM_IRAM_HIGH);
@ -96,9 +102,10 @@ inline static bool esp_ptr_in_diram_iram(const void *p) {
 */
 __attribute__((always_inline))
 inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
-#if SOC_RTC_FAST_MEM_SUPPORTED
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
    return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@ -115,6 +122,7 @@ inline static bool esp_ptr_in_rtc_dram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
    return ((intptr_t)p >= SOC_RTC_DRAM_LOW && (intptr_t)p < SOC_RTC_DRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@ -150,6 +158,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }

+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM

   - Address must be word aligned
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@ -33,6 +33,7 @@ typedef struct {
  uint32_t segment_data[ESP_IMAGE_MAX_SEGMENTS]; /* Data offsets for each segment */
  uint32_t image_len; /* Length of image on flash, in bytes */
  uint8_t image_digest[32]; /* appended SHA-256 digest */
+  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
 } esp_image_metadata_t;

 typedef enum {
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@ -26,7 +26,7 @@
 #include "bootloader_flash_priv.h"

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
-#define IS_MAX_REV_SET(max_chip_rev_full) (((max_chip_rev_full) != 65535) && ((max_chip_rev_full) != 0))
+#define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))

 static const char* TAG = "boot_comm";

@ -56,6 +56,31 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata)
    return bootloader_common_select_otadata(two_otadata, valid_two_otadata, true);
 }

+#if !CONFIG_IDF_TARGET_ESP32
+esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full)
+{
+    esp_err_t err = ESP_OK;
+#ifndef CONFIG_IDF_ENV_FPGA
+    // Check whether the efuse block version satisfy the requirements of current image.
+    uint32_t revision = efuse_hal_blk_version();
+    uint32_t major_rev = revision / 100;
+    uint32_t minor_rev = revision % 100;
+    if (IS_FIELD_SET(min_rev_full) && !ESP_EFUSE_BLK_REV_ABOVE(revision, min_rev_full)) {
+        ESP_LOGE(TAG, "Image requires efuse blk rev >= v%"PRIu32".%"PRIu32", but chip is v%"PRIu32".%"PRIu32,
+                    min_rev_full / 100, min_rev_full % 100, major_rev, minor_rev);
+        err = ESP_FAIL;
+    }
+    // If burnt `disable_blk_version_major` bit, skip the max version check
+    if ((IS_FIELD_SET(max_rev_full) && (revision > max_rev_full) && !efuse_hal_get_disable_blk_version_major())) {
+        ESP_LOGE(TAG, "Image requires efuse blk rev <= v%"PRIu32".%"PRIu32", but chip is v%"PRIu32".%"PRIu32,
+                    max_rev_full / 100, max_rev_full % 100, major_rev, minor_rev);
+        err = ESP_FAIL;
+    }
+#endif
+    return err;
+}
+#endif  // !CONFIG_IDF_TARGET_ESP32
+
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
 {
    esp_err_t err = ESP_OK;
@ -79,7 +104,7 @@ esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hd
        }
        if (type == ESP_IMAGE_APPLICATION) {
            unsigned max_rev = img_hdr->max_chip_rev_full;
-            if ((IS_MAX_REV_SET(max_rev) && (revision > max_rev) && !efuse_hal_get_disable_wafer_version_major())) {
+            if ((IS_FIELD_SET(max_rev) && (revision > max_rev) && !efuse_hal_get_disable_wafer_version_major())) {
                ESP_LOGE(TAG, "Image requires chip rev <= v%d.%d, but chip is v%d.%d",
                         max_rev / 100, max_rev % 100,
                         major_rev, minor_rev);
@ -121,7 +146,7 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,
 #if CONFIG_BOOTLOADER_RESERVE_RTC_MEM

 static uint32_t rtc_retain_mem_size(void) {
-#ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
+#if CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC && !CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
    /* A custom memory has been reserved by the user, do not consider this memory into CRC calculation as it may change without
     * the have the user updating the CRC. Return the offset of the custom field, which is equivalent to size of the structure
     * minus the size of everything after (including) `custom` */
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@ -1,11 +1,12 @@
 /*
- * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 #include "sdkconfig.h"
 #include "bootloader_console.h"
+#include "soc/soc_caps.h"
 #include "soc/uart_periph.h"
 #include "soc/uart_channel.h"
 #include "soc/io_mux_reg.h"
@ -18,6 +19,9 @@
 #include "esp32s2/rom/usb/cdc_acm.h"
 #include "esp32s2/rom/usb/usb_common.h"
 #endif
+#if CONFIG_ESP_CONSOLE_USB_CDC
+#include "hal/usb_wrap_ll.h"
+#endif
 #include "esp_rom_gpio.h"
 #include "esp_rom_uart.h"
 #include "esp_rom_sys.h"
@ -35,6 +39,7 @@ void bootloader_console_init(void)
 void bootloader_console_init(void)
 {
    const int uart_num = CONFIG_ESP_CONSOLE_UART_NUM;
+    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused)); // To avoid build errors/warnings about __DECLARE_RCC_ATOMIC_ENV

    // Install rom uart printf as console.
    esp_rom_install_uart_printf();
@ -56,8 +61,8 @@ void bootloader_console_init(void)
            uart_tx_gpio != UART_NUM_0_TXD_DIRECT_GPIO_NUM ||
            uart_rx_gpio != UART_NUM_0_RXD_DIRECT_GPIO_NUM) {
        // Change default UART pins back to GPIOs
-        gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_U0RXD_U, PIN_FUNC_GPIO);
-        gpio_hal_iomux_func_sel(PERIPHS_IO_MUX_U0TXD_U, PIN_FUNC_GPIO);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[UART_NUM_0_RXD_DIRECT_GPIO_NUM], PIN_FUNC_GPIO);
+        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[UART_NUM_0_TXD_DIRECT_GPIO_NUM], PIN_FUNC_GPIO);
        // Route GPIO signals to/from pins
        const uint32_t tx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_TX_PIN_IDX);
        const uint32_t rx_idx = UART_PERIPH_SIGNAL(uart_num, SOC_UART_RX_PIN_IDX);
@ -68,7 +73,11 @@ void bootloader_console_init(void)
        esp_rom_gpio_connect_in_signal(uart_rx_gpio, rx_idx, 0);
        gpio_hal_iomux_func_sel(GPIO_PIN_MUX_REG[uart_tx_gpio], PIN_FUNC_GPIO);
        // Enable the peripheral
-        periph_ll_enable_clk_clear_rst(PERIPH_UART0_MODULE + uart_num);
+        uart_ll_enable_bus_clock(uart_num, true);
+        uart_ll_reset_register(uart_num);
+        // Reset TX and RX FIFOs
+        uart_ll_txfifo_rst(UART_LL_GET_HW(uart_num));
+        uart_ll_rxfifo_rst(UART_LL_GET_HW(uart_num));
    }
 #endif // CONFIG_ESP_CONSOLE_UART_CUSTOM

@ -77,7 +86,6 @@ void bootloader_console_init(void)
 #if ESP_ROM_UART_CLK_IS_XTAL
    clock_hz = (uint32_t)rtc_clk_xtal_freq_get() * MHZ; // From esp32-s3 on, UART clk source is selected to XTAL in ROM
 #endif
-    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused)); // To avoid build errors/warnings about __DECLARE_RCC_ATOMIC_ENV
    esp_rom_uart_set_clock_baudrate(uart_num, clock_hz, CONFIG_ESP_CONSOLE_UART_BAUDRATE);
 }
 #endif // CONFIG_ESP_CONSOLE_UART
@ -98,6 +106,9 @@ void bootloader_console_init(void)
    esp_rom_uart_usb_acm_init(s_usb_cdc_buf, sizeof(s_usb_cdc_buf));
    esp_rom_uart_set_as_console(ESP_ROM_USB_OTG_NUM);
    esp_rom_install_channel_putc(1, bootloader_console_write_char_usb);
+    // Ensure that the USB FSLS PHY is mapped to the USB WRAP
+    usb_wrap_ll_phy_enable_pad(&USB_WRAP, true);
+    usb_wrap_ll_phy_enable_external(&USB_WRAP, false);
 }
 #endif //CONFIG_ESP_CONSOLE_USB_CDC

--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@ -42,10 +42,17 @@ esp_err_t bootloader_read_bootloader_header(void)

 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    unsigned int revision = efuse_hal_chip_revision();
-    unsigned int major = revision / 100;
-    unsigned int minor = revision % 100;
-    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", major, minor);
+    unsigned int chip_revision = efuse_hal_chip_revision();
+    unsigned int chip_major_rev = chip_revision / 100;
+    unsigned int chip_minor_rev = chip_revision % 100;
+    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", chip_major_rev, chip_minor_rev);
+/* ESP32 doesn't have more memory and more efuse bits for block major version. */
+#if !CONFIG_IDF_TARGET_ESP32
+    unsigned int efuse_revision = efuse_hal_blk_version();
+    unsigned int efuse_major_rev = efuse_revision / 100;
+    unsigned int efuse_minor_rev = efuse_revision % 100;
+    ESP_EARLY_LOGI(TAG, "efuse block revision: v%d.%d", efuse_major_rev, efuse_minor_rev);
+#endif  // !CONFIG_IDF_TARGET_ESP32
    /* compare with the one set in bootloader image header */
    if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
        return ESP_FAIL;
--- a/components/bootloader_support/src/bootloader_random_esp32c6.c
+++ b/components/bootloader_support/src/bootloader_random_esp32c6.c
@ -53,7 +53,7 @@ void bootloader_random_enable(void)

    // create patterns and set them in pattern table
    uint32_t pattern_one = (SAR2_CHANNEL << 2) | SAR2_ATTEN; // we want channel 9 with max attenuation
-    uint32_t pattern_two = SAR1_ATTEN; // we want channel 0 with max attenuation, channel doesn't really matter here
+    uint32_t pattern_two = (SAR2_CHANNEL << 2) | SAR1_ATTEN; // we want channel 9 with max attenuation
    uint32_t pattern_table = 0 | (pattern_two << 3 * PATTERN_BIT_WIDTH) | pattern_one << 2 * PATTERN_BIT_WIDTH;
    REG_WRITE(APB_SARADC_SAR_PATT_TAB1_REG, pattern_table);

@ -88,9 +88,6 @@ void bootloader_random_disable(void)
    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC1_ENCAL_REF_ADDR, 0);
    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC2_ENCAL_REF_ADDR, 0);

-    // Revert PMU_RF_PWC_REG to it's initial value
-    CLEAR_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
-
    // disable ADC_CTRL_CLK (SAR ADC function clock)
    REG_WRITE(PCR_SARADC_CLKM_CONF_REG, 0x00404000);

--- a/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
+++ b/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
@ -89,6 +89,8 @@ static inline void bootloader_hardware_init(void)
 {
    /* Enable analog i2c master clock */
    SET_PERI_REG_MASK(MODEM_LPCON_CLK_CONF_REG, MODEM_LPCON_CLK_I2C_MST_EN);
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }

 static inline void bootloader_ana_reset_config(void)
--- a/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

+#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
    // otherwise the Flash Encryption key cannot be read protected
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -19,6 +19,8 @@
 #include "bootloader_util.h"
 #include "bootloader_common.h"
 #include "esp_rom_sys.h"
+#include "esp_efuse.h"
+#include "esp_app_desc.h"
 #include "bootloader_memory_utils.h"
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
@ -89,10 +91,10 @@ static bool should_map(uint32_t load_addr);

 static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
 /* Load or verify a segment */
-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);

 /* split segment and verify if data_len is too long */
-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum);
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata);

 /* Verify the main image header */
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);
@ -240,6 +242,21 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
        cache_ll_writeback_all(CACHE_LL_LEVEL_INT_MEM, CACHE_TYPE_DATA, CACHE_LL_ID_ALL);
 #endif
    }
+
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    /* For anti-rollback case, reconfirm security version of the application to prevent FI attacks */
+    bool sec_ver = false;
+    if (do_load) {
+        sec_ver = esp_efuse_check_secure_version(data->secure_version);
+        if (!sec_ver) {
+            err = ESP_FAIL;
+            goto err;
+        }
+    }
+    /* Ensure that the security version check passes for image loading scenario */
+    ESP_FAULT_ASSERT(!do_load || sec_ver == true);
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
 #endif // BOOTLOADER_BUILD

    // Success!
@ -522,7 +539,7 @@ static esp_err_t process_segments(esp_image_metadata_t *data, bool silent, bool
    for (int i = 0; i < data->image.segment_count; i++) {
        esp_image_segment_header_t *header = &data->segments[i];
        ESP_LOGV(TAG, "loading segment header %d at offset 0x%"PRIx32, i, next_addr);
-        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum));
+        CHECK_ERR(process_segment(i, next_addr, header, silent, do_load, sha_handle, checksum, data));
        next_addr += sizeof(esp_image_segment_header_t);
        data->segment_data[i] = next_addr;
        next_addr += header->data_len;
@ -543,7 +560,7 @@ err:
    return err;
 }

-static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segment_header_t *header, bool silent, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
    esp_err_t err;

@ -601,7 +618,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme
        uint32_t offset_page = ((data_addr & MMAP_ALIGNED_MASK) != 0) ? 1 : 0;
        /* Data we could map in case we are not aligned to PAGE boundary is one page size lesser. */
        data_len = MIN(data_len_remain, ((free_page_count - offset_page) * SPI_FLASH_MMU_PAGE_SIZE));
-        CHECK_ERR(process_segment_data(load_addr, data_addr, data_len, do_load, sha_handle, checksum));
+        CHECK_ERR(process_segment_data(index, load_addr, data_addr, data_len, do_load, sha_handle, checksum, metadata));
        data_addr += data_len;
        data_len_remain -= data_len;
    }
@ -616,7 +633,42 @@ err:
    return err;
 }

-static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum)
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+/* The __attribute__((optimize("O0"))) is used to disable optimizations for this function,
+ * preventing the compiler from potentially optimizing data_buffer and reading data directly from src.
+ * This is crucial as we want to read from Flash only once, ensuring the integrity of the data.
+ */
+__attribute__((optimize("O0")))
+static size_t process_esp_app_desc_data(const uint32_t *src, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
+{
+    /* Using data_buffer here helps to securely read secure_version
+     * (for anti-rollback) from esp_app_desc_t, preventing FI attack.
+     * We read data from Flash into this buffer, which is covered by sha256.
+     * Therefore, if the flash is under attackers control and contents are modified
+     * the sha256 comparison will fail.
+     *
+     * The esp_app_desc_t structure is located in DROM and is always in segment #0.
+     *
+     * esp_app_desc_t is always at #0 segment (index==0).
+     * secure_version field of esp_app_desc_t is located at #2 word (w_i==1).
+     */
+    uint32_t data_buffer[2];
+    memcpy(data_buffer, src, sizeof(data_buffer));
+    assert(data_buffer[0] == ESP_APP_DESC_MAGIC_WORD);
+    metadata->secure_version = data_buffer[1];
+    if (checksum != NULL) {
+        *checksum ^= data_buffer[0] ^ data_buffer[1];
+    }
+    if (sha_handle != NULL) {
+        bootloader_sha256_data(sha_handle, data_buffer, sizeof(data_buffer));
+    }
+    ESP_FAULT_ASSERT(memcmp(data_buffer, src, sizeof(data_buffer)) == 0);
+    ESP_FAULT_ASSERT(memcmp(&metadata->secure_version, &src[1], sizeof(uint32_t)) == 0);
+    return sizeof(data_buffer);
+}
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+
+static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum, esp_image_metadata_t *metadata)
 {
    // If we are not loading, and the checksum is empty, skip processing this
    // segment for data
@ -649,10 +701,33 @@ static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, ui
 #endif
    }
    uint32_t *dest = (uint32_t *)load_addr;
-#endif
+#endif // BOOTLOADER_BUILD

    const uint32_t *src = data;

+    // Case I: Bootloader verifying application
+    // Case II: Bootloader verifying bootloader
+    // The esp_app_desc_t structure is located in DROM and is always in segment #0.
+    // Anti-rollback check and efuse block version check should handle only Case I from above.
+    if (segment == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+/* ESP32 doesn't have more memory and more efuse bits for block major version. */
+#if !CONFIG_IDF_TARGET_ESP32
+        const esp_app_desc_t *app_desc = (const esp_app_desc_t *)src;
+        esp_err_t ret = bootloader_common_check_efuse_blk_validity(app_desc->min_efuse_blk_rev_full, app_desc->max_efuse_blk_rev_full);
+        if (ret != ESP_OK) {
+            bootloader_munmap(data);
+            return ret;
+        }
+#endif  // !CONFIG_IDF_TARGET_ESP32
+#if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+        ESP_LOGD(TAG, "additional anti-rollback check 0x%"PRIx32, data_addr);
+        size_t len = process_esp_app_desc_data(src, sha_handle, checksum, metadata);
+        data_len -= len;
+        src += len / 4;
+        // In BOOTLOADER_BUILD, for DROM (segment #0) we do not load it into dest (only map it), do_load = false.
+#endif // CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
+    }
+
    for (size_t i = 0; i < data_len; i += 4) {
        int w_i = i / 4; // Word index
        uint32_t w = src[w_i];
@ -932,9 +1007,13 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
        return ESP_ERR_IMAGE_INVALID;
    }

-#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
    // Adjust image length result to include the appended signature
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
    data->image_len = end - data->start_addr + sizeof(ets_secure_boot_signature_t);
+#elif defined(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+    if (data->start_addr != ESP_BOOTLOADER_OFFSET) {
+        data->image_len = end - data->start_addr + sizeof(esp_secure_boot_sig_block_t);
+    }
 #endif

 #endif // SECURE_BOOT_CHECK_SIGNATURE
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"

 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@ -211,6 +214,13 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32

+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@ -457,6 +467,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
    }
    result &= secure;

+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
    return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@ -393,14 +393,21 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
 {
    esp_err_t err;
    bool should_encrypt = (partition->flags & PART_FLAG_ENCRYPTED);
+    uint32_t size = partition->pos.size;

    if (partition->type == PART_TYPE_APP) {
        /* check if the partition holds a valid unencrypted app */
-        esp_image_metadata_t data_ignored;
+        esp_image_metadata_t image_data = {};
        err = esp_image_verify(ESP_IMAGE_VERIFY,
                               &partition->pos,
-                               &data_ignored);
+                               &image_data);
        should_encrypt = (err == ESP_OK);
+#ifdef CONFIG_SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
+        if (should_encrypt) {
+            // Encrypt only the app image instead of encrypting the whole partition
+            size = image_data.image_len;
+        }
+#endif
    } else if ((partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA)
                || (partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_NVS_KEYS)) {
        /* check if we have ota data partition and the partition should be encrypted unconditionally */
@ -411,9 +418,9 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
        return ESP_OK;
    } else {
        /* should_encrypt */
-        ESP_LOGI(TAG, "Encrypting partition %d at offset 0x%x (length 0x%x)...", index, partition->pos.offset, partition->pos.size);
+        ESP_LOGI(TAG, "Encrypting partition %d at offset 0x%x (length 0x%x)...", index, partition->pos.offset, size);

-        err = esp_flash_encrypt_region(partition->pos.offset, partition->pos.size);
+        err = esp_flash_encrypt_region(partition->pos.offset, size);
        ESP_LOGI(TAG, "Done encrypting");
        if (err != ESP_OK) {
            ESP_LOGE(TAG, "Failed to encrypt partition %d", index);
--- a/components/bootloader_support/test_apps/.build-test-rules.yml
+++ b/components/bootloader_support/test_apps/.build-test-rules.yml
@ -4,7 +4,3 @@ components/bootloader_support/test_apps/rtc_custom_section:
  enable:
    - if: SOC_RTC_MEM_SUPPORTED == 1
      reason: this feature is supported on chips that have RTC memory
-  disable:
-    - if: IDF_TARGET == "esp32p4"
-      temporary: true
-      reason: this feature on esp32p4 isn't supported yet # TODO: IDF-8069
--- a/components/bootloader_support/test_apps/rtc_custom_section/README.md
+++ b/components/bootloader_support/test_apps/rtc_custom_section/README.md
@ -1,2 +1,2 @@
-| Supported Targets | ESP32 | ESP32-C3 | ESP32-C6 | ESP32-H2 | ESP32-S2 | ESP32-S3 |
-| ----------------- | ----- | -------- | -------- | -------- | -------- | -------- |
+| Supported Targets | ESP32 | ESP32-C3 | ESP32-C6 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- | -------- | -------- | -------- |
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@ -30,6 +30,7 @@ set(common_include_dirs
    common/api/include/api
    common/btc/profile/esp/blufi/include
    common/btc/profile/esp/include
+    common/hci_log/include
 )

 set(ble_mesh_include_dirs
@ -45,15 +46,25 @@ set(ble_mesh_include_dirs
    "esp_ble_mesh/api/core/include"
    "esp_ble_mesh/api/models/include"
    "esp_ble_mesh/api"
+)
+
+set(ble_mesh_v11_include_dirs
+    "esp_ble_mesh/lib/include"
    "esp_ble_mesh/v1.1/api/core/include"
    "esp_ble_mesh/v1.1/api/models/include"
    "esp_ble_mesh/v1.1/btc/include"
-    "esp_ble_mesh/v1.1/include"
 )

+if(CONFIG_IDF_DOC_BUILD)
+    list(APPEND ble_mesh_include_dirs
+                ${ble_mesh_v11_include_dirs})
+endif()
+
 set(bluedroid_include_dirs host/bluedroid/api/include/api)

+if(CONFIG_BT_CONTROLLER_ENABLED OR CONFIG_IDF_DOC_BUILD)
 set(nimble_hci_include_dirs host/nimble/esp-hci/include)
+endif()

 if(CONFIG_IDF_DOC_BUILD)
    list(APPEND include_dirs
@ -64,37 +75,45 @@ if(CONFIG_IDF_DOC_BUILD)
         ${nimble_hci_include_dirs})
 endif()

-
 if(CONFIG_BT_ENABLED)

    set(srcs "")
    set(include_dirs "")
-    set(ldfragments "linker.lf")
+    set(ldscripts "linker_common.lf")
+    if(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_IDF_TARGET_ESP32)
+            list(APPEND srcs "controller/esp32/bt.c"
+                             "controller/esp32/hli_api.c"
+                             "controller/esp32/hli_vectors.S")
+            list(APPEND ldscripts "linker_rw_bt_controller.lf")

-    if(CONFIG_IDF_TARGET_ESP32)
-        list(APPEND srcs "controller/esp32/bt.c"
-                         "controller/esp32/hli_api.c"
-                         "controller/esp32/hli_vectors.S")
+        elseif(CONFIG_IDF_TARGET_ESP32C3)
+            list(APPEND srcs "controller/esp32c3/bt.c")
+            list(APPEND ldscripts "linker_rw_bt_controller.lf")

-    elseif(CONFIG_IDF_TARGET_ESP32C3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32S3)
+            list(APPEND srcs "controller/esp32c3/bt.c")
+            list(APPEND ldscripts "linker_rw_bt_controller.lf")

-    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        list(APPEND srcs "controller/esp32c3/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/bt.c")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+                list(APPEND srcs "controller/esp32c2/dummy.c")
+            endif()
+            set(ldscripts "linker_esp32c2.lf")

-    elseif(CONFIG_IDF_TARGET_ESP32C2)
-        set(ldfragments "linker.lf.esp32c2")
-        list(APPEND srcs "controller/esp32c2/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32C6)
+            list(APPEND srcs "controller/esp32c6/bt.c")
+            list(APPEND ldscripts "linker_esp_ble_controller.lf")

-    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        list(APPEND srcs "controller/esp32c6/bt.c")
+        elseif(CONFIG_IDF_TARGET_ESP32H2)
+            list(APPEND srcs "controller/esp32h2/bt.c")
+            list(APPEND ldscripts "linker_esp_ble_controller.lf")
+        endif()

-    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        list(APPEND srcs "controller/esp32h2/bt.c")
+        list(APPEND include_dirs ${target_specific_include_dirs})
    endif()

-    list(APPEND include_dirs ${target_specific_include_dirs})
-
    # Common
    list(APPEND include_dirs common/osi/include)

@ -102,11 +121,13 @@ if(CONFIG_BT_ENABLED)
            common/btc/include
            common/include
            porting/mem/
+            porting/include
        )
    list(APPEND include_dirs ${common_include_dirs})

    list(APPEND srcs "common/btc/core/btc_alarm.c"
         "common/api/esp_blufi_api.c"
+         "common/hci_log/bt_hci_log.c"
         "common/btc/core/btc_manage.c"
         "common/btc/core/btc_task.c"
         "common/btc/profile/esp/blufi/blufi_prf.c"
@ -174,6 +195,7 @@ if(CONFIG_BT_ENABLED)

        list(APPEND srcs "host/bluedroid/api/esp_a2dp_api.c"
                   "host/bluedroid/api/esp_avrc_api.c"
+                   "host/bluedroid/api/esp_bluedroid_hci.c"
                   "host/bluedroid/api/esp_bt_device.c"
                   "host/bluedroid/api/esp_bt_main.c"
                   "host/bluedroid/api/esp_gap_ble_api.c"
@ -509,7 +531,6 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/core/rpl.c"
                    "esp_ble_mesh/core/scan.c"
                    "esp_ble_mesh/core/test.c"
-                    "esp_ble_mesh/core/transport.c"
                    "esp_ble_mesh/models/common/device_property.c"
                    "esp_ble_mesh/models/common/model_common.c"
                    "esp_ble_mesh/models/client/client_common.c"
@ -523,53 +544,92 @@ if(CONFIG_BT_ENABLED)
                    "esp_ble_mesh/models/server/server_common.c"
                    "esp_ble_mesh/models/server/state_binding.c"
                    "esp_ble_mesh/models/server/state_transition.c"
-                    "esp_ble_mesh/models/server/time_scene_server.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_agg_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_brc_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_cm_data_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_df_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_lcd_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_odp_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_prb_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_rpr_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_sar_model_api.c"
-                    "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_srpl_model_api.c"
-                    "esp_ble_mesh/v1.1/api/models/esp_ble_mesh_mbt_model_api.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_agg_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_brc_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_df_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_lcd_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_mbt_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_odp_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_prb_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_rpr_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
-                    "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
-                    "esp_ble_mesh/v1.1/ext.c")
+                    "esp_ble_mesh/models/server/time_scene_server.c")
+        if(CONFIG_BLE_MESH_V11_SUPPORT)
+            list(APPEND include_dirs ${ble_mesh_v11_include_dirs})
+
+            list(APPEND srcs
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_agg_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_brc_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_cm_data_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_df_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_lcd_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_odp_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_prb_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_rpr_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_sar_model_api.c"
+                        "esp_ble_mesh/v1.1/api/core/esp_ble_mesh_srpl_model_api.c"
+                        "esp_ble_mesh/v1.1/api/models/esp_ble_mesh_mbt_model_api.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_agg_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_brc_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_df_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_lcd_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_mbt_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_odp_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_prb_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_rpr_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_sar_model.c"
+                        "esp_ble_mesh/v1.1/btc/btc_ble_mesh_srpl_model.c"
+                        "esp_ble_mesh/lib/ext.c")
+            if(CONFIG_BLE_MESH_SAR_ENHANCEMENT)
+                list(APPEND srcs "esp_ble_mesh/core/transport.enh.c")
+            else()
+                list(APPEND srcs "esp_ble_mesh/core/transport.c")
+            endif()
+        else()
+            list(APPEND srcs
+                        "esp_ble_mesh/core/transport.c")
+        endif()
    endif()



    if(CONFIG_BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT)
+        list(APPEND srcs
+                "porting/npl/freertos/src/npl_os_freertos.c"
+                "porting/mem/os_msys_init.c"
+                "porting/transport/src/hci_transport.c"
+        )
+
+        if(CONFIG_BT_CONTROLLER_DISABLED)
            list(APPEND srcs
-                    "porting/npl/freertos/src/npl_os_freertos.c"
-                    "porting/nimble/src/os_msys_init.c"
+                "host/nimble/nimble/porting/nimble/src/hal_uart.c"
            )
-
-            list(APPEND include_dirs
-                    porting/include
-                    porting/nimble/include
-                    porting/npl/freertos/include
-                    porting/transport/include
-            )
-
-            if(CONFIG_BT_LE_HCI_INTERFACE_USE_UART)
+        elseif(CONFIG_BT_LE_HCI_INTERFACE_USE_RAM)
+            if(CONFIG_BT_NIMBLE_ENABLED)
                list(APPEND srcs
-                        "porting/transport/uart/hci_uart.c"
-                    )
+                    "porting/transport/driver/vhci/hci_driver_nimble.c"
+                    "host/nimble/nimble/nimble/transport/esp_ipc/src/hci_esp_ipc.c"
+                )
+            else()
+                list(APPEND srcs
+                    "porting/transport/driver/vhci/hci_driver_standard.c"
+                )
            endif()
-    endif()
+        elseif(CONFIG_BT_LE_HCI_INTERFACE_USE_UART)
+                list(APPEND srcs
+                    "porting/transport/driver/common/hci_driver_util.c"
+                    "porting/transport/driver/common/hci_driver_h4.c"
+                    "porting/transport/driver/common/hci_driver_mem.c"
+                    "porting/transport/driver/uart/hci_driver_uart_config.c"
+                )
+            if(CONFIG_BT_LE_UART_HCI_DMA_MODE)
+                list(APPEND srcs
+                    "porting/transport/driver/uart/hci_driver_uart_dma.c"
+                )
+            else()
+                list(APPEND srcs
+                    "porting/transport/driver/uart/hci_driver_uart.c"
+                )
+            endif()
+        endif()

+        list(APPEND include_dirs
+                porting/include
+                porting/npl/freertos/include
+                porting/transport/include
+        )
+    endif()

    if(NOT (CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS))
        list(APPEND include_dirs
@ -595,8 +655,8 @@ if(CONFIG_BT_ENABLED)
    if(CONFIG_BT_NIMBLE_ENABLED)

        list(APPEND include_dirs
-
                    host/nimble/nimble/nimble/host/include
+                    host/nimble/nimble/nimble/include
                    host/nimble/nimble/nimble/host/services/ans/include
                    host/nimble/nimble/nimble/host/services/bas/include
                    host/nimble/nimble/nimble/host/services/dis/include
@ -608,7 +668,10 @@ if(CONFIG_BT_ENABLED)
                    host/nimble/nimble/nimble/host/services/ipss/include
                    host/nimble/nimble/nimble/host/services/lls/include
                    host/nimble/nimble/nimble/host/services/prox/include
+                    host/nimble/nimble/nimble/host/services/cts/include
                    host/nimble/nimble/nimble/host/services/tps/include
+                    host/nimble/nimble/nimble/host/services/hid/include
+                    host/nimble/nimble/nimble/host/services/sps/include
                    host/nimble/nimble/nimble/host/util/include
                    host/nimble/nimble/nimble/host/store/ram/include
                    host/nimble/nimble/nimble/host/store/config/include
@ -628,6 +691,9 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/nimble/host/services/dis/src/ble_svc_dis.c"
                    "host/nimble/nimble/nimble/host/services/lls/src/ble_svc_lls.c"
                    "host/nimble/nimble/nimble/host/services/prox/src/ble_svc_prox.c"
+                    "host/nimble/nimble/nimble/host/services/cts/src/ble_svc_cts.c"
+                    "host/nimble/nimble/nimble/host/services/hid/src/ble_svc_hid.c"
+                    "host/nimble/nimble/nimble/host/services/sps/src/ble_svc_sps.c"
                    "host/nimble/nimble/nimble/host/src/ble_hs_conn.c"
                    "host/nimble/nimble/nimble/host/src/ble_store_util.c"
                    "host/nimble/nimble/nimble/host/src/ble_sm.c"
@ -676,19 +742,37 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/nimble/host/store/ram/src/ble_store_ram.c"
                    "host/nimble/nimble/nimble/host/store/config/src/ble_store_config.c"
                    "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
+                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
+                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                )

+            if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
+                list(APPEND srcs
+                        "host/nimble/nimble/nimble/transport/uart_ll/src/hci_uart.c"
+                        "host/nimble/nimble/nimble/transport/common/hci_h4/src/hci_h4.c"
+                )
+            endif()
+
            list(APPEND srcs
                "host/nimble/nimble/porting/nimble/src/nimble_port.c"
                "host/nimble/nimble/porting/npl/freertos/src/nimble_port_freertos.c"
+                "host/nimble/port/src/nvs_port.c"
            )
+
            list(APPEND include_dirs
-                porting/include
                host/nimble/nimble/porting/nimble/include
                host/nimble/port/include
                host/nimble/nimble/nimble/transport/include
+                host/nimble/nimble/nimble/include
            )

+            if(CONFIG_BT_CONTROLLER_DISABLED)
+                list(APPEND include_dirs
+                    host/nimble/nimble/nimble/transport/common/hci_h4/include
+                )
+            endif()
+
        if(NOT CONFIG_BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT)
            list(APPEND srcs
                    "host/nimble/nimble/porting/nimble/src/endian.c"
@ -698,16 +782,23 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/porting/nimble/src/os_msys_init.c"
                    "host/nimble/nimble/porting/npl/freertos/src/npl_os_freertos.c"
                    )
+
+            if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
+                list(APPEND srcs
+                    "host/nimble/nimble/porting/nimble/src/hal_uart.c"
+                )
+            endif()
+
            list(APPEND include_dirs
+                    porting/include
                    host/nimble/nimble/porting/npl/freertos/include
-                    host/nimble/nimble/porting/nimble/include
-                    host/nimble/nimble/nimble/include
            )
        endif()

-        if(CONFIG_BT_NIMBLE_LEGACY_VHCI_ENABLE)
+        if(CONFIG_BT_NIMBLE_LEGACY_VHCI_ENABLE AND CONFIG_BT_CONTROLLER_ENABLED)
            list(APPEND srcs
                "host/nimble/esp-hci/src/esp_nimble_hci.c"
+                "host/nimble/nimble/nimble/transport/esp_ipc_legacy/src/hci_esp_ipc_legacy.c"
            )
            list(APPEND include_dirs ${nimble_hci_include_dirs})
        endif()
@ -773,7 +864,7 @@ idf_component_register(SRCS "${srcs}"
                       PRIV_INCLUDE_DIRS "${priv_include_dirs}"
                       REQUIRES esp_timer esp_wifi
                       PRIV_REQUIRES nvs_flash soc esp_pm esp_phy esp_coex mbedtls driver vfs
-                       LDFRAGMENTS "${ldfragments}")
+                       LDFRAGMENTS "${ldscripts}")

 if(CONFIG_BT_ENABLED)
    target_compile_options(${COMPONENT_LIB} PRIVATE -Wno-implicit-fallthrough -Wno-unused-const-variable)
@ -785,19 +876,29 @@ if(CONFIG_BT_ENABLED)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
        target_link_directories(${COMPONENT_LIB} INTERFACE
                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32c3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
    elseif(CONFIG_IDF_TARGET_ESP32S3)
        target_link_directories(${COMPONENT_LIB} INTERFACE
                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
-    elseif(CONFIG_IDF_TARGET_ESP32C2)
-        add_prebuilt_library(libble_app "controller/lib_esp32c2/esp32c2-bt-lib/libble_app.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
-    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        add_prebuilt_library(libble_app "controller/lib_esp32c6/esp32c6-bt-lib/libble_app.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
-    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        add_prebuilt_library(libble_app "controller/lib_esp32h2/esp32h2-bt-lib/libble_app.a")
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
+    elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_IDF_TARGET_ESP32C6)
+            add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/esp32c6/libble_app.a")
+        else()
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app_flash.a")
+            else()
+                add_prebuilt_library(libble_app "controller/lib_${target}/${target}-bt-lib/libble_app.a")
+            endif()
+        endif()
        target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
    endif()

@ -811,22 +912,22 @@ if(CONFIG_BT_ENABLED)
    target_compile_options(${COMPONENT_LIB} PRIVATE "-Wno-format")
 endif()

-if(CONFIG_BLE_MESH)
+if(CONFIG_BLE_MESH_V11_SUPPORT)
    if(CONFIG_IDF_TARGET_ESP32)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32S3)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32s3/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32c3/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32C6)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32c6/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    elseif(CONFIG_IDF_TARGET_ESP32H2)
-        add_prebuilt_library(mesh_v11 "esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a")
-        target_link_libraries(${COMPONENT_LIB} PRIVATE mesh_v11)
+        add_prebuilt_library(ble_mesh "esp_ble_mesh/lib/lib/esp32h2/libble_mesh.a")
+        target_link_libraries(${COMPONENT_LIB} PRIVATE ble_mesh)
    endif()
 endif()

--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@ -1,9 +1,8 @@
 menu "Bluetooth"
-    visible if SOC_BT_SUPPORTED

    config BT_ENABLED
        bool "Bluetooth"
-        depends on SOC_BT_SUPPORTED && !APP_NO_BLOBS
+        depends on !APP_NO_BLOBS
        help
            Select this option to enable Bluetooth and show the submenu with Bluetooth configuration choices.

@ -26,6 +25,7 @@ menu "Bluetooth"
                This option is recommended for BLE only usecases to save on memory

        config BT_CONTROLLER_ONLY
+            depends on SOC_BT_SUPPORTED
            bool "Disabled"
            help
                This option is recommended when you want to communicate directly with the
@ -42,6 +42,7 @@ menu "Bluetooth"
            This helps to choose Bluetooth controller stack

        config BT_CONTROLLER_ENABLED
+            depends on SOC_BT_SUPPORTED
            bool "Enabled"
            help
                This option is recommended for Bluetooth controller usecases
@ -79,6 +80,37 @@ menu "Bluetooth"
            We cannot split the memory into 3 different regions (IRAM, BLE-IRAM, DRAM).
            So this option will disable the PMP (ESP_SYSTEM_PMP_IDRAM_SPLIT)

+    config BT_HCI_LOG_DEBUG_EN
+        depends on BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED
+        bool "Enable Bluetooth HCI debug mode"
+        default n
+        help
+            This option is used to enable bluetooth debug mode, which saves the hci layer data stream.
+
+    config BT_HCI_LOG_DATA_BUFFER_SIZE
+        depends on BT_HCI_LOG_DEBUG_EN
+        int "Size of the cache used for HCI data in Bluetooth HCI debug mode (N*1024 bytes)"
+        range 1 100
+        default 5
+        help
+            This option is to configure the buffer size of the hci data steam cache in hci debug mode.
+            This is a ring buffer, the new data will overwrite the oldest data if the buffer is full.
+
+    config BT_HCI_LOG_ADV_BUFFER_SIZE
+        depends on BT_HCI_LOG_DEBUG_EN
+        int "Size of the cache used for adv report in Bluetooth HCI debug mode (N*1024 bytes)"
+        range 1 100
+        default 8
+        help
+            This option is to configure the buffer size of the hci adv report cache in hci debug mode.
+            This is a ring buffer, the new data will overwrite the oldest data if the buffer is full.
+
+    menu "Common Options"
+        visible if (BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED)
+
+        source "$IDF_PATH/components/bt/common/Kconfig.in"
+    endmenu
+
 endmenu

 menuconfig BLE_MESH
--- a/components/bt/common/Kconfig.in
+++ b/components/bt/common/Kconfig.in
@ -0,0 +1,6 @@
+config BT_ALARM_MAX_NUM
+    int "Maximum number of Bluetooth alarms"
+    default 50
+    help
+        This option decides the maximum number of alarms which
+        could be used by Bluetooth host.
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -69,6 +69,12 @@
 #include "btc_ble_mesh_prov.h"
 #include "btc_ble_mesh_health_model.h"
 #include "btc_ble_mesh_config_model.h"
+#include "btc_ble_mesh_generic_model.h"
+#include "btc_ble_mesh_lighting_model.h"
+#include "btc_ble_mesh_sensor_model.h"
+#include "btc_ble_mesh_time_scene_model.h"
+#if CONFIG_BLE_MESH_V11_SUPPORT
+#include "btc_ble_mesh_mbt_model.h"
 #include "btc_ble_mesh_agg_model.h"
 #include "btc_ble_mesh_brc_model.h"
 #include "btc_ble_mesh_df_model.h"
@ -78,11 +84,7 @@
 #include "btc_ble_mesh_rpr_model.h"
 #include "btc_ble_mesh_sar_model.h"
 #include "btc_ble_mesh_srpl_model.h"
-#include "btc_ble_mesh_generic_model.h"
-#include "btc_ble_mesh_lighting_model.h"
-#include "btc_ble_mesh_sensor_model.h"
-#include "btc_ble_mesh_time_scene_model.h"
-#include "btc_ble_mesh_mbt_model.h"
+#endif /* CONFIG_BLE_MESH_V11_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */

 #define BTC_TASK_PINNED_TO_CORE         (TASK_PINNED_TO_CORE)
@ -295,8 +297,8 @@ static bt_status_t btc_task_post(btc_msg_t *msg, uint32_t timeout)
 /**
 * transfer an message to another module in the different task.
 * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
 * @param  copy_func deep copy function
 * @param  free_func deep free function
 * @return           BT_STATUS_SUCCESS: success
@ -342,7 +344,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 }

 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
 * @param  msg       message
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
@ -380,7 +382,7 @@ static void btc_deinit_mem(void) {
        btc_profile_cb_tab = NULL;
    }

-#if (BLE_INCLUDED == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
    if (gl_bta_adv_data_ptr) {
        osi_free(gl_bta_adv_data_ptr);
        gl_bta_adv_data_ptr = NULL;
@ -390,7 +392,7 @@ static void btc_deinit_mem(void) {
        osi_free(gl_bta_scan_rsp_data_ptr);
        gl_bta_scan_rsp_data_ptr = NULL;
    }
-#endif  ///BLE_INCLUDED == TRUE
+#endif // BLE_42_FEATURE_SUPPORT

 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
    if (btc_creat_tab_env_ptr) {
@ -405,6 +407,13 @@ static void btc_deinit_mem(void) {
 #endif
 #endif

+#if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
+    if (hf_local_param_ptr) {
+        osi_free(hf_local_param_ptr);
+        hf_local_param_ptr = NULL;
+    }
+#endif
+
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
    if (hf_client_local_param_ptr) {
        osi_free(hf_client_local_param_ptr);
@ -435,7 +444,8 @@ static bt_status_t btc_init_mem(void) {
    }
    memset((void *)btc_profile_cb_tab, 0, sizeof(void *) * BTC_PID_NUM);

-#if (BLE_INCLUDED == TRUE)
+#if BTC_DYNAMIC_MEMORY == TRUE
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
    if ((gl_bta_adv_data_ptr = (tBTA_BLE_ADV_DATA *)osi_malloc(sizeof(tBTA_BLE_ADV_DATA))) == NULL) {
        goto error_exit;
    }
@ -445,7 +455,8 @@ static bt_status_t btc_init_mem(void) {
        goto error_exit;
    }
    memset((void *)gl_bta_scan_rsp_data_ptr, 0, sizeof(tBTA_BLE_ADV_DATA));
-#endif  ///BLE_INCLUDED == TRUE
+#endif // (BLE_42_FEATURE_SUPPORT == TRUE)
+#endif // BTC_DYNAMIC_MEMORY == TRUE

 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
    if ((btc_creat_tab_env_ptr = (esp_btc_creat_tab_t *)osi_malloc(sizeof(esp_btc_creat_tab_t))) == NULL) {
@ -460,6 +471,13 @@ static bt_status_t btc_init_mem(void) {
 #endif
 #endif

+#if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+        goto error_exit;
+    }
+    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+#endif
+
 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
    if ((hf_client_local_param_ptr = (hf_client_local_param_t *)osi_malloc(sizeof(hf_client_local_param_t))) == NULL) {
        goto error_exit;
--- a/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        if (p_data->req_data.p_data->write_req.is_prep) {
            tBTA_GATT_STATUS status = GATT_SUCCESS;

-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);

            memset(&rsp, 0, sizeof(tGATTS_RSP));
            rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;
--- a/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)

 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
    struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
    uint16_t checksum, checksum_pkt;
    int ret;

--- a/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -9,6 +9,11 @@

 #include "btc/btc_task.h"
 #include "esp_blufi_api.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #if (BLUFI_INCLUDED == TRUE)

 #define BTC_BLUFI_GREAT_VER   0x01  //Version + Subversion
@ -31,7 +36,9 @@ typedef struct {
    UINT32                  trans_id;
    UINT8                   congest;
    UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
    uint8_t                 *prepare_buf;
    int                     prepare_len;
    /* Control reference */
@ -193,5 +200,10 @@ void btc_blufi_cb_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);

 void btc_blufi_cb_deep_free(btc_msg_t *msg);

-#endif /* __BLUFI_INT_H__ */
-#endif  ///BLUFI_INCLUDED == TRUE
+#endif ///BLUFI_INCLUDED == TRUE
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __BLUFI_INT_H__ */
--- a/components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h
+++ b/components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -20,6 +20,10 @@
 #include "esp_gap_ble_api.h"
 #endif

+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #define BLUFI_APP_UUID      0xFFFF
 #define BLUFI_DEVICE_NAME            "BLUFI_DEVICE"

@ -40,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a

 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif
@ -96,4 +101,7 @@ void esp_blufi_send_encap(void *arg);
 int esp_blufi_handle_gap_events(struct ble_gap_event *event, void *arg);
 #endif

+#ifdef __cplusplus
+}
+#endif
 #endif/* _ESP_BLUFI_ */
--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -124,7 +124,31 @@ static size_t write_value(uint16_t conn_handle, uint16_t attr_handle,
        }
    }

-    btc_blufi_recv_handler(&ctxt->om->om_data[0], ctxt->om->om_len);
+    /* Data may come in linked om. So retrieve all data */
+    if (SLIST_NEXT(ctxt->om, om_next) != NULL) {
+	uint8_t *fw_buf = (uint8_t *)malloc(517 * sizeof(uint8_t));
+	memset(fw_buf, 0x0, 517);
+
+        memcpy(fw_buf, &ctxt->om->om_data[0], ctxt->om->om_len);
+        struct os_mbuf *last;
+        last = ctxt->om;
+        uint32_t offset = ctxt->om->om_len;
+
+        while (SLIST_NEXT(last, om_next) != NULL) {
+              struct os_mbuf *temp = SLIST_NEXT(last, om_next);
+	      memcpy(fw_buf + offset  , &temp->om_data[0], temp->om_len);
+	      offset += temp->om_len;
+	      last = SLIST_NEXT(last, om_next);
+              temp = NULL;
+        }
+	btc_blufi_recv_handler(fw_buf, offset);
+
+	free(fw_buf);
+    }
+    else {
+        btc_blufi_recv_handler(&ctxt->om->om_data[0], ctxt->om->om_len);
+    }
+
    rc = ble_hs_mbuf_to_flat(ctxt->om, value->buf->om_data,
                             value->buf->om_len, &len);
    if (rc != 0) {
@ -216,6 +240,32 @@ static void init_gatt_values(void)

 }

+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
    int rc;
@ -236,6 +286,18 @@ int esp_blufi_gatt_svr_init(void)
    return 0;
 }

+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
 static int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
@ -418,8 +480,10 @@ uint8_t esp_blufi_init(void)
 void esp_blufi_deinit(void)
 {
    blufi_env.enabled = false;
-    btc_msg_t msg;
    esp_blufi_cb_param_t param;
+    btc_msg_t msg;
+    memset (&msg, 0x0, sizeof (msg));
+    msg.sig = BTC_SIG_API_CB;
    msg.pid = BTC_PID_BLUFI;
    msg.act = ESP_BLUFI_EVENT_DEINIT_FINISH;
    param.deinit_finish.state = ESP_BLUFI_DEINIT_OK;
--- a/components/bt/common/btc/profile/esp/include/btc_blufi_prf.h
+++ b/components/bt/common/btc/profile/esp/include/btc_blufi_prf.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -21,6 +21,11 @@
 #define ESP_BLUFI_SUCCESS 0x00
 #endif

+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #define BT_BD_ADDR_STR         "%02x:%02x:%02x:%02x:%02x:%02x"
 #define BT_BD_ADDR_HEX(addr)   addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]

@ -100,4 +105,7 @@ void btc_blufi_call_deep_free(btc_msg_t *msg);

 uint16_t btc_blufi_get_version(void);

+#ifdef __cplusplus
+}
+#endif
 #endif /* __BTC_BLUFI_PRF_H__ */
--- a/components/bt/common/hci_log/bt_hci_log.c
+++ b/components/bt/common/hci_log/bt_hci_log.c
@ -0,0 +1,342 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include "hci_log/bt_hci_log.h"
+#include "bt_common.h"
+#include "osi/mutex.h"
+#include "esp_attr.h"
+
+#if (BT_HCI_LOG_INCLUDED == TRUE)
+#define BT_HCI_LOG_PRINT_TAG                     (1)
+#define BT_HCI_LOG_DATA_BUF_SIZE                 (1024 * HCI_LOG_DATA_BUFFER_SIZE)
+#define BT_HCI_LOG_ADV_BUF_SIZE                  (1024 * HCI_LOG_ADV_BUFFER_SIZE)
+
+typedef struct {
+    osi_mutex_t mutex_lock;
+    uint64_t log_record_in;
+    uint64_t log_record_out;
+    uint64_t buf_size;
+    uint8_t *p_hci_log_buffer;
+    uint8_t index;
+    bool overflow;
+} bt_hci_log_t;
+
+static const char s_hex_to_char_mapping[16] = {
+    '0', '1', '2', '3', '4', '5', '6', '7',
+    '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+};
+
+static bt_hci_log_t g_bt_hci_log_data_ctl  = {0};
+static bt_hci_log_t g_bt_hci_log_adv_ctl  = {0};
+
+esp_err_t bt_hci_log_init(void)
+{
+    uint8_t *g_bt_hci_log_data_buffer = NULL;
+    uint8_t *g_bt_hci_log_adv_buffer  = NULL;
+
+    g_bt_hci_log_data_buffer = malloc(BT_HCI_LOG_DATA_BUF_SIZE);
+    if (!g_bt_hci_log_data_buffer) {
+        return ESP_ERR_NO_MEM;
+    }
+    g_bt_hci_log_adv_buffer = malloc(BT_HCI_LOG_ADV_BUF_SIZE);
+    if (!g_bt_hci_log_adv_buffer) {
+        if (g_bt_hci_log_data_buffer) {
+            free(g_bt_hci_log_data_buffer);
+            g_bt_hci_log_data_buffer = NULL;
+        }
+        return ESP_ERR_NO_MEM;
+    }
+
+    memset(g_bt_hci_log_data_buffer, 0, BT_HCI_LOG_DATA_BUF_SIZE);
+    memset(g_bt_hci_log_adv_buffer, 0, BT_HCI_LOG_ADV_BUF_SIZE);
+
+    memset(&g_bt_hci_log_data_ctl, 0, sizeof(bt_hci_log_t));
+    g_bt_hci_log_data_ctl.buf_size = BT_HCI_LOG_DATA_BUF_SIZE;
+    g_bt_hci_log_data_ctl.p_hci_log_buffer = g_bt_hci_log_data_buffer;
+
+    memset(&g_bt_hci_log_adv_ctl, 0, sizeof(bt_hci_log_t));
+    g_bt_hci_log_adv_ctl.buf_size = BT_HCI_LOG_ADV_BUF_SIZE;
+    g_bt_hci_log_adv_ctl.p_hci_log_buffer = g_bt_hci_log_adv_buffer;
+
+    osi_mutex_new((osi_mutex_t *)&g_bt_hci_log_data_ctl.mutex_lock);
+    osi_mutex_new((osi_mutex_t *)&g_bt_hci_log_adv_ctl.mutex_lock);
+
+    return ESP_OK;
+}
+
+esp_err_t bt_hci_log_deinit(void)
+{
+    if (g_bt_hci_log_data_ctl.p_hci_log_buffer) {
+        free(g_bt_hci_log_data_ctl.p_hci_log_buffer);
+        g_bt_hci_log_data_ctl.p_hci_log_buffer = NULL;
+    }
+
+    if (g_bt_hci_log_adv_ctl.p_hci_log_buffer) {
+        free(g_bt_hci_log_adv_ctl.p_hci_log_buffer);
+        g_bt_hci_log_adv_ctl.p_hci_log_buffer = NULL;
+    }
+
+    osi_mutex_free((osi_mutex_t *)&g_bt_hci_log_data_ctl.mutex_lock);
+    osi_mutex_free((osi_mutex_t *)&g_bt_hci_log_adv_ctl.mutex_lock);
+
+    memset(&g_bt_hci_log_data_ctl, 0, sizeof(bt_hci_log_t));
+    memset(&g_bt_hci_log_adv_ctl, 0, sizeof(bt_hci_log_t));
+
+    return ESP_OK;
+}
+
+#if (BT_HCI_LOG_PRINT_TAG)
+static char IRAM_ATTR *bt_data_type_to_str(uint8_t data_type)
+{
+    char *tag = NULL;
+    switch (data_type)
+    {
+    case HCI_LOG_DATA_TYPE_COMMAND:
+        // hci cmd data
+        tag = "C";
+        break;
+    case HCI_LOG_DATA_TYPE_H2C_ACL:
+        // host to controller hci acl data
+        tag = "H";
+        break;
+    case HCI_LOG_DATA_TYPE_SCO:
+        // hci sco data
+        tag = "S";
+        break;
+    case HCI_LOG_DATA_TYPE_EVENT:
+        // hci event
+        tag = "E";
+        break;
+    case HCI_LOG_DATA_TYPE_ADV:
+        // controller adv report data
+        tag = NULL;
+        break;
+    case HCI_LOG_DATA_TYPE_C2H_ACL:
+        // controller to host hci acl data
+        tag = "D";
+        break;
+    case HCI_LOG_DATA_TYPE_SELF_DEFINE:
+        // self-defining data
+        tag = "S";
+        break;
+    default:
+        // unknown data type
+        tag = "U";
+        break;
+    }
+
+    return tag;
+}
+#endif
+
+void bt_hci_log_record_hex(bt_hci_log_t *p_hci_log_ctl, uint8_t *hex, uint8_t hex_len)
+{
+    uint8_t hci_log_char;
+    uint8_t *g_hci_log_buffer;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    while (hex_len--)
+    {
+        hci_log_char = ((*hex) >> 4);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = s_hex_to_char_mapping [hci_log_char];
+
+        if (++ p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        hci_log_char = ((*hex) & 0x0f);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = s_hex_to_char_mapping [hci_log_char];
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = ' ';
+
+        if (++ p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+
+        ++ hex;
+    }
+}
+
+void bt_hci_log_record_string(bt_hci_log_t *p_hci_log_ctl, char *string)
+{
+    uint8_t *g_hci_log_buffer;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    while (*string != '\0') {
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = *string;
+        ++string;
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+    }
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *str, uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    osi_mutex_t mutex_lock;
+    uint8_t *g_hci_log_buffer;
+
+    if (!p_hci_log_ctl->p_hci_log_buffer) {
+        return ESP_FAIL;
+    }
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    if (!g_hci_log_buffer) {
+        return ESP_FAIL;
+    }
+
+    mutex_lock = p_hci_log_ctl->mutex_lock;
+    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
+
+#if (1)
+    // Add hci data index
+    bt_hci_log_record_hex(p_hci_log_ctl, &p_hci_log_ctl->index, 1);
+#endif
+
+#if (BT_HCI_LOG_PRINT_TAG)
+    char *tag = NULL;
+    tag = bt_data_type_to_str(data_type);
+
+    if (tag) {
+        bt_hci_log_record_string(p_hci_log_ctl, tag);
+
+        g_hci_log_buffer[p_hci_log_ctl->log_record_in] = ':';
+
+        if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+            p_hci_log_ctl->log_record_in = 0;
+        }
+
+        if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+            p_hci_log_ctl->overflow = true;
+        }
+    }
+#endif
+
+    if (str) {
+        bt_hci_log_record_string(p_hci_log_ctl, str);
+    }
+
+    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+
+    g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';
+
+    if (++p_hci_log_ctl->log_record_in >= p_hci_log_ctl->buf_size) {
+        p_hci_log_ctl->log_record_in = 0;
+    }
+
+    if (p_hci_log_ctl->log_record_in == p_hci_log_ctl->log_record_out) {
+        p_hci_log_ctl->overflow = true;
+    }
+
+    p_hci_log_ctl->index ++;
+
+    osi_mutex_unlock(&mutex_lock);
+
+    return ESP_OK;
+}
+
+void bt_hci_log_data_show(bt_hci_log_t *p_hci_log_ctl)
+{
+    volatile uint64_t log_record_in,log_record_out;
+    uint8_t *g_hci_log_buffer;
+
+    if (!p_hci_log_ctl->p_hci_log_buffer) {
+        return;
+    }
+
+    osi_mutex_t mutex_lock = p_hci_log_ctl->mutex_lock;
+
+    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);
+
+    log_record_in  = p_hci_log_ctl->log_record_in;
+    log_record_out = p_hci_log_ctl->log_record_out;
+
+    g_hci_log_buffer = p_hci_log_ctl->p_hci_log_buffer;
+
+    if (p_hci_log_ctl->overflow) {
+        log_record_out = log_record_in;
+        printf("%c",g_hci_log_buffer[log_record_out]);
+
+        if (++log_record_out >= p_hci_log_ctl->buf_size) {
+            log_record_out = 0;
+        }
+    }
+
+    while (log_record_in != log_record_out)
+    {
+        printf("%c",g_hci_log_buffer[log_record_out]);
+
+        if (++log_record_out >= p_hci_log_ctl->buf_size) {
+            log_record_out = 0;
+        }
+    }
+
+    p_hci_log_ctl->log_record_out = log_record_out;
+    p_hci_log_ctl->overflow = false;
+
+    osi_mutex_unlock(&mutex_lock);
+}
+static bool enable_hci_log_flag = true;
+void bt_hci_log_record_hci_enable(bool enable)
+{
+    enable_hci_log_flag = enable;
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_hci_data(uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    if (!enable_hci_log_flag) return ESP_OK;
+    return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, NULL, data_type, data, data_len);
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_custom_data(char *string, uint8_t *data, uint8_t data_len)
+{
+    if (!enable_hci_log_flag) return ESP_OK;
+    return bt_hci_log_record_data(&g_bt_hci_log_data_ctl, string, HCI_LOG_DATA_TYPE_SELF_DEFINE, data, data_len);
+}
+
+esp_err_t IRAM_ATTR bt_hci_log_record_hci_adv(uint8_t data_type, uint8_t *data, uint8_t data_len)
+{
+    if (!enable_hci_log_flag) return ESP_OK;
+    return bt_hci_log_record_data(&g_bt_hci_log_adv_ctl, NULL, data_type, data, data_len);
+}
+
+void bt_hci_log_hci_data_show(void)
+{
+    bt_hci_log_data_show(&g_bt_hci_log_data_ctl);
+}
+
+void bt_hci_log_hci_adv_show(void)
+{
+    bt_hci_log_data_show(&g_bt_hci_log_adv_ctl);
+}
+
+#endif // (BT_HCI_LOG_INCLUDED == TRUE)
--- a/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
+++ b/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
@ -0,0 +1,108 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef __ESP_BT_HCI_LOG_H__
+#define __ESP_BT_HCI_LOG_H__
+
+#include "esp_err.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define    HCI_LOG_DATA_TYPE_COMMAND         (1)
+#define    HCI_LOG_DATA_TYPE_H2C_ACL         (2)
+#define    HCI_LOG_DATA_TYPE_SCO             (3)
+#define    HCI_LOG_DATA_TYPE_EVENT           (4)
+#define    HCI_LOG_DATA_TYPE_ADV             (5)
+#define    HCI_LOG_DATA_TYPE_SELF_DEFINE     (6)
+#define    HCI_LOG_DATA_TYPE_C2H_ACL         (7)
+
+/**
+ *
+ * @brief            This function is called to record self-defining data
+ * @param string :   data identification
+ * @param data :     data
+ * @param data_len : the length of data
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_custom_data(char *string, uint8_t *data, uint8_t data_len);
+/**
+ *
+ * @brief           This function is called to print all hci data record
+ *
+ *
+ * @return          None
+ *
+ */
+void bt_hci_log_hci_data_show(void);
+
+/**
+ *
+ * @brief           This function is called to print all adv report
+ *
+ *
+ * @return          None
+ *
+ */
+void bt_hci_log_hci_adv_show(void);
+
+/**
+ *
+ * @brief           This function is called to init hci log env
+ *
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_init(void);
+
+/**
+ *
+ * @brief           This function is called to deinit hci debug mode,
+ *                  and can only be called internally by Bluetooth
+ *
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_deinit(void);
+
+/**
+ *
+ * @brief           This function is called to record hci data without adv report event,
+ *                  and can only be called internally by Bluetooth
+ *
+ * @param str :     data type, define in bt_data_type_to_str()
+ * @param data :    data
+ * @param data_len : the length of data
+ *
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_hci_data(uint8_t data_type, uint8_t *data, uint8_t data_len);
+
+/**
+ *
+ * @brief           This function is called to record hci adv report event only
+ *                  and can only be called internally by Bluetooth
+ *
+ * @param str :     data type, define in bt_data_type_to_str()
+ * @param data :    data
+ * @param data_len : the length of data
+ * @return          ESP_OK - success, other - failed
+ *
+ */
+esp_err_t bt_hci_log_record_hci_adv(uint8_t data_type, uint8_t *data, uint8_t data_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ESP_BT_HCI_LOG_H__ */
--- a/components/bt/common/include/bt_common.h
+++ b/components/bt/common/include/bt_common.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -46,6 +46,7 @@
 #define OSI_INITIAL_TRACE_LEVEL             UC_BT_LOG_OSI_TRACE_LEVEL
 #define BLUFI_INITIAL_TRACE_LEVEL           UC_BT_LOG_BLUFI_TRACE_LEVEL

+// MEMORY
 #if UC_BT_BLE_DYNAMIC_ENV_MEMORY
 #define BT_BLE_DYNAMIC_ENV_MEMORY  TRUE
 #define BTC_DYNAMIC_MEMORY         TRUE
@ -64,6 +65,37 @@
 #define BT_BLE_DYNAMIC_ENV_MEMORY  FALSE
 #endif

+#if UC_HEAP_ALLOCATION_FROM_SPIRAM_FIRST
+#define HEAP_ALLOCATION_FROM_SPIRAM_FIRST TRUE
+#else
+#define HEAP_ALLOCATION_FROM_SPIRAM_FIRST FALSE
+#endif
+
+#if UC_BT_ABORT_WHEN_ALLOCATION_FAILS
+#define HEAP_ALLOCATION_FAILS_ABORT TRUE
+#else
+#define HEAP_ALLOCATION_FAILS_ABORT FALSE
+#endif
+
+// HCI LOG
+#if UC_BT_HCI_LOG_DEBUG_EN
+#define BT_HCI_LOG_INCLUDED  UC_BT_HCI_LOG_DEBUG_EN
+#else
+#define BT_HCI_LOG_INCLUDED  FALSE
+#endif
+
+#if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
+#define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
+#else
+#define HCI_BUFFER_SIZE  (5)
+#endif
+
+#if UC_BT_HCI_ADV_BUFFER_SIZE
+#define HCI_LOG_ADV_BUFFER_SIZE  UC_BT_HCI_LOG_ADV_BUFFER_SIZE
+#else
+#define HCI_LOG_ADV_BUFFER_SIZE  (5)
+#endif
+
 /* OS Configuration from User config (eg: sdkconfig) */
 #define TASK_PINNED_TO_CORE         UC_TASK_PINNED_TO_CORE
 #define BT_TASK_MAX_PRIORITIES      configMAX_PRIORITIES
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -29,6 +29,12 @@
 #define UC_BT_STACK_NO_LOG               FALSE
 #endif

+#ifdef CONFIG_BT_CONTROLLER_ENABLED
+#define UC_BT_CONTROLLER_INCLUDED        TRUE
+#else
+#define UC_BT_CONTROLLER_INCLUDED        FALSE
+#endif
+
 /**********************************************************
 * Thread/Task reference
 **********************************************************/
@ -44,6 +50,15 @@
 #define UC_BTC_TASK_STACK_SIZE              4096
 #endif

+/**********************************************************
+ * Alarm reference
+ **********************************************************/
+#ifdef CONFIG_BT_ALARM_MAX_NUM
+#define UC_ALARM_MAX_NUM                    CONFIG_BT_ALARM_MAX_NUM
+#else
+#define UC_ALARM_MAX_NUM                    50
+#endif
+
 /**********************************************************
 * Trace reference
 **********************************************************/
@ -85,11 +100,42 @@
 #define UC_BT_BLUFI_ENABLE                  FALSE
 #endif

-//MEMORY DEBUG
+//MEMORY
 #ifdef CONFIG_BT_BLUEDROID_MEM_DEBUG
 #define UC_BT_BLUEDROID_MEM_DEBUG TRUE
 #else
 #define UC_BT_BLUEDROID_MEM_DEBUG FALSE
 #endif

+#ifdef CONFIG_BT_ALLOCATION_FROM_SPIRAM_FIRST
+#define UC_HEAP_ALLOCATION_FROM_SPIRAM_FIRST    CONFIG_BT_ALLOCATION_FROM_SPIRAM_FIRST
+#else
+#define UC_HEAP_ALLOCATION_FROM_SPIRAM_FIRST    FALSE
+#endif
+
+#ifdef CONFIG_BT_ABORT_WHEN_ALLOCATION_FAILS
+#define UC_BT_ABORT_WHEN_ALLOCATION_FAILS       CONFIG_BT_ABORT_WHEN_ALLOCATION_FAILS
+#else
+#define UC_BT_ABORT_WHEN_ALLOCATION_FAILS       FALSE
+#endif
+
+//HCI LOG
+#ifdef CONFIG_BT_HCI_LOG_DEBUG_EN
+#define UC_BT_HCI_LOG_DEBUG_EN  TRUE
+#else
+#define UC_BT_HCI_LOG_DEBUG_EN  FALSE
+#endif
+
+#ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
+#define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
+#else
+#define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  (5)
+#endif
+
+#ifdef CONFIG_BT_HCI_LOG_ADV_BUFFER_SIZE
+#define UC_BT_HCI_LOG_ADV_BUFFER_SIZE CONFIG_BT_HCI_LOG_ADV_BUFFER_SIZE
+#else
+#define UC_BT_HCI_LOG_ADV_BUFFER_SIZE  (5)
+#endif
+
 #endif /* __BT_USER_CONFIG_H__ */
--- a/components/bt/common/osi/allocator.c
+++ b/components/bt/common/osi/allocator.c
@ -213,42 +213,30 @@ char *osi_strdup(const char *str)

 void *osi_malloc_func(size_t size)
 {
-#if HEAP_MEMORY_DEBUG
-    void *p;
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-    p = heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);
-#else
-    p = malloc(size);
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-    osi_mem_dbg_record(p, size, __func__, __LINE__);
+    void *p = osi_malloc_base(size);
+
+    if (size != 0 && p == NULL) {
+        OSI_TRACE_ERROR("malloc failed (caller=%p size=%u)\n", __builtin_return_address(0), size);
+#if HEAP_ALLOCATION_FAILS_ABORT
+        assert(0);
+#endif
+    }
+
    return p;
-#else
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-    return heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);
-#else
-    return malloc(size);
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-#endif /* #if HEAP_MEMORY_DEBUG */
 }

 void *osi_calloc_func(size_t size)
 {
-#if HEAP_MEMORY_DEBUG
-    void *p;
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-    p = heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);
-#else
-    p = calloc(1, size);
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-    osi_mem_dbg_record(p, size, __func__, __LINE__);
+    void *p = osi_calloc_base(size);
+
+    if (size != 0 && p == NULL) {
+        OSI_TRACE_ERROR("calloc failed (caller=%p size=%u)\n", __builtin_return_address(0), size);
+#if HEAP_ALLOCATION_FAILS_ABORT
+        assert(0);
+#endif
+    }
+
    return p;
-#else
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-    return heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);
-#else
-    return calloc(1, size);
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-#endif /* #if HEAP_MEMORY_DEBUG */
 }

 void osi_free_func(void *ptr)
--- a/components/bt/common/osi/config.c
+++ b/components/bt/common/osi/config.c
@ -264,13 +264,13 @@ bool config_update_newest_section(config_t *config, const char *section)
        return false;
    }
    section_t *first_sec = list_node(first_node);
-    if (!strcmp(first_sec->name, section)) {
+    if (strcmp(first_sec->name, section) == 0) {
        return true;
    }

    for (const list_node_t *node = list_begin(config->sections); node != list_end(config->sections); node = list_next(node)) {
        section_t *sec = list_node(node);
-        if (!strcmp(sec->name, section)) {
+        if (strcmp(sec->name, section) == 0) {
            list_delete(config->sections, sec);
            list_prepend(config->sections, sec);
            return true;
--- a/components/bt/common/osi/include/osi/alarm.h
+++ b/components/bt/common/osi/include/osi/alarm.h
@ -21,6 +21,7 @@

 #include <stdint.h>
 #include "esp_timer.h"
+#include "bt_user_config.h"

 typedef struct alarm_t osi_alarm_t;
 typedef uint64_t period_ms_t;
@ -33,7 +34,7 @@ typedef enum {
    OSI_ALARM_ERR_INVALID_STATE = -3,
 } osi_alarm_err_t;

-#define ALARM_CBS_NUM   50
+#define ALARM_CBS_NUM   UC_ALARM_MAX_NUM
 #define ALARM_ID_BASE   1000

 int osi_alarm_create_mux(void);
--- a/components/bt/common/osi/include/osi/allocator.h
+++ b/components/bt/common/osi/include/osi/allocator.h
@ -29,6 +29,15 @@ void *osi_malloc_func(size_t size);
 void *osi_calloc_func(size_t size);
 void osi_free_func(void *ptr);

+// Memory alloc function without print and assertion
+#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
+#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#else
+#define osi_malloc_base(size)             malloc((size))
+#define osi_calloc_base(size)             calloc(1, (size))
+#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
+
 #if HEAP_MEMORY_DEBUG

 void osi_mem_dbg_init(void);
@ -41,13 +50,10 @@ void osi_men_dbg_set_section_start(uint8_t index);
 void osi_men_dbg_set_section_end(uint8_t index);
 uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);

-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
 #define osi_malloc(size)                                \
 ({                                                      \
    void *p;                                            \
-    p = heap_caps_malloc_prefer(size, 2,                \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_malloc_base(size);                          \
    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
    (void *)p;                                          \
 })
@ -55,34 +61,11 @@ uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 #define osi_calloc(size)                                \
 ({                                                      \
    void *p;                                            \
-    p = heap_caps_calloc_prefer(1, size, 2,             \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_calloc_base(size);                          \
    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
    (void *)p;                                          \
 })

-#else
-
-#define osi_malloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = malloc((size));                                 \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#define osi_calloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = calloc(1, (size));                              \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
-
 #if 0
 #define osi_malloc(size)                                \
 do {                                                    \
@ -122,13 +105,9 @@ do {                                                    \

 #else

-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-#define osi_malloc(size)                  heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#define osi_calloc(size)                  heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#else
-#define osi_malloc(size)                  malloc((size))
-#define osi_calloc(size)                  calloc(1, (size))
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
+// Memory alloc function with print and assertion when fails
+#define osi_malloc(size)                  osi_malloc_func((size))
+#define osi_calloc(size)                  osi_calloc_func((size))
 #define osi_free(p)                       free((p))

 #endif /* HEAP_MEMORY_DEBUG */
--- a/components/bt/common/osi/thread.c
+++ b/components/bt/common/osi/thread.c
@ -271,10 +271,10 @@ _err:
        }

        for (int i = 0; i < thread->work_queue_num; i++) {
-            if (thread->work_queues[i]) {
+            if (thread->work_queues && thread->work_queues[i]) {
                osi_work_queue_delete(thread->work_queues[i]);
+                thread->work_queues[i] = NULL;
            }
-            thread->work_queues[i] = NULL;
        }

        if (thread->work_queues) {
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@ -172,7 +172,7 @@ config BTDM_CTRL_PINNED_TO_CORE
 choice BTDM_CTRL_HCI_MODE_CHOICE
    prompt "HCI mode"
    help
-        Speicify HCI mode as VHCI or UART(H4)
+        Specify HCI mode as VHCI or UART(H4)

    config BTDM_CTRL_HCI_MODE_VHCI
        bool "VHCI"
@ -262,10 +262,10 @@ menu "MODEM SLEEP Options"
                the bluetooth low power clock source.

        config BTDM_CTRL_LPCLK_SEL_EXT_32K_XTAL
-            bool "External 32kHz crystal"
-            depends on RTC_CLK_SRC_EXT_CRYS
+            bool "External 32kHz crystal/oscillator"
+            depends on RTC_CLK_SRC_EXT_CRYS || RTC_CLK_SRC_EXT_OSC
            help
-                External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
+                External 32kHz crystal/oscillator has a nominal frequency of 32.768kHz and provides good frequency
                stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
                modem sleep to be used with both DFS and light sleep.
    endchoice
@ -356,7 +356,7 @@ config BTDM_SCAN_DUPL_CACHE_SIZE
    default 100
    help
        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
+        When the maximum amount of device in the filter is reached, the oldest device will be refreshed.

 config BTDM_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
@ -398,6 +398,23 @@ config BTDM_CTRL_FULL_SCAN_SUPPORTED
        The full scan function is mainly used to provide BLE scan performance.
        This is required for scenes with high scan performance requirements, such as BLE Mesh scenes.

+config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
+    bool "Disable active scan backoff"
+    default n
+    help
+        Disable active scan backoff. The bluetooth spec requires that scanners should run a backoff procedure to
+        minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
+        scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
+
+config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+
 config BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
    bool "BLE adv report flow control supported"
    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
@ -432,6 +449,46 @@ config BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD
        If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
        may cause adv packets lost more.

+menu "BLE disconnect when instant passed"
+    config BTDM_BLE_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed during connection update procedure.
+
+    config BTDM_BLE_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in channel map update procedure.
+endmenu
+
+config BTDM_BLE_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BTDM_BLE_PING_EN
+    bool "Enable LE Ping procedure"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+config BTDM_BLE_VS_QA_SUPPORT
+    bool "BLE vendor HCI QA support"
+    depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
+    default n
+    help
+        This enables BLE vendor HCI command and event for QA.

 config BTDM_RESERVE_DRAM
    hex
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -16,8 +16,8 @@
 #include "freertos/task.h"
 #include "freertos/queue.h"
 #include "freertos/semphr.h"
-#include "freertos/xtensa_api.h"
 #include "freertos/portmacro.h"
+#include "xtensa_api.h" // Replace with interrupt allocator API (IDF-3891)
 #include "xtensa/core-macros.h"
 #include "esp_types.h"
 #include "esp_mac.h"
@ -35,7 +35,7 @@
 #include "soc/rtc.h"
 #include "soc/soc_memory_layout.h"
 #include "soc/dport_reg.h"
-#include "esp_coexist_internal.h"
+#include "private/esp_coexist_internal.h"
 #include "esp_timer.h"
 #if !CONFIG_FREERTOS_UNICORE
 #include "esp_ipc.h"
@ -89,9 +89,10 @@ do{\
 } while(0)

 #define OSI_FUNCS_TIME_BLOCKING  0xffffffff
-#define OSI_VERSION              0x00010004
+#define OSI_VERSION              0x00010005
 #define OSI_MAGIC_VALUE          0xFADEBEAD

+#define BLE_CONTROLLER_MALLOC_CAPS        (MALLOC_CAP_8BIT|MALLOC_CAP_DMA|MALLOC_CAP_INTERNAL)
 /* Types definition
 ************************************************************************
 */
@ -176,6 +177,7 @@ struct osi_funcs_t {
    void (*_interrupt_l3_restore)(void);
    void *(* _customer_queue_create)(uint32_t queue_len, uint32_t item_size);
    int (* _coex_version_get)(unsigned int *major, unsigned int *minor, unsigned int *patch);
+    void (* _patch_apply)(void);
    uint32_t _magic;
 };

@ -232,16 +234,17 @@ extern uint32_t _data_end_btdm_rom;

 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
-extern uint32_t _nimble_bss_start;
-extern uint32_t _nimble_bss_end;
-extern uint32_t _btdm_bss_start;
-extern uint32_t _btdm_bss_end;
+extern uint32_t _bt_controller_bss_start;
+extern uint32_t _bt_controller_bss_end;
 extern uint32_t _bt_data_start;
 extern uint32_t _bt_data_end;
-extern uint32_t _nimble_data_start;
-extern uint32_t _nimble_data_end;
-extern uint32_t _btdm_data_start;
-extern uint32_t _btdm_data_end;
+extern uint32_t _bt_controller_data_start;
+extern uint32_t _bt_controller_data_end;
+
+extern void config_bt_funcs_reset(void);
+extern void config_ble_funcs_reset(void);
+extern void config_btdm_funcs_reset(void);
+extern void config_ble_vs_qa_funcs_reset(void);

 /* Local Function Declare
 *********************************************************************
@ -315,6 +318,7 @@ static void *customer_queue_create_hlevel_wrapper(uint32_t queue_len, uint32_t i
 static void interrupt_l3_disable(void);
 static void interrupt_l3_restore(void);
 static void bt_controller_deinit_internal(void);
+static void patch_apply(void);

 /* Local variable definition
 ***************************************************************************
@ -402,6 +406,7 @@ static const struct osi_funcs_t osi_funcs_ro = {
    ._customer_queue_create = NULL,
 #endif /* CONFIG_BTDM_CTRL_HLI */
    ._coex_version_get = coex_version_get_wrapper,
+    ._patch_apply = patch_apply,
    ._magic = OSI_MAGIC_VALUE,
 };

@ -753,7 +758,7 @@ static int32_t queue_send_hlevel_wrapper(void *queue, void *item, uint32_t block
 * @param  item  The message which will be send
 * @param  hptw  need do task yield or not
 * @return       send success or not
- *               There is an issue here:  When the queue is full, it may reture true but it send fail to the queue, sometimes.
+ *               There is an issue here:  When the queue is full, it may return true but it send fail to the queue, sometimes.
 *               But in Bluetooth controller's isr, We don't care about the return value.
 *               It only required tp send success when the queue is empty all the time.
 *               So, this function meets the requirement.
@ -861,7 +866,21 @@ static int IRAM_ATTR cause_sw_intr_to_core_wrapper(int core_id, int intr_no)

 static void *malloc_internal_wrapper(size_t size)
 {
-    return heap_caps_malloc(size, MALLOC_CAP_8BIT|MALLOC_CAP_DMA|MALLOC_CAP_INTERNAL);
+    return heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+}
+
+void *malloc_ble_controller_mem(size_t size)
+{
+    void *p = heap_caps_malloc(size, BLE_CONTROLLER_MALLOC_CAPS);
+    if(p == NULL) {
+        ESP_LOGE(BTDM_LOG_TAG, "Malloc failed");
+    }
+    return p;
+}
+
+uint32_t get_ble_controller_free_heap_size(void)
+{
+    return heap_caps_get_free_size(BLE_CONTROLLER_MALLOC_CAPS);
 }

 static int32_t IRAM_ATTR read_mac_wrapper(uint8_t mac[6])
@ -1197,23 +1216,12 @@ static int coex_register_wifi_channel_change_callback_wrapper(void *cb)
 static int coex_version_get_wrapper(unsigned int *major, unsigned int *minor, unsigned int *patch)
 {
 #if CONFIG_SW_COEXIST_ENABLE
-    const char *ver_str = esp_coex_version_get();
-    if (ver_str != NULL) {
-        unsigned int _major = 0, _minor = 0, _patch = 0;
-        if (sscanf(ver_str, "%u.%u.%u", &_major, &_minor, &_patch) != 3) {
-            return -1;
-        }
-        if (major != NULL) {
-            *major = _major;
-        }
-        if (minor != NULL) {
-            *minor = _minor;
-        }
-        if (patch != NULL) {
-            *patch = _patch;
-        }
-        return 0;
-    }
+    coex_version_t version;
+    ESP_ERROR_CHECK(coex_version_get_value(&version));
+    *major = (unsigned int)version.major;
+    *minor = (unsigned int)version.minor;
+    *patch = (unsigned int)version.patch;
+    return 0;
 #endif
    return -1;
 }
@ -1285,7 +1293,45 @@ static esp_err_t try_heap_caps_add_region(intptr_t start, intptr_t end)
    return ret;
 }

-esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)
+typedef struct {
+    intptr_t start;
+    intptr_t end;
+    const char* name;
+} bt_area_t;
+
+
+static esp_err_t esp_bt_mem_release_area(const bt_area_t *area)
+{
+    esp_err_t ret = ESP_OK;
+    intptr_t mem_start = area->start;
+    intptr_t mem_end = area->end;
+    if (mem_start != mem_end) {
+        ESP_LOGD(BTDM_LOG_TAG, "Release %s [0x%08x] - [0x%08x], len %d", area->name, mem_start, mem_end, mem_end - mem_start);
+        ret = try_heap_caps_add_region(mem_start, mem_end);
+    }
+    return ret;
+}
+
+static esp_err_t esp_bt_mem_release_areas(const bt_area_t *area1, const bt_area_t *area2)
+{
+    esp_err_t ret = ESP_OK;
+
+    if (area1->end == area2->start) {
+        bt_area_t merged_area = {
+            .start = area1->start,
+            .end = area2->end,
+            .name = area1->name
+        };
+        ret = esp_bt_mem_release_area(&merged_area);
+    } else {
+        esp_bt_mem_release_area(area1);
+        ret = esp_bt_mem_release_area(area2);
+    }
+
+    return ret;
+}
+
+static esp_err_t esp_bt_controller_rom_mem_release(esp_bt_mode_t mode)
 {
    bool update = true;
    intptr_t mem_start=(intptr_t) NULL, mem_end=(intptr_t) NULL;
@ -1296,7 +1342,8 @@ esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)

    //already released
    if (!(mode & btdm_dram_available_region[0].mode)) {
-        return ESP_ERR_INVALID_STATE;
+        ESP_LOGW(BTDM_LOG_TAG, "%s already released, mode %d",__func__, mode);
+        return ESP_OK;
    }

    for (int i = 0; i < sizeof(btdm_dram_available_region)/sizeof(btdm_dram_available_region_t); i++) {
@ -1336,61 +1383,89 @@ esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)
        }
    }

-    if (mode == ESP_BT_MODE_BTDM) {
-        mem_start = (intptr_t)&_btdm_bss_start;
-        mem_end = (intptr_t)&_btdm_bss_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release BTDM BSS [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
-        }
-        mem_start = (intptr_t)&_btdm_data_start;
-        mem_end = (intptr_t)&_btdm_data_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release BTDM Data [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
-        }
-    }
    return ESP_OK;
 }

+esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode)
+{
+    esp_err_t ret = ESP_OK;
+
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return ESP_ERR_INVALID_STATE;
+    }
+
+    if (mode == ESP_BT_MODE_BTDM) {
+        bt_area_t cont_bss = {
+            .start = (intptr_t)&_bt_controller_bss_start,
+            .end   = (intptr_t)&_bt_controller_bss_end,
+            .name  = "BT Controller BSS",
+        };
+        bt_area_t cont_data = {
+            .start = (intptr_t)&_bt_controller_data_start,
+            .end   = (intptr_t)&_bt_controller_data_end,
+            .name  = "BT Controller Data"
+        };
+
+        ret = esp_bt_mem_release_areas(&cont_data, &cont_bss);
+    }
+
+    if (ret == ESP_OK) {
+        ret = esp_bt_controller_rom_mem_release(mode);
+    }
+
+    return ret;
+}
+
 esp_err_t esp_bt_mem_release(esp_bt_mode_t mode)
 {
-    int ret;
-    intptr_t mem_start, mem_end;
+    esp_err_t ret = ESP_OK;

-    ret = esp_bt_controller_mem_release(mode);
-    if (ret != ESP_OK) {
-        return ret;
+    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_IDLE) {
+        return ESP_ERR_INVALID_STATE;
    }

+    bt_area_t bss = {
+        .start = (intptr_t)&_bt_bss_start,
+        .end   = (intptr_t)&_bt_bss_end,
+        .name  = "BT BSS",
+    };
+    bt_area_t cont_bss = {
+        .start = (intptr_t)&_bt_controller_bss_start,
+        .end   = (intptr_t)&_bt_controller_bss_end,
+        .name  = "BT Controller BSS",
+    };
+    bt_area_t data = {
+        .start = (intptr_t)&_bt_data_start,
+        .end   = (intptr_t)&_bt_data_end,
+        .name  = "BT Data",
+    };
+    bt_area_t cont_data = {
+        .start = (intptr_t)&_bt_controller_data_start,
+        .end   = (intptr_t)&_bt_controller_data_end,
+        .name  = "BT Controller Data"
+    };
+
+    /*
+     * Free data and BSS section for Bluetooth controller ROM code.
+     * Note that rom mem release must be performed before section _bt_data_start to _bt_data_end is released,
+     * otherwise `btdm_dram_available_region` will no longer be available when performing rom mem release and
+     * thus causing heap corruption.
+     */
+    ret = esp_bt_controller_rom_mem_release(mode);
+
    if (mode == ESP_BT_MODE_BTDM) {
-        mem_start = (intptr_t)&_bt_bss_start;
-        mem_end = (intptr_t)&_bt_bss_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release BT BSS [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
-        }
-        mem_start = (intptr_t)&_bt_data_start;
-        mem_end = (intptr_t)&_bt_data_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release BT Data [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
+        /* Start by freeing Bluetooth BSS section */
+        if (ret == ESP_OK) {
+            ret = esp_bt_mem_release_areas(&bss, &cont_bss);
        }

-        mem_start = (intptr_t)&_nimble_bss_start;
-        mem_end = (intptr_t)&_nimble_bss_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release NimBLE BSS [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
-        }
-        mem_start = (intptr_t)&_nimble_data_start;
-        mem_end = (intptr_t)&_nimble_data_end;
-        if (mem_start != mem_end) {
-            ESP_LOGD(BTDM_LOG_TAG, "Release NimBLE Data [0x%08x] - [0x%08x]", mem_start, mem_end);
-            ESP_ERROR_CHECK(try_heap_caps_add_region(mem_start, mem_end));
+        /* Do the same thing with the Bluetooth data section */
+        if (ret == ESP_OK) {
+            ret = esp_bt_mem_release_areas(&data, &cont_data);
        }
    }
-    return ESP_OK;
+
+    return ret;
 }

 #if CONFIG_BTDM_CTRL_HLI
@ -1475,6 +1550,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    btdm_controller_mem_init();

    periph_module_enable(PERIPH_BT_MODULE);
+    periph_module_reset(PERIPH_BT_MODULE);

 #ifdef CONFIG_PM_ENABLE
    s_btdm_allow_light_sleep = false;
@ -1561,7 +1637,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)

    btdm_cfg_mask = btdm_config_mask_load();

-    if (btdm_controller_init(btdm_cfg_mask, cfg) != 0) {
+    err = btdm_controller_init(btdm_cfg_mask, cfg);
+
+    if (err != 0) {
+        ESP_LOGE(BTDM_LOG_TAG, "%s %d\n",__func__,err);
        err = ESP_ERR_NO_MEM;
        goto error;
    }
@ -1654,6 +1733,22 @@ static void bt_shutdown(void)
    return;
 }

+static void patch_apply(void)
+{
+    config_btdm_funcs_reset();
+
+#ifndef CONFIG_BTDM_CTRL_MODE_BLE_ONLY
+    config_bt_funcs_reset();
+#endif
+
+#ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
+    config_ble_funcs_reset();
+#endif
+
+#ifdef CONFIG_BTDM_BLE_VS_QA_SUPPORT
+    config_ble_vs_qa_funcs_reset();
+#endif
+}

 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 {
@ -1687,7 +1782,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)

    sdk_config_set_bt_pll_track_enable(true);

-    // inititalize bluetooth baseband
+    // initialize bluetooth baseband
    btdm_check_and_init_bb();

    ret = btdm_controller_enable(mode);
@ -1839,7 +1934,7 @@ esp_err_t esp_bredr_sco_datapath_set(esp_sco_data_path_t data_path)
    return ESP_OK;
 }

-esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+esp_err_t esp_ble_scan_duplicate_list_flush(void)
 {
    if (btdm_controller_status != ESP_BT_CONTROLLER_STATUS_ENABLED) {
        return ESP_ERR_INVALID_STATE;
@ -1848,9 +1943,14 @@ esp_err_t esp_ble_scan_dupilcate_list_flush(void)
    return ESP_OK;
 }

+esp_err_t esp_ble_scan_dupilcate_list_flush(void)
+{
+    return esp_ble_scan_duplicate_list_flush();
+}
+
 /**
 * This function re-write controller's function,
- * As coredump can not show paramerters in function which is in a .a file.
+ * As coredump can not show parameters in function which is in a .a file.
 *
 * After coredump fixing this issue, just delete this function.
 */
--- a/components/bt/controller/esp32/hli_vectors.S
+++ b/components/bt/controller/esp32/hli_vectors.S
@ -8,7 +8,7 @@
 #include <xtensa/coreasm.h>
 #include <xtensa/corebits.h>
 #include <xtensa/config/system.h>
-#include "freertos/xtensa_context.h"
+#include "xtensa_context.h"
 #include "sdkconfig.h"
 #include "soc/soc.h"

--- a/components/bt/controller/esp32c2/Kconfig.in
+++ b/components/bt/controller/esp32c2/Kconfig.in
@ -2,15 +2,15 @@
 menu "HCI Config"

    choice BT_LE_HCI_INTERFACE
-        prompt "Select HCI interface"
+        prompt "HCI mode"
        default BT_LE_HCI_INTERFACE_USE_RAM

        config BT_LE_HCI_INTERFACE_USE_RAM
-            bool "ram"
+            bool "VHCI"
            help
                Use RAM as HCI interface
        config BT_LE_HCI_INTERFACE_USE_UART
-            bool "uart"
+            bool "UART(H4)"
            help
                Use UART as HCI interface
    endchoice
@ -73,12 +73,26 @@ menu "HCI Config"
                UART_PARITY_ODD
    endchoice

-    config BT_LE_HCI_UART_TASK_STACK_SIZE
-        int "HCI uart task stack size"
-        depends on BT_LE_HCI_INTERFACE_USE_UART
-        default 1000
+    config BT_LE_HCI_UART_RX_BUFFER_SIZE
+        int "The size of rx ring buffer memory"
+        depends on !BT_LE_HCI_INTERFACE_USE_RAM
+        default 512
        help
-            Set the size of uart task stack
+            The size of rx ring buffer memory
+
+    config BT_LE_HCI_UART_TX_BUFFER_SIZE
+        int "The size of tx ring buffer memory"
+        depends on !BT_LE_HCI_INTERFACE_USE_RAM
+        default 256
+        help
+            The size of tx ring buffer memory
+
+    config BT_LE_HCI_TRANS_TASK_STACK_SIZE
+        int "HCI transport task stack size"
+        depends on !BT_LE_HCI_INTERFACE_USE_RAM
+        default 1024
+        help
+            This configures stack size of hci transport task
 endmenu

 config BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT
@ -95,86 +109,100 @@ menuconfig BT_LE_50_FEATURE_SUPPORT
    help
        Enable BLE 5 feature

-config BT_LE_LL_CFG_FEAT_LE_2M_PHY
-    bool "Enable 2M Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable 2M-PHY
-
-config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
-    bool "Enable coded Phy"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable coded-PHY
-
-config BT_LE_EXT_ADV
-    bool "Enable extended advertising"
-    depends on BT_LE_50_FEATURE_SUPPORT
-    default y
-    help
-        Enable this option to do extended advertising. Extended advertising
-        will be supported from BLE 5.0 onwards.
-
-if BT_LE_EXT_ADV
-    config BT_LE_MAX_EXT_ADV_INSTANCES
-        int "Maximum number of extended advertising instances."
-        range 0 4
-        default 1
-        depends on BT_LE_EXT_ADV
-        help
-            Change this option to set maximum number of extended advertising
-            instances. Minimum there is always one instance of
-            advertising. Enter how many more advertising instances you
-            want.
-            Each extended advertising instance will take about 0.5k DRAM.
-
-    config BT_LE_EXT_ADV_MAX_SIZE
-        int "Maximum length of the advertising data."
-        range 0 1650
-        default 1650
-        depends on BT_LE_EXT_ADV
-        help
-            Defines the length of the extended adv data. The value should not
-            exceed 1650.
-
-    config BT_LE_ENABLE_PERIODIC_ADV
-        bool "Enable periodic advertisement."
-        default y
-        depends on BT_LE_EXT_ADV
-        help
-            Enable this option to start periodic advertisement.
-
-    config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
-        bool "Enable Transer Sync Events"
-        depends on BT_LE_ENABLE_PERIODIC_ADV
+if BT_LE_50_FEATURE_SUPPORT
+    config BT_LE_LL_CFG_FEAT_LE_2M_PHY
+        bool "Enable 2M Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
        default y
        help
-            This enables controller transfer periodic sync events to host
+            Enable 2M-PHY

+    config BT_LE_LL_CFG_FEAT_LE_CODED_PHY
+        bool "Enable coded Phy"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable coded-PHY
+
+    config BT_LE_EXT_ADV
+        bool "Enable extended advertising"
+        depends on BT_LE_50_FEATURE_SUPPORT
+        default y
+        help
+            Enable this option to do extended advertising. Extended advertising
+            will be supported from BLE 5.0 onwards.
+
+    if BT_LE_EXT_ADV
+        config BT_LE_MAX_EXT_ADV_INSTANCES
+            int "Maximum number of extended advertising instances."
+            range 0 4
+            default 1
+            depends on BT_LE_EXT_ADV
+            help
+                Change this option to set maximum number of extended advertising
+                instances. Minimum there is always one instance of
+                advertising. Enter how many more advertising instances you
+                want.
+                Each extended advertising instance will take about 0.5k DRAM.
+
+        config BT_LE_EXT_ADV_MAX_SIZE
+            int "Maximum length of the advertising data."
+            range 0 1650
+            default 1650
+            depends on BT_LE_EXT_ADV
+            help
+                Defines the length of the extended adv data. The value should not
+                exceed 1650.
+
+        config BT_LE_ENABLE_PERIODIC_ADV
+            bool "Enable periodic advertisement."
+            default y
+            depends on BT_LE_EXT_ADV
+            help
+                Enable this option to start periodic advertisement.
+
+        config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
+            bool "Enable Transfer Sync Events"
+            depends on BT_LE_ENABLE_PERIODIC_ADV
+            default y
+            help
+                This enables controller transfer periodic sync events to host
+    endif
+
+    config BT_LE_EXT_SCAN
+        bool "Enable extended scanning"
+        depends on BT_LE_50_FEATURE_SUPPORT && BT_LE_ROLE_OBSERVER_ENABLE
+        default y
+        help
+            Enable this option to do extended scanning.
+
+    config BT_LE_ENABLE_PERIODIC_SYNC
+        bool "Enable periodic sync"
+        default y
+        depends on BT_LE_EXT_SCAN
+        help
+            Enable this option to receive periodic advertisement.
+
+    if BT_LE_ENABLE_PERIODIC_SYNC
+        config BT_LE_MAX_PERIODIC_SYNCS
+            int "Maximum number of periodic advertising syncs"
+            range 0 3
+            default 1 if BT_LE_ENABLE_PERIODIC_ADV
+            default 0
+            help
+                Set this option to set the upper limit for number of periodic sync
+                connections. This should be less than maximum connections allowed by
+                controller.
+
+        config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
+            int "Maximum number of periodic advertiser list"
+            range 1 5
+            default 5
+            help
+                Set this option to set the upper limit for number of periodic advertiser list.
+    endif
 endif

-config BT_LE_MAX_PERIODIC_SYNCS
-    int "Maximum number of periodic advertising syncs"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-
-    range 0 3
-    default 1 if BT_LE_ENABLE_PERIODIC_ADV
-    default 0
-    help
-        Set this option to set the upper limit for number of periodic sync
-        connections. This should be less than maximum connections allowed by
-        controller.
-
-config BT_LE_MAX_PERIODIC_ADVERTISER_LIST
-    int "Maximum number of periodic advertiser list"
-    depends on BT_LE_50_FEATURE_SUPPORT && !BT_NIMBLE_ENABLED
-    range 1 5
-    default 5
-    help
-        Set this option to set the upper limit for number of periodic advertiser list.
-
 menu "Memory Settings"
    depends on !BT_NIMBLE_ENABLED

@ -253,7 +281,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -264,21 +292,60 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    bool "Store ble controller logs to flash(Experimental)"
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+            Store ble controller logs to flash memory.
+
+config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+    int "size of ble controller log partition(Multiples of 4K)"
+    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    default 65536
+    help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
@ -328,7 +395,6 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
    bool "Override TinyCrypt with mbedTLS for crypto computations"
    default y
    depends on !BT_NIMBLE_ENABLED
-    select MBEDTLS_ECP_RESTARTABLE
    select MBEDTLS_CMAC_C
    help
        Enable this option to choose mbedTLS instead of TinyCrypt for crypto
@ -400,6 +466,26 @@ config BT_LE_SLEEP_ENABLE
    help
        Enable BLE sleep

+choice BT_LE_LP_CLK_SRC
+    prompt "BLE low power clock source"
+    default BT_LE_LP_CLK_SRC_MAIN_XTAL
+    config BT_LE_LP_CLK_SRC_MAIN_XTAL
+        bool "Use main XTAL as RTC clock source"
+        help
+            User main XTAL as RTC clock source.
+            This option is recommended if external 32.768k XTAL is not available.
+            Using the external 32.768 kHz XTAL will have lower current consumption
+            in light sleep compared to using the main XTAL.
+
+    config BT_LE_LP_CLK_SRC_DEFAULT
+        bool "Use system RTC slow clock source"
+        help
+            Use the same slow clock source as system RTC
+            Using any clock source other than external 32.768 kHz XTAL at pin0 supports only
+            legacy ADV and SCAN due to low clock accuracy.
+
+endchoice
+
 config BT_LE_USE_ESP_TIMER
    bool "Use Esp Timer for callout"
    depends on !BT_NIMBLE_ENABLED
@ -409,6 +495,7 @@ config BT_LE_USE_ESP_TIMER

 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
    bool "BLE adv report flow control supported"
+    depends on BT_LE_ROLE_OBSERVER_ENABLE
    default y
    help
        The function is mainly used to enable flow control for advertising reports. When it is enabled,
@ -443,3 +530,140 @@ config BT_CTRL_BLE_ADV_REPORT_DISCARD_THRSHOLD
 config BT_LE_RELEASE_IRAM_SUPPORTED
    bool
    default y
+
+config BT_LE_TX_CCA_ENABLED
+    bool "Enable TX CCA feature"
+    default n
+    help
+        Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
+
+config BT_LE_CCA_RSSI_THRESH
+    int "CCA RSSI threshold value"
+    depends on BT_LE_TX_CCA_ENABLED
+    range 20 100
+    default 20
+    help
+        Power threshold of CCA in unit of -1 dBm.
+
+config BT_LE_FEAT_LL_ENCRYPTION
+    bool "Enable controller ACL encryption"
+    default y
+
+config BT_LE_ROLE_CENTROL_ENABLE
+    bool "Enable BLE Centrol role function"
+    depends on !BT_NIMBLE_ENABLED
+    default y
+    help
+        Enable centrol role function.
+
+config BT_LE_ROLE_PERIPHERAL_ENABLE
+    bool "Enable BLE Peripheral role function"
+    depends on !BT_NIMBLE_ENABLED
+    default y
+    help
+        Enable Peripheral role function.
+
+config BT_LE_ROLE_BROADCASTER_ENABLE
+    bool "Enable BLE Broadcaster role function"
+    depends on !BT_NIMBLE_ENABLED
+    default y
+    help
+        Enable broadcaster role function.
+
+config BT_LE_ROLE_OBSERVER_ENABLE
+    bool "Enable BLE Observer role function"
+    depends on !BT_NIMBLE_ENABLED
+    default y
+    help
+        Enable observer role function.
+
+choice BT_LE_DFT_TX_POWER_LEVEL_DBM
+    prompt "BLE default Tx power level(dBm)"
+    default BT_LE_DFT_TX_POWER_LEVEL_P9
+    help
+        Specify default Tx power level(dBm).
+    config BT_LE_DFT_TX_POWER_LEVEL_N24
+        bool "-24dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N21
+        bool "-21dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N18
+        bool "-18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N15
+        bool "-15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N12
+        bool "-12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N9
+        bool "-9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N6
+        bool "-6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N3
+        bool "-3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N0
+        bool "0dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P3
+        bool "+3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P6
+        bool "+6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P9
+        bool "+9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P12
+        bool "+12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P15
+        bool "+15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P18
+        bool "+18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
+endchoice
+
+config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
+    int
+    default -24 if BT_LE_DFT_TX_POWER_LEVEL_N24
+    default -21 if BT_LE_DFT_TX_POWER_LEVEL_N21
+    default -18 if BT_LE_DFT_TX_POWER_LEVEL_N18
+    default -15 if BT_LE_DFT_TX_POWER_LEVEL_N15
+    default -12 if BT_LE_DFT_TX_POWER_LEVEL_N12
+    default -9 if BT_LE_DFT_TX_POWER_LEVEL_N9
+    default -6 if BT_LE_DFT_TX_POWER_LEVEL_N6
+    default -3 if BT_LE_DFT_TX_POWER_LEVEL_N3
+    default 0 if BT_LE_DFT_TX_POWER_LEVEL_N0
+    default 3 if BT_LE_DFT_TX_POWER_LEVEL_P3
+    default 6 if BT_LE_DFT_TX_POWER_LEVEL_P6
+    default 9 if BT_LE_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_LE_DFT_TX_POWER_LEVEL_P12
+    default 15 if BT_LE_DFT_TX_POWER_LEVEL_P15
+    default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
+    default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
+    default 0
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
+
+        - Only one Tx-Rx can be performed in each connection interval. Therefore, reduce the connection interval
+          as much as possible to improve the throughput. If you want higher connection performance, you can
+          enable BT_LE_PLACE_CONN_RELATED_INTO_IRAM to put the connection-related code into iram.
+        - For HCI_LE_Extended_Create_Connection command, only 1M phy's connection parameters will be applied.
+          Other phys' will be ignored.
+        - For extended scanning, we may be unable to receive the extended adv with 300us MAFS.
+
+config BT_LE_PLACE_CONN_RELATED_INTO_IRAM
+    bool "Place the connection-related code into IRAM"
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    default n
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
--- a/components/bt/controller/esp32c2/dummy.c
+++ b/components/bt/controller/esp32c2/dummy.c
@ -0,0 +1,320 @@
+/*
+ * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "esp_bt_cfg.h"
+
+#define BLE_ERR_UNKNOWN_HCI_CMD         (0x01)
+/* LL Features */
+#define BLE_LL_FEAT_LE_ENCRYPTION       (0x0000000001)
+#define BLE_LL_FEAT_CONN_PARM_REQ       (0x0000000002)
+#define BLE_LL_FEAT_EXTENDED_REJ        (0x0000000004)
+#define BLE_LL_FEAT_PERIPH_INIT         (0x0000000008)
+#define BLE_LL_FEAT_LE_PING             (0x0000000010)
+#define BLE_LL_FEAT_DATA_LEN_EXT        (0x0000000020)
+#define BLE_LL_FEAT_LL_PRIVACY          (0x0000000040)
+#define BLE_LL_FEAT_EXT_SCAN_FILT       (0x0000000080)
+#define BLE_LL_FEAT_LE_2M_PHY           (0x0000000100)
+#define BLE_LL_FEAT_STABLE_MOD_ID_TX    (0x0000000200)
+#define BLE_LL_FEAT_STABLE_MOD_ID_RX    (0x0000000400)
+#define BLE_LL_FEAT_LE_CODED_PHY        (0x0000000800)
+#define BLE_LL_FEAT_EXT_ADV             (0x0000001000)
+#define BLE_LL_FEAT_PERIODIC_ADV        (0x0000002000)
+#define BLE_LL_FEAT_CSA2                (0x0000004000)
+#define BLE_LL_FEAT_LE_POWER_CLASS_1    (0x0000008000)
+#define BLE_LL_FEAT_MIN_USED_CHAN       (0x0000010000)
+#define BLE_LL_FEAT_CTE_REQ             (0x0000020000)
+#define BLE_LL_FEAT_CTE_RSP             (0x0000040000)
+#define BLE_LL_FEAT_CTE_TX              (0x0000080000)
+#define BLE_LL_FEAT_CTE_RX              (0x0000100000)
+#define BLE_LL_FEAT_CTE_AOD             (0x0000200000)
+#define BLE_LL_FEAT_CTE_AOA             (0x0000400000)
+#define BLE_LL_FEAT_CTE_RECV            (0x0000800000)
+#define BLE_LL_FEAT_SYNC_TRANS_SEND     (0x0001000000)
+#define BLE_LL_FEAT_SYNC_TRANS_RECV     (0x0002000000)
+#define BLE_LL_FEAT_SCA_UPDATE          (0x0004000000)
+#define BLE_LL_FEAT_REM_PKEY            (0x0008000000)
+#define BLE_LL_FEAT_CIS_CENTRAL         (0x0010000000)
+#define BLE_LL_FEAT_CIS_PERIPH          (0x0020000000)
+#define BLE_LL_FEAT_ISO_BROADCASTER     (0x0040000000)
+#define BLE_LL_FEAT_SYNC_RECV           (0x0080000000)
+#define BLE_LL_FEAT_CIS_HOST            (0x0100000000)
+#define BLE_LL_FEAT_POWER_CTRL_REQ      (0x0200000000)
+#define BLE_LL_FEAT_POWER_CHANGE_IND    (0x0400000000)
+#define BLE_LL_FEAT_PATH_LOSS_MON       (0x0800000000)
+#define BLE_LL_FEAT_PERIODIC_ADV_ADI    (0x1000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING      (0x2000000000)
+#define BLE_LL_FEAT_CONN_SUBRATING_HOST (0x4000000000)
+#define BLE_LL_FEAT_CHANNEL_CLASS       (0x8000000000)
+
+uint64_t ble_ll_supported_features;
+
+void
+ble_ll_supported_features_init(void)
+{
+    ble_ll_supported_features = BLE_LL_FEAT_EXTENDED_REJ;
+    ble_ll_supported_features |= BLE_LL_FEAT_DATA_LEN_EXT;
+
+#if DEFAULT_BT_LE_ROLE_CENTROL || DEFAULT_BT_LE_ROLE_PERIPHERAL
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIPH_INIT;
+    ble_ll_supported_features |= BLE_LL_FEAT_CONN_PARM_REQ;
+#endif
+
+#if CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_ENCRYPTION;
+#endif
+
+    ble_ll_supported_features |= (BLE_LL_FEAT_LL_PRIVACY | BLE_LL_FEAT_EXT_SCAN_FILT);
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_PING;
+
+#if DEFAULT_BT_LE_EXT_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_EXT_ADV;
+#endif
+
+#if DEFAULT_BT_LE_PERIODIC_ADV
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV;
+    ble_ll_supported_features |= BLE_LL_FEAT_PERIODIC_ADV_ADI;
+#endif
+
+#if DEFAULT_BT_LE_PAST
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_RECV;
+    ble_ll_supported_features |= BLE_LL_FEAT_SYNC_TRANS_SEND;
+#endif
+
+#if DEGAULT_BT_LE_2M_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_2M_PHY;
+#endif
+
+#if DEGAULT_BT_LE_CODED_PHY
+    ble_ll_supported_features |= BLE_LL_FEAT_LE_CODED_PHY;
+#endif
+
+#if DEFAULT_BT_LE_50_FEATURE_SUPPORT
+    ble_ll_supported_features |= BLE_LL_FEAT_CSA2;
+    ble_ll_supported_features |= BLE_LL_FEAT_SCA_UPDATE;
+    ble_ll_supported_features |= BLE_LL_FEAT_REM_PKEY;
+    ble_ll_supported_features |= BLE_LL_FEAT_CHANNEL_CLASS;
+#endif
+}
+
+#if !DEFAULT_BT_LE_ROLE_BROADCASTER
+void r_ble_ll_adv_rpa_timeout(void) { }
+void r_ble_lll_adv_halt(void) { }
+void r_ble_lll_adv_event_rmvd_from_sched(void) { }
+void r_ble_lll_adv_ext_event_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_enabled(void) { return 0; }
+int  r_ble_ll_adv_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_adv_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+void r_ble_ll_adv_reset(void) { }
+void r_ble_ll_adv_init(void) { }
+void r_ble_ll_adv_deinit(void) { }
+int  r_ble_ll_adv_env_init(void) { return 0; }
+void r_ble_ll_adv_env_deinit(void) { }
+int  r_ble_lll_adv_rx_pkt_isr(void) { return -1; }
+void r_ble_ll_adv_rx_pkt_in(void) { }
+int  r_ble_ll_adv_set_adv_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_read_txpwr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_set_scan_rsp_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_adv_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_vendor_hci_legacy_adv_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_set_data_related_addr_change(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif // !DEFAULT_BT_LE_ROLE_BROADCASTER
+
+#if !DEFAULT_BT_LE_EXT_ADV
+bool r_ble_ll_adv_ext_check_data_itvl(void) { return true; }
+void r_ble_lll_adv_coex_dpc_update_on_aux_scheduled(void) { }
+void r_ble_lll_adv_coex_dpc_calc_pti_update_itvl(void) { }
+void r_ble_lll_adv_sec_done(void) { }
+int r_ble_lll_adv_sec_schedule_next_aux(void) { return 0; }
+void r_ble_lll_adv_sec_event_done(void) { }
+int  r_ble_lll_adv_secondary_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_aux_schedule(void) { }
+void r_ble_lll_adv_update_rsp_offset(void) { }
+int  r_ble_ll_adv_hci_set_random_addr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_adv_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_scan_rsp(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_ext_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_max_adv_data_len(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_rd_sup_adv_sets(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_clear_all(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_ADV
+
+#if !DEFAULT_BT_LE_PERIODIC_ADV
+void r_ble_ll_adv_sm_stop_periodic(void) { }
+void r_ble_lll_adv_periodic_event_done(void) { }
+int  r_ble_lll_adv_sync_tx_start_cb(void) { return 0; }
+void r_ble_lll_adv_sync_tx_end(void) { }
+int  r_ble_lll_adv_periodic_start(void) { return 0; }
+void r_ble_lll_adv_periodic_rmvd_from_sched(void) { }
+int  r_ble_ll_adv_periodic_set_param(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_set_data(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_adv_periodic_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_ROLE_OBSERVER
+void r_ble_lll_scan_halt(void) { }
+void r_ble_ll_scan_end_adv_evt(void) { }
+void r_ble_ll_scan_rx_pkt_in(void) { }
+int  r_ble_lll_scan_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_scan_env_init(void) { return 0; }
+void r_ble_ll_scan_env_deinit(void) {  }
+void r_ble_ll_scan_init(void) { }
+void r_ble_ll_scan_deinit(void) { }
+void r_ble_ll_scan_reset(void) { }
+int  r_ble_ll_scan_can_chg_whitelist(void) { return 1; }
+int  r_ble_ll_scan_enabled(void) { return false; }
+int  r_ble_lll_scan_chk_resume(void) { return -1; }
+int  r_ble_ll_scan_set_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_update_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_scan_hci_set_adv_report_flow_ctrl(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_OBSERVER
+
+#if !DEFAULT_BT_LE_EXT_SCAN
+void r_ble_lll_scan_duration_period_timers_restart(void) { }
+void r_ble_lll_scan_duration_period_timers_stop(void) { }
+int r_ble_ll_hci_send_legacy_ext_adv_report(void) { return -1; }
+void r_ble_lll_sched_rmv_elem_type(void) { }
+void r_ble_ll_scan_send_truncated(void) { }
+void r_ble_ll_scan_aux_data_unref(void) { }
+void r_ble_lll_scan_sched_remove(void) { }
+void r_ble_lll_scan_aux_data_free(void) { }
+void r_ble_lll_aux_scan_drop(void) { }
+int r_ble_lll_sched_aux_scan(void) { return -1; }
+int r_ble_lll_scan_rx_isr_on_aux(void) { return -1; }
+void r_ble_lll_scan_period_timer_cb(void) { }
+void r_ble_lll_scan_duration_timer_cb(void) { }
+void r_ble_ll_scan_rx_pkt_in_on_aux(void) { }
+int  r_ble_ll_set_ext_scan_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_ext_scan_set_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL
+void r_ble_ll_init_rx_pkt_in(void) { }
+int  r_ble_lll_init_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_create_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+int  r_ble_ll_ext_conn_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !DEFAULT_BT_LE_EXT_SCAN
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL
+int r_ble_ll_conn_slave_start(void) { return 0; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+void r_ble_ll_conn_rx_data_pdu(void) { }
+int  r_ble_lll_conn_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_hci_disconnect(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_rem_ver_cmd(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_update(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_rd_chan_map(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_read_rem_features(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_rr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_param_nrr(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL && !DEFAULT_BT_LE_ROLE_PERIPHERAL
+
+#if !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+int r_ble_ll_conn_chk_phy_upd_start(void) { return -1; }
+void r_ble_ll_hci_ev_encrypt_chg(void) { }
+int r_ble_ll_ctrl_enc_allowed_pdu_rx(void) { return 1; }
+int r_ble_ll_ctrl_enc_allowed_pdu_tx(void) { return 1; }
+uint8_t r_ble_ll_ctrl_rx_start_enc_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_pause_enc_rsp(void) { return 0x07; }
+int  r_ble_ll_hci_le_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_pause_enc_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_enc_req(void) { return 0x07; }
+int r_ble_ll_conn_hci_le_ltk_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int r_ble_ll_conn_hci_le_ltk_neg_reply(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_PERIPHERAL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+uint8_t r_ble_ll_ctrl_rx_start_enc_req(void) { return 0x07; }
+void r_ble_ll_ctrl_rx_enc_rsp(void) { }
+void r_ble_ll_ctrl_enc_req_make(void) { }
+int r_ble_ll_conn_hci_le_start_encrypt(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_ROLE_CENTROL || !CONFIG_BT_LE_FEAT_LL_ENCRYPTION
+
+#if !DEGAULT_BT_LE_2M_PHY && !DEGAULT_BT_LE_CODED_PHY
+void r_ble_ll_ctrl_phy_update_proc_complete(void) { }
+void r_ble_ll_ctrl_phy_update_cancel(void) { }
+uint8_t r_ble_ll_ctrl_rx_phy_update_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_rsp(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_phy_req(void) { return 0x07; }
+void r_ble_ll_ctrl_phy_req_rsp_make(void) { }
+#endif //DEGAULT_BT_LE_2M_PHY && DEGAULT_BT_LE_CODED_PHY
+
+#if !DEFAULT_BT_LE_PERIODIC_SYNC
+void r_ble_lll_sync_halt(void) { }
+void r_ble_lll_sync_rmvd_from_sched(void) { }
+int  r_ble_ll_sync_list_search(void) { return -1; }
+uint8_t r_ble_ll_ctrl_rx_periodic_sync_ind(void) { return 0x07; }
+void r_ble_ll_sync_rx_pkt_in(void) {  }
+int  r_ble_lll_sync_rx_pkt_isr(void) { return -1; }
+int  r_ble_ll_sync_env_init(void) { return 0; }
+void r_ble_ll_sync_env_deinit(void) {  }
+void r_ble_ll_sync_init(void) {  }
+void r_ble_ll_sync_deinit(void) {  }
+void r_ble_ll_sync_reset(void) {  }
+bool r_ble_ll_sync_enabled(void) { return false; }
+int  r_ble_ll_sync_create(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_cancel(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_terminate(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_add(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_remove(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_clear(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_list_size(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_sync_receive_enable(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+int  r_ble_ll_adv_periodic_set_info_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_ADV
+
+#if !DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+int  r_ble_ll_sync_transfer(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_set_default_sync_transfer_params(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_PAST || !DEFAULT_BT_LE_PERIODIC_SYNC
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+uint8_t r_ble_ll_ctrl_rx_channel_reporting_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_channel_status_ind(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_req(void) { return 0x07; }
+uint8_t r_ble_ll_ctrl_rx_sca_rsp(void) { return 0x07; }
+void r_ble_ll_ctrl_channel_class_reporting_make(void) { }
+void r_ble_ll_ctrl_channel_class_enable_make(void) { }
+void r_ble_ll_ctrl_sca_req_rsp_make(void) { }
+int  r_ble_ll_modify_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_req_peer_sca(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !DEFAULT_BT_LE_50_FEATURE_SUPPORT
+int  r_ble_ll_conn_hci_le_rd_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_hci_le_set_def_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_ll_conn_hci_le_set_phy(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!DEFAULT_BT_LE_50_FEATURE_SUPPORT
+
+#if !CONFIG_BT_LE_DTM_ENABLED
+void r_ble_lll_dtm_rx_pkt_in(void) {  }
+int  r_ble_lll_dtm_rx_isr_end(void) { return -1; }
+void r_ble_lll_dtm_reset(void) { }
+void r_ble_lll_dtm_init(void) { }
+void r_ble_lll_dtm_deinit(void) { }
+int  r_ble_lll_dtm_env_init(void) { return 0; }
+void r_ble_lll_dtm_env_deinit(void) { }
+int  r_ble_lll_hci_dtm_tx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_dtm_end_test(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_rx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+int  r_ble_lll_hci_dtm_tx_test_v2(void) { return BLE_ERR_UNKNOWN_HCI_CMD; }
+#endif //!CONFIG_BT_LE_DTM_ENABLED
--- a/components/bt/controller/esp32c2/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c2/esp_bt_cfg.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -28,7 +28,6 @@ extern "C" {
    #else
    #define BLE_LL_SCAN_PHY_NUMBER_N (1)
    #endif
-
    #define DEFAULT_BT_LE_MAX_PERIODIC_ADVERTISER_LIST MYNEWT_VAL(BLE_MAX_PERIODIC_ADVERTISER_LIST)
    #define DEFAULT_BT_LE_MAX_PERIODIC_SYNCS MYNEWT_VAL(BLE_MAX_PERIODIC_SYNCS)
    #define DEFAULT_BT_LE_MAX_CONNECTIONS MYNEWT_VAL(BLE_MAX_CONNECTIONS)
@ -40,7 +39,24 @@ extern "C" {
    #define DEFAULT_BT_NIMBLE_WHITELIST_SIZE MYNEWT_VAL(BLE_LL_WHITELIST_SIZE)
    #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
    #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif

+    #define DEGAULT_BT_LE_2M_PHY                         (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_2M_PHY)
+    #define DEGAULT_BT_LE_CODED_PHY                      (CONFIG_BT_NIMBLE_LL_CFG_FEAT_LE_CODED_PHY)
+    #define DEFAULT_BT_LE_EXT_ADV                        (CONFIG_BT_NIMBLE_EXT_ADV)
+    #define DEFAULT_BT_LE_PERIODIC_ADV                   (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_ADV)
+    #define DEFAULT_BT_LE_EXT_SCAN                       (CONFIG_BT_NIMBLE_EXT_SCAN)
+    #define DEFAULT_BT_LE_PERIODIC_SYNC                  (CONFIG_BT_NIMBLE_ENABLE_PERIODIC_SYNC)
+    #define DEFAULT_BT_LE_PAST                           (CONFIG_BT_NIMBLE_PERIODIC_ADV_SYNC_TRANSFER)
+
+    #define DEFAULT_BT_LE_ROLE_OBSERVER                  MYNEWT_VAL(BLE_ROLE_OBSERVER)
+    #define DEFAULT_BT_LE_ROLE_CENTROL                   MYNEWT_VAL(BLE_ROLE_CENTRAL)
+    #define DEFAULT_BT_LE_ROLE_PERIPHERAL                MYNEWT_VAL(BLE_ROLE_PERIPHERAL)
+    #define DEFAULT_BT_LE_ROLE_BROADCASTER               MYNEWT_VAL(BLE_ROLE_BROADCASTER)
 #else

    #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@ -52,13 +68,13 @@ extern "C" {
    #if defined(CONFIG_BT_LE_MAX_PERIODIC_ADVERTISER_LIST)
        #define DEFAULT_BT_LE_MAX_PERIODIC_ADVERTISER_LIST (CONFIG_BT_LE_MAX_PERIODIC_ADVERTISER_LIST)
    #else
-        #define DEFAULT_BT_LE_MAX_PERIODIC_ADVERTISER_LIST (5)
+        #define DEFAULT_BT_LE_MAX_PERIODIC_ADVERTISER_LIST (0)
    #endif

    #if defined(CONFIG_BT_LE_MAX_PERIODIC_SYNCS)
        #define DEFAULT_BT_LE_MAX_PERIODIC_SYNCS (CONFIG_BT_LE_MAX_PERIODIC_SYNCS)
    #else
-        #define DEFAULT_BT_LE_MAX_PERIODIC_SYNCS (1)
+        #define DEFAULT_BT_LE_MAX_PERIODIC_SYNCS (0)
    #endif

    #if defined(CONFIG_BT_LE_MAX_CONNECTIONS)
@ -115,10 +131,101 @@ extern "C" {
        #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT (8)
    #endif

+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+        #define DEGAULT_BT_LE_2M_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_2M_PHY)
+    #else
+        #define DEGAULT_BT_LE_2M_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+        #define DEGAULT_BT_LE_CODED_PHY (CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY)
+    #else
+        #define DEGAULT_BT_LE_CODED_PHY (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_ADV)
+        #define DEFAULT_BT_LE_EXT_ADV       (CONFIG_BT_LE_EXT_ADV)
+    #else
+        #define DEFAULT_BT_LE_EXT_ADV       (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (CONFIG_BT_LE_ENABLE_PERIODIC_ADV)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_ADV  (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_EXT_SCAN)
+        #define DEFAULT_BT_LE_EXT_SCAN      (CONFIG_BT_LE_EXT_SCAN)
+    #else
+        #define DEFAULT_BT_LE_EXT_SCAN      (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (CONFIG_BT_LE_ENABLE_PERIODIC_SYNC)
+    #else
+        #define DEFAULT_BT_LE_PERIODIC_SYNC  (0)
+    #endif
+
+    #if defined(BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+        #define DEFAULT_BT_LE_PAST          (BT_LE_PERIODIC_ADV_SYNC_TRANSFER)
+    #else
+        #define DEFAULT_BT_LE_PAST          (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ROLE_CENTROL_ENABLE)
+        #define DEFAULT_BT_LE_ROLE_CENTROL (1)
+    #else
+        #define DEFAULT_BT_LE_ROLE_CENTROL (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ROLE_PERIPHERAL_ENABLE)
+        #define DEFAULT_BT_LE_ROLE_PERIPHERAL (1)
+    #else
+        #define DEFAULT_BT_LE_ROLE_PERIPHERAL (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ROLE_BROADCASTER_ENABLE)
+        #define DEFAULT_BT_LE_ROLE_BROADCASTER (1)
+    #else
+        #define DEFAULT_BT_LE_ROLE_BROADCASTER (0)
+    #endif
+
+    #if defined(CONFIG_BT_LE_ROLE_OBSERVER_ENABLE)
+        #define DEFAULT_BT_LE_ROLE_OBSERVER (1)
+    #else
+        #define DEFAULT_BT_LE_ROLE_OBSERVER (0)
+    #endif
+    #if defined (CONFIG_BT_LE_HCI_UART_FLOWCTRL)
+        #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (CONFIG_BT_LE_HCI_UART_FLOWCTRL)
+        #if DEFAULT_BT_LE_HCI_UART_FLOW_CTRL
+            #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (CONFIG_BT_LE_HCI_UART_CTS_PIN)
+            #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (CONFIG_BT_LE_HCI_UART_RTS_PIN)
+        #else
+            #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
+            #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
+        #endif
+    #else
+        #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
+        #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
+        #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
+    #endif
 #endif

 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF

+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@ -155,8 +262,6 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_UART_DATA_BITS (UART_DATA_8_BITS)
    #define DEFAULT_BT_LE_HCI_UART_STOP_BITS (UART_STOP_BITS_1)
    #define DEFAULT_BT_LE_HCI_UART_PARITY (0)
-    #define DEFAULT_BT_LE_HCI_UART_TASK_STACK_SIZE (CONFIG_BT_LE_HCI_UART_TASK_STACK_SIZE)
-    #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
 #else
    #define DEFAULT_BT_LE_HCI_UART_TX_PIN (0)
    #define DEFAULT_BT_LE_HCI_UART_RX_PIN (0)
@ -165,8 +270,6 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_UART_DATA_BITS (0)
    #define DEFAULT_BT_LE_HCI_UART_STOP_BITS (0)
    #define DEFAULT_BT_LE_HCI_UART_PARITY (0)
-    #define DEFAULT_BT_LE_HCI_UART_TASK_STACK_SIZE (0)
-    #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
 #endif

 /* Unchanged configuration */
@ -195,7 +298,7 @@ extern "C" {
    #define RTC_FREQ_N                      (32000) /* in Hz */
 #endif // CONFIG_XTAL_FREQ_26

-#define BLE_LL_TX_PWR_DBM_N                 (9)
+#define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)


 #define RUN_BQB_TEST                        (0)
--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@ -23,7 +23,7 @@ config BT_CTRL_BLE_STATIC_ACL_TX_BUF_NB
    default 0
    help
        BLE ACL buffer have two methods to be allocated. One is persistent allocating
-        (alloate when controller initialise, never free until controller de-initialise)
+        (allocate when controller initialise, never free until controller de-initialise)
        another is dynamically allocating (allocate before TX and free after TX).

 choice BT_CTRL_PINNED_TO_CORE_CHOICE
@ -72,11 +72,11 @@ config BT_CTRL_HCI_TL
        HCI mode as VHCI or UART(H4)

 config BT_CTRL_ADV_DUP_FILT_MAX
-    int "The maxinum number of 5.0 extend duplicate scan filter"
+    int "The maximum number of 5.0 extend duplicate scan filter"
    range 1 500
    default 30
    help
-        The maxinum number of suplicate scan filter
+        The maximum number of suplicate scan filter

 choice BT_BLE_CCA_MODE
    prompt "BLE CCA mode"
@ -200,8 +200,8 @@ choice BT_CTRL_DFT_TX_POWER_LEVEL
        bool "+15dBm"
    config BT_CTRL_DFT_TX_POWER_LEVEL_P18
        bool "+18dBm"
-    config BT_CTRL_DFT_TX_POWER_LEVEL_P21
-        bool "+21dBm"
+    config BT_CTRL_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
 endchoice

 config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
@ -221,11 +221,12 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF
    default 12 if BT_CTRL_DFT_TX_POWER_LEVEL_P12
    default 13 if BT_CTRL_DFT_TX_POWER_LEVEL_P15
    default 14 if BT_CTRL_DFT_TX_POWER_LEVEL_P18
-    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P21
+    default 15 if BT_CTRL_DFT_TX_POWER_LEVEL_P20
    default 0

 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
    bool "BLE adv report flow control supported"
+    depends on (!BT_CTRL_RUN_IN_FLASH_ONLY) || (BT_CTRL_RUN_IN_FLASH_ONLY && BT_CTRL_BLE_SCAN)
    default y
    help
        The function is mainly used to enable flow control for advertising reports. When it is enabled,
@ -402,10 +403,10 @@ menu "MODEM SLEEP Options"
                bluetooth can work under light sleep enabled. Main crystal has a relatively better performance
                than other bluetooth low power clock sources.
        config BT_CTRL_LPCLK_SEL_EXT_32K_XTAL
-            bool "External 32kHz crystal"
-            depends on RTC_CLK_SRC_EXT_CRYS
+            bool "External 32kHz crystal/oscillator"
+            depends on RTC_CLK_SRC_EXT_CRYS || RTC_CLK_SRC_EXT_OSC
            help
-                External 32kHz crystal has a nominal frequency of 32.768kHz and provides good frequency
+                External 32kHz crystal/oscillator has a nominal frequency of 32.768kHz and provides good frequency
                stability. If used as Bluetooth low power clock, External 32kHz can support Bluetooth
                modem sleep to be used with both DFS and light sleep.

@ -467,3 +468,85 @@ config BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
        Disable active scan backoff. The bluetooth spec requires that scanners should run a backoff procedure to
        minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
        scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
+
+config BT_BLE_ADV_DATA_LENGTH_ZERO_AUX
+    bool "Enable aux packet when ext adv data length is zero"
+    default n
+    help
+        When this option is enabled, auxiliary packets will be present in the events of
+        'Non-Connectable and Non-Scannable' regardless of whether the advertising length is 0.
+        If this option is not enabled, auxiliary packets will only be present when the advertising length is not 0.
+
+config BT_CTRL_CHAN_ASS_EN
+    bool "Enable channel assessment"
+    default y
+    help
+        If this option is enabled, The Controller will records the communication quality
+        for each channel and then start a timer to check and update the channel map every 4 seconds.
+
+config BT_CTRL_LE_PING_EN
+    bool "Enable LE Ping procedure"
+    default y
+    help
+        If this option is disabled, The Controller will not start the LE authenticated payload timer.
+        This option is used for some compatibility problems related to LE ping procedure.
+
+menu "BLE disconnect when instant passed"
+    config BT_CTRL_BLE_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed during connection update procedure.
+
+    config BT_CTRL_BLE_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in channel map update procedure.
+
+    config BT_CTRL_BLE_LLCP_PHY_UPDATE
+        bool "BLE ACL PHY update procedure"
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in PHY update procedure.
+endmenu
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Put all BLE Controller code in flash"
+    default n
+    help
+        If this option is enabled, all code for the Bluetooth controller will be moved from ROM and IRAM
+        to flash, saving over 20K bytes of memory. However, it will require more flash resources and the
+        performance of Bluetooth will decrease If this option is enabled, Bluetooth may not work properly
+        during erasing flash. It is recommended to turn on the auto suspend function of flash. After auto
+        suspend is turned on, Bluetooth interrupts can be executed normally during erasing flash, with less
+        impact on Bluetooth performance.
+
+config BT_CTRL_DTM_ENABLE
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable direct test mode feature"
+    default n
+
+config BT_CTRL_BLE_MASTER
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE master role feature"
+    default y
+
+config BT_CTRL_BLE_TEST
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE QA test feature"
+    default n
+
+config BT_CTRL_BLE_SCAN
+    depends on BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Enable BLE scan feature"
+    default y
+config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@ -2,19 +2,37 @@
 menu "HCI Config"

    choice BT_LE_HCI_INTERFACE
-        prompt "Select HCI interface"
+        prompt "HCI mode"
        default BT_LE_HCI_INTERFACE_USE_RAM

        config BT_LE_HCI_INTERFACE_USE_RAM
-            bool "ram"
+            bool "VHCI"
            help
                Use RAM as HCI interface
        config BT_LE_HCI_INTERFACE_USE_UART
-            bool "uart"
+            bool "UART(H4)"
            help
                Use UART as HCI interface
    endchoice

+    choice BT_LE_UART_HCI_MODE_CHOICE
+        prompt "UART HCI mode"
+        depends on BT_LE_HCI_INTERFACE_USE_UART
+        default BT_LE_UART_HCI_NO_DMA_MODE
+        help
+            Specify UART HCI mode: DMA or No DMA
+
+        config BT_LE_UART_HCI_DMA_MODE
+            bool "UHCI(UART with DMA)(EXPERIMENTAL)"
+            help
+                UART HCI Mode with DMA functionality.
+
+        config BT_LE_UART_HCI_NO_DMA_MODE
+            bool "UART(NO DMA)"
+            help
+                UART HCI Mode without DMA functionality.
+    endchoice
+
    config BT_LE_HCI_UART_PORT
        int "HCI UART port"
        depends on BT_LE_HCI_INTERFACE_USE_UART
@ -73,12 +91,40 @@ menu "HCI Config"
                UART_PARITY_ODD
    endchoice

-    config BT_LE_HCI_UART_TASK_STACK_SIZE
-        int "HCI uart task stack size"
-        depends on BT_LE_HCI_INTERFACE_USE_UART
-        default 1000
+    config BT_LE_HCI_UART_RX_BUFFER_SIZE
+        int "The size of rx ring buffer memory"
+        depends on BT_LE_UART_HCI_NO_DMA_MODE
+        default 512
        help
-            Set the size of uart task stack
+            The size of rx ring buffer memory
+
+    config BT_LE_HCI_UART_TX_BUFFER_SIZE
+        int "The size of tx ring buffer memory"
+        depends on BT_LE_UART_HCI_NO_DMA_MODE
+        default 256
+        help
+            The size of tx ring buffer memory
+
+    config BT_LE_HCI_TRANS_TASK_STACK_SIZE
+        int "HCI transport task stack size"
+        depends on !BT_LE_HCI_INTERFACE_USE_RAM
+        default 1024
+        help
+            This configures stack size of hci transport task
+
+    config BT_LE_HCI_TRANS_RX_MEM_NUM
+        int "The amount of rx memory received at the same time"
+        depends on BT_LE_UART_HCI_DMA_MODE
+        default 3
+        help
+            The amount of rx memory received at the same time
+
+    config BT_LE_HCI_LLDESCS_POOL_NUM
+        int "The amount of lldecs memory for driver dma mode"
+        depends on BT_LE_UART_HCI_DMA_MODE
+        default 20
+        help
+            The amount of lldecs memory for driver dma mode
 endmenu

 config BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT
@ -147,7 +193,7 @@ if BT_LE_EXT_ADV
            Enable this option to start periodic advertisement.

    config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
-        bool "Enable Transer Sync Events"
+        bool "Enable Transfer Sync Events"
        depends on BT_LE_ENABLE_PERIODIC_ADV
        default y
        help
@ -212,6 +258,15 @@ menu "Memory Settings"
        help
            Dynamic memory size of block 2

+    config BT_LE_MSYS_BUF_FROM_HEAP
+        bool "Get Msys Mbuf from heap"
+        default y
+        depends on BT_LE_MSYS_INIT_IN_CONTROLLER
+        help
+            This option sets the source of the shared msys mbuf memory between
+            the Host and the Controller. Allocate the memory from the heap if
+            this option is sets, from the mempool otherwise.
+
    config BT_LE_ACL_BUF_COUNT
        int "ACL Buffer count"
        default 10
@ -260,7 +315,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -271,21 +326,60 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    bool "Store ble controller logs to flash(Experimental)"
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+            Store ble controller logs to flash memory.
+
+config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+    int "size of ble controller log partition(Multiples of 4K)"
+    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    default 65536
+    help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
@ -335,7 +429,6 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
    bool "Override TinyCrypt with mbedTLS for crypto computations"
    default y
    depends on !BT_NIMBLE_ENABLED
-    select MBEDTLS_ECP_RESTARTABLE
    select MBEDTLS_CMAC_C
    help
        Enable this option to choose mbedTLS instead of TinyCrypt for crypto
@ -352,7 +445,7 @@ config BT_LE_WHITELIST_SIZE

 config BT_LE_LL_DUP_SCAN_LIST_COUNT
    int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
    default 20
    help
        config the max count of duplicate scan list
@ -513,15 +606,6 @@ config BT_LE_SCAN_DUPL_TYPE
    default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
    default 0

-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
    depends on BT_LE_SCAN_DUPL
@ -539,5 +623,85 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
        again.

 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
    default y
+
+config BT_LE_TX_CCA_ENABLED
+    bool "Enable TX CCA feature"
+    default n
+    help
+        Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
+
+config BT_LE_CCA_RSSI_THRESH
+    int "CCA RSSI threshold value"
+    depends on BT_LE_TX_CCA_ENABLED
+    range 20 100
+    default 20
+    help
+        Power threshold of CCA in unit of -1 dBm.
+
+choice BT_LE_DFT_TX_POWER_LEVEL_DBM
+    prompt "BLE default Tx power level(dBm)"
+    default BT_LE_DFT_TX_POWER_LEVEL_P9
+    help
+        Specify default Tx power level(dBm).
+    config BT_LE_DFT_TX_POWER_LEVEL_N15
+        bool "-15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N12
+        bool "-12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N9
+        bool "-9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N6
+        bool "-6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N3
+        bool "-3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N0
+        bool "0dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P3
+        bool "+3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P6
+        bool "+6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P9
+        bool "+9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P12
+        bool "+12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P15
+        bool "+15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P18
+        bool "+18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
+endchoice
+
+config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
+    int
+    default -15 if BT_LE_DFT_TX_POWER_LEVEL_N15
+    default -12 if BT_LE_DFT_TX_POWER_LEVEL_N12
+    default -9 if BT_LE_DFT_TX_POWER_LEVEL_N9
+    default -6 if BT_LE_DFT_TX_POWER_LEVEL_N6
+    default -3 if BT_LE_DFT_TX_POWER_LEVEL_N3
+    default 0 if BT_LE_DFT_TX_POWER_LEVEL_N0
+    default 3 if BT_LE_DFT_TX_POWER_LEVEL_P3
+    default 6 if BT_LE_DFT_TX_POWER_LEVEL_P6
+    default 9 if BT_LE_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_LE_DFT_TX_POWER_LEVEL_P12
+    default 15 if BT_LE_DFT_TX_POWER_LEVEL_P15
+    default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
+    default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
+    default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
--- a/components/bt/controller/esp32c6/bt.c
+++ b/components/bt/controller/esp32c6/bt.c
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@ -40,6 +40,11 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
    #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
    #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+    #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
 #else

    #if CONFIG_BT_LE_LL_CFG_FEAT_LE_CODED_PHY
@ -119,10 +124,36 @@ extern "C" {
    #else
        #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED (0)
    #endif
+    #if defined(CONFIG_BT_LE_50_FEATURE_SUPPORT)
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
+    #else
+        #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (0)
+    #endif
+
+    #if defined (CONFIG_BT_LE_HCI_UART_FLOWCTRL)
+        #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (CONFIG_BT_LE_HCI_UART_FLOWCTRL)
+        #if DEFAULT_BT_LE_HCI_UART_FLOW_CTRL
+            #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (CONFIG_BT_LE_HCI_UART_CTS_PIN)
+            #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (CONFIG_BT_LE_HCI_UART_RTS_PIN)
+        #else
+            #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
+            #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
+        #endif
+    #else
+        #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
+        #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
+        #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
+    #endif
 #endif

 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF

+#ifdef CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (CONFIG_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS)
+#else
+#define DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS  (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@ -159,8 +190,6 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_UART_DATA_BITS (UART_DATA_8_BITS)
    #define DEFAULT_BT_LE_HCI_UART_STOP_BITS (UART_STOP_BITS_1)
    #define DEFAULT_BT_LE_HCI_UART_PARITY (0)
-    #define DEFAULT_BT_LE_HCI_UART_TASK_STACK_SIZE (CONFIG_BT_LE_HCI_UART_TASK_STACK_SIZE)
-    #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
 #else
    #define DEFAULT_BT_LE_HCI_UART_TX_PIN (0)
    #define DEFAULT_BT_LE_HCI_UART_RX_PIN (0)
@ -169,8 +198,6 @@ extern "C" {
    #define DEFAULT_BT_LE_HCI_UART_DATA_BITS (0)
    #define DEFAULT_BT_LE_HCI_UART_STOP_BITS (0)
    #define DEFAULT_BT_LE_HCI_UART_PARITY (0)
-    #define DEFAULT_BT_LE_HCI_UART_TASK_STACK_SIZE (0)
-    #define DEFAULT_BT_LE_HCI_UART_FLOW_CTRL (0)
 #endif

 /* Unchanged configuration */
@ -195,8 +222,7 @@ extern "C" {

 #define RTC_FREQ_N                          (32768) /* in Hz */

-#define BLE_LL_TX_PWR_DBM_N                 (9)
-
+#define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)

 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
--- a/components/bt/controller/esp32h2/Kconfig.in
+++ b/components/bt/controller/esp32h2/Kconfig.in
@ -2,19 +2,37 @@
 menu "HCI Config"

    choice BT_LE_HCI_INTERFACE
-        prompt "Select HCI interface"
+        prompt "HCI mode"
        default BT_LE_HCI_INTERFACE_USE_RAM

        config BT_LE_HCI_INTERFACE_USE_RAM
-            bool "ram"
+            bool "VHCI"
            help
                Use RAM as HCI interface
        config BT_LE_HCI_INTERFACE_USE_UART
-            bool "uart"
+            bool "UART(H4)"
            help
                Use UART as HCI interface
    endchoice

+    choice BT_LE_UART_HCI_MODE_CHOICE
+        prompt "UART HCI mode"
+        depends on BT_LE_HCI_INTERFACE_USE_UART
+        default BT_LE_UART_HCI_NO_DMA_MODE
+        help
+            Specify UART HCI mode: DMA or No DMA
+
+        config BT_LE_UART_HCI_DMA_MODE
+            bool "UHCI(UART with DMA)(EXPERIMENTAL)"
+            help
+                UART HCI Mode with DMA functionality.
+
+        config BT_LE_UART_HCI_NO_DMA_MODE
+            bool "UART(NO DMA)"
+            help
+                UART HCI Mode without DMA functionality.
+    endchoice
+
    config BT_LE_HCI_UART_PORT
        int "HCI UART port"
        depends on BT_LE_HCI_INTERFACE_USE_UART
@ -73,12 +91,40 @@ menu "HCI Config"
                UART_PARITY_ODD
    endchoice

-    config BT_LE_HCI_UART_TASK_STACK_SIZE
-        int "HCI uart task stack size"
-        depends on BT_LE_HCI_INTERFACE_USE_UART
-        default 1000
+    config BT_LE_HCI_UART_RX_BUFFER_SIZE
+        int "The size of rx ring buffer memory"
+        depends on BT_LE_UART_HCI_NO_DMA_MODE
+        default 512
        help
-            Set the size of uart task stack
+            The size of rx ring buffer memory
+
+    config BT_LE_HCI_UART_TX_BUFFER_SIZE
+        int "The size of tx ring buffer memory"
+        depends on BT_LE_UART_HCI_NO_DMA_MODE
+        default 256
+        help
+            The size of tx ring buffer memory
+
+    config BT_LE_HCI_TRANS_TASK_STACK_SIZE
+        int "HCI transport task stack size"
+        depends on !BT_LE_HCI_INTERFACE_USE_RAM
+        default 1024
+        help
+            This configures stack size of hci transport task
+
+    config BT_LE_HCI_TRANS_RX_MEM_NUM
+        int "The amount of rx memory received at the same time"
+        depends on BT_LE_UART_HCI_DMA_MODE
+        default 3
+        help
+            The amount of rx memory received at the same time
+
+    config BT_LE_HCI_LLDESCS_POOL_NUM
+        int "The amount of lldecs memory for driver dma mode"
+        depends on BT_LE_UART_HCI_DMA_MODE
+        default 20
+        help
+            The amount of lldecs memory for driver dma mode
 endmenu

 config BT_LE_CONTROLLER_NPL_OS_PORTING_SUPPORT
@ -147,7 +193,7 @@ if BT_LE_EXT_ADV
            Enable this option to start periodic advertisement.

    config BT_LE_PERIODIC_ADV_SYNC_TRANSFER
-        bool "Enable Transer Sync Events"
+        bool "Enable Transfer Sync Events"
        depends on BT_LE_ENABLE_PERIODIC_ADV
        default y
        help
@ -260,7 +306,7 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-config BT_LE_CONTROLLER_LOG_ENABLED
+menuconfig BT_LE_CONTROLLER_LOG_ENABLED
    bool "Controller log enable"
    default n
    help
@ -271,21 +317,60 @@ config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable controller log module
+            Enable controller log module

 config BT_LE_CONTROLLER_LOG_HCI_ENABLED
    bool "enable HCI log module"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Enable hci log module
+            Enable hci log module

 config BT_LE_CONTROLLER_LOG_DUMP_ONLY
    bool "Controller log dump mode only"
    depends on BT_LE_CONTROLLER_LOG_ENABLED
    default y
    help
-        Only operate in dump mode
+            Only operate in dump mode
+
+config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    bool "Store ble controller logs to flash(Experimental)"
+    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default n
+    help
+            Store ble controller logs to flash memory.
+
+config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+    int "size of ble controller log partition(Multiples of 4K)"
+    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+    default 65536
+    help
+            The size of ble controller log partition shall be a multiples of 4K.
+            The name of log partition shall be "bt_ctrl_log".
+            The partition type shall be ESP_PARTITION_TYPE_DATA.
+            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+
+config BT_LE_LOG_CTRL_BUF1_SIZE
+    int "size of the first BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the first BLE controller LOG buffer.
+
+config BT_LE_LOG_CTRL_BUF2_SIZE
+    int "size of the second BLE controller LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 1024
+    help
+            Configure the size of the second BLE controller LOG buffer.
+
+config BT_LE_LOG_HCI_BUF_SIZE
+    int "size of the BLE HCI LOG buffer"
+    depends on BT_LE_CONTROLLER_LOG_ENABLED
+    default 4096
+    help
+            Configure the size of the BLE HCI LOG buffer.

 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
@ -335,7 +420,6 @@ config BT_LE_CRYPTO_STACK_MBEDTLS
    bool "Override TinyCrypt with mbedTLS for crypto computations"
    default y
    depends on !BT_NIMBLE_ENABLED
-    select MBEDTLS_ECP_RESTARTABLE
    select MBEDTLS_CMAC_C
    help
        Enable this option to choose mbedTLS instead of TinyCrypt for crypto
@ -352,7 +436,7 @@ config BT_LE_WHITELIST_SIZE

 config BT_LE_LL_DUP_SCAN_LIST_COUNT
    int "BLE duplicate scan list count"
-    range 1 100
+    range 5 100
    default 20
    help
        config the max count of duplicate scan list
@ -514,16 +598,6 @@ config BT_LE_SCAN_DUPL_TYPE
    default 2 if BT_LE_SCAN_DUPL_TYPE_DATA_DEVICE
    default 0

-
-config BT_LE_SCAN_DUPL_CACHE_SIZE
-    int "Maximum number of devices in scan duplicate filter"
-    depends on BT_LE_SCAN_DUPL
-    range 10 1000
-    default 100
-    help
-        Maximum number of devices which can be recorded in scan duplicate filter.
-        When the maximum amount of device in the filter is reached, the cache will be refreshed.
-
 config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
    int "Duplicate scan list refresh period (seconds)"
    depends on BT_LE_SCAN_DUPL
@ -543,3 +617,92 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
 config BT_LE_MSYS_INIT_IN_CONTROLLER
    bool
    default y
+
+config BT_LE_TX_CCA_ENABLED
+    bool "Enable TX CCA feature"
+    default n
+    help
+        Enable CCA feature to cancel sending the packet if the signal power is stronger than CCA threshold.
+
+config BT_LE_CCA_RSSI_THRESH
+    int "CCA RSSI threshold value"
+    depends on BT_LE_TX_CCA_ENABLED
+    range 20 100
+    default 20
+    help
+        Power threshold of CCA in unit of -1 dBm.
+
+choice BT_LE_DFT_TX_POWER_LEVEL_DBM
+    prompt "BLE default Tx power level(dBm)"
+    default BT_LE_DFT_TX_POWER_LEVEL_P9
+    help
+        Specify default Tx power level(dBm).
+    config BT_LE_DFT_TX_POWER_LEVEL_N24
+        bool "-24dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N21
+        bool "-21dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N18
+        bool "-18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N15
+        bool "-15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N12
+        bool "-12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N9
+        bool "-9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N6
+        bool "-6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N3
+        bool "-3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_N0
+        bool "0dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P3
+        bool "+3dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P6
+        bool "+6dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P9
+        bool "+9dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P12
+        bool "+12dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P15
+        bool "+15dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P18
+        bool "+18dBm"
+    config BT_LE_DFT_TX_POWER_LEVEL_P20
+        bool "+20dBm"
+endchoice
+
+config BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF
+    int
+    default -24 if BT_LE_DFT_TX_POWER_LEVEL_N24
+    default -21 if BT_LE_DFT_TX_POWER_LEVEL_N21
+    default -18 if BT_LE_DFT_TX_POWER_LEVEL_N18
+    default -15 if BT_LE_DFT_TX_POWER_LEVEL_N15
+    default -12 if BT_LE_DFT_TX_POWER_LEVEL_N12
+    default -9 if BT_LE_DFT_TX_POWER_LEVEL_N9
+    default -6 if BT_LE_DFT_TX_POWER_LEVEL_N6
+    default -3 if BT_LE_DFT_TX_POWER_LEVEL_N3
+    default 0 if BT_LE_DFT_TX_POWER_LEVEL_N0
+    default 3 if BT_LE_DFT_TX_POWER_LEVEL_P3
+    default 6 if BT_LE_DFT_TX_POWER_LEVEL_P6
+    default 9 if BT_LE_DFT_TX_POWER_LEVEL_P9
+    default 12 if BT_LE_DFT_TX_POWER_LEVEL_P12
+    default 15 if BT_LE_DFT_TX_POWER_LEVEL_P15
+    default 18 if BT_LE_DFT_TX_POWER_LEVEL_P18
+    default 20 if BT_LE_DFT_TX_POWER_LEVEL_P20
+    default 0
+
+config BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+config BT_CTRL_RUN_IN_FLASH_ONLY
+    bool "Reduce BLE IRAM usage (READ DOCS FIRST) (EXPERIMENTAL)"
+    default n
+    help
+        Move most IRAM into flash. This will increase the usage of flash and reduce ble performance.
+        Because the code is moved to the flash, the execution speed of the code is reduced.
+        To have a small impact on performance, you need to enable flash suspend (SPI_FLASH_AUTO_SUSPEND).
--- a/Show More
+++ b/Show More