Merge branch 'fix/ecdsa_hal' into 'master'

ecdsa: Support multiple ECDSA keys Closes IDF-7027 and IDF-7176 See merge request espressif/esp-idf!23023
ci: Add patterns and target-tests for ecdsa_efuse runner
2023-04-07 21:51:45 +08:00 · 2023-04-07 14:56:37 +05:30 · 2023-04-07 14:55:21 +05:30 · 2023-04-07 14:55:21 +05:30 · 2023-04-07 14:55:21 +05:30
4705 changed files with 455449 additions and 238972 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -96,6 +96,4 @@ dependencies.lock
 managed_components

 # pytest log
-pytest-embedded/
-# legacy one
 pytest_embedded_log/
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -13,7 +13,7 @@ stages:
 workflow:
  rules:
    # Disable those non-protected push triggered pipelines
-    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && $CI_PIPELINE_SOURCE == "push"'
+    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
      when: never
    # when running merged result pipelines, it would create a temp commit id. use $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA instead of $CI_COMMIT_SHA.
    # Please use PIPELINE_COMMIT_SHA at all places that require a commit sha
@@ -54,6 +54,10 @@ variables:
  BATCH_BUILD: "1"
  V: "0"
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"
+  PYTHON_VER: 3.7.10
+
+  CLANG_TIDY_RUNNER_PROJ: 2107  # idf/clang-tidy-runner
+  IDF_BUILD_APPS_PROJ: 2818  # espressif/idf-build-apps

  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"
@@ -68,6 +72,9 @@ variables:

  PRE_COMMIT_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-pre-commit:1"

+  # target test config file, used by assign test job
+  CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/.gitlab/ci/target-test.yml"
+
  # target test repo parameters
  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"

@@ -91,9 +98,6 @@ variables:
  # This is used only if CI_PYTHON_TOOL_REPO is not empty.
  CI_PYTHON_TOOL_BRANCH: ""

-  # Set this variable to specify the file name for the known failure cases.
-  KNOWN_FAILURE_CASES_FILE_NAME: "5.1.txt"
-
  IDF_CI_BUILD: 1

 cache:
@@ -127,8 +131,8 @@ cache:
  export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/esp_app_trace:$IDF_PATH/components/partition_table:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"

 .setup_tools_and_idf_python_venv: &setup_tools_and_idf_python_venv |
-  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
-  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
+  # must use after setup_tools_except_target_test
+  # otherwise the export.sh won't work properly

  # download constraint file for dev
  if [[ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]]; then
@@ -171,21 +175,13 @@ cache:
  source ./export.sh

  # Custom OpenOCD
-  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
-    machine="$(uname -m)"
-    if [[ "$machine" == "armv7l" ]] ; then
-      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
-    elif [[ "$machine" == "aarch64" ]] ; then
-      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
-    fi
-    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
-      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-      wget $OOCD_DISTRO_URL
-      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-      tar -x -f $ARCH_NAME
-      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-      export PATH=$PWD/openocd-esp32/bin:$PATH
-    fi
+  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
+    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+    wget $OOCD_DISTRO_URL
+    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+    tar -x -f $ARCH_NAME
+    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+    export PATH=$PWD/openocd-esp32/bin:$PATH
  fi

  if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then
@@ -206,10 +202,6 @@ before_script:

 .before_script_macos:
  before_script:
-    # macos is running shell executor, which means it would use
-    # the system installed /usr/local/bin/python3 by default.
-    # Ensure pyenv and PYENV_VERSION installed
-    - eval "$(pyenv init -)"
    - *common-before_scripts
    # On macOS, these tools need to be installed
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
@@ -244,7 +236,6 @@ include:
  - '.gitlab/ci/pre_check.yml'
  - '.gitlab/ci/build.yml'
  - '.gitlab/ci/assign-test.yml'
-  - '.gitlab/ci/integration_test.yml'
  - '.gitlab/ci/host-test.yml'
  - '.gitlab/ci/target-test.yml'
  - '.gitlab/ci/deploy.yml'
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -2,5 +2,214 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
+# If more than one rule matches a given file, the latest rule is used.
+# The file should be generally kept sorted, except when it is necessary
+# to use a different order due to the fact above. In that case, use
+# '# sort-order-reset' comment line to reset the sort order.
+#
+# Recipes for a few common cases:
+#
+# 1. Specific directory with all its contents:
+#
+#    /components/app_trace/
+#
+#    Note the trailing slash!
+#
+# 2. File with certain extension in any subdirectory of a certain directory:
+#
+#    /examples/**/*.py
+#
+#    This includes an *.py files in /examples/ directory as well.
+#
+# 3. Contents of a directory with a certain name, anywhere in the tree:
+#
+#    test_*_host/
+#
+#    Will match everything under components/efuse/test_efuse_host/,
+#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
+#
+# 4. Same as above, except limited to a specific place in the tree:
+#
+#    /components/esp32*/
+#
+#    Matches everything under /components/esp32, /components/esp32s2, etc.
+#    Doesn't match /tools/some-test/components/esp32s5.
+#
+# 5. Specific file:
+#
+#    /tools/tools.json
+#
+# 6. File with a certain name anywhere in the tree
+#
+#    .gitignore
+#

-* @esp-idf-codeowners/all-maintainers
+* @esp-idf-codeowners/other
+
+/.*                                   @esp-idf-codeowners/tools
+/.github/workflows/                   @esp-idf-codeowners/ci
+/.gitlab-ci.yml                       @esp-idf-codeowners/ci
+/.gitlab/ci/                          @esp-idf-codeowners/ci
+/.gitlab/dangerjs/                    @esp-idf-codeowners/ci @esp-idf-codeowners/tools
+/.pre-commit-config.yaml              @esp-idf-codeowners/ci
+/.readthedocs.yml                     @esp-idf-codeowners/docs
+/CMakeLists.txt                       @esp-idf-codeowners/build-config
+/CONTRIBUTING.md                      @esp-idf-codeowners/docs
+/Kconfig                              @esp-idf-codeowners/build-config
+/README*.md                           @esp-idf-codeowners/docs
+/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
+/add_path.sh                          @esp-idf-codeowners/tools
+/conftest.py                          @esp-idf-codeowners/ci
+/export.*                             @esp-idf-codeowners/tools
+/install.*                            @esp-idf-codeowners/tools
+/pytest.ini                           @esp-idf-codeowners/ci
+/sdkconfig.rename                     @esp-idf-codeowners/build-config
+/sonar-project.properties             @esp-idf-codeowners/ci
+
+# sort-order-reset
+
+/components/app_trace/                @esp-idf-codeowners/tools
+/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
+/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
+/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
+/components/bt/                       @esp-idf-codeowners/bluetooth
+/components/cmock/                    @esp-idf-codeowners/system
+/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
+/components/cxx/                      @esp-idf-codeowners/system
+/components/driver/                   @esp-idf-codeowners/peripherals
+/components/efuse/                    @esp-idf-codeowners/system
+/components/esp_adc/                  @esp-idf-codeowners/peripherals
+/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
+/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
+/components/esp_common/               @esp-idf-codeowners/system
+/components/esp_eth/                  @esp-idf-codeowners/network
+/components/esp_event/                @esp-idf-codeowners/system
+/components/esp_gdbstub/              @esp-idf-codeowners/tools
+/components/esp_hid/                  @esp-idf-codeowners/bluetooth
+/components/esp_http_client/          @esp-idf-codeowners/app-utilities
+/components/esp_http_server/          @esp-idf-codeowners/app-utilities
+/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
+/components/esp_https_server/         @esp-idf-codeowners/app-utilities
+/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
+/components/esp_lcd/                  @esp-idf-codeowners/peripherals
+/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
+/components/esp_mm/                   @esp-idf-codeowners/peripherals
+/components/esp_netif/                @esp-idf-codeowners/network
+/components/esp_netif_stack/          @esp-idf-codeowners/network
+/components/esp_partition/            @esp-idf-codeowners/storage
+/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
+/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
+/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
+/components/esp_ringbuf/              @esp-idf-codeowners/system
+/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
+/components/esp_system/               @esp-idf-codeowners/system
+/components/esp_timer/                @esp-idf-codeowners/system
+/components/esp-tls/                  @esp-idf-codeowners/app-utilities
+/components/esp_wifi/                 @esp-idf-codeowners/wifi
+/components/espcoredump/              @esp-idf-codeowners/tools
+/components/esptool_py/               @esp-idf-codeowners/tools
+/components/fatfs/                    @esp-idf-codeowners/storage
+/components/fatfs/**/*.py             @esp-idf-codeowners/tools
+/components/freertos/                 @esp-idf-codeowners/system
+/components/hal/                      @esp-idf-codeowners/peripherals
+/components/heap/                     @esp-idf-codeowners/system
+/components/http_parser/              @esp-idf-codeowners/app-utilities
+/components/idf_test/                 @esp-idf-codeowners/ci
+/components/ieee802154/               @esp-idf-codeowners/ieee802154
+/components/json/                     @esp-idf-codeowners/app-utilities
+/components/linux/                    @esp-idf-codeowners/system
+/components/log/                      @esp-idf-codeowners/system
+/components/lwip/                     @esp-idf-codeowners/lwip
+/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
+/components/mqtt/                     @esp-idf-codeowners/network
+/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/tools
+/components/nvs_flash/                @esp-idf-codeowners/storage
+/components/openthread/               @esp-idf-codeowners/ieee802154
+/components/partition_table/          @esp-idf-codeowners/system
+/components/perfmon/                  @esp-idf-codeowners/tools
+/components/protobuf-c/               @esp-idf-codeowners/app-utilities
+/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
+/components/pthread/                  @esp-idf-codeowners/system
+/components/riscv/                    @esp-idf-codeowners/system
+/components/sdmmc/                    @esp-idf-codeowners/storage
+/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
+/components/spi_flash/                @esp-idf-codeowners/peripherals
+/components/spiffs/                   @esp-idf-codeowners/storage
+/components/tcp_transport/            @esp-idf-codeowners/network
+/components/touch_element/            @esp-idf-codeowners/peripherals
+/components/ulp/                      @esp-idf-codeowners/system
+/components/unity/                    @esp-idf-codeowners/ci
+/components/usb/                      @esp-idf-codeowners/peripherals/usb
+/components/vfs/                      @esp-idf-codeowners/storage
+/components/wear_levelling/           @esp-idf-codeowners/storage
+/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
+/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
+/components/xtensa/                   @esp-idf-codeowners/system
+
+/docs/                                  @esp-idf-codeowners/docs
+/docs/**/api-reference/bluetooth/       @esp-idf-codeowners/bluetooth
+/docs/**/api-reference/network/         @esp-idf-codeowners/network
+/docs/**/api-reference/peripherals/     @esp-idf-codeowners/peripherals
+/docs/**/api-reference/peripherals/usb* @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
+/docs/**/api-reference/protocols/       @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
+/docs/**/api-reference/provisioning/    @esp-idf-codeowners/app-utilities/provisioning
+/docs/**/api-reference/storage/         @esp-idf-codeowners/storage
+/docs/**/api-reference/system/          @esp-idf-codeowners/system
+/docs/**/security/                      @esp-idf-codeowners/security
+/docs/**/migration-guides/              @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
+
+/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
+/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
+/examples/bluetooth/          @esp-idf-codeowners/bluetooth
+/examples/build_system/       @esp-idf-codeowners/build-config
+/examples/common_components/  @esp-idf-codeowners/system
+/examples/custom_bootloader/  @esp-idf-codeowners/system
+/examples/cxx/                @esp-idf-codeowners/system
+/examples/ethernet/           @esp-idf-codeowners/network
+/examples/get-started/        @esp-idf-codeowners/system
+/examples/mesh/               @esp-idf-codeowners/wifi
+/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
+/examples/openthread/         @esp-idf-codeowners/ieee802154
+/examples/peripherals/        @esp-idf-codeowners/peripherals
+/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
+/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
+/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
+/examples/security/           @esp-idf-codeowners/security
+/examples/storage/            @esp-idf-codeowners/storage
+/examples/system/             @esp-idf-codeowners/system
+/examples/system/ota/         @esp-idf-codeowners/app-utilities
+/examples/wifi/               @esp-idf-codeowners/wifi
+/examples/zigbee/             @esp-idf-codeowners/ieee802154
+
+/tools/                       @esp-idf-codeowners/tools
+/tools/ble/                   @esp-idf-codeowners/app-utilities
+/tools/catch/                 @esp-idf-codeowners/ci
+/tools/ci/                    @esp-idf-codeowners/ci
+/tools/cmake/                 @esp-idf-codeowners/build-config
+/tools/esp_prov/              @esp-idf-codeowners/app-utilities
+/tools/kconfig*/              @esp-idf-codeowners/build-config
+/tools/ldgen/                 @esp-idf-codeowners/build-config
+/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
+/tools/mocks/                 @esp-idf-codeowners/system
+/tools/test_apps/README.md    @esp-idf-codeowners/docs @esp-idf-codeowners/ci
+
+## Note: owners here should be the same as the owners for the same example subdir, above
+/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
+/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
+/tools/test_apps/security/           @esp-idf-codeowners/security
+/tools/test_apps/system/             @esp-idf-codeowners/system
+
+/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
+
+/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
+
+/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
+
+# sort-order-reset
+
+/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
+
+# ignore lists
+/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
+/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
+/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
--- a/.gitlab/ci/README.md
+++ b/.gitlab/ci/README.md
@@ -21,6 +21,11 @@
      - [Shell Script Related](#shell-script-related)
  - [Manifest File to Control the Build/Test apps](#manifest-file-to-control-the-buildtest-apps)
    - [Grammar](#grammar)
+      - [Operands](#operands)
+      - [Operators](#operators)
+      - [Limitation:](#limitation)
+    - [How does it work?](#how-does-it-work)
+    - [Example](#example)

 ## General Workflow

@@ -51,7 +56,7 @@
 - `example_test[_esp32/esp32s2/...]`
 - `fuzzer_test`
 - `host_test`
- `integration_test`
+- `integration_test[_wifi/ble]`
 - `iperf_stress_test`
 - `macos`
 - `macos_test`
@@ -139,11 +144,10 @@ check if there's a suitable `.if-<if-anchor-you-need>` anchor
 1. if there is, create a rule following [`rules` Template Naming Rules](#rules-template-naming-rules).For detail information, please refer to [GitLab Documentation `rules-if`](https://docs.gitlab.com/ee/ci/yaml/README.html#rulesif). Here's an example.

    ```yaml
-    .rules:patterns:python-files:
+    .rules:dev:
      rules:
-        - <<: *if-protected
+        - <<: *if-trigger
        - <<: *if-dev-push
-          changes: *patterns-python-files
    ```

 2. if there isn't
--- a/.gitlab/ci/assign-test.yml
+++ b/.gitlab/ci/assign-test.yml
@@ -5,7 +5,6 @@
    - assign_test
  variables:
    SUBMODULES_TO_FETCH: "none"
-    CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/.gitlab/ci/target-test.yml"
  artifacts:
    paths:
      - ${TEST_DIR}/test_configs/
@@ -67,3 +66,34 @@ assign_unit_test:
  variables:
    TEST_TYPE: unit_test
    TEST_DIR: components/idf_test/unit_test
+
+assign_integration_test:
+  extends:
+    - .assign_test_template
+    - .rules:test:integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  needs:
+    - build_ssc_esp32
+    - build_ssc_esp32c3
+    - build_ssc_esp32c2
+  artifacts:
+    paths:
+      - $TEST_DIR/test_configs
+    expire_in: 1 week
+  variables:
+    TEST_DIR: ${CI_PROJECT_DIR}/tools/ci/integration_test
+    BUILD_DIR: ${CI_PROJECT_DIR}/SSC/ssc_bin
+    INTEGRATION_TEST_CASE_PATH: "${CI_PROJECT_DIR}/auto_test_script/TestCaseFiles"
+    ASSIGN_TEST_CASE_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIAssignTestCases.py"
+    PYTHONPATH: ${CI_PROJECT_DIR}/auto_test_script/packages
+    GIT_LFS_SKIP_SMUDGE: 1
+  script:
+    - add_gitlab_ssh_keys
+    # clone test script to assign tests
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # assign integration test cases
+    - python ${ASSIGN_TEST_CASE_SCRIPT} -t ${INTEGRATION_TEST_CASE_PATH} -c $CI_TARGET_TEST_CONFIG_FILE -b ${BUILD_DIR} -o $TEST_DIR/test_configs
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -215,6 +215,14 @@ build_pytest_examples_esp32c2:
    IDF_TARGET: esp32c2
    TEST_DIR: examples

+build_pytest_examples_esp32h4:
+  extends:
+    - .build_pytest_no_jtag_template
+    - .rules:build:example_test-esp32h4
+  variables:
+    IDF_TARGET: esp32h4
+    TEST_DIR: examples
+
 build_pytest_examples_jtag:  # for all targets
  extends:
    - .build_pytest_jtag_template
@@ -236,7 +244,6 @@ build_pytest_examples_esp32h2:
  extends:
    - .build_pytest_template
    - .rules:build:example_test-esp32h2
-  parallel: 2
  variables:
    IDF_TARGET: esp32h2
    TEST_DIR: examples
@@ -403,7 +410,7 @@ build_only_tools_test_apps:
  extends:
    - .build_cmake_template
    - .rules:build:custom_test
-  parallel: 8
+  parallel: 9
  script:
    # CI specific options start from "--collect-size-info xxx". could ignore when running locally
    - run_cmd python tools/ci/ci_build_apps.py tools/test_apps -v
@@ -451,6 +458,66 @@ fast_template_app:
  variables:
    BUILD_COMMAND_ARGS: "-p"
 #------------------------------------------------------------------------------
+
+.build_ssc_template:
+  extends:
+    - .build_template
+    - .rules:build:integration_test
+  needs:
+    - job: fast_template_app
+      artifacts: false
+  artifacts:
+    paths:
+      - SSC/ssc_bin
+    expire_in: 1 week
+  script:
+    - retry_failed git clone $SSC_REPOSITORY
+    - python $CHECKOUT_REF_SCRIPT SSC SSC
+    - cd SSC
+    - MAKEFLAGS= ./ci_build_ssc.sh $TARGET_NAME
+
+build_ssc_esp32:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32"
+
+build_ssc_esp32s2:
+  extends: .build_ssc_template
+  parallel: 2
+  variables:
+    TARGET_NAME: "ESP32S2"
+
+build_ssc_esp32c2:
+  extends: .build_ssc_template
+  parallel: 2
+  variables:
+    TARGET_NAME: "ESP32C2"
+
+build_ssc_esp32c3:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32C3"
+
+build_ssc_esp32s3:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32S3"
+
+build_ssc_esp32c6:
+  extends: .build_ssc_template
+  parallel: 3
+  variables:
+    TARGET_NAME: "ESP32C6"
+
+build_ssc_esp32h2:
+  extends: .build_ssc_template
+  parallel: 2
+  variables:
+    TARGET_NAME: "ESP32H2"
+
 .build_esp_idf_tests_cmake_template:
  extends:
    - .build_cmake_template
@@ -577,16 +644,24 @@ build_examples_cmake_esp32c3:
  extends:
    - .build_cmake_template
    - .rules:build:example_test-esp32c3
-  parallel: 8
+  parallel: 6
  variables:
    IDF_TARGET: esp32c3
    TEST_DIR: examples

+build_examples_cmake_esp32h4:
+  extends:
+    - .build_cmake_template
+    - .rules:build:example_test-esp32h4
+  variables:
+    IDF_TARGET: esp32h4
+    TEST_DIR: examples
+
 build_examples_cmake_esp32c6:
  extends:
    - .build_cmake_template
    - .rules:build:example_test-esp32c6
-  parallel: 10
+  parallel: 6
  variables:
    IDF_TARGET: esp32c6
    TEST_DIR: examples
@@ -595,7 +670,7 @@ build_examples_cmake_esp32h2:
  extends:
    - .build_cmake_template
    - .rules:build:example_test-esp32h2
-  parallel: 6
+  parallel: 2
  variables:
    IDF_TARGET: esp32h2
    TEST_DIR: examples
@@ -654,6 +729,13 @@ build_clang_test_apps_esp32c6:
  variables:
    IDF_TARGET: esp32c6

+build_clang_test_apps_esp32h4:
+  extends:
+    - .build_clang_test_apps_riscv
+    - .rules:build:custom_test-esp32h4
+  variables:
+    IDF_TARGET: esp32h4
+
 .test_build_system_template:
  stage: host_test
  extends:
@@ -662,7 +744,6 @@ build_clang_test_apps_esp32c6:
  needs:
    - job: fast_template_app
      artifacts: false
-      optional: true
  script:
    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
    - rm -rf test_build_system
@@ -684,19 +765,6 @@ test_build_system_cmake_macos:
    - macos_shell
  variables:
    SHELL_TEST_SCRIPT: test_build_system_cmake.sh
-    PYENV_VERSION: "3.7"
-  script:
-    - ${IDF_PATH}/tools/ci/test_configure_ci_environment.sh
-    - rm -rf test_build_system
-    - mkdir test_build_system
-    - cd test_build_system
-    # copy-paste the script from .test_build_system_template
-    # since `ESP_IDF_TEMPLATE_GIT` is a group variable and has higher precedence than job variable
-    # export here to override the group variable
-    #
-    # Clone the template app from github for macos runners
-    - export ESP_IDF_TEMPLATE_GIT="https://github.com/espressif/esp-idf-template.git"
-    - ${IDF_PATH}/tools/ci/${SHELL_TEST_SCRIPT}

 test_build_system_spaces:
  extends: .test_build_system_template
--- a/.gitlab/ci/dependencies/dependencies.yml
+++ b/.gitlab/ci/dependencies/dependencies.yml
@@ -3,6 +3,7 @@
  - esp32s2
  - esp32s3
  - esp32c3
+  - esp32h4
  - esp32c2
  - esp32c6
  - esp32h2
@@ -75,6 +76,16 @@
    - "build:{0}"
    - build:target_test

+build:integration_test:
+  labels:
+    - build
+  patterns:
+    - build_components
+    - build_system
+  included_in:
+    - build:target_test
+
+
 ####################
 # Target Test Jobs #
 ####################
@@ -122,15 +133,14 @@
    - *target_test
    - *all_targets
    - - bt        # example_test_005
-      - wifi      # pytest*wifi*
-      - ethernet  # pytest*ethernet*
-      - sdio      # pytest*sdio*
+      - wifi      # example_test_002, example_test*wifi*
+      - ethernet  # example_test*ethernet*
+      - sdio      # component_ut_pytest_esp32_sdio
      - usb       # USB Device & Host tests
-      - adc       # pytest*adc*
+      - adc       # component_ut_pytest_esp32x_adc
      - i154
      - flash_multi
      - ecdsa
-      - ccs811    # pytest*ccs811*
  patterns:
    - "{0}-{1}-{2}"
    - "{0}-{2}"
@@ -172,18 +182,21 @@
    - "build:example_test"
    - build:target_test

-# For openthread sleepy
-"test:example_test-otsleepy":
-  patterns:
-    - "example_test-otsleepy"
-    - "target_test-i154"
+"test:integration_test_{0}":
+  matrix:
+    - - wifi
+      - ble
  labels:
+    - integration_test_{0}
+    - integration_test
    - target_test
-    - example_test
+  patterns:
+    - integration_test-{0}
+    - target_test-{0}
+    # - maybe others
  included_in:
-    - "build:example_test-esp32c6"
-    - "build:example_test-esp32h2"
-    - "build:example_test"
+    - test:integration_test
+    - build:integration_test
    - build:target_test

 "test:host_test":
@@ -201,6 +214,37 @@
 #################################
 # Triggered Only By Labels Jobs #
 #################################
+"labels:iperf_stress_test": # example_test
+  labels:
+    - iperf_stress_test
+  included_in:
+    - build:example_test
+    - build:example_test-esp32
+    - build:target_test
+
+"labels:weekend_test": # custom test
+  labels:
+    - weekend_test
+  included_in:
+    - build:custom_test
+    - build:custom_test-esp32
+    - build:target_test
+
 "labels:nvs_coverage": # host_test
  labels:
    - nvs_coverage
+
+"labels:fuzzer_test-weekend_test": # host test
+  labels:
+    - fuzzer_test
+    - weekend_test
+
+"labels-protected:lan8720":  # UT # FIXME: IDFCI-1176 temporary run this on master/release or with label
+  labels:
+    - lan8720
+  included_in:
+    - build:unit_test
+    - build:unit_test-esp32
+    - build:target_test
+    - build:component_ut
+    - build:component_ut-esp32
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@@ -32,25 +32,50 @@ push_to_github:
  extends:
    - .deploy_job_template
    - .before_script_minimal
-    - .rules:push_to_github
-  needs:
-    - check_submodule_sync
+    - .rules:protected-no_label
+  dependencies: []
  script:
    - add_github_ssh_keys
    - git remote remove github &>/dev/null || true
    - git remote add github git@github.com:espressif/esp-idf.git
    - tools/ci/push_to_github.sh

-deploy_update_SHA_in_esp-dockerfiles:
+deploy_test_result:
  extends:
    - .deploy_job_template
    - .before_script_minimal
-    - .rules:protected-no_label-always
+    - .rules:ref:master-always
+  image: $CI_DOCKER_REGISTRY/bot-env:1
  dependencies: []
+  tags:
+    - deploy_test
+  artifacts:
+    when: always
+    paths:
+      - ${CI_PROJECT_DIR}/test-management/*.log
+    expire_in: 1 week
  variables:
-    GIT_DEPTH: 2
-  tags: [ shiny, build ]
+    BOT_ACCOUNT_CONFIG_FILE: "${CI_PROJECT_DIR}/test-management/Config/Account.local.yml"
+    TEST_RESULTS_PATH: "${CI_PROJECT_DIR}/TEST_RESULTS"
  script:
-    - 'curl --header "PRIVATE-TOKEN: ${ESPCI_SCRIPTS_TOKEN}" -o create_MR_in_esp_dockerfile.sh $GITLAB_HTTP_SERVER/api/v4/projects/1260/repository/files/create_MR_in_esp_dockerfile%2Fcreate_MR_in_esp_dockerfile.sh/raw\?ref\=master'
-    - chmod +x create_MR_in_esp_dockerfile.sh
-    - ./create_MR_in_esp_dockerfile.sh
+    - add_gitlab_ssh_keys
+    - export GIT_SHA=$(echo ${CI_COMMIT_SHA} | cut -c 1-8)
+    - export REV_COUNT=$(git rev-list --count ${GIT_SHA} --)
+    - export SUMMARY="IDF CI test result for $GIT_SHA (r${REV_COUNT})"
+    # Download test result
+    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
+    - python3 ${IDF_PATH}/tools/ci/get_all_test_results.py --path ${TEST_RESULTS_PATH} --include_retried
+    - if [[ -z $(find ${TEST_RESULTS_PATH} -name "*.xml") ]]; then exit 0; fi
+    # Clone test-management repo
+    - retry_failed git clone $TEST_MANAGEMENT_REPO
+    - python3 $CHECKOUT_REF_SCRIPT test-management test-management
+    - cd test-management
+    - echo $BOT_JIRA_ACCOUNT > ${BOT_ACCOUNT_CONFIG_FILE}
+    # Make sure all requirements are installed
+    - pip3 install -r requirements.txt
+    # Update test cases
+    - python3 ImportTestCase.py $JIRA_TEST_MANAGEMENT_PROJECT from_xml -d ${TEST_RESULTS_PATH} -r $GIT_SHA -l IDFCI
+    # update test results
+    - python3 ImportTestResult.py -r "$GIT_SHA (r${REV_COUNT})" -j $JIRA_TEST_MANAGEMENT_PROJECT -s "$SUMMARY" -l IDFCI -p ${TEST_RESULTS_PATH} --pipeline_url ${CI_PIPELINE_URL}
+  # May need a long time to upload all test results.
+  timeout: 4 hours
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@@ -3,7 +3,6 @@
  - "docs/**/*"
  - "**/*.rst"
  - "CONTRIBUTING.rst"
-  - "**/soc_caps.h"

 .patterns-docs-partial: &patterns-docs-partial
  - "components/**/*.h"
@@ -25,9 +24,6 @@
 .if-protected-no_label: &if-protected-no_label
  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) && $BOT_TRIGGER_WITH_LABEL == null'

-.if-qa-test-tag: &if-qa-test-tag
-  if: '$CI_COMMIT_TAG =~ /^qa-test/'
-
 .if-label-build_docs: &if-label-build_docs
  if: '$BOT_LABEL_BUILD_DOCS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build_docs(?:,[^,\n\r]+)*$/i'

@@ -35,12 +31,10 @@
  if: '$BOT_LABEL_DOCS_FULL || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*docs_full(?:,[^,\n\r]+)*$/i'

 .if-dev-push: &if-dev-push
-  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
+  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'

 .doc-rules:build:docs-full:
  rules:
-    - <<: *if-qa-test-tag
-      when: never
    - <<: *if-protected
    - <<: *if-label-build_docs
    - <<: *if-label-docs_full
@@ -49,11 +43,6 @@

 .doc-rules:build:docs-partial:
  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-dev-push
-      changes: *patterns-docs-full
-      when: never
    - <<: *if-dev-push
      changes: *patterns-docs-partial

--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@@ -135,10 +135,10 @@ test_idf_tools:
    entrypoint: [""]  # use system python3. no extra pip package installed
  script:
    # Tools must be downloaded for testing
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa
+    - python3 ${IDF_PATH}/tools/idf_tools.py download
    - cd ${IDF_PATH}/tools/test_idf_tools
    - python3 -m pip install jsonschema
-    - python3 ./test_idf_tools.py -v
+    - python3 ./test_idf_tools.py
    - python3 ./test_idf_tools_python_env.py

 .test_efuse_table_on_host_template:
@@ -185,6 +185,30 @@ test_efuse_table_on_host_esp32c6:
  variables:
    IDF_TARGET: esp32c6

+test_efuse_table_on_host_esp32h4:
+  extends: .test_efuse_table_on_host_template
+  variables:
+    IDF_TARGET: esp32h4
+
+test_espcoredump:
+  extends: .host_test_template
+  artifacts:
+    when: always
+    paths:
+      - components/espcoredump/test/**/.coverage
+      - components/espcoredump/test/**/output
+    expire_in: 1 week
+  variables:
+    IDF_COREDUMP_ELF_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/idf/idf-coredump-elf.git"
+    IDF_COREDUMP_ELF_TAG: idf-20220928
+    # install CMake version specified in tools.json
+    SETUP_TOOLS_LIST: "all"
+  script:
+    - eval $($IDF_PATH/tools/idf_tools.py export)
+    - retry_failed git clone ${IDF_COREDUMP_ELF_REPO} -b $IDF_COREDUMP_ELF_TAG
+    - cd ${IDF_PATH}/components/espcoredump/test/
+    - ./test_espcoredump.sh ${CI_PROJECT_DIR}/idf-coredump-elf
+
 test_logtrace_proc:
  extends: .host_test_template
  artifacts:
@@ -307,7 +331,7 @@ test_pytest_qemu:
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest-embedded/
+      - pytest_embedded_log/
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
@@ -316,13 +340,13 @@ test_pytest_qemu:
      --target esp32
      --pytest-apps
      -m qemu
-    - python tools/ci/get_known_failure_cases_file.py
+    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    - pytest
      --target esp32
      -m qemu
      --embedded-services idf,qemu
      --junitxml=XUNIT_RESULT.xml
-      --known-failure-cases-file ${KNOWN_FAILURE_CASES_FILE_NAME}
+      --known-failure-cases-file known_failure_cases/known_failure_cases.txt

 test_pytest_linux:
  extends:
@@ -332,7 +356,7 @@ test_pytest_linux:
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest-embedded/
+      - pytest_embedded_log/
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
@@ -341,6 +365,6 @@ test_pytest_linux:
      --target linux
      --pytest-apps
      -m host_test
-    - python tools/ci/get_known_failure_cases_file.py
+    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    - run_cmd pytest --target linux -m host_test --junitxml=XUNIT_RESULT.xml
-      --known-failure-cases-file ${KNOWN_FAILURE_CASES_FILE_NAME}
+      --known-failure-cases-file known_failure_cases/known_failure_cases.txt
--- a/.gitlab/ci/integration_test.yml
+++ b/.gitlab/ci/integration_test.yml
@@ -1,69 +0,0 @@
-# generate dynamic integration pipeline by `idf-integration-ci` project
-
-.patterns-integration_test: &patterns-integration_test
-  # add all possible patterns to make sure `gen_integration_pipeline` can be triggered.
-  # fine-grained control will be done while generating the pipeline
-  # find `patterns` in `idf-integration-ci` project
-  - "components/**/*"
-  - "tools/**/*"
-  - ".gitlab-ci.yml"
-  - ".gitlab/ci/common.yml"
-  - ".gitlab/ci/integration_test.yml"
-  - ".gitmodules"
-  - "CMakeLists.txt"
-  - "install.sh"
-  - "export.sh"
-  - "Kconfig"
-  - "sdkconfig.rename"
-
-# Simplify the rules
-.integration_test_rules:
-  rules:
-    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      changes: *patterns-integration_test
-    # support trigger by ci labels
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*target_test(?:,[^,\n\r]+)*$/i'
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*build(?:,[^,\n\r]+)*$/i'
-
-gen_integration_pipeline:
-  extends:
-    - .before_script_minimal
-    - .integration_test_rules
-  image: ${CI_INTEGRATION_ASSIGN_ENV}
-  stage: assign_test
-  cache: []
-  tags:
-    - assign_test
-  variables:
-    SUBMODULES_TO_FETCH: "none"
-    GIT_LFS_SKIP_SMUDGE: 1
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    paths:
-      - idf-integration-ci/child_pipeline/
-    expire_in: 2 weeks
-  script:
-    - add_gitlab_ssh_keys
-    - retry_failed git clone ${CI_GEN_INTEGRATION_PIPELINE_REPO} idf-integration-ci
-    - python $CHECKOUT_REF_SCRIPT idf-integration-ci idf-integration-ci
-    - cd idf-integration-ci
-    - python tools/generate_child_pipeline.py -o child_pipeline/
-
-child_integration_test_pipeline:
-  extends:
-    - .integration_test_rules
-  stage: assign_test
-  needs:
-    - gen_integration_pipeline
-  trigger:
-    include:
-      - artifact: idf-integration-ci/child_pipeline/pipeline.yml
-        job: gen_integration_pipeline
-    forward:
-      yaml_variables: false
-    strategy: depend
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@@ -17,15 +17,13 @@ check_pre_commit_master_release:
    - .rules:protected
  script:
    - git diff-tree --no-commit-id --name-only -r $PIPELINE_COMMIT_SHA | xargs pre-commit run --files
-    - pre-commit run --hook-stage post-commit validate-sbom-manifest

 check_pre_commit_MR:
  extends:
    - .check_pre_commit_template
-    - .rules:mr
+    - .rules:dev
  script:
    - python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py files ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} | xargs pre-commit run --files
-    - pre-commit run --hook-stage post-commit validate-sbom-manifest

 check_MR_style_dangerjs:
  extends:
@@ -44,8 +42,6 @@ check_MR_style_dangerjs:
    - danger ci --dangerfile=".gitlab/dangerjs/dangerfile.js" --failOnErrors -v
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-  tags:
-    - dangerjs

 check_version:
  # Don't run this for feature/bugfix branches, so that it is possible to modify
--- a/.gitlab/ci/rules.yml
+++ b/.gitlab/ci/rules.yml
@@ -55,6 +55,8 @@
  - "tools/test_build_system/**/*"

 .patterns-custom_test: &patterns-custom_test
+  - "components/espcoredump/**/*"
+
  - "tools/ci/python_packages/gitlab_api.py"
  - "tools/ci/python_packages/tiny_test_fw/**/*"
  - "tools/ci/python_packages/ttfw_idf/**/*"
@@ -93,13 +95,6 @@
  - "examples/common_components/iperf/**/*"
  - "examples/openthread/**/*"

-.patterns-example_test-otsleepy: &patterns-example_test-otsleepy
-  - "components/esp_hw_support/**/*"
-  - "components/esp_netif/**/*"
-  - "components/lwip/**/*"
-  - "components/openthread/**/*"
-  - "examples/openthread/**/*"
-
 .patterns-target_test-wifi: &patterns-target_test-wifi
  - "components/esp_netif/**/*"
  - "components/lwip/**/*"
@@ -108,6 +103,20 @@
  - "components/wpa_supplicant/**/*"
  - "components/esp_coex/**/*"

+.patterns-integration_test-ble: &patterns-integration_test-ble
+  - "tools/ci/python_packages/gitlab_api.py"
+  - "tools/ci/integration_test/**/*"
+  - "components/bt/controller/lib_esp32"
+  - "components/bt/controller/lib_esp32c3_family"
+  - "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"
+  - "components/bt/host/nimble/nimble"
+  - "components/esp_phy/lib"
+  - "components/esp_coex/**/*"
+
+.patterns-integration_test-wifi: &patterns-integration_test-wifi
+  - "tools/ci/python_packages/gitlab_api.py"
+  - "tools/ci/integration_test/**/*"
+
 .patterns-host_test: &patterns-host_test
  - ".gitlab/ci/host-test.yml"

@@ -159,8 +168,6 @@

  - "tools/split_paths_by_spaces.py"

-  - "tools/check_python_dependencies.py"
-
 .patterns-windows: &patterns-windows
  - "tools/windows/**/*"

@@ -178,6 +185,7 @@
  - "components/esp_phy/lib"
  - "components/esp_wifi/lib"
  - "components/esp_coex/lib"
+  - "components/ieee802154/lib"
  - "components/json/cJSON"
  - "components/lwip/lwip"
  - "components/mbedtls/mbedtls"
@@ -238,7 +246,6 @@
  - "components/driver/include/driver/sdio*.h"
  - "components/driver/include/driver/sdmmc*.h"
  - "components/sdmmc/**/*"
-  - "examples/peripherals/sdio/**/*"

 # for jobs: component_ut_pytest_sdio related
 .patterns-component_ut-sdio: &patterns-component_ut-sdio
@@ -252,13 +259,6 @@
  - "components/driver/include/driver/sdmmc*.h"
  - "components/sdmmc/**/*"

-.patterns-example_test-ccs811: &patterns-example_test-ccs811
-  # components
-  - "examples/system/console/advanced/components/**/*"
-  - "components/driver/i2c/**/*"
-  # tests
-  - "examples/peripherals/i2c/i2c_tools/**/*"
-
 # for jobs: UT_xx_SDSPI related
 .patterns-unit_test-sdio: &patterns-unit_test-sdio
  - "components/hal/sdio*.c"
@@ -321,19 +321,13 @@
  if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/'

 .if-protected: &if-protected
-  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) || $CI_COMMIT_TAG =~ /^qa-test/'
+  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/)'

 .if-protected-no_label: &if-protected-no_label
  if: '($CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_BRANCH =~ /^release\/v/ || $CI_COMMIT_TAG =~ /^v\d+\.\d+(\.\d+)?($|-)/) && $BOT_TRIGGER_WITH_LABEL == null'

-.if-qa-test-tag: &if-qa-test-tag
-  if: '$CI_COMMIT_TAG =~ /^qa-test/'
-
 .if-dev-push: &if-dev-push
-  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'
-
-.if-merge_request: &if-merge_request
-  if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'

 .if-schedule: &if-schedule
  if: '$CI_PIPELINE_SOURCE == "schedule"'
@@ -366,24 +360,10 @@
  rules:
    - <<: *if-protected

-.rules:push_to_github:
+.rules:protected-no_label:
  rules:
-    - <<: *if-qa-test-tag
-      when: never
    - <<: *if-protected-no_label

-.rules:protected-no_label-always:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-      when: always
-
-.rules:mr:
-  rules:
-    - <<: *if-merge_request
-
-### Patterns ###
 .rules:patterns:python-cache:
  rules:
    - *if-schedule
@@ -430,6 +410,15 @@
    - <<: *if-dev-push
      changes: *patterns-python-files

+.rules:patterns:static-code-analysis-preview:
+  rules:
+    - <<: *if-dev-push
+      changes: *patterns-c-files
+    - <<: *if-dev-push
+      changes: *patterns-python-files
+    - <<: *if-dev-push
+      changes: *patterns-sonarqube-files
+
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 # DO NOT place comments or maintain any code from this line
 #
@@ -463,6 +452,9 @@
 .if-label-component_ut_esp32h2: &if-label-component_ut_esp32h2
  if: '$BOT_LABEL_COMPONENT_UT_ESP32H2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*component_ut_esp32h2(?:,[^,\n\r]+)*$/i'

+.if-label-component_ut_esp32h4: &if-label-component_ut_esp32h4
+  if: '$BOT_LABEL_COMPONENT_UT_ESP32H4 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*component_ut_esp32h4(?:,[^,\n\r]+)*$/i'
+
 .if-label-component_ut_esp32s2: &if-label-component_ut_esp32s2
  if: '$BOT_LABEL_COMPONENT_UT_ESP32S2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*component_ut_esp32s2(?:,[^,\n\r]+)*$/i'

@@ -487,6 +479,9 @@
 .if-label-custom_test_esp32h2: &if-label-custom_test_esp32h2
  if: '$BOT_LABEL_CUSTOM_TEST_ESP32H2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*custom_test_esp32h2(?:,[^,\n\r]+)*$/i'

+.if-label-custom_test_esp32h4: &if-label-custom_test_esp32h4
+  if: '$BOT_LABEL_CUSTOM_TEST_ESP32H4 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*custom_test_esp32h4(?:,[^,\n\r]+)*$/i'
+
 .if-label-custom_test_esp32s2: &if-label-custom_test_esp32s2
  if: '$BOT_LABEL_CUSTOM_TEST_ESP32S2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*custom_test_esp32s2(?:,[^,\n\r]+)*$/i'

@@ -514,15 +509,36 @@
 .if-label-example_test_esp32h2: &if-label-example_test_esp32h2
  if: '$BOT_LABEL_EXAMPLE_TEST_ESP32H2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*example_test_esp32h2(?:,[^,\n\r]+)*$/i'

+.if-label-example_test_esp32h4: &if-label-example_test_esp32h4
+  if: '$BOT_LABEL_EXAMPLE_TEST_ESP32H4 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*example_test_esp32h4(?:,[^,\n\r]+)*$/i'
+
 .if-label-example_test_esp32s2: &if-label-example_test_esp32s2
  if: '$BOT_LABEL_EXAMPLE_TEST_ESP32S2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*example_test_esp32s2(?:,[^,\n\r]+)*$/i'

 .if-label-example_test_esp32s3: &if-label-example_test_esp32s3
  if: '$BOT_LABEL_EXAMPLE_TEST_ESP32S3 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*example_test_esp32s3(?:,[^,\n\r]+)*$/i'

+.if-label-fuzzer_test: &if-label-fuzzer_test
+  if: '$BOT_LABEL_FUZZER_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*fuzzer_test(?:,[^,\n\r]+)*$/i'
+
 .if-label-host_test: &if-label-host_test
  if: '$BOT_LABEL_HOST_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*host_test(?:,[^,\n\r]+)*$/i'

+.if-label-integration_test: &if-label-integration_test
+  if: '$BOT_LABEL_INTEGRATION_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test(?:,[^,\n\r]+)*$/i'
+
+.if-label-integration_test_ble: &if-label-integration_test_ble
+  if: '$BOT_LABEL_INTEGRATION_TEST_BLE || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_ble(?:,[^,\n\r]+)*$/i'
+
+.if-label-integration_test_wifi: &if-label-integration_test_wifi
+  if: '$BOT_LABEL_INTEGRATION_TEST_WIFI || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*integration_test_wifi(?:,[^,\n\r]+)*$/i'
+
+.if-label-iperf_stress_test: &if-label-iperf_stress_test
+  if: '$BOT_LABEL_IPERF_STRESS_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*iperf_stress_test(?:,[^,\n\r]+)*$/i'
+
+.if-label-lan8720: &if-label-lan8720
+  if: '$BOT_LABEL_LAN8720 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*lan8720(?:,[^,\n\r]+)*$/i'
+
 .if-label-macos: &if-label-macos
  if: '$BOT_LABEL_MACOS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*macos(?:,[^,\n\r]+)*$/i'

@@ -556,12 +572,18 @@
 .if-label-unit_test_esp32h2: &if-label-unit_test_esp32h2
  if: '$BOT_LABEL_UNIT_TEST_ESP32H2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test_esp32h2(?:,[^,\n\r]+)*$/i'

+.if-label-unit_test_esp32h4: &if-label-unit_test_esp32h4
+  if: '$BOT_LABEL_UNIT_TEST_ESP32H4 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test_esp32h4(?:,[^,\n\r]+)*$/i'
+
 .if-label-unit_test_esp32s2: &if-label-unit_test_esp32s2
  if: '$BOT_LABEL_UNIT_TEST_ESP32S2 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test_esp32s2(?:,[^,\n\r]+)*$/i'

 .if-label-unit_test_esp32s3: &if-label-unit_test_esp32s3
  if: '$BOT_LABEL_UNIT_TEST_ESP32S3 || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*unit_test_esp32s3(?:,[^,\n\r]+)*$/i'

+.if-label-weekend_test: &if-label-weekend_test
+  if: '$BOT_LABEL_WEEKEND_TEST || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*weekend_test(?:,[^,\n\r]+)*$/i'
+
 .if-label-windows: &if-label-windows
  if: '$BOT_LABEL_WINDOWS || $CI_MERGE_REQUEST_LABELS =~ /^(?:[^,\n\r]+,)*windows(?:,[^,\n\r]+)*$/i'

@@ -590,8 +612,10 @@
    - <<: *if-label-component_ut_esp32c3
    - <<: *if-label-component_ut_esp32c6
    - <<: *if-label-component_ut_esp32h2
+    - <<: *if-label-component_ut_esp32h4
    - <<: *if-label-component_ut_esp32s2
    - <<: *if-label-component_ut_esp32s3
+    - <<: *if-label-lan8720
    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
@@ -599,6 +623,7 @@
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-label-unit_test_esp32c6
    - <<: *if-label-unit_test_esp32h2
+    - <<: *if-label-unit_test_esp32h4
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@@ -632,6 +657,7 @@
    - <<: *if-label-build
    - <<: *if-label-component_ut
    - <<: *if-label-component_ut_esp32
+    - <<: *if-label-lan8720
    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
@@ -874,9 +900,11 @@
    - <<: *if-label-custom_test_esp32c3
    - <<: *if-label-custom_test_esp32c6
    - <<: *if-label-custom_test_esp32h2
+    - <<: *if-label-custom_test_esp32h4
    - <<: *if-label-custom_test_esp32s2
    - <<: *if-label-custom_test_esp32s3
    - <<: *if-label-target_test
+    - <<: *if-label-weekend_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@@ -903,6 +931,7 @@
    - <<: *if-label-custom_test
    - <<: *if-label-custom_test_esp32
    - <<: *if-label-target_test
+    - <<: *if-label-weekend_test
    - <<: *if-dev-push
      changes: *patterns-build_components
    - <<: *if-dev-push
@@ -1024,6 +1053,32 @@
    - <<: *if-dev-push
      changes: *patterns-target_test-wifi

+.rules:build:custom_test-esp32h4:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-custom_test
+    - <<: *if-label-custom_test_esp32h4
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-custom_test
+    - <<: *if-dev-push
+      changes: *patterns-downloadable-tools
+    - <<: *if-dev-push
+      changes: *patterns-target_test-adc
+    - <<: *if-dev-push
+      changes: *patterns-target_test-ecdsa
+    - <<: *if-dev-push
+      changes: *patterns-target_test-i154
+    - <<: *if-dev-push
+      changes: *patterns-target_test-wifi
+
 .rules:build:custom_test-esp32s2:
  rules:
    - <<: *if-revert-branch
@@ -1105,8 +1160,10 @@
    - <<: *if-label-example_test_esp32c3
    - <<: *if-label-example_test_esp32c6
    - <<: *if-label-example_test_esp32h2
+    - <<: *if-label-example_test_esp32h4
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-iperf_stress_test
    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
@@ -1120,14 +1177,10 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
      changes: *patterns-example_test-i154
-    - <<: *if-dev-push
-      changes: *patterns-example_test-otsleepy
    - <<: *if-dev-push
      changes: *patterns-example_test-sdio
    - <<: *if-dev-push
@@ -1152,6 +1205,7 @@
    - <<: *if-label-build
    - <<: *if-label-example_test
    - <<: *if-label-example_test_esp32
+    - <<: *if-label-iperf_stress_test
    - <<: *if-label-target_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
@@ -1165,8 +1219,6 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
@@ -1207,8 +1259,6 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
@@ -1250,8 +1300,6 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
@@ -1292,14 +1340,10 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
      changes: *patterns-example_test-i154
-    - <<: *if-dev-push
-      changes: *patterns-example_test-otsleepy
    - <<: *if-dev-push
      changes: *patterns-example_test-sdio
    - <<: *if-dev-push
@@ -1336,14 +1380,50 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
      changes: *patterns-example_test-i154
    - <<: *if-dev-push
-      changes: *patterns-example_test-otsleepy
+      changes: *patterns-example_test-sdio
+    - <<: *if-dev-push
+      changes: *patterns-example_test-usb
+    - <<: *if-dev-push
+      changes: *patterns-example_test-wifi
+    - <<: *if-dev-push
+      changes: *patterns-target_test-adc
+    - <<: *if-dev-push
+      changes: *patterns-target_test-ecdsa
+    - <<: *if-dev-push
+      changes: *patterns-target_test-i154
+    - <<: *if-dev-push
+      changes: *patterns-target_test-wifi
+
+.rules:build:example_test-esp32h4:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-example_test
+    - <<: *if-label-example_test_esp32h4
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build-example_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-downloadable-tools
+    - <<: *if-dev-push
+      changes: *patterns-example_test
+    - <<: *if-dev-push
+      changes: *patterns-example_test-bt
+    - <<: *if-dev-push
+      changes: *patterns-example_test-ethernet
+    - <<: *if-dev-push
+      changes: *patterns-example_test-i154
    - <<: *if-dev-push
      changes: *patterns-example_test-sdio
    - <<: *if-dev-push
@@ -1380,8 +1460,6 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
@@ -1422,8 +1500,6 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
@@ -1443,6 +1519,27 @@
    - <<: *if-dev-push
      changes: *patterns-target_test-wifi

+.rules:build:integration_test:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-build_components
+    - <<: *if-dev-push
+      changes: *patterns-build_system
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-wifi
+    - <<: *if-dev-push
+      changes: *patterns-target_test-wifi
+
 .rules:build:macos:
  rules:
    - <<: *if-revert-branch
@@ -1469,6 +1566,7 @@
    - <<: *if-label-component_ut_esp32c3
    - <<: *if-label-component_ut_esp32c6
    - <<: *if-label-component_ut_esp32h2
+    - <<: *if-label-component_ut_esp32h4
    - <<: *if-label-component_ut_esp32s2
    - <<: *if-label-component_ut_esp32s3
    - <<: *if-label-custom_test
@@ -1477,6 +1575,7 @@
    - <<: *if-label-custom_test_esp32c3
    - <<: *if-label-custom_test_esp32c6
    - <<: *if-label-custom_test_esp32h2
+    - <<: *if-label-custom_test_esp32h4
    - <<: *if-label-custom_test_esp32s2
    - <<: *if-label-custom_test_esp32s3
    - <<: *if-label-example_test
@@ -1485,8 +1584,14 @@
    - <<: *if-label-example_test_esp32c3
    - <<: *if-label-example_test_esp32c6
    - <<: *if-label-example_test_esp32h2
+    - <<: *if-label-example_test_esp32h4
    - <<: *if-label-example_test_esp32s2
    - <<: *if-label-example_test_esp32s3
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-iperf_stress_test
+    - <<: *if-label-lan8720
    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
@@ -1494,8 +1599,10 @@
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-label-unit_test_esp32c6
    - <<: *if-label-unit_test_esp32h2
+    - <<: *if-label-unit_test_esp32h4
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-label-unit_test_esp32s3
+    - <<: *if-label-weekend_test
    - <<: *if-dev-push
      changes: *patterns-build-example_test
    - <<: *if-dev-push
@@ -1518,20 +1625,20 @@
      changes: *patterns-example_test
    - <<: *if-dev-push
      changes: *patterns-example_test-bt
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
    - <<: *if-dev-push
      changes: *patterns-example_test-ethernet
    - <<: *if-dev-push
      changes: *patterns-example_test-i154
-    - <<: *if-dev-push
-      changes: *patterns-example_test-otsleepy
    - <<: *if-dev-push
      changes: *patterns-example_test-sdio
    - <<: *if-dev-push
      changes: *patterns-example_test-usb
    - <<: *if-dev-push
      changes: *patterns-example_test-wifi
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-wifi
    - <<: *if-dev-push
      changes: *patterns-target_test-adc
    - <<: *if-dev-push
@@ -1553,6 +1660,7 @@
      when: never
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-lan8720
    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
@@ -1560,6 +1668,7 @@
    - <<: *if-label-unit_test_esp32c3
    - <<: *if-label-unit_test_esp32c6
    - <<: *if-label-unit_test_esp32h2
+    - <<: *if-label-unit_test_esp32h4
    - <<: *if-label-unit_test_esp32s2
    - <<: *if-label-unit_test_esp32s3
    - <<: *if-dev-push
@@ -1589,6 +1698,7 @@
      when: never
    - <<: *if-protected
    - <<: *if-label-build
+    - <<: *if-label-lan8720
    - <<: *if-label-target_test
    - <<: *if-label-unit_test
    - <<: *if-label-unit_test_esp32
@@ -1793,6 +1903,13 @@
    - <<: *if-dev-push
      changes: *patterns-unit_test-sdio

+.rules:labels-protected:lan8720:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-lan8720
+
 .rules:labels:nvs_coverage:
  rules:
    - <<: *if-revert-branch
@@ -2309,19 +2426,6 @@
    - <<: *if-dev-push
      changes: *patterns-example_test-bt

-.rules:test:example_test-esp32-ccs811:
-  rules:
-    - <<: *if-revert-branch
-      when: never
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-example_test
-    - <<: *if-label-example_test_esp32
-    - <<: *if-label-target_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test-ccs811
-
 .rules:test:example_test-esp32-ethernet:
  rules:
    - <<: *if-revert-branch
@@ -2647,20 +2751,6 @@
    - <<: *if-dev-push
      changes: *patterns-target_test-i154

-.rules:test:example_test-otsleepy:
-  rules:
-    - <<: *if-revert-branch
-      when: never
-    - <<: *if-protected
-    - <<: *if-label-build-only
-      when: never
-    - <<: *if-label-example_test
-    - <<: *if-label-target_test
-    - <<: *if-dev-push
-      changes: *patterns-example_test-otsleepy
-    - <<: *if-dev-push
-      changes: *patterns-target_test-i154
-
 .rules:test:host_test:
  rules:
    - <<: *if-revert-branch
@@ -2672,6 +2762,52 @@
    - <<: *if-dev-push
      changes: *patterns-host_test

+.rules:test:integration_test:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-ble
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-wifi
+    - <<: *if-dev-push
+      changes: *patterns-target_test-wifi
+
+.rules:test:integration_test_ble:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_ble
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-ble
+
+.rules:test:integration_test_wifi:
+  rules:
+    - <<: *if-revert-branch
+      when: never
+    - <<: *if-protected
+    - <<: *if-label-build-only
+      when: never
+    - <<: *if-label-integration_test
+    - <<: *if-label-integration_test_wifi
+    - <<: *if-label-target_test
+    - <<: *if-dev-push
+      changes: *patterns-integration_test-wifi
+    - <<: *if-dev-push
+      changes: *patterns-target_test-wifi
+
 .rules:test:submodule:
  rules:
    - <<: *if-revert-branch
--- a/.gitlab/ci/static-code-analysis.yml
+++ b/.gitlab/ci/static-code-analysis.yml
@@ -5,16 +5,23 @@ clang_tidy_check:
    - .rules:patterns:clang_tidy
  artifacts:
    paths:
-      - clang_tidy_reports/
+      - $OUTPUT_DIR
    when: always
    expire_in: 1 day
  variables:
+    CLANG_TIDY_DIRS_TXT: ${CI_PROJECT_DIR}/tools/ci/clang_tidy_dirs.txt
+    RULES_FILE: ${CI_PROJECT_DIR}/tools/ci/static-analysis-rules.yml
+    OUTPUT_DIR: ${CI_PROJECT_DIR}/clang_tidy_reports
    IDF_TOOLCHAIN: clang
  script:
-    - run_cmd idf_clang_tidy $(cat tools/ci/clang_tidy_dirs.txt | xargs)
-      --output-path clang_tidy_reports
-      --limit-file tools/ci/static-analysis-rules.yml
+    - internal_pip_install $CLANG_TIDY_RUNNER_PROJ pyclang
+    - export PATH=$PATH:$(python -c "import sys; print(sys.executable.rsplit('/', 1)[0])")
+    - dirs=$(cat ${CLANG_TIDY_DIRS_TXT} | while read line; do echo ${CI_PROJECT_DIR}/${line}; done | xargs)
+    - run_cmd idf_clang ${dirs}
+      --output-path ${OUTPUT_DIR}
+      --limit-file ${RULES_FILE}
      --xtensa-include-dir
+      --run-clang-tidy-py run-clang-tidy

 check_pylint:
  extends:
@@ -36,3 +43,85 @@ check_pylint:
        export files=$(find . -iname "*.py" -print);
      fi
    - pylint --rcfile=.pylintrc $files -r n --output-format=parseable > pylint-report.txt || exit 0
+
+# build stage
+# Sonarqube related jobs put here for this reason:
+# Here we have two jobs. code_quality_check and code_quality_report.
+#
+# code_quality_check will analyze the code changes between your MR and
+# code repo stored in sonarqube server. The analysis result is only shown in
+# the comments under this MR and won't be transferred to the server.
+#
+# code_quality_report will analyze and transfer both of the newly added code
+# and the analysis result to the server.
+#
+# Put in the front to ensure that the newly merged code can be stored in
+# sonarqube server ASAP, in order to avoid reporting unrelated code issues
+.sonar_scan_template:
+  stage: build
+  extends: .pre_check_template
+  image:
+    name: $SONARQUBE_SCANNER_IMAGE
+  before_script:
+    - source tools/ci/utils.sh
+    - export PYTHONPATH="$CI_PROJECT_DIR/tools:$CI_PROJECT_DIR/tools/ci/python_packages:$PYTHONPATH"
+    - fetch_submodules
+    # Exclude the submodules, all paths ends with /**
+    - submodules=$(get_all_submodules)
+    # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
+    - custom_excludes=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
+    # Exclude the report dir as well
+    - export EXCLUSIONS="$custom_excludes,$submodules"
+    - export SONAR_SCANNER_OPTS="-Xmx2048m"
+  variables:
+    GIT_DEPTH: 0
+    REPORT_PATTERN: clang_tidy_reports/*.txt
+  artifacts:
+    when: always
+    paths:
+      - $REPORT_PATTERN
+    expire_in: 1 week
+  dependencies:  # Here is not a hard dependency relationship, could be skipped when only python files changed. so we do not use "needs" here.
+    - clang_tidy_check
+    - check_pylint
+
+code_quality_check:
+  extends:
+    - .sonar_scan_template
+    - .rules:patterns:static-code-analysis-preview
+  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
+                       # we don't want to block ci when critical issues founded
+  script:
+    - export CI_MERGE_REQUEST_COMMITS=$(python ${CI_PROJECT_DIR}/tools/ci/ci_get_mr_info.py commits ${CI_COMMIT_REF_NAME} | tr '\n' ',')
+    # test if this branch have merge request, if not, exit 0
+    - test -n "$CI_MERGE_REQUEST_IID" || exit 0
+    - test -n "$CI_MERGE_REQUEST_COMMITS" || exit 0
+    - sonar-scanner
+      -Dsonar.analysis.mode=preview
+      -Dsonar.branch.name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
+      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
+      -Dsonar.exclusions=$EXCLUSIONS
+      -Dsonar.gitlab.ci_merge_request_iid=$CI_MERGE_REQUEST_IID
+      -Dsonar.gitlab.commit_sha=$CI_MERGE_REQUEST_COMMITS
+      -Dsonar.gitlab.merge_request_discussion=true
+      -Dsonar.gitlab.ref_name=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME
+      -Dsonar.host.url=$SONAR_HOST_URL
+      -Dsonar.login=$SONAR_LOGIN
+      -Dsonar.python.pylint.reportPath=pylint-report.txt
+
+code_quality_report:
+  extends:
+    - .sonar_scan_template
+    - .rules:protected
+  allow_failure: true  # since now it's using exit code to indicate the code analysis result,
+                       # we don't want to block ci when critical issues founded
+  script:
+    - sonar-scanner
+      -Dsonar.branch.name=$CI_COMMIT_REF_NAME
+      -Dsonar.cxx.clangtidy.reportPath=$REPORT_PATTERN
+      -Dsonar.exclusions=$EXCLUSIONS
+      -Dsonar.gitlab.commit_sha=$PIPELINE_COMMIT_SHA
+      -Dsonar.gitlab.ref_name=$CI_COMMIT_REF_NAME
+      -Dsonar.host.url=$SONAR_HOST_URL
+      -Dsonar.login=$SONAR_LOGIN
+      -Dsonar.python.pylint.reportPath=pylint-report.txt
--- a/.gitlab/ci/target-test.yml
+++ b/.gitlab/ci/target-test.yml
@@ -19,12 +19,12 @@
    when: always
    paths:
      - XUNIT_RESULT.xml
-      - pytest-embedded/
+      - pytest_embedded_log/
    reports:
      junit: XUNIT_RESULT.xml
    expire_in: 1 week
  script:
-    - python tools/ci/get_known_failure_cases_file.py
+    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    # get runner env config file
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
@@ -35,7 +35,7 @@
    - run_cmd pytest $TEST_DIR
      -m \"${markers}\"
      --junitxml=XUNIT_RESULT.xml
-      --known-failure-cases-file ${KNOWN_FAILURE_CASES_FILE_NAME}
+      --known-failure-cases-file known_failure_cases/known_failure_cases.txt
      --parallel-count ${CI_NODE_TOTAL:-1}
      --parallel-index ${CI_NODE_INDEX:-1}
      ${PYTEST_EXTRA_FLAGS}
@@ -97,22 +97,6 @@ pytest_examples_esp32_jtag:
    SETUP_TOOLS: "1"  # need gdb openocd
    PYTEST_EXTRA_FLAGS: "--log-cli-level DEBUG"

-pytest_examples_esp32_ccs811:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32-ccs811
-  needs:
-    - build_pytest_examples_esp32
-  tags: [ esp32, ccs811 ]
-
-pytest_examples_esp32_sdio:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32-sdio
-  needs:
-    - build_pytest_examples_esp32
-  tags: [ esp32, sdio_master_slave ]
-
 pytest_examples_esp32s2_generic:
  extends:
    - .pytest_examples_dir_template
@@ -217,14 +201,6 @@ pytest_examples_esp32c6_generic:
    - build_pytest_examples_esp32c6
  tags: [ esp32c6, generic ]

-pytest_examples_esp32c6_usj_device:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c6
-  needs:
-    - job: build_pytest_examples_esp32c6
-  tags: [ esp32c6, usj_device ]
-
 pytest_examples_esp32h2_generic:
  extends:
    - .pytest_examples_dir_template
@@ -273,14 +249,6 @@ pytest_examples_esp32_ethernet:
    - build_pytest_examples_esp32
  tags: [ esp32, ethernet]

-pytest_examples_esp32_ethernet_httpbin:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32-ethernet
-  needs:
-    - build_pytest_examples_esp32
-  tags: [ esp32, httpbin]
-
 pytest_examples_esp32_8mb_flash:
  extends:
    - .pytest_examples_dir_template
@@ -297,23 +265,6 @@ pytest_examples_esp32_wifi_ap:
    - build_pytest_examples_esp32
  tags: [ esp32, wifi_ap ]

-pytest_examples_esp32c2_wifi_ap:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c2-wifi
-  needs:
-    - build_pytest_examples_esp32c2
-  tags: [ esp32c2, wifi_ap,  xtal_26mhz]
-
-
-pytest_examples_esp32c2eco4_wifi_ap:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c2-wifi
-  needs:
-    - build_pytest_examples_esp32c2
-  tags: [ wifi_ap_eco,  xtal_26mhz, esp32c2]
-
 pytest_examples_esp32c3_wifi_ap:
  extends:
    - .pytest_examples_dir_template
@@ -322,15 +273,6 @@ pytest_examples_esp32c3_wifi_ap:
    - build_pytest_examples_esp32c3
  tags: [ esp32c3, wifi_ap ]

-
-pytest_examples_esp32c3eco7_wifi_ap:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c3-wifi
-  needs:
-    - build_pytest_examples_esp32c3
-  tags: [ wifi_ap_eco , esp32c3]
-
 pytest_examples_esp32s3_wifi_ap:
  extends:
    - .pytest_examples_dir_template
@@ -392,7 +334,7 @@ pytest_examples_esp32_ethernet_ip101:
    - .rules:test:example_test-esp32
  needs:
    - build_pytest_examples_esp32
-  tags: [ esp32, eth_ip101 ]
+  tags: [ esp32, ip101 ]

 pytest_examples_esp32_flash_encryption:
  extends:
@@ -434,22 +376,6 @@ pytest_examples_esp32c2_wifi_two_dut:
    - build_pytest_examples_esp32c2
  tags: [ esp32c2, wifi_two_dut, xtal_26mhz ]

-pytest_examples_esp32c2eco4_wifi_two_dut:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c2-wifi
-  needs:
-    - build_pytest_examples_esp32c2
-  tags: [wifi_two_dut_eco, xtal_26mhz, esp32c2]
-
-pytest_examples_esp32c3eco7_wifi_two_dut:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32c3-wifi
-  needs:
-    - build_pytest_examples_esp32c3
-  tags: [ wifi_two_dut_eco , esp32c3]
-
 pytest_examples_esp32c3_flash_encryption:
  extends:
    - .pytest_examples_dir_template
@@ -562,14 +488,6 @@ pytest_examples_esp32h2_adc:
    - build_pytest_examples_esp32h2
  tags: [ esp32h2, adc ]

-example_test_pytest_esp32s3_emmc:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-esp32s3
-  needs:
-    - build_pytest_examples_esp32s3
-  tags: [ esp32s3, emmc ]
-
 .pytest_components_dir_template:
  extends: .pytest_template
  variables:
@@ -622,63 +540,15 @@ pytest_components_esp32_ip101:
    - .rules:test:component_ut-esp32
  needs:
    - build_pytest_components_esp32
-  tags: [ esp32, eth_ip101 ]
+  tags: [ esp32, ip101 ]

 pytest_components_esp32_lan8720:
  extends:
    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
+    - .rules:labels-protected:lan8720  # FIXME: IDFCI-1176
  needs:
    - build_pytest_components_esp32
-  tags: [ esp32, eth_lan8720 ]
-
-pytest_components_esp32_rtl8201:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_rtl8201 ]
-
-pytest_components_esp32_w5500:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_w5500 ]
-
-pytest_components_esp32_ksz8851snl:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_ksz8851snl ]
-
-pytest_components_esp32_dm9051:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_dm9051 ]
-
-pytest_components_esp32_ksz8041:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_ksz8041 ]
-
-pytest_components_esp32_dp83848:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32
-  needs:
-    - build_pytest_components_esp32
-  tags: [ esp32, eth_dp83848 ]
+  tags: [ esp32, lan8720 ]

 pytest_components_esp32_ethernet:
  extends:
@@ -924,22 +794,6 @@ pytest_components_esp32c2_wifi_two_dut:
    - build_pytest_components_esp32c2
  tags: [ esp32c2, wifi_two_dut, xtal_26mhz ]

-pytest_components_esp32c3eco7_wifi_two_dut:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32c3-wifi
-  needs:
-    - build_pytest_components_esp32c3
-  tags: [ wifi_two_dut_eco , esp32c3]
-
-pytest_components_esp32c2eco4_wifi_two_dut:
-  extends:
-    - .pytest_components_dir_template
-    - .rules:test:component_ut-esp32c2-wifi
-  needs:
-    - build_pytest_components_esp32c2
-  tags: [ wifi_two_dut_eco, xtal_26mhz, esp32c2]
-
 pytest_components_esp32c3_adc:
  extends:
    - .pytest_components_dir_template
@@ -1074,17 +928,6 @@ pytest_examples_openthread_br:
    - esp32c6
    - openthread_br

-pytest_examples_openthread_sleep:
-  extends:
-    - .pytest_examples_dir_template
-    - .rules:test:example_test-otsleepy
-  needs:
-    - build_pytest_examples_esp32c6
-    - build_pytest_examples_esp32h2
-  tags:
-    - esp32c6
-    - openthread_sleep
-
 pytest_components_esp32s3_usb_host:
  extends:
    - .pytest_components_dir_template
@@ -1145,22 +988,6 @@ pytest_test_apps_esp32c2_generic:
    - build_pytest_test_apps_esp32c2
  tags: [ esp32c2, generic, xtal_40mhz ]

-pytest_test_apps_esp32c2xtal26mhz_generic:
-  extends:
-    - .pytest_test_apps_dir_template
-    - .rules:test:custom_test-esp32c2
-  needs:
-    - build_pytest_test_apps_esp32c2
-  tags: [ esp32c2, generic, xtal_26mhz ]
-
-pytest_test_apps_esp32c2eco4_xtal26mhz_generic:
-  extends:
-    - .pytest_test_apps_dir_template
-    - .rules:test:custom_test-esp32c2
-  needs:
-    - build_pytest_test_apps_esp32c2
-  tags: [ esp32c2, generic_eco, xtal_26mhz ]
-
 pytest_test_apps_esp32c3_generic:
  extends:
    - .pytest_test_apps_dir_template
@@ -1169,14 +996,6 @@ pytest_test_apps_esp32c3_generic:
    - build_pytest_test_apps_esp32c3
  tags: [ esp32c3, generic ]

-pytest_test_apps_esp32c3eco7_generic:
-  extends:
-    - .pytest_test_apps_dir_template
-    - .rules:test:custom_test-esp32c3
-  needs:
-    - build_pytest_test_apps_esp32c3
-  tags: [ esp32c3, generic_eco ]
-
 pytest_test_apps_esp32c6_generic:
  extends:
    - .pytest_test_apps_dir_template
@@ -1250,10 +1069,10 @@ pytest_test_apps_esp32s3_mspi_f4r4:
    - retry_failed git clone $TEST_ENV_CONFIG_REPO
    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
    # git clone the known failure cases repo, run test
-    - python tools/ci/get_known_failure_cases_file.py
+    - retry_failed git clone $KNOWN_FAILURE_CASES_REPO known_failure_cases
    # run test
    - cd tools/ci/python_packages/tiny_test_fw/bin
-    - run_cmd python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/${KNOWN_FAILURE_CASES_FILE_NAME}
+    - run_cmd python Runner.py $TEST_CASE_PATH -c $CONFIG_FILE -e $ENV_FILE --known_failure_cases_file $CI_PROJECT_DIR/known_failure_cases/known_failure_cases.txt

 .example_test_template:
  extends: .target_test_job_template
@@ -1279,6 +1098,12 @@ example_test_001C:
    - ESP32
    - Example_GENERIC

+.example_test_003:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - Example_SDIO
+
 example_test_005:
  extends:
    - .example_test_esp32_template
@@ -1287,6 +1112,12 @@ example_test_005:
    - ESP32
    - Example_WIFI_BT

+example_test_007:
+  extends: .example_test_esp32_template
+  tags:
+    - ESP32
+    - Example_I2C_CCS811_SENSOR
+
 example_test_C3_GENERIC:
  extends: .example_test_esp32c3_template
  tags:
@@ -1380,12 +1211,19 @@ UT_006:
    - UT_T1_SPIMODE
    - psram

-.UT_017:
+UT_017:
  extends: .unit_test_esp32_template
  tags:
    - ESP32_IDF
    - EMMC

+UT_022:
+  extends: .unit_test_esp32_template
+  tags:
+    - ESP32_IDF
+    - UT_T2_I2C
+    - psram
+
 UT_028:
  extends: .unit_test_esp32_template
  tags:
@@ -1458,6 +1296,12 @@ UT_C3_FLASH:
    - ESP32C3_IDF
    - UT_T1_ESP_FLASH

+UT_C3_I2C:
+  extends: .unit_test_esp32c3_template
+  tags:
+    - ESP32C3_IDF
+    - UT_T2_I2C
+
 UT_C3_SDSPI:
  extends:
    - .unit_test_esp32c3_template
@@ -1501,3 +1345,301 @@ UT_S3_QUAD_PSRAM:
    - ESP32S3_IDF
    - UT_T1_1
    - quad_psram
+
+.integration_test_template:
+  extends:
+    - .target_test_job_template
+    - .rules:test:integration_test
+    - .before_script_minimal
+  image: ${CI_INTEGRATION_TEST_ENV_IMAGE}
+  cache: []
+  needs: # the assign already needs all the build jobs
+    - assign_integration_test
+  variables:
+    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32_IDF"
+    LOG_PATH: "${CI_PROJECT_DIR}/TEST_LOGS"
+    TEST_CASE_FILE_PATH: "$CI_PROJECT_DIR/auto_test_script/TestCaseFiles"
+    CONFIG_FILE_PATH: "${CI_PROJECT_DIR}/tools/ci/integration_test/test_configs"
+    KNOWN_ISSUE_FILE: "${CI_PROJECT_DIR}/tools/ci/integration_test/KnownIssues"
+    CI_RUNNER_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/bin/CIRunner.py"
+    PREPARE_TEST_BIN_SCRIPT: "${CI_PROJECT_DIR}/auto_test_script/tools/ci/idf_prepare_test_bins.py"
+    PYTHONPATH: "${CI_PROJECT_DIR}/auto_test_script/packages:${CI_PROJECT_DIR}/tools/ci/python_packages:${PYTHONPATH}"
+    INITIAL_CONDITION_RETRY_COUNT: "1"
+    GIT_LFS_SKIP_SMUDGE: 1
+  script:
+    - *define_config_file_name
+    # first test if config file exists, if not exist, exit 0
+    - test -e $CONFIG_FILE || exit 0
+    # clone local test env configs
+    - add_gitlab_ssh_keys
+    - retry_failed git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
+    # clone test bench
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # Merge known issues
+    - cat ${KNOWN_ISSUE_FILE} >> ${TEST_CASE_FILE_PATH}/KnownIssues
+    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+
+.integration_test_esp32c3_template:
+  extends:
+    - .integration_test_template
+  variables:
+    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32C3_IDF"
+
+.integration_test_esp32c2_template:
+  extends:
+    - .integration_test_template
+  variables:
+    LOCAL_ENV_CONFIG_PATH: "$CI_PROJECT_DIR/ci-test-runner-configs/$CI_RUNNER_DESCRIPTION/ESP32C2_IDF"
+
+nvs_compatible_test:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test
+  artifacts:
+    when: always
+    paths:
+      - $LOG_PATH
+      - nvs_wifi.bin
+    expire_in: 1 mos
+  tags:
+    - ESP32_IDF
+    - NVS_Compatible
+  script:
+    - *define_config_file_name
+    # first test if config file exists, if not exist, exit 0
+    - test -e $CONFIG_FILE || exit 0
+    # clone local test env configs
+    - add_gitlab_ssh_keys
+    - retry_failed git clone $TEST_ENV_CONFIG_REPO
+    - python $CHECKOUT_REF_SCRIPT ci-test-runner-configs ci-test-runner-configs
+    # clone test bench
+    - retry_failed git clone ${CI_AUTO_TEST_SCRIPT_REPO_URL} auto_test_script
+    - python $CHECKOUT_REF_SCRIPT auto_test_script auto_test_script
+    - cd auto_test_script
+    - ./tools/ci/setup_idfci.sh
+    # prepare nvs bins
+    - ./tools/prepare_nvs_bin.sh
+    # run test
+    - python ${PREPARE_TEST_BIN_SCRIPT} $CONFIG_FILE
+    - python ${CI_RUNNER_SCRIPT} -l "$LOG_PATH/$JOB_FULL_NAME" -c $CONFIG_FILE -e $LOCAL_ENV_CONFIG_PATH -t $TEST_CASE_FILE_PATH
+
+IT_T1_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 2
+  tags:
+    - ESP32_IDF
+    - SSC_T1_Simple
+
+IT_T1_WAP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_WAP
+
+IT_T2_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 9
+  tags:
+    - ESP32_IDF
+    - SSC_T2_Simple
+
+IT_T5_BT_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
+  parallel: 3
+  tags:
+    - ESP32_IDF
+    - SSC_T5_BT_Simple
+
+IT_T2_BT_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
+  parallel: 6
+  tags:
+    - ESP32_IDF
+    - SSC_T2_BT_Simple
+
+IT_T1_BT_Dongle:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_ble
+  parallel: 2
+  tags:
+    - ESP32_IDF
+    - SSC_T1_BT_Dongle
+
+IT_T1_AP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_AP
+
+IT_T1_AP_E:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 5
+  tags:
+    - ESP32_IDF
+    - SSC_T1_AP_E
+
+IT_T1_WNIC_AP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_WNIC_AP
+
+IT_T1_WNIC_AP_E:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_WNIC_AP_E
+
+IT_T1_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_MESH1
+
+IT_T2_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  parallel: 2
+  tags:
+    - ESP32_IDF
+    - SSC_T2_MESH1
+
+IT_T3_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T3_MESH1
+
+IT_T6_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T6_MESH1
+
+IT_T12_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T12_MESH1
+
+IT_T50_MESH1:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  allow_failure: true
+  tags:
+    - ESP32_IDF
+    - SSC_T50_MESH1
+
+IT_T1_MESH2:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T1_MESH2
+
+IT_T2_WNIC:
+  extends:
+   - .integration_test_template
+   - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T2_WNIC
+
+IT_T2_AP:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T2_AP
+
+IT_T3_Simple:
+  extends:
+    - .integration_test_template
+    - .rules:test:integration_test_wifi
+  tags:
+    - ESP32_IDF
+    - SSC_T3_Simple
+
+IT_C3_T2_BT_Simple:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  parallel: 11
+  tags:
+    - ESP32C3_IDF
+    - SSC_T2_BT_Simple
+
+IT_C3_T5_BT_Simple:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  parallel: 5
+  tags:
+    - ESP32C3_IDF
+    - SSC_T5_BT_Simple
+
+IT_C3_T1_BT_Dongle:
+  extends:
+    - .integration_test_esp32c3_template
+    - .rules:test:integration_test_ble
+  image: gitlab.espressif.cn:5050/qa/dockerfiles/integration-test-env-dbg:1
+  parallel: 2
+  tags:
+    - ESP32C3_IDF
+    - SSC_T1_BT_Dongle
+
+IT_C2_T2_BT_Simple:
+  extends:
+    - .integration_test_esp32c2_template
+    - .rules:test:integration_test_ble
+  parallel: 9
+  tags:
+    - ESP32C2_IDF
+    - SSC_T2_BT_Simple
+
+IT_C2_T1_BT_Dongle:
+  extends:
+    - .integration_test_esp32c2_template
+    - .rules:test:integration_test_ble
+  image: gitlab.espressif.cn:5050/qa/dockerfiles/integration-test-env-dbg:1
+  parallel: 2
+  tags:
+    - ESP32C2_IDF
+    - SSC_T1_BT_Dongle
--- a/.gitmodules
+++ b/.gitmodules
@@ -2,26 +2,6 @@
 # All the relative URL paths are intended to be GitHub ones
 # For Espressif's public projects please use '../../espressif/proj', not a '../proj'
 #
-# Submodules SBOM information
-# ---------------------------
-# Submodules, which are used directly and not forked into espressif namespace should
-# contain SBOM information here. Other submodules should have the SBOM manifest file
-# included in the root of their project's repository.
-#
-# The sbom-hash entry records the submodule's checkout SHA as presented in git-tree
-# commit object. For example spiffs submodule
-#
-# $ git ls-tree HEAD components/spiffs/spiffs
-# 160000 commit 0dbb3f71c5f6fae3747a9d935372773762baf852	components/spiffs/spiffs
-#
-# The hash can be also obtained with git submodule command
-#
-# $ git submodule status components/spiffs/spiffs
-# 0dbb3f71c5f6fae3747a9d935372773762baf852 components/spiffs/spiffs (0.2-255-g0dbb3f71c5f6)
-#
-# The submodule SHA recorded here has to match with SHA, which is presented in git-tree.
-# This is checked by CI. Also please don't forget to update the submodule version
-# if you are changing the sbom-hash. This is important for SBOM generation.

 [submodule "components/bt/controller/lib_esp32"]
 	path = components/bt/controller/lib_esp32
@@ -30,34 +10,14 @@
 [submodule "components/bootloader/subproject/components/micro-ecc/micro-ecc"]
 	path = components/bootloader/subproject/components/micro-ecc/micro-ecc
 	url = ../../kmackay/micro-ecc.git
-	sbom-version = 1.1
-	sbom-cpe = cpe:2.3:a:micro-ecc_project:micro-ecc:{}:*:*:*:*:*:*:*
-	sbom-supplier = Person: Ken MacKay
-	sbom-url = https://github.com/kmackay/micro-ecc
-	sbom-description = A small and fast ECDH and ECDSA implementation for 8-bit, 32-bit, and 64-bit processors
-	sbom-hash = 24c60e243580c7868f4334a1ba3123481fe1aa48

 [submodule "components/spiffs/spiffs"]
 	path = components/spiffs/spiffs
 	url = ../../pellepl/spiffs.git
-	sbom-version = 0.2-255-g0dbb3f71c5f6
-	sbom-supplier = Person: Peter Andersson
-	sbom-url = https://github.com/pellepl/spiffs
-	sbom-description = Wear-leveled SPI flash file system for embedded devices
-	sbom-hash = 0dbb3f71c5f6fae3747a9d935372773762baf852

 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
-	sbom-version = 1.7.18
-	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
-	sbom-supplier = Person: Dave Gamble
-	sbom-url = https://github.com/DaveGamble/cJSON
-	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = 8f2beb57ddad1f94bed899790b00f46df893ccac
-	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
-	sbom-cve-exclude-list = CVE-2023-26819 Resolved in commit a328d65ad490b64da8c87523cbbfe16050ba5bf6
-	sbom-cve-exclude-list = CVE-2023-53154 Resolved in v1.7.18

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
@@ -74,21 +34,10 @@
 [submodule "components/protobuf-c/protobuf-c"]
 	path = components/protobuf-c/protobuf-c
 	url = ../../protobuf-c/protobuf-c.git
-	sbom-version = 1.4.1
-	sbom-cpe = cpe:2.3:a:protobuf-c_project:protobuf-c:{}:*:*:*:*:*:*:*
-	sbom-supplier = Organization: protobuf-c community <https://groups.google.com/g/protobuf-c>
-	sbom-url = https://github.com/protobuf-c/protobuf-c
-	sbom-description = Protocol Buffers implementation in C
-	sbom-hash = abc67a11c6db271bedbb9f58be85d6f4e2ea8389

 [submodule "components/unity/unity"]
 	path = components/unity/unity
 	url = ../../ThrowTheSwitch/Unity.git
-	sbom-version = v2.4.3-51-g7d2bf62b7e6a
-	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
-	sbom-url = https://github.com/ThrowTheSwitch/Unity
-	sbom-description = Simple Unit Testing for C
-	sbom-hash = 7d2bf62b7e6afaf38153041a9d53c21aeeca9a25

 [submodule "components/bt/host/nimble/nimble"]
 	path = components/bt/host/nimble/nimble
@@ -101,11 +50,6 @@
 [submodule "components/cmock/CMock"]
 	path = components/cmock/CMock
 	url = ../../ThrowTheSwitch/CMock.git
-	sbom-version = v2.5.2-2-geeecc49ce8af
-	sbom-supplier = Organization: ThrowTheSwitch community <http://www.throwtheswitch.org>
-	sbom-url = https://github.com/ThrowTheSwitch/CMock
-	sbom-description = CMock - Mock/stub generator for C
-	sbom-hash = eeecc49ce8af123cf8ad40efdb9673e37b56230f

 [submodule "components/openthread/openthread"]
 	path = components/openthread/openthread
@@ -123,6 +67,10 @@
 	path = components/openthread/lib
 	url = ../../espressif/esp-thread-lib.git

+[submodule "components/ieee802154/lib"]
+	path = components/ieee802154/lib
+	url = ../../espressif/esp-ieee802154-lib.git
+
 [submodule "components/bt/controller/lib_esp32h2/esp32h2-bt-lib"]
 	path = components/bt/controller/lib_esp32h2/esp32h2-bt-lib
 	url = ../../espressif/esp32h2-bt-lib.git
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,9 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks

-default_stages: [commit]
-
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v4.0.1
    hooks:
      - id: trailing-whitespace
        # note: whitespace exclusions use multiline regex, see https://pre-commit.com/#regular-expressions
@@ -35,12 +33,11 @@ repos:
    hooks:
      - id: flake8
        args: ['--config=.flake8', '--tee', '--benchmark']
-  - repo: https://github.com/asottile/reorder-python-imports
-    rev: v3.12.0
+  - repo: https://github.com/pycqa/isort
+    rev: 5.11.5  # python 3.7 compatible
    hooks:
-      - id: reorder-python-imports
-        name: Reorder Python imports
-        args: [--py37-plus]
+      - id: isort
+        name: isort (python)
        exclude: >
          (?x)^(
              .*_pb2.py
@@ -104,10 +101,10 @@ repos:
        name: Check type annotations in python files
        entry: tools/ci/check_type_comments.py
        additional_dependencies:
-          - 'mypy'
-          - 'mypy-extensions'
-          - 'types-setuptools'
-          - 'types-PyYAML'
+          - 'mypy==0.940'
+          - 'mypy-extensions==0.4.3'
+          - 'types-setuptools==57.4.14'
+          - 'types-PyYAML==0.1.9'
        exclude: >
          (?x)^(
              .*_pb2.py
@@ -142,11 +139,10 @@ repos:
        name: Check if all apps readme files match given .build-test-rules.yml files. Modify the supported target tables
        entry: tools/ci/check_build_test_rules.py check-readmes
        language: python
-        files: 'tools/test_apps/.+|examples/.+|components/.+|tools/idf_py_actions/constants.py|tools/ci/check_build_test_rules.py'
-        require_serial: true
+        files: 'tools/test_apps/.+|examples/.+|components/.+'
        additional_dependencies:
          - PyYAML == 5.3.1
-          - idf_build_apps~=1.0
+          - idf_build_apps
      - id: sort-build-test-rules-ymls
        name: sort .build-test-rules.yml files
        entry: tools/ci/check_build_test_rules.py sort-yaml
@@ -161,12 +157,7 @@ repos:
      - id: file-contents-sorter
        files: 'tools\/ci\/(executable-list\.txt|mypy_ignore_list\.txt|check_copyright_ignore\.txt)'
  - repo: https://github.com/espressif/check-copyright/
-    rev: v1.0.3
+    rev: v1.0.1
    hooks:
      - id: check-copyright
        args: ['--ignore', 'tools/ci/check_copyright_ignore.txt', '--config', 'tools/ci/check_copyright_config.yaml']
-  - repo: https://github.com/espressif/esp-idf-sbom.git
-    rev: v0.13.0
-    hooks:
-      - id: validate-sbom-manifest
-        stages: [post-commit]
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -198,35 +198,8 @@ endif()
 list(APPEND link_options "-fno-lto")

 if(CONFIG_IDF_TARGET_LINUX AND CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin")
-    # Not all versions of the MacOS linker support the -warn_commons flag.
-    # ld version 1053.12 (and above) have been tested to support it.
-    # Hence, we extract the version string from the linker output
-    # before including the flag.
-
-    # Get the ld version, capturing both stdout and stderr
-    execute_process(
-        COMMAND ${CMAKE_LINKER} -v
-        OUTPUT_VARIABLE LD_VERSION_OUTPUT
-        ERROR_VARIABLE LD_VERSION_ERROR
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-        ERROR_STRIP_TRAILING_WHITESPACE
-    )
-
-    # Combine stdout and stderr
-    set(LD_VERSION_OUTPUT "${LD_VERSION_OUTPUT}\n${LD_VERSION_ERROR}")
-
-    # Extract the version string
-    string(REGEX MATCH "PROJECT:(ld|dyld)-([0-9]+)\\.([0-9]+)" LD_VERSION_MATCH "${LD_VERSION_OUTPUT}")
-    set(LD_VERSION_MAJOR_MINOR "${CMAKE_MATCH_2}.${CMAKE_MATCH_3}")
-
-    message(STATUS "Linker Version: ${LD_VERSION_MAJOR_MINOR}")
-
-    # Compare the version with 1053.12
-    if(LD_VERSION_MAJOR_MINOR VERSION_GREATER_EQUAL "1053.12")
-        list(APPEND link_options "-Wl,-warn_commons")
-    endif()
-
    list(APPEND link_options "-Wl,-dead_strip")
+    list(APPEND link_options "-Wl,-warn_commons")
 else()
    list(APPEND link_options "-Wl,--gc-sections")
    list(APPEND link_options "-Wl,--warn-common")
--- a/24
+++ b/24
@@ -66,6 +66,28 @@ mainmenu "Espressif IoT Development Framework Configuration"
        select FREERTOS_UNICORE
        select IDF_TARGET_ARCH_RISCV

+    config IDF_TARGET_ESP32H4
+        bool
+        default "y" if IDF_TARGET="esp32h4"
+        select FREERTOS_UNICORE
+        select IDF_TARGET_ARCH_RISCV
+
+    choice IDF_TARGET_ESP32H4_BETA_VERSION
+        prompt "ESP32-H4 beta version"
+        depends on IDF_TARGET_ESP32H4
+        default IDF_TARGET_ESP32H4_BETA_VERSION_2
+        help
+            Currently ESP32-H4 has several beta versions for internal use only.
+            Select the one that matches your chip model.
+
+        config IDF_TARGET_ESP32H4_BETA_VERSION_1
+            bool
+            prompt "ESP32-H4 beta1"
+        config IDF_TARGET_ESP32H4_BETA_VERSION_2
+            bool
+            prompt "ESP32-H4 beta2"
+    endchoice
+
    config IDF_TARGET_ESP32C2
        bool
        default "y" if IDF_TARGET="esp32c2"
@@ -94,8 +116,10 @@ mainmenu "Espressif IoT Development Framework Configuration"
        default 0x0002 if IDF_TARGET_ESP32S2
        default 0x0005 if IDF_TARGET_ESP32C3
        default 0x0009 if IDF_TARGET_ESP32S3
+        default 0x000A if IDF_TARGET_ESP32H4_BETA_VERSION_1
        default 0x000C if IDF_TARGET_ESP32C2
        default 0x000D if IDF_TARGET_ESP32C6
+        default 0x000E if IDF_TARGET_ESP32H4_BETA_VERSION_2 # ESP32-TODO: IDF-3475
        default 0x0010 if IDF_TARGET_ESP32H2
        default 0xFFFF

--- a/components/app_trace/Kconfig
+++ b/components/app_trace/Kconfig
@@ -389,11 +389,4 @@ menu "Application Level Tracing"
        help
            Enables support for GCOV data transfer to host.

-    config APPTRACE_GCOV_DUMP_TASK_STACK_SIZE
-        int "Gcov dump task stack size"
-        depends on APPTRACE_GCOV_ENABLE
-        default 2048
-        help
-            Configures stack size of Gcov dump task
-
 endmenu
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -148,18 +148,6 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
        if (res != ESP_OK) {
            break;
        }
-#if CONFIG_IDF_TARGET_ESP32S3
-        /*
-        * ESP32S3 has a serious data corruption issue with the transferred data to host.
-        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
-        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
-        * the current thread continues execution. While this doesn't completely prevent
-        * memory access from other threads/cores/ISRs, it has shown to significantly improve
-        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
-        * number of retries needed to read an entire block without corruption.
-        */
-        esp_rom_delay_us(100);
-#endif
    }
    return res;
 }
@@ -351,7 +339,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
    esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
    // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
    // higher prio tasks and the latter can not allocate buffers at all
    // this is abnormal situation can be detected on host which will receive only uncompleted buffers
--- a/components/app_trace/gcov/gcov_rtio.c
+++ b/components/app_trace/gcov/gcov_rtio.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -15,8 +15,7 @@
 #include "esp_app_trace.h"
 #include "esp_freertos_hooks.h"
 #include "esp_private/dbg_stubs.h"
-#include "esp_private/esp_ipc.h"
-#include "esp_attr.h"
+#include "esp_ipc.h"
 #include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
@@ -77,15 +76,14 @@ gcov_exit:
 void gcov_create_task(void *arg)
 {
    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
-    xTaskCreatePinnedToCore(&gcov_dump_task, "gcov_dump_task", CONFIG_APPTRACE_GCOV_DUMP_TASK_STACK_SIZE,
-		(void *)&s_gcov_task_running, configMAX_PRIORITIES - 1, NULL, 0);
+    xTaskCreatePinnedToCore(&gcov_dump_task, "gcov_dump_task", 2048, (void *)&s_gcov_task_running, configMAX_PRIORITIES - 1, NULL, 0);
 }

-static IRAM_ATTR
 void gcov_create_task_tick_hook(void)
 {
+    extern esp_err_t esp_ipc_start_gcov_from_isr(uint32_t cpu_id, esp_ipc_func_t func, void* arg);
    if (s_create_gcov_task) {
-        if (esp_ipc_call_nonblocking(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
+        if (esp_ipc_start_gcov_from_isr(xPortGetCoreID(), &gcov_create_task, NULL) == ESP_OK) {
            s_create_gcov_task = false;
        }
    }
@@ -107,16 +105,12 @@ static int esp_dbg_stub_gcov_entry(void)

 void gcov_rtio_init(void)
 {
-    uint32_t stub_entry = 0;
+    uint32_t capabilities = 0;
    ESP_EARLY_LOGV(TAG, "%s", __FUNCTION__);
-    assert(esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_GCOV, &stub_entry) == ESP_OK);
-    if (stub_entry != 0) {
-        /* "__gcov_init()" can be called several times. We must avoid multiple tick hook registration */
-        return;
-    }
    esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_GCOV, (uint32_t)&esp_dbg_stub_gcov_entry);
-    assert(esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &stub_entry) == ESP_OK);
-    esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, stub_entry | ESP_DBG_STUB_CAP_GCOV_TASK);
+    if (esp_dbg_stub_entry_get(ESP_DBG_STUB_ENTRY_CAPABILITIES, &capabilities) == ESP_OK) {
+        esp_dbg_stub_entry_set(ESP_DBG_STUB_ENTRY_CAPABILITIES, capabilities | ESP_DBG_STUB_CAP_GCOV_TASK);
+    }
    esp_register_freertos_tick_hook(gcov_create_task_tick_hook);
 }

--- a/components/app_trace/heap_trace_tohost.c
+++ b/components/app_trace/heap_trace_tohost.c
@@ -8,7 +8,7 @@
 #define HEAP_TRACE_SRCFILE /* don't warn on inclusion here */
 #include "esp_heap_trace.h"
 #undef HEAP_TRACE_SRCFILE
-#include "esp_heap_caps.h"
+
 #if CONFIG_APPTRACE_SV_ENABLE
 #include "esp_app_trace.h"
 #include "esp_sysview_trace.h"
@@ -85,7 +85,7 @@ void heap_trace_dump_caps(__attribute__((unused)) const uint32_t caps)
 }

 /* Add a new allocation to the heap trace records */
-static HEAP_IRAM_ATTR void record_allocation(const heap_trace_record_t *record)
+static IRAM_ATTR void record_allocation(const heap_trace_record_t *record)
 {
    if (!s_tracing) {
        return;
@@ -100,7 +100,7 @@ static HEAP_IRAM_ATTR void record_allocation(const heap_trace_record_t *record)
   For HEAP_TRACE_ALL, this means filling in the freed_by pointer.
   For HEAP_TRACE_LEAKS, this means removing the record from the log.
 */
-static HEAP_IRAM_ATTR void record_free(void *p, void **callers)
+static IRAM_ATTR void record_free(void *p, void **callers)
 {
    if (!s_tracing) {
        return;
--- a/components/app_trace/host_file_io.c
+++ b/components/app_trace/host_file_io.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -228,11 +228,8 @@ size_t esp_apptrace_fwrite(esp_apptrace_dest_t dest, const void *ptr, size_t siz
        ESP_EARLY_LOGE(TAG, "Failed to read response (%d)!", ret);
        return 0;
    }
-    /* OpenOCD writes it like that:
-     *      fwrite(buf, size, 1, file);
-     * So, if 1 was returned that means fwrite succeed
-     */
-    return resp == 1 ? nmemb : 0;
+
+    return resp/size; // return the number of items written
 }

 static void esp_apptrace_fread_args_prepare(uint8_t *buf, void *priv)
@@ -278,10 +275,6 @@ size_t esp_apptrace_fread(esp_apptrace_dest_t dest, void *ptr, size_t size, size
        ESP_EARLY_LOGE(TAG, "Failed to read file data (%d)!", ret);
        return 0;
    }
-    /* OpenOCD reads it like that:
-     *      fread(buf, 1 ,size, file);
-     * So, total read bytes count returns
-     */
    return resp/size; // return the number of items read
 }

--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -12,7 +12,7 @@
 // ======================

 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================

-// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,15 +55,9 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//    See 'Targets Connection' section for details.
-//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
-//    The register has the following format:
-//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
-//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
-//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
-//    This allows the host to verify data integrity of the received trace data.
+// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//   See 'Targets Connection' setion for details.

 // 3. Modes of operation
 // =====================
@@ -133,7 +127,7 @@

 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -148,9 +142,9 @@

 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When waiting on trace data lock.
+// - Trace data are locked by another task/ISR. When wating on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -165,15 +159,11 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
-#include "esp_rom_crc.h"

 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
-#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
-
-#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)

 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -508,8 +498,7 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
        uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
        uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
        if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
-                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %x %d %x %x/%lx", esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
            res = ESP_ERR_NO_MEM;
            goto _on_err;
@@ -525,14 +514,6 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
    uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
    uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
-
-    /* calculate CRC16 of the already switched block */
-    if (prev_block_len > 0) {
-        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
-        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
-        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
-        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
-    }
    eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
              host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
    esp_apptrace_trax_buffer_swap_unlock();
--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-__attribute__((unused)) static U64 _cbGetTime(void) {
+static U64 _cbGetTime(void) {
  U64 Time;

  Time = xTaskGetTickCountFromISR();
@@ -260,10 +260,7 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
-     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
-     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
-  NULL,
+  _cbGetTime,
  _cbSendTaskList,
 };

--- a/components/app_trace/sys_view/esp/SEGGER_RTT_esp.c
+++ b/components/app_trace/sys_view/esp/SEGGER_RTT_esp.c
@@ -167,8 +167,8 @@ unsigned SEGGER_RTT_WriteSkipNoLock(unsigned BufferIndex, const void* pBuffer, u
      (event_id == SYSVIEW_EVTID_TASK_STOP_EXEC) ||
      (event_id == SYSVIEW_EVTID_TASK_START_READY) ||
      (event_id == SYSVIEW_EVTID_TASK_STOP_READY) ||
-      (event_id == SYSVIEW_EVTID_MARK_START) ||
-      (event_id == SYSVIEW_EVTID_MARK_STOP) ||
+      (event_id == SYSVIEW_EVTID_USER_START) ||
+      (event_id == SYSVIEW_EVTID_USER_STOP) ||
      (event_id == SYSVIEW_EVTID_TIMER_ENTER) ||
      (event_id == SYSVIEW_EVTID_TIMER_EXIT) ||
      (event_id == SYSVIEW_EVTID_STACK_INFO) ||
--- a/components/app_trace/sys_view/ext/heap_trace_module.c
+++ b/components/app_trace/sys_view/ext/heap_trace_module.c
@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif

 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "M=ESP32 SystemView Heap Tracing Module",
+    .sModule = "ESP32 SystemView Heap Tracing Module",
    .NumEvents = 2,
 };

--- a/components/app_update/.build-test-rules.yml
+++ b/components/app_update/.build-test-rules.yml
@@ -0,0 +1,7 @@
+# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
+
+components/app_update/test_apps:
+  disable:
+    - if: IDF_TARGET == "esp32c6" or IDF_TARGET == "esp32h2"
+      temporary: true
+      reason: target esp32c6, esp32h2 is not supported yet
--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -37,6 +37,8 @@
 #include "esp32c3/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32H4
+#include "esp32h4/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32C2
 #include "esp32c2/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32C6
@@ -195,18 +197,13 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
        return ESP_ERR_INVALID_ARG;
    }

-    if (size == 0) {
-        ESP_LOGD(TAG, "write data size is 0");
-        return ESP_OK;
-    }
-
    // find ota handle in linked list
    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
        if (it->handle == handle) {
            if (it->need_erase) {
                // must erase the partition before writing to it
-                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE; // first affected sector
-                uint32_t last_sector = (it->wrote_size + size - 1) / SPI_FLASH_SEC_SIZE; // last affected sector
+                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE;
+                uint32_t last_sector = (it->wrote_size + size) / SPI_FLASH_SEC_SIZE;

                ret = ESP_OK;
                if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
@@ -901,27 +898,9 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void)
    return ESP_OK;
 }

-#if SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY && CONFIG_SECURE_BOOT_V2_ENABLED
+#if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS > 1 && CONFIG_SECURE_BOOT_V2_ENABLED
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index) {

-// Validates the image at "app_pos" with the secure boot digests other than "revoked_key_index"
-static bool validate_img(esp_ota_secure_boot_public_key_index_t revoked_key_index, esp_partition_pos_t *app_pos)
-{
-    bool verified = false;
-    for (int i = 0; i < SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS; i++) {
-        if (i == revoked_key_index) {
-            continue;
-        }
-        if (esp_secure_boot_verify_with_efuse_digest_index(i, app_pos) == ESP_OK) {
-            verified = true;
-            ESP_LOGI(TAG, "Application successfully verified with public key digest %d", i);
-            break;
-        }
-    }
-    return verified;
-}
-
-esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index)
-{
    if (!esp_secure_boot_enabled()) {
        ESP_LOGE(TAG, "Secure boot v2 has not been enabled.");
        return ESP_FAIL;
@@ -934,21 +913,14 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
        return ESP_ERR_INVALID_ARG;
    }

-    const esp_partition_t *running_app_part = esp_ota_get_running_partition();
-    esp_err_t ret = ESP_FAIL;
-#ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
-    esp_ota_img_states_t running_app_state;
-    ret = esp_ota_get_state_partition(running_app_part, &running_app_state);
-    if (ret != ESP_OK) {
-        ESP_LOGE(TAG, "esp_ota_get_state_partition returned: %s", esp_err_to_name(ret));
+    esp_image_sig_public_key_digests_t app_digests = { 0 };
+    esp_err_t err = esp_secure_boot_get_signature_blocks_for_running_app(true, &app_digests);
+    if (err != ESP_OK || app_digests.num_digests == 0) {
+        ESP_LOGE(TAG, "This app is not signed, but check signature on update is enabled in config. It won't be possible to verify any update.");
        return ESP_FAIL;
    }
-    if (running_app_state != ESP_OTA_IMG_VALID) {
-        ESP_LOGE(TAG, "The current running application is not marked as a valid image. Aborting..");
-        return ESP_FAIL;
-    }
-#endif

+    esp_err_t ret;
    esp_secure_boot_key_digests_t trusted_keys;
    ret = esp_secure_boot_read_key_digests(&trusted_keys);
    if (ret != ESP_OK) {
@@ -957,38 +929,55 @@ esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_i
    }

    if (trusted_keys.key_digests[index] == NULL) {
-        ESP_LOGI(TAG, "Given public key digest(%d) is already revoked.", index);
+        ESP_LOGI(TAG, "Trusted Key block(%d) already revoked.", index);
        return ESP_OK;
    }

-    /* Check if the application can be verified with a key other than the one being revoked */
-    esp_partition_pos_t running_app_pos = {
-        .offset = running_app_part->address,
-        .size   = running_app_part->size,
-    };
+    esp_image_sig_public_key_digests_t trusted_digests = { 0 };
+    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        if (i == index) {
+            continue; // omitting - to find if there is a valid key after revoking this digest
+        }

-    if (!validate_img(index, &running_app_pos)) {
-        ESP_LOGE(TAG, "Application cannot be verified with any key other than the one being revoked");
+        if (trusted_keys.key_digests[i] != NULL) {
+            bool all_zeroes = true;
+            for (unsigned j = 0; j < ESP_SECURE_BOOT_DIGEST_LEN; j++) {
+                all_zeroes = all_zeroes && (*(uint8_t *)(trusted_keys.key_digests[i] + j) == 0);
+            }
+            if (!all_zeroes) {
+                memcpy(trusted_digests.key_digests[trusted_digests.num_digests++], (uint8_t *)trusted_keys.key_digests[i], ESP_SECURE_BOOT_DIGEST_LEN);
+            } else {
+                ESP_LOGD(TAG, "Empty trusted key block (%d).", i);
+            }
+        }
+    }
+
+    bool match = false;
+    for (unsigned i = 0; i < trusted_digests.num_digests; i++) {
+        if (match == true) {
+            break;
+        }
+
+        for (unsigned j = 0; j < app_digests.num_digests; j++) {
+            if (memcmp(trusted_digests.key_digests[i], app_digests.key_digests[j], ESP_SECURE_BOOT_DIGEST_LEN) == 0) {
+                ESP_LOGI(TAG, "App key block(%d) matches Trusted key block(%d)[%d -> Next active trusted key block].", j, i, i);
+                esp_err_t err = esp_efuse_set_digest_revoke(index);
+                if (err != ESP_OK) {
+                    ESP_LOGE(TAG, "Failed to revoke digest (0x%x).", err);
+                    return ESP_FAIL;
+                }
+                ESP_LOGI(TAG, "Revoked signature block %d.", index);
+                match = true;
+                break;
+            }
+        }
+    }
+
+    if (match == false) {
+        ESP_LOGE(TAG, "Running app doesn't have another valid secure boot key. Cannot revoke current key(%d).", index);
        return ESP_FAIL;
    }

-    /* Check if bootloder can be verified with any key other than the one being revoked */
-    esp_partition_pos_t bootloader_pos = {
-        .offset = ESP_BOOTLOADER_OFFSET,
-        .size   = (ESP_PARTITION_TABLE_OFFSET - ESP_BOOTLOADER_OFFSET),
-    };
-
-    if (!validate_img(index, &bootloader_pos)) {
-        ESP_LOGE(TAG, "Bootloader cannot be verified with any key other than the one being revoked");
-        return ESP_FAIL;
-    }
-
-    esp_err_t err = esp_efuse_set_digest_revoke(index);
-    if (err != ESP_OK) {
-        ESP_LOGE(TAG, "Failed to revoke digest (0x%x).", err);
-        return ESP_FAIL;
-    }
-    ESP_LOGI(TAG, "Revoked signature block %d.", index);
    return ESP_OK;
 }
 #endif
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -110,7 +110,7 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
 * @param size    Size of data buffer in bytes.
 *
 * @return
- *    - ESP_OK: Data was written to flash successfully, or size = 0
+ *    - ESP_OK: Data was written to flash successfully.
 *    - ESP_ERR_INVALID_ARG: handle is invalid.
 *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
 *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
@@ -332,10 +332,10 @@ typedef enum {
 } esp_ota_secure_boot_public_key_index_t;

 /**
- * @brief Revokes the signature digest denoted by the given index. This should be called in the application only after the rollback logic otherwise the device may end up in unrecoverable state.
+ * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
 *
- * Relevant for Secure boot v2 on ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6, ESP32-H2 where up to 3 key digests can be stored (Key \#N-1, Key \#N, Key \#N+1).
- * When a key used to sign an app is invalidated, an OTA update is to be sent with an app signed with at least one of the other two keys which has not been revoked already.
+ * Relevant for Secure boot v2 on ESP32-S2, ESP32-S3, ESP32-C3, ESP32-H4 where upto 3 key digests can be stored (Key \#N-1, Key \#N, Key \#N+1).
+ * When key \#N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key \#N-1 & Key \#N.
 * After successfully booting the OTA app should call this function to revoke Key \#N-1.
 *
 * @param index - The index of the signature block to be revoked
--- a/components/app_update/test_apps/test_app_update/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/CMakeLists.txt
--- a/components/app_update/test_apps/test_app_update/README.md
+++ b/components/app_update/test_apps/test_app_update/README.md
--- a/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
                       PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash
                      WHOLE_ARCHIVE)
--- a/components/app_update/test_apps/test_app_update/main/app_main.c
+++ b/components/app_update/test_apps/test_app_update/main/app_main.c
--- a/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
+++ b/components/app_update/test_apps/test_app_update/main/test_ota_ops.c
@@ -6,7 +6,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include "esp_log.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/task.h>
 #include <freertos/semphr.h>
@@ -114,11 +113,3 @@ TEST_CASE("esp_ota_get_partition_description", "[ota]")
    };
    TEST_ESP_ERR(ESP_ERR_NOT_FOUND, bootloader_common_get_partition_description(&not_app_pos, &app_desc1));
 }
-
-TEST_CASE("esp_ota_get_running_partition points to correct address", "[spi_flash]")
-{
-    const esp_partition_t *factory = esp_partition_find_first(ESP_PARTITION_TYPE_APP, ESP_PARTITION_SUBTYPE_ANY, "factory");
-    const esp_partition_t* part = esp_ota_get_running_partition();
-    ESP_LOGI("running bin", "0x%p", (void*)part->address);
-    TEST_ASSERT_EQUAL_HEX32(factory->address, part->address);
-}
--- a/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
+++ b/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
@@ -842,7 +842,7 @@ static void test_flow6(void)
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);

 //IDF-5145
-TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is invalid", "[partitions]")
+TEST_CASE("Test bootloader_common_get_sha256_of_partition returns ESP_ERR_IMAGE_INVALID when image is ivalid", "[partitions]")
 {
    const esp_partition_t *cur_app = esp_ota_get_running_partition();
    ESP_LOGI(TAG, "copy current app to next part");
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota.csv
--- a/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
+++ b/components/app_update/test_apps/test_app_update/partition_table_unit_test_two_ota_2m.csv
--- a/components/app_update/test_apps/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/pytest_app_update_ut.py
@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-License-Identifier: Unlicense OR CC0-1.0
+import re
+
+import pytest
+from pytest_embedded import Dut
+
+DEFAULT_TIMEOUT = 20
+TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
+
+
+def run_multiple_stages(dut: Dut, test_case_num: int, stages: int) -> None:
+    for stage in range(1, stages + 1):
+        dut.write(str(test_case_num))
+        dut.expect(TEST_SUBMENU_PATTERN_PYTEST, timeout=DEFAULT_TIMEOUT)
+        dut.write(str(stage))
+        if stage != stages:
+            dut.expect_exact('Press ENTER to see the list of tests.')
+
+
+@pytest.mark.supported_targets
+@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
+@pytest.mark.generic
+def test_app_update(dut: Dut) -> None:
+    extra_data = dut.parse_test_menu()
+    for test_case in extra_data:
+        if test_case.type != 'multi_stage':
+            dut.write(str(test_case.index))
+        else:
+            run_multiple_stages(dut, test_case.index, len(test_case.subcases))
+        dut.expect_unity_test_output(timeout=90)
+        dut.expect_exact("Enter next test, or 'enter' to see menu")
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c2
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32c3
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s2
--- a/components/app_update/test_apps/test_app_update/.build-test-rules.yml
+++ b/components/app_update/test_apps/test_app_update/.build-test-rules.yml
@@ -1,12 +0,0 @@
-# Documentation: .gitlab/ci/README.md#manifest-file-to-control-the-buildtest-apps
-
-components/app_update/test_apps:
-  enable:
-    - if: CONFIG_NAME == "defaults" and IDF_TARGET != "linux"
-    - if: CONFIG_NAME == "xip_psram" and IDF_TARGET in ["esp32s2", "esp32s3"]
-    # S2 doesn't have ROM for flash
-    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and IDF_TARGET in ["esp32s3"]
-  disable:
-    - if: IDF_TARGET in ["esp32c6", "esp32h2"]
-      temporary: true
-      reason: target esp32c6, esp32h2 are not supported yet # TODO: IDF-8068
--- a/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
@@ -1,50 +0,0 @@
-# SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
-# SPDX-License-Identifier: Unlicense OR CC0-1.0
-import re
-
-import pytest
-from pytest_embedded import Dut
-
-DEFAULT_TIMEOUT = 20
-TEST_SUBMENU_PATTERN_PYTEST = re.compile(rb'\s+\((\d+)\)\s+"([^"]+)"\r?\n')
-
-
-@pytest.mark.supported_targets
-@pytest.mark.temp_skip_ci(targets=['esp32c6', 'esp32h2'], reason='c6/h2 support TBD')
-@pytest.mark.generic
-@pytest.mark.parametrize(
-    'config',
-    [
-        'defaults',
-    ],
-    indirect=True,
-)
-def test_app_update(dut: Dut) -> None:
-    dut.run_all_single_board_cases(timeout=90)
-
-
-@pytest.mark.esp32s2
-@pytest.mark.esp32s3
-@pytest.mark.generic
-@pytest.mark.parametrize(
-    'config',
-    [
-        'xip_psram',
-    ],
-    indirect=True,
-)
-def test_app_update_xip_psram(dut: Dut) -> None:
-    dut.run_all_single_board_cases(timeout=90)
-
-
-@pytest.mark.esp32s3
-@pytest.mark.generic
-@pytest.mark.parametrize(
-    'config',
-    [
-        'xip_psram_with_rom_impl',
-    ],
-    indirect=True,
-)
-def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
-    dut.run_all_single_board_cases(timeout=90)
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.defaults
@@ -1,2 +0,0 @@
-# don't delete.
-# used for CI to compile a default config when 'sdkconfig.ci.xxxx' is exist
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram
@@ -1,3 +0,0 @@
-CONFIG_SPIRAM=y
-CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
-CONFIG_SPIRAM_RODATA=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.xip_psram_with_rom_impl
@@ -1,4 +0,0 @@
-CONFIG_SPIRAM=y
-CONFIG_SPIRAM_FETCH_INSTRUCTIONS=y
-CONFIG_SPIRAM_RODATA=y
-CONFIG_SPI_FLASH_ROM_IMPL=y
--- a/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.defaults.esp32s3
@@ -1,2 +0,0 @@
-CONFIG_IDF_TARGET="esp32s3"
-CONFIG_BOOTLOADER_NUM_PIN_APP_TEST=18
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -62,66 +62,34 @@ menu "Bootloader config"
        default 4 if BOOTLOADER_LOG_LEVEL_DEBUG
        default 5 if BOOTLOADER_LOG_LEVEL_VERBOSE

-    menu "Serial Flash Configurations"
-        config BOOTLOADER_SPI_CUSTOM_WP_PIN
-            bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
-            depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
-            default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
-            default n
-            help
-                This setting is only used if the SPI flash pins have been overridden by setting the eFuses
-                SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+    config BOOTLOADER_SPI_CUSTOM_WP_PIN
+        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+        default n
+        help
+            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.

-                When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
-                ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
-                for external SPIRAM if it is enabled.
+            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+            for external SPIRAM if it is enabled.

-                If this config item is set to N (default), the correct WP pin will be automatically used for any
-                Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
-                Y and specify the GPIO number connected to the WP.
+            If this config item is set to N (default), the correct WP pin will be automatically used for any
+            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+            Y and specify the GPIO number connected to the WP.

-        config BOOTLOADER_SPI_WP_PIN
-            int "Custom SPI Flash WP Pin"
-            range 0 33
-            default 7
-            depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
-            #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
-            help
-                The option "Use custom SPI Flash WP Pin" must be set or this value is ignored
+    config BOOTLOADER_SPI_WP_PIN
+        int "Custom SPI Flash WP Pin"
+        range 0 33
+        default 7
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
+        help
+            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored

-                If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
-                value to the GPIO number of the SPI flash WP pin.
-
-        config BOOTLOADER_FLASH_DC_AWARE
-            bool "Allow app adjust Dummy Cycle bits in SPI Flash for higher frequency (READ HELP FIRST)"
-            help
-                This will force 2nd bootloader to be loaded by DOUT mode, and will restore Dummy Cycle setting by
-                resetting the Flash
-
-        config BOOTLOADER_FLASH_XMC_SUPPORT
-            bool "Enable the support for flash chips of XMC (READ DOCS FIRST)"
-            default y
-            help
-                Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
-                XMC chips will be forbidden to be used, when this option is disabled.
-
-                DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
-
-                comment "Features below require specific hardware (READ DOCS FIRST!)"
-
-        config BOOTLOADER_FLASH_32BIT_ADDR
-            bool
-            default y if ESPTOOLPY_FLASHSIZE_32MB || ESPTOOLPY_FLASHSIZE_64MB || ESPTOOLPY_FLASHSIZE_128MB
-            default n
-            help
-                This is a helper config for 32bits address flash. Invisible for users.
-
-        config BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
-            bool
-            default y if ESPTOOLPY_OCT_FLASH && BOOTLOADER_FLASH_32BIT_ADDR
-            default n
-
-    endmenu
+            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+            value to the GPIO number of the SPI flash WP pin.

    choice BOOTLOADER_VDDSDIO_BOOST
        bool "VDDSDIO LDO voltage"
@@ -437,21 +405,6 @@ menu "Bootloader config"
            (The application and bootoloader must be compiled with the same option).
            The RTC FAST memory has access only through PRO_CPU.

-    config BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
-        bool "Include custom memory in the CRC calculation"
-        depends on BOOTLOADER_CUSTOM_RESERVE_RTC
-        default n
-        help
-            This option allows the customer to use the legacy bootloader behavior when the
-            RTC FAST memory CRC calculation takes place. When this option is enabled, the
-            allocated user custom data will be taken into account in the CRC calculcation.
-            This means that any change to the custom data would need a CRC update to prevent
-            the bootloader from marking this data as corrupted.
-            If this option is disabled, the custom data will not be taken into account when
-            calculating the RTC FAST memory CRC. The user custom data can be changed freely,
-            without the need to update the CRC.
-            THIS OPTION MUST BE THE SAME FOR BOTH THE BOOTLOADER AND THE APPLICATION BUILDS.
-
    config BOOTLOADER_CUSTOM_RESERVE_RTC_SIZE
        hex "Size in bytes for custom purposes"
        default 0
@@ -471,6 +424,15 @@ menu "Bootloader config"
            - "Reserve RTC FAST memory for custom purposes"
            - "GPIO triggers factory reset"

+    config BOOTLOADER_FLASH_XMC_SUPPORT
+        bool "Enable the support for flash chips of XMC (READ HELP FIRST)"
+        default y
+        help
+            Perform the startup flow recommended by XMC. Please consult XMC for the details of this flow.
+            XMC chips will be forbidden to be used, when this option is disabled.
+
+            DON'T DISABLE THIS UNLESS YOU KNOW WHAT YOU ARE DOING.
+
 endmenu  # Bootloader


@@ -742,12 +704,14 @@ menu "Security features"

    config SECURE_BOOT_VERIFICATION_KEY
        string "Secure boot public signature verification key"
-        depends on SECURE_SIGNED_APPS && SECURE_SIGNED_APPS_ECDSA_SCHEME && !SECURE_BOOT_BUILD_SIGNED_BINARIES
+        depends on SECURE_SIGNED_APPS && !SECURE_BOOT_BUILD_SIGNED_BINARIES && !SECURE_SIGNED_APPS_RSA_SCHEME
        default "signature_verification_key.bin"
        help
            Path to a public key file used to verify signed images.
            Secure Boot V1: This ECDSA public key is compiled into the bootloader and/or
            app, to verify app images.
+            Secure Boot V2: This RSA public key is compiled into the signature block at
+            the end of the bootloader/app.

            Key file is in raw binary format, and can be extracted from a
            PEM formatted private key using the espsecure.py
@@ -771,33 +735,6 @@ menu "Security features"
            This can lead to permanent bricking of the device, in case all keys are revoked
            because of signature verification failure.

-    config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
-        bool "Do not disable the ability to further read protect eFuses"
-        depends on SECURE_BOOT_V2_ENABLED
-        default n
-        help
-            If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
-            efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
-
-            If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
-            Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
-            BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the secure boot public key digest,
-            causing an immediate denial of service and possibly allowing an additional fault injection attack to
-            bypass the signature protection.
-
-            The option must be set when you need to program any read-protected key type into the efuses,
-            e.g., HMAC, ECDSA etc. after secure boot has already been enabled on the device.
-            Please refer to secure boot V2 documentation guide for more details.
-
-            NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
-
-            NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
-            "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
-            then it is __NOT__ possible to read/write efuses using espefuse.py utility.
-            However, efuse can be read/written from the application
-
-            Please refer to the Secure Boot V2 documentation guide for more information.
-
    choice SECURE_BOOTLOADER_KEY_ENCODING
        bool "Hardware Key Encoding"
        depends on SECURE_BOOTLOADER_REFLASHABLE
@@ -959,6 +896,26 @@ menu "Security features"
                image to this length. It is generally not recommended to set this option, unless you have a legacy
                partitioning scheme which doesn't support 64KB aligned partition lengths.

+        config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
+            bool "Allow additional read protecting of efuses"
+            depends on SECURE_BOOT_INSECURE && SECURE_BOOT_V2_ENABLED
+            help
+                If not set (default, recommended), on first boot the bootloader will burn the WR_DIS_RD_DIS
+                efuse when Secure Boot is enabled. This prevents any more efuses from being read protected.
+
+                If this option is set, it will remain possible to write the EFUSE_RD_DIS efuse field after Secure
+                Boot is enabled. This may allow an attacker to read-protect the BLK2 efuse (for ESP32) and
+                BLOCK4-BLOCK10 (i.e. BLOCK_KEY0-BLOCK_KEY5)(for other chips) holding the public key digest, causing an
+                immediate denial of service and possibly allowing an additional fault injection attack to
+                bypass the signature protection.
+
+                NOTE: Once a BLOCK is read-protected, the application will read all zeros from that block
+
+                NOTE: If "UART ROM download mode (Permanently disabled (recommended))" or
+                "UART ROM download mode (Permanently switch to Secure mode (recommended))" is set,
+                then it is __NOT__ possible to read/write efuses using espefuse.py utility.
+                However, efuse can be read/written from the application
+
        config SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS
            bool "Leave unused digest slots available (not revoke)"
            depends on SECURE_BOOT_INSECURE && SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
@@ -1052,22 +1009,6 @@ menu "Security features"
                DIS_DOWNLOAD_MANUAL_ENCRYPT, DIS_USB_JTAG, DIS_USB_SERIAL_JTAG, STRAP_JTAG_SEL, USB_PHY_SEL.
    endmenu  # Potentially Insecure

-    config SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
-        bool "Encrypt only the app image that is present in the partition of type app"
-        depends on SECURE_FLASH_ENC_ENABLED && !SECURE_FLASH_REQUIRE_ALREADY_ENABLED
-        default n
-        help
-            If set, optimise encryption time for the partition of type APP,
-            by only encrypting the app image that is present in the partition,
-            instead of the whole partition.
-            The image length used for encryption is derived from the image metadata, which
-            includes the size of the app image, checksum, hash and also the signature sector
-            when secure boot is enabled.
-
-            If not set (default), the whole partition of type APP would be encrypted,
-            which increases the encryption time but might be useful if there
-            is any custom data appended to the firmware image.
-
    config SECURE_FLASH_CHECK_ENC_EN_IN_APP
        bool "Check Flash Encryption enabled on app startup"
        depends on SECURE_FLASH_ENC_ENABLED
@@ -1080,44 +1021,6 @@ menu "Security features"

            If not set, the app does not care if the flash encryption eFuse bit is set or not.

-    config SECURE_FLASH_PSEUDO_ROUND_FUNC
-        bool "Permanently enable XTS-AES's pseudo rounds function"
-        default y
-        depends on SECURE_FLASH_ENCRYPTION_MODE_RELEASE && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
-        help
-            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
-            Note: Enabling this config would burn an efuse.
-
-    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
-        prompt "Strength of the pseudo rounds function"
-        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
-        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
-        help
-            The strength of the pseudo rounds functions can be configured to low, medium and high,
-            each denoting the values that would be stored in the efuses field.
-            By default the value to set to low.
-            You can configure the strength of the pseudo rounds functions according to your use cases,
-            for example, increasing the strength would provide higher security but would slow down the
-            flash encryption/decryption operations.
-            For more info regarding the performance impact, please checkout the pseudo round function section of the
-            security guide documentation.
-
-        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
-            bool "Low"
-
-        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
-            bool "Medium"
-
-        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
-            bool "High"
-    endchoice
-
-    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
-        int
-        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
-        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
-        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
-
    config SECURE_ROM_DL_MODE_ENABLED
        bool
        default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
--- a/components/bootloader/project_include.cmake
+++ b/components/bootloader/project_include.cmake
@@ -148,5 +148,5 @@ endif()
 #
 # So for now we just have the top-level build remove the final build products...
 set_property(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}" APPEND PROPERTY
-    ADDITIONAL_CLEAN_FILES
+    ADDITIONAL_MAKE_CLEAN_FILES
    ${bootloader_binary_files})
--- a/components/bootloader/sdkconfig.rename
+++ b/components/bootloader/sdkconfig.rename
@@ -23,5 +23,3 @@ CONFIG_FLASH_ENCRYPTION_UART_BOOTLOADER_ALLOW_CACHE         CONFIG_SECURE_FLASH_

 # Secure Boot Scheme
 CONFIG_SECURE_BOOT_ENABLED                                  CONFIG_SECURE_BOOT_V1_ENABLED
-
-CONFIG_SPI_FLASH_OCTAL_32BIT_ADDR_ENABLE                    CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
--- a/components/bootloader/subproject/components/micro-ecc/micro-ecc
+++ b/components/bootloader/subproject/components/micro-ecc/micro-ecc
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.ld
@@ -25,7 +25,7 @@ MEMORY
  */
  iram_seg (RWX) :                  org = 0x40080400, len = 0xfc00
  /* 64k at the end of DRAM, after ROM bootloader stack */
-  dram_seg (RW) :                  	org = 0x3FFF0000, len = 0x6000
+  dram_seg (RW) :                  	org = 0x3FFF0000, len = 0x10000
 }

 /*  Default entry point:  */
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.rom.ld
@@ -0,0 +1,9 @@
+PROVIDE ( ets_update_cpu_frequency = 0x40008550 ); /* Updates g_ticks_per_us on the current CPU only; not on the other core */
+PROVIDE ( MD5Final = 0x4005db1c );
+PROVIDE ( MD5Init = 0x4005da7c );
+PROVIDE ( MD5Update = 0x4005da9c );
+
+/* bootloader will use following functions from xtensa hal library */
+xthal_get_ccount = 0x4000c050;
+xthal_get_ccompare = 0x4000c078;
+xthal_set_ccompare = 0x4000c058;
--- a/components/bootloader/subproject/main/ld/esp32h4/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32h4/bootloader.ld
@@ -0,0 +1,240 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** Simplified memory map for the bootloader.
+ *  Make sure the bootloader can load into main memory without overwriting itself.
+ *
+ *  ESP32-H4 ROM static data usage is as follows:
+ *  - 0x3fccb900 - 0x3fcdd210: Shared buffers, used in UART/USB/SPI download mode only
+ *  - 0x3fcdd210 - 0x3fcdf210: PRO CPU stack, can be reclaimed as heap after RTOS startup
+ *  - 0x3fcdf210 - 0x3fce0000: ROM .bss and .data (not easily reclaimable)
+ *
+ *  The 2nd stage bootloader can take space up to the end of ROM shared
+ *  buffers area (0x3fce9704). For alignment purpose we shall use value (0x3fce9700).
+ */
+
+/* The offset between Dbus and Ibus. Used to convert between 0x403xxxxx and 0x3fcxxxxx addresses. */
+iram_dram_offset = 0x700000;
+
+/* We consider 0x3fce9700 to be the last usable address for 2nd stage bootloader stack overhead, dram_seg,
+ * and work out iram_seg and iram_loader_seg addresses from there, backwards.
+ */
+
+/* These lengths can be adjusted, if necessary: */
+bootloader_usable_dram_end = 0x3fcdd120;
+bootloader_stack_overhead = 0x2000; /* For safety margin between bootloader data section and startup stacks */
+bootloader_dram_seg_len = 0x5000;
+bootloader_iram_loader_seg_len = 0x7000;
+bootloader_iram_seg_len = 0x2000;
+
+/* Start of the lower region is determined by region size and the end of the higher region */
+bootloader_dram_seg_end = bootloader_usable_dram_end - bootloader_stack_overhead;
+bootloader_dram_seg_start = bootloader_dram_seg_end - bootloader_dram_seg_len;
+bootloader_iram_loader_seg_start = bootloader_dram_seg_start - bootloader_iram_loader_seg_len + iram_dram_offset;
+bootloader_iram_seg_start = bootloader_iram_loader_seg_start - bootloader_iram_seg_len;
+
+MEMORY
+{
+  iram_seg (RWX) :                  org = bootloader_iram_seg_start, len = bootloader_iram_seg_len
+  iram_loader_seg (RWX) :           org = bootloader_iram_loader_seg_start, len = bootloader_iram_loader_seg_len
+  dram_seg (RW) :                   org = bootloader_dram_seg_start, len = bootloader_dram_seg_len
+}
+
+/* Default entry point: */
+ENTRY(call_start_cpu0);
+
+SECTIONS
+{
+
+  .iram_loader.text :
+  {
+    . = ALIGN (16);
+    _loader_text_start = ABSOLUTE(.);
+    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
+    *liblog.a:(.literal .text .literal.* .text.*)
+    *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
+    *libbootloader_support.a:bootloader_efuse.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_soc.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libhal.a:mmu_hal.*(.literal .text .literal.* .text.*)
+    *libhal.a:cache_hal.*(.literal .text .literal.* .text.*)
+    *libhal.a:efuse_hal.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
+    *libefuse.a:*.*(.literal .text .literal.* .text.*)
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+    _loader_text_end = ABSOLUTE(.);
+  } > iram_loader_seg
+
+  .iram.text :
+  {
+    . = ALIGN (16);
+    *(.entry.text)
+    *(.init.literal)
+    *(.init)
+  } > iram_seg
+
+
+  /* Shared RAM */
+  .dram0.bss (NOLOAD) :
+  {
+    . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
+    _bss_start = ABSOLUTE(.);
+    *(.dynsbss)
+    *(.sbss)
+    *(.sbss.*)
+    *(.gnu.linkonce.sb.*)
+    *(.scommon)
+    *(.sbss2)
+    *(.sbss2.*)
+    *(.gnu.linkonce.sb2.*)
+    *(.dynbss)
+    *(.bss)
+    *(.bss.*)
+    *(.gnu.linkonce.b.*)
+    *(COMMON)
+    . = ALIGN (8);
+    _bss_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.data :
+  {
+    _data_start = ABSOLUTE(.);
+    *(.data)
+    *(.data.*)
+    *(.gnu.linkonce.d.*)
+    *(.data1)
+    *(.sdata)
+    *(.sdata.*)
+    *(.gnu.linkonce.s.*)
+    *(.gnu.linkonce.s2.*)
+    *(.jcr)
+    _data_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.rodata :
+  {
+    _rodata_start = ABSOLUTE(.);
+    *(.rodata)
+    *(.rodata.*)
+    *(.gnu.linkonce.r.*)
+    *(.rodata1)
+    *(.sdata2 .sdata2.* .srodata .srodata.*)
+    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
+    *(.xt_except_table)
+    *(.gcc_except_table)
+    *(.gnu.linkonce.e.*)
+    *(.gnu.version_r)
+    *(.eh_frame)
+    . = (. + 3) & ~ 3;
+    /* C++ constructor and destructor tables, properly ordered: */
+    __init_array_start = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.ctors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
+    __init_array_end = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))
+    /*  C++ exception handlers table:  */
+    __XT_EXCEPTION_DESCS_ = ABSOLUTE(.);
+    *(.xt_except_desc)
+    *(.gnu.linkonce.h.*)
+    __XT_EXCEPTION_DESCS_END__ = ABSOLUTE(.);
+    *(.xt_except_desc_end)
+    *(.dynamic)
+    *(.gnu.version_d)
+    _rodata_end = ABSOLUTE(.);
+    /* Literals are also RO data. */
+    _lit4_start = ABSOLUTE(.);
+    *(*.lit4)
+    *(.lit4.*)
+    *(.gnu.linkonce.lit4.*)
+    _lit4_end = ABSOLUTE(.);
+    . = ALIGN(4);
+    _dram_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .iram.text :
+  {
+    _stext = .;
+    _text_start = ABSOLUTE(.);
+    *(.literal .text .literal.* .text.* .stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+    *(.iram .iram.*) /* catch stray IRAM_ATTR */
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } > iram_seg
+
+}
+
+/**
+ *  Appendix: Memory Usage of ROM bootloader
+ *
+ * 0x3fccb81c ------------------> _dram0_0_start
+ *            |               |
+ *            |               |
+ *            |               |   1. Large buffers that are only used in certain boot modes, see shared_buffers.h
+ *            |               |
+ *            |               |
+ * 0x3fcdd120 ------------------> __stack_sentry
+ *            |               |
+ *            |               |   2. Startup pro cpu stack (freed when IDF app is running)
+ *            |               |
+ * 0x3fcdf120 ------------------> __stack (pro cpu)
+ *            |               |
+ *            |               |
+ *            |               |   3. Shared memory only used in startup code or nonos/early boot*
+ *            |               |      (can be freed when IDF runs)
+ *            |               |
+ *            |               |
+ * 0x3fcdfa6c ------------------> _dram0_rtos_reserved_start
+ *            |               |
+ *            |               |
+ *            |               |   4. Shared memory used in startup code and when IDF runs
+ *            |               |
+ *            |               |
+ * 0x3fcdfe40 ------------------> _dram0_rtos_reserved_end
+ *            |               |
+ * 0x3fcdfe4c ------------------> _data_start_interface
+ *            |               |
+ *            |               |   5. End of DRAM is the 'interface' data with constant addresses (ECO compatible)
+ *            |               |
+ * 0x3fce0000 ------------------> _data_end_interface
+ */
--- a/components/bootloader/subproject/main/ld/esp32h4/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32h4/bootloader.rom.ld
@@ -0,0 +1,6 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* No definition for ESP32-H4 target */
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.rom.ld
@@ -0,0 +1,13 @@
+/*
+ * ESP32S2 ROM address table
+ * Generated for ROM with MD5sum: 0a2c7ec5109c17884606d23b47045796
+*/
+PROVIDE (ets_update_cpu_frequency = 0x4000d8a4);
+
+PROVIDE (MD5Final = 0x4000530c);
+PROVIDE (MD5Init = 0x4000526c);
+PROVIDE (MD5Update = 0x4000528c);
+/* bootloader will use following functions from xtensa hal library */
+xthal_get_ccount = 0x4001aa90;
+xthal_get_ccompare = 0x4001aabc;
+xthal_set_ccompare = 0x4001aa98;
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.rom.ld
@@ -0,0 +1,6 @@
+/**
+ * ESP32S3 ROM address table
+ * Generated for ROM with MD5sum: d20fb231463ce337432b1fa9cba0b3c9
+ */
+
+PROVIDE ( ets_update_cpu_frequency = 0x40043164 );
--- a/components/bootloader_support/.build-test-rules.yml
+++ b/components/bootloader_support/.build-test-rules.yml
@@ -5,3 +5,7 @@ components/bootloader_support/test_apps/rtc_custom_section:
    - if: IDF_TARGET == "esp32c2"
      temporary: false
      reason: esp32c2 does not have RTC memory
+  disable_test:
+    - if: IDF_TARGET == "esp32h2"
+      temporary: true
+      reason: target esp32h2 is not supported yet
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -26,10 +26,6 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
        )
 endif()

-if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
-    list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
-endif()
-
 if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    set(include_dirs "include" "bootloader_flash/include"
        "private_include")
@@ -44,6 +40,10 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
    )
    list(APPEND priv_requires hal)
+    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
+        list(APPEND srcs
+            "src/${IDF_TARGET}/bootloader_ecdsa.c")
+    endif()
 else()
    list(APPEND srcs
        "src/idf/bootloader_sha.c")
@@ -164,7 +164,7 @@ if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE
    target_add_binary_data(${COMPONENT_LIB} "${secure_boot_verification_key}" "BINARY"
        RENAME_TO signature_verification_key_bin)
    set_property(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
-        APPEND PROPERTY ADDITIONAL_CLEAN_FILES
+        APPEND PROPERTY ADDITIONAL_MAKE_CLEAN_FILES
        "${secure_boot_verification_key}")
 endif()

--- a/components/bootloader_support/bootloader_flash/include/bootloader_flash.h
+++ b/components/bootloader_support/bootloader_flash/include/bootloader_flash.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -54,13 +54,6 @@ esp_err_t bootloader_flash_reset_chip(void);
 */
 bool bootloader_flash_is_octal_mode_enabled(void);

-/**
- * @brief Get the spi flash working mode.
- *
- * @return The mode of flash working mode, see `esp_rom_spiflash_read_mode_t`
- */
-esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void);
-
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/bootloader_flash/include/bootloader_flash_override.h
+++ b/components/bootloader_support/bootloader_flash/include/bootloader_flash_override.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -109,17 +109,6 @@ extern const bootloader_qio_info_t __attribute__((weak)) bootloader_flash_qe_sup
  */
 esp_err_t __attribute__((weak)) bootloader_flash_unlock(void);

-#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
-/**
- * @brief Enable 32bits address flash(larger than 16MB) can map to cache.
- *
- * @param flash_mode SPI flash working mode.
- *
- * @note This can be overridden because it's attribute weak.
- */
-void __attribute__((weak)) bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode);
-#endif
-
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
+++ b/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
@@ -52,8 +52,6 @@ extern "C" {
 #define CMD_RESUME     0x7A /* Resume command to clear flash suspend bit */
 #define CMD_RESETEN    0x66
 #define CMD_RESET      0x99
-#define CMD_FASTRD_4B       0x0C
-#define CMD_SLOWRD_4B       0x13


 /* Provide a Flash API for bootloader_support code,
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -120,13 +120,9 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
 #include "esp32/rom/cache.h"
 #endif
 #include "esp_rom_spiflash.h"
-#include "esp_rom_sys.h"
 #include "hal/mmu_hal.h"
 #include "hal/mmu_ll.h"
 #include "hal/cache_hal.h"
-#if CONFIG_IDF_TARGET_ESP32S3
-#include "esp32s3/rom/opi_flash.h"
-#endif
 static const char *TAG = "bootloader_flash";

 #if CONFIG_IDF_TARGET_ESP32
@@ -413,33 +409,6 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
    return spi_to_esp_err(rc);
 }

-#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
-void bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)
-{
-    esp_rom_opiflash_spi0rd_t cache_rd = {};
-    switch (flash_mode) {
-    case ESP_ROM_SPIFLASH_FASTRD_MODE:
-        cache_rd.addr_bit_len = 32;
-        cache_rd.dummy_bit_len = 8;
-        cache_rd.cmd = CMD_FASTRD_4B;
-        cache_rd.cmd_bit_len = 8;
-        break;
-     case ESP_ROM_SPIFLASH_SLOWRD_MODE:
-        cache_rd.addr_bit_len = 32;
-        cache_rd.dummy_bit_len = 0;
-        cache_rd.cmd = CMD_SLOWRD_4B;
-        cache_rd.cmd_bit_len = 8;
-        break;
-    default:
-        assert(false);
-        break;
-    }
-    cache_hal_disable(CACHE_TYPE_ALL);
-    esp_rom_opiflash_cache_mode_config(flash_mode, &cache_rd);
-    cache_hal_enable(CACHE_TYPE_ALL);
-}
-#endif
-
 #endif // BOOTLOADER_BUILD


@@ -643,7 +612,7 @@ void bootloader_spi_flash_reset(void)
 ******************************************************************************/

 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
-#define XMC_VENDOR_ID_1 0x20
+#define XMC_VENDOR_ID 0x20

 #if BOOTLOADER_BUILD
 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
@@ -660,7 +629,7 @@ static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
    uint32_t mfid = BYTESHIFT(rdid, 1);
    uint32_t cpid = BYTESHIFT(rdid, 0);

-    if (vendor_id != XMC_VENDOR_ID_1) {
+    if (vendor_id != XMC_VENDOR_ID) {
        return false;
    }

@@ -693,7 +662,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
    // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
    const int sfdp_mfid_addr = 0x10;
    uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
-    if (mf_id != XMC_VENDOR_ID_1) {
+    if (mf_id != XMC_VENDOR_ID) {
        BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
        return ESP_OK;
    }
@@ -725,7 +694,7 @@ esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
 {
    uint32_t vendor_id = (rdid >> 16) & 0xFF;
-    return (vendor_id == XMC_VENDOR_ID_1);
+    return (vendor_id == XMC_VENDOR_ID);
 }

 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
@@ -786,40 +755,3 @@ bool IRAM_ATTR bootloader_flash_is_octal_mode_enabled(void)
    return false;
 #endif
 }
-
-esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void)
-{
-    esp_rom_spiflash_read_mode_t spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
-#if CONFIG_IDF_TARGET_ESP32
-    uint32_t spi_ctrl = REG_READ(SPI_CTRL_REG(0));
-    if (spi_ctrl & SPI_FREAD_QIO) {
-        spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
-    } else if (spi_ctrl & SPI_FREAD_QUAD) {
-        spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
-    } else if (spi_ctrl & SPI_FREAD_DIO) {
-        spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
-    } else if (spi_ctrl & SPI_FREAD_DUAL) {
-        spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
-    } else if (spi_ctrl & SPI_FASTRD_MODE) {
-        spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
-    } else {
-        spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
-    }
-#else
-    uint32_t spi_ctrl = REG_READ(SPI_MEM_CTRL_REG(0));
-    if (spi_ctrl & SPI_MEM_FREAD_QIO) {
-        spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
-    } else if (spi_ctrl & SPI_MEM_FREAD_QUAD) {
-        spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
-    } else if (spi_ctrl & SPI_MEM_FREAD_DIO) {
-        spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
-    } else if (spi_ctrl & SPI_MEM_FREAD_DUAL) {
-        spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
-    } else if (spi_ctrl & SPI_MEM_FASTRD_MODE) {
-        spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
-    } else {
-        spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
-    }
-#endif
-    return spi_mode;
-}
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c6.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c6.c
@@ -200,12 +200,6 @@ esp_err_t bootloader_init_spi_flash(void)
    bootloader_enable_qio_mode();
 #endif

-    // Since the workaround in IDF-6709, the spi_speed value in the bootloader header
-    // is not the real value, overwrite it.
-#if CONFIG_ESPTOOLPY_FLASHFREQ_80M
-    bootloader_image_hdr.spi_speed = ESP_IMAGE_SPI_SPEED_DIV_1;
-#endif
-
    print_flash_info(&bootloader_image_hdr);
    update_flash_config(&bootloader_image_hdr);
    //ensure the flash is write-protected
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32h4.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32h4.c
@@ -0,0 +1,250 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdbool.h>
+#include <assert.h>
+#include "string.h"
+#include "sdkconfig.h"
+#include "esp_err.h"
+#include "esp_log.h"
+#include "esp_rom_gpio.h"
+#include "esp_rom_efuse.h"
+#include "esp32h4/rom/gpio.h"
+#include "esp32h4/rom/spi_flash.h"
+#include "esp32h4/rom/efuse.h"
+#include "soc/gpio_periph.h"
+#include "soc/efuse_reg.h"
+#include "soc/spi_reg.h"
+#include "soc/spi_mem_reg.h"
+#include "soc/soc_caps.h"
+#include "flash_qio_mode.h"
+#include "bootloader_flash_config.h"
+#include "bootloader_common.h"
+#include "bootloader_flash_priv.h"
+#include "bootloader_init.h"
+#include "hal/mmu_hal.h"
+#include "hal/cache_hal.h"
+#include "hal/mmu_ll.h"
+
+#define FLASH_IO_MATRIX_DUMMY_40M   0
+#define FLASH_IO_MATRIX_DUMMY_80M   0
+
+void bootloader_flash_update_id()
+{
+    esp_rom_spiflash_chip_t *chip = &rom_spiflash_legacy_data->chip;
+    chip->device_id = bootloader_read_flash_id();
+}
+
+void IRAM_ATTR bootloader_flash_cs_timing_config()
+{
+    SET_PERI_REG_MASK(SPI_MEM_USER_REG(0), SPI_MEM_CS_HOLD_M | SPI_MEM_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_HOLD_TIME_V, 0, SPI_MEM_CS_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(0), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
+    SET_PERI_REG_MASK(SPI_MEM_USER_REG(1), SPI_MEM_CS_HOLD_M | SPI_MEM_CS_SETUP_M);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(1), SPI_MEM_CS_HOLD_TIME_V, 1, SPI_MEM_CS_HOLD_TIME_S);
+    SET_PERI_REG_BITS(SPI_MEM_CTRL2_REG(1), SPI_MEM_CS_SETUP_TIME_V, 0, SPI_MEM_CS_SETUP_TIME_S);
+}
+
+void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
+{
+    uint32_t spi_clk_div = 0;
+    switch (pfhdr->spi_speed) {
+    case ESP_IMAGE_SPI_SPEED_DIV_1:
+        spi_clk_div = 1;
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_2:
+        spi_clk_div = 2;
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_3:
+        spi_clk_div = 3;
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_4:
+        spi_clk_div = 4;
+        break;
+    default:
+        break;
+    }
+    esp_rom_spiflash_config_clk(spi_clk_div, 0);
+}
+
+void IRAM_ATTR bootloader_flash_set_dummy_out(void)
+{
+    REG_SET_BIT(SPI_MEM_CTRL_REG(0), SPI_MEM_FDUMMY_OUT | SPI_MEM_D_POL | SPI_MEM_Q_POL);
+    REG_SET_BIT(SPI_MEM_CTRL_REG(1), SPI_MEM_FDUMMY_OUT | SPI_MEM_D_POL | SPI_MEM_Q_POL);
+}
+
+void IRAM_ATTR bootloader_flash_dummy_config(const esp_image_header_t *pfhdr)
+{
+    bootloader_configure_spi_pins(1);
+    bootloader_flash_set_dummy_out();
+}
+
+static const char *TAG = "boot.esp32h4";
+
+void IRAM_ATTR bootloader_configure_spi_pins(int drv)
+{
+    const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
+    uint8_t wp_pin = esp_rom_efuse_get_flash_wp_gpio();
+    uint8_t clk_gpio_num = SPI_CLK_GPIO_NUM;
+    uint8_t q_gpio_num   = SPI_Q_GPIO_NUM;
+    uint8_t d_gpio_num   = SPI_D_GPIO_NUM;
+    uint8_t cs0_gpio_num = SPI_CS0_GPIO_NUM;
+    uint8_t hd_gpio_num  = SPI_HD_GPIO_NUM;
+    uint8_t wp_gpio_num  = SPI_WP_GPIO_NUM;
+    if (spiconfig == 0) {
+
+    } else {
+        clk_gpio_num = spiconfig         & 0x3f;
+        q_gpio_num = (spiconfig >> 6)    & 0x3f;
+        d_gpio_num = (spiconfig >> 12)   & 0x3f;
+        cs0_gpio_num = (spiconfig >> 18) & 0x3f;
+        hd_gpio_num = (spiconfig >> 24)  & 0x3f;
+        wp_gpio_num = wp_pin;
+    }
+    esp_rom_gpio_pad_set_drv(clk_gpio_num, drv);
+    esp_rom_gpio_pad_set_drv(q_gpio_num,   drv);
+    esp_rom_gpio_pad_set_drv(d_gpio_num,   drv);
+    esp_rom_gpio_pad_set_drv(cs0_gpio_num, drv);
+    if (hd_gpio_num <= MAX_PAD_GPIO_NUM) {
+        esp_rom_gpio_pad_set_drv(hd_gpio_num, drv);
+    }
+    if (wp_gpio_num <= MAX_PAD_GPIO_NUM) {
+        esp_rom_gpio_pad_set_drv(wp_gpio_num, drv);
+    }
+}
+
+static void update_flash_config(const esp_image_header_t *bootloader_hdr)
+{
+    uint32_t size;
+    switch (bootloader_hdr->spi_size) {
+    case ESP_IMAGE_FLASH_SIZE_1MB:
+        size = 1;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_2MB:
+        size = 2;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_4MB:
+        size = 4;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_8MB:
+        size = 8;
+        break;
+    case ESP_IMAGE_FLASH_SIZE_16MB:
+        size = 16;
+        break;
+    default:
+        size = 2;
+    }
+    cache_hal_disable(CACHE_TYPE_ALL);
+    // Set flash chip size
+    esp_rom_spiflash_config_param(rom_spiflash_legacy_data->chip.device_id, size * 0x100000, 0x10000, 0x1000, 0x100, 0xffff);    // TODO: set mode
+    cache_hal_enable(CACHE_TYPE_ALL);
+}
+
+static void print_flash_info(const esp_image_header_t *bootloader_hdr)
+{
+    ESP_EARLY_LOGD(TAG, "magic %02x", bootloader_hdr->magic);
+    ESP_EARLY_LOGD(TAG, "segments %02x", bootloader_hdr->segment_count);
+    ESP_EARLY_LOGD(TAG, "spi_mode %02x", bootloader_hdr->spi_mode);
+    ESP_EARLY_LOGD(TAG, "spi_speed %02x", bootloader_hdr->spi_speed);
+    ESP_EARLY_LOGD(TAG, "spi_size %02x", bootloader_hdr->spi_size);
+
+    const char *str;
+    switch (bootloader_hdr->spi_speed) {
+    case ESP_IMAGE_SPI_SPEED_DIV_2:
+        str = "24MHz";
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_3:
+        str = "16MHz";
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_4:
+        str = "12MHz";
+        break;
+    case ESP_IMAGE_SPI_SPEED_DIV_1:
+        str = "48MHz";
+        break;
+    default:
+        str = "12MHz";
+        break;
+    }
+    ESP_EARLY_LOGI(TAG, "SPI Speed      : %s", str);
+
+    /* SPI mode could have been set to QIO during boot already,
+       so test the SPI registers not the flash header */
+    uint32_t spi_ctrl = REG_READ(SPI_MEM_CTRL_REG(0));
+    if (spi_ctrl & SPI_MEM_FREAD_QIO) {
+        str = "QIO";
+    } else if (spi_ctrl & SPI_MEM_FREAD_QUAD) {
+        str = "QOUT";
+    } else if (spi_ctrl & SPI_MEM_FREAD_DIO) {
+        str = "DIO";
+    } else if (spi_ctrl & SPI_MEM_FREAD_DUAL) {
+        str = "DOUT";
+    } else if (spi_ctrl & SPI_MEM_FASTRD_MODE) {
+        str = "FAST READ";
+    } else {
+        str = "SLOW READ";
+    }
+    ESP_EARLY_LOGI(TAG, "SPI Mode       : %s", str);
+
+    switch (bootloader_hdr->spi_size) {
+    case ESP_IMAGE_FLASH_SIZE_1MB:
+        str = "1MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_2MB:
+        str = "2MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_4MB:
+        str = "4MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_8MB:
+        str = "8MB";
+        break;
+    case ESP_IMAGE_FLASH_SIZE_16MB:
+        str = "16MB";
+        break;
+    default:
+        str = "2MB";
+        break;
+    }
+    ESP_EARLY_LOGI(TAG, "SPI Flash Size : %s", str);
+}
+
+static void IRAM_ATTR bootloader_init_flash_configure(void)
+{
+    bootloader_flash_dummy_config(&bootloader_image_hdr);
+    bootloader_flash_cs_timing_config();
+}
+
+static void bootloader_spi_flash_resume(void)
+{
+    bootloader_execute_flash_command(CMD_RESUME, 0, 0, 0);
+    esp_rom_spiflash_wait_idle(&g_rom_flashchip);
+}
+
+esp_err_t bootloader_init_spi_flash(void)
+{
+    bootloader_init_flash_configure();
+#ifndef CONFIG_SPI_FLASH_ROM_DRIVER_PATCH
+    const uint32_t spiconfig = esp_rom_efuse_get_flash_gpio_info();
+    if (spiconfig != ESP_ROM_EFUSE_FLASH_DEFAULT_SPI && spiconfig != ESP_ROM_EFUSE_FLASH_DEFAULT_HSPI) {
+        ESP_EARLY_LOGE(TAG, "SPI flash pins are overridden. Enable CONFIG_SPI_FLASH_ROM_DRIVER_PATCH in menuconfig");
+        return ESP_FAIL;
+    }
+#endif
+
+    bootloader_spi_flash_resume();
+    bootloader_flash_unlock();
+
+#if CONFIG_ESPTOOLPY_FLASHMODE_QIO || CONFIG_ESPTOOLPY_FLASHMODE_QOUT
+    bootloader_enable_qio_mode();
+#endif
+
+    print_flash_info(&bootloader_image_hdr);
+    update_flash_config(&bootloader_image_hdr);
+    //ensure the flash is write-protected
+    bootloader_enable_wp();
+    return ESP_OK;
+}
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s3.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32s3.c
@@ -260,7 +260,7 @@ esp_err_t bootloader_init_spi_flash(void)
    }
 #endif

-#if CONFIG_BOOTLOADER_FLASH_DC_AWARE
+#if CONFIG_SPI_FLASH_HPM_ENABLE
    // Reset flash, clear volatile bits DC[0:1]. Make it work under default mode to boot.
    bootloader_spi_flash_reset();
 #endif
@@ -272,9 +272,7 @@ esp_err_t bootloader_init_spi_flash(void)
        bootloader_enable_qio_mode();
    }
 #endif
-#if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
-    bootloader_flash_32bits_address_map_enable(bootloader_flash_get_spi_mode());
-#endif
+
    print_flash_info(&bootloader_image_hdr);
    update_flash_config(&bootloader_image_hdr);
    //ensure the flash is write-protected
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -168,20 +168,6 @@ uint32_t bootloader_common_get_chip_ver_pkg(void);
 */
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type);

-#if !CONFIG_IDF_TARGET_ESP32
-/**
- * @brief Check the eFuse block revision
- *
- * @param[in] min_rev_full The required minimum revision of the eFuse block
- * @param[in] max_rev_full The required maximum revision of the eFuse block
- * @return
- *          - ESP_OK: The eFuse block revision is in the required range.
- *          - ESP_OK: DISABLE_BLK_VERSION_MAJOR has been set in the eFuse of the SoC. No requirements shall be checked at this time.
- *          - ESP_FAIL: The eFuse block revision of this chip does not match the requirement of the current image.
- */
-esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full);
-#endif  // !CONFIG_IDF_TARGET_ESP32
-
 /**
 * @brief Configure VDDSDIO, call this API to rise VDDSDIO to 1.9V when VDDSDIO regulator is enabled as 1.8V mode.
 */
--- a/components/bootloader_support/include/esp_app_format.h
+++ b/components/bootloader_support/include/esp_app_format.h
@@ -18,8 +18,12 @@ typedef enum {
    ESP_CHIP_ID_ESP32C3 = 0x0005, /*!< chip ID: ESP32-C3 */
    ESP_CHIP_ID_ESP32S3 = 0x0009, /*!< chip ID: ESP32-S3 */
    ESP_CHIP_ID_ESP32C2 = 0x000C, /*!< chip ID: ESP32-C2 */
+#if CONFIG_IDF_TARGET_ESP32H4_BETA_VERSION_2
+    ESP_CHIP_ID_ESP32H4 = 0x000E, /*!< chip ID: ESP32-H4 Beta2*/  // ESP32H4-TODO: IDF-3475
+#elif CONFIG_IDF_TARGET_ESP32H4_BETA_VERSION_1
+    ESP_CHIP_ID_ESP32H4 = 0x000A, /*!< chip ID: ESP32-H4 Beta1 */
+#endif
    ESP_CHIP_ID_ESP32C6 = 0x000D, /*!< chip ID: ESP32-C6 */
-    ESP_CHIP_ID_ESP32H2 = 0x0010, /*!< chip ID: ESP32-H2 */
    ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
 } __attribute__((packed)) esp_chip_id_t;

--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@@ -33,7 +33,6 @@ typedef struct {
  uint32_t segment_data[ESP_IMAGE_MAX_SEGMENTS]; /* Data offsets for each segment */
  uint32_t image_len; /* Length of image on flash, in bytes */
  uint8_t image_digest[32]; /* appended SHA-256 digest */
-  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
 } esp_image_metadata_t;

 typedef enum {
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -282,23 +282,6 @@ esp_err_t esp_secure_boot_enable_secure_features(void);
 */
 bool esp_secure_boot_cfg_verify_release_mode(void);

-
-#if !defined(BOOTLOADER_BUILD) && SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY && CONFIG_SECURE_BOOT_V2_ENABLED
-
-/** @brief Returns the verification status of the image pointed by the part_pos argument against the public key digest present at index `efuse_digest_index`
- *
- * @param index[in]         Index of public key digest present in efuse against which the image is to be verified
- * @param part_pos[in]      It is a pointer to the bootloader/app partition.
- *
- * @return
- *  - ESP_OK - if the image can be verified by the key at efuse_index.
- *  - ESP_FAIL - if the image cannot be verified by the key at efuse_index.
- *  - ESP_ERR_INVALID_ARG: Error in the passed arguments.
- */
-esp_err_t esp_secure_boot_verify_with_efuse_digest_index(int efuse_digest_index, esp_partition_pos_t *part_pos);
-
-#endif // !defined(BOOTLOADER_BUILD) && SOC_SUPPORT_SECURE_BOOT_REVOKE_KEY && CONFIG_SECURE_BOOT_V2_ENABLED
-
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/private_include/bootloader_signature.h
+++ b/components/bootloader_support/private_include/bootloader_signature.h
@@ -17,6 +17,8 @@
 #include "esp32c3/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32S3
 #include "esp32s3/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32H4
+#include "esp32h4/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32C2
 #include "esp32c2/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32C6
--- a/components/bootloader_support/private_include/bootloader_utility.h
+++ b/components/bootloader_support/private_include/bootloader_utility.h
@@ -45,7 +45,7 @@ int bootloader_utility_get_selected_boot_partition(const bootloader_state_t *bs)
 * @param[in] bs Bootloader state structure.
 * @param[in] start_index The index from which the search for images begins.
 */
-__attribute__((__noreturn__)) void bootloader_utility_load_boot_image(const bootloader_state_t *bs, int start_index);
+__attribute__((noreturn)) void bootloader_utility_load_boot_image(const bootloader_state_t *bs, int start_index);

 #ifdef CONFIG_BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP
 /**
@@ -65,7 +65,7 @@ void bootloader_utility_load_boot_image_from_deep_sleep(void);
 *
 * It is not recommended to call this function from an app (if called, the app will abort).
 */
-__attribute__((__noreturn__)) void bootloader_reset(void);
+__attribute__((noreturn)) void bootloader_reset(void);

 /**
 * @brief Do any cleanup before exiting the bootloader, before starting the app or resetting
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -27,7 +27,7 @@
 #include "bootloader_flash_priv.h"

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
-#define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define IS_MAX_REV_SET(max_chip_rev_full) (((max_chip_rev_full) != 65535) && ((max_chip_rev_full) != 0))

 static const char* TAG = "boot_comm";

@@ -57,31 +57,6 @@ int bootloader_common_get_active_otadata(esp_ota_select_entry_t *two_otadata)
    return bootloader_common_select_otadata(two_otadata, valid_two_otadata, true);
 }

-#if !CONFIG_IDF_TARGET_ESP32
-esp_err_t bootloader_common_check_efuse_blk_validity(uint32_t min_rev_full, uint32_t max_rev_full)
-{
-    esp_err_t err = ESP_OK;
-#ifndef CONFIG_IDF_ENV_FPGA
-    // Check whether the efuse block version satisfy the requirements of current image.
-    uint32_t revision = efuse_hal_blk_version();
-    uint32_t major_rev = revision / 100;
-    uint32_t minor_rev = revision % 100;
-    if (IS_FIELD_SET(min_rev_full) && !ESP_EFUSE_BLK_REV_ABOVE(revision, min_rev_full)) {
-        ESP_LOGE(TAG, "efuse blk rev = v%"PRIu32".%"PRIu32" < min rev v%"PRIu32".%"PRIu32,
-                    major_rev, minor_rev, min_rev_full / 100, min_rev_full % 100);
-        err = ESP_FAIL;
-    }
-    // If burnt `disable_blk_version_major` bit, skip the max version check
-    if ((IS_FIELD_SET(max_rev_full) && (revision > max_rev_full) && !efuse_hal_get_disable_blk_version_major())) {
-        ESP_LOGE(TAG, "efuse blk rev = v%"PRIu32".%"PRIu32" > max rev v%"PRIu32".%"PRIu32,
-                    major_rev, minor_rev, max_rev_full / 100, max_rev_full % 100);
-        err = ESP_FAIL;
-    }
-#endif
-    return err;
-}
-#endif  // !CONFIG_IDF_TARGET_ESP32
-
 esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hdr, esp_image_type type)
 {
    esp_err_t err = ESP_OK;
@@ -105,7 +80,7 @@ esp_err_t bootloader_common_check_chip_validity(const esp_image_header_t* img_hd
        }
        if (type == ESP_IMAGE_APPLICATION) {
            unsigned max_rev = img_hdr->max_chip_rev_full;
-            if ((IS_FIELD_SET(max_rev) && (revision > max_rev) && !efuse_hal_get_disable_wafer_version_major())) {
+            if ((IS_MAX_REV_SET(max_rev) && (revision > max_rev) && !efuse_ll_get_disable_wafer_version_major())) {
                ESP_LOGE(TAG, "Image requires chip rev <= v%d.%d, but chip is v%d.%d",
                         max_rev / 100, max_rev % 100,
                         major_rev, minor_rev);
@@ -146,38 +121,52 @@ int bootloader_common_select_otadata(const esp_ota_select_entry_t *two_otadata,

 #if CONFIG_BOOTLOADER_RESERVE_RTC_MEM

+#define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+
+_Static_assert(RTC_RETAIN_MEM_ADDR >= SOC_RTC_DRAM_LOW, "rtc_retain_mem_t structure size is bigger than the RTC memory size. Consider reducing RTC reserved memory size.");
+
+rtc_retain_mem_t *const rtc_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
+
+#ifndef BOOTLOADER_BUILD
+#include "heap_memory_layout.h"
+/* The app needs to be told this memory is reserved, important if configured to use RTC memory as heap.
+
+   Note that keeping this macro here only works when other symbols in this file are referenced by the app, as
+   this feature is otherwise 100% part of the bootloader. However this seems to happen in all apps.
+ */
+SOC_RESERVE_MEMORY_REGION(RTC_RETAIN_MEM_ADDR, RTC_RETAIN_MEM_ADDR + sizeof(rtc_retain_mem_t), rtc_retain_mem);
+#endif
+
 static uint32_t rtc_retain_mem_size(void) {
-#if CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC && !CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC_IN_CRC
+#ifdef CONFIG_BOOTLOADER_CUSTOM_RESERVE_RTC
    /* A custom memory has been reserved by the user, do not consider this memory into CRC calculation as it may change without
     * the have the user updating the CRC. Return the offset of the custom field, which is equivalent to size of the structure
     * minus the size of everything after (including) `custom` */
    return offsetof(rtc_retain_mem_t, custom);
 #else
-    return sizeof(rtc_retain_mem_t) - sizeof(bootloader_common_get_rtc_retain_mem()->crc);
+    return sizeof(rtc_retain_mem_t) - sizeof(rtc_retain_mem->crc);
 #endif
 }

 static bool is_retain_mem_valid(void)
 {
-    rtc_retain_mem_t* rtc_retain_mem = bootloader_common_get_rtc_retain_mem();
    return esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size()) == rtc_retain_mem->crc && rtc_retain_mem->crc != UINT32_MAX;
 }

 static void update_rtc_retain_mem_crc(void)
 {
-    rtc_retain_mem_t* rtc_retain_mem = bootloader_common_get_rtc_retain_mem();
    rtc_retain_mem->crc = esp_rom_crc32_le(UINT32_MAX, (uint8_t*)rtc_retain_mem, rtc_retain_mem_size());
 }

 NOINLINE_ATTR void bootloader_common_reset_rtc_retain_mem(void)
 {
-    hal_memset(bootloader_common_get_rtc_retain_mem(), 0, sizeof(rtc_retain_mem_t));
+    hal_memset(rtc_retain_mem, 0, sizeof(rtc_retain_mem_t));
 }

 uint16_t bootloader_common_get_rtc_retain_mem_reboot_counter(void)
 {
    if (is_retain_mem_valid()) {
-        return bootloader_common_get_rtc_retain_mem()->reboot_counter;
+        return rtc_retain_mem->reboot_counter;
    }
    return 0;
 }
@@ -187,13 +176,12 @@ void bootloader_common_set_rtc_retain_mem_factory_reset_state(void)
    if (!is_retain_mem_valid()) {
        bootloader_common_reset_rtc_retain_mem();
    }
-    bootloader_common_get_rtc_retain_mem()->flags.factory_reset_state = true;
+    rtc_retain_mem->flags.factory_reset_state = true;
    update_rtc_retain_mem_crc();
 }

 bool bootloader_common_get_rtc_retain_mem_factory_reset_state(void)
 {
-    rtc_retain_mem_t* rtc_retain_mem = bootloader_common_get_rtc_retain_mem();
    if (is_retain_mem_valid()) {
        bool factory_reset_state = rtc_retain_mem->flags.factory_reset_state;
        if (factory_reset_state == true) {
@@ -208,14 +196,13 @@ bool bootloader_common_get_rtc_retain_mem_factory_reset_state(void)
 esp_partition_pos_t* bootloader_common_get_rtc_retain_mem_partition(void)
 {
    if (is_retain_mem_valid()) {
-        return &bootloader_common_get_rtc_retain_mem()->partition;
+        return &rtc_retain_mem->partition;
    }
    return NULL;
 }

 void bootloader_common_update_rtc_retain_mem(esp_partition_pos_t* partition, bool reboot_counter)
 {
-    rtc_retain_mem_t* rtc_retain_mem = bootloader_common_get_rtc_retain_mem();
    if (reboot_counter) {
        if (!is_retain_mem_valid()) {
            bootloader_common_reset_rtc_retain_mem();
@@ -237,14 +224,7 @@ void bootloader_common_update_rtc_retain_mem(esp_partition_pos_t* partition, boo

 rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 {
-#ifdef BOOTLOADER_BUILD
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
-    static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
-    return s_bootloader_retain_mem;
-#else
-    static __attribute__((section(".bootloader_data_rtc_mem"))) rtc_retain_mem_t s_bootloader_retain_mem;
-    return &s_bootloader_retain_mem;
-#endif // !BOOTLOADER_BUILD
+    return rtc_retain_mem;
 }

 #endif // CONFIG_BOOTLOADER_RESERVE_RTC_MEM
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@@ -1,12 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 #include "sdkconfig.h"
 #include "bootloader_console.h"
-#include "soc/soc_caps.h"
 #include "soc/uart_periph.h"
 #include "soc/uart_channel.h"
 #include "soc/io_mux_reg.h"
@@ -19,9 +18,6 @@
 #include "esp32s2/rom/usb/cdc_acm.h"
 #include "esp32s2/rom/usb/usb_common.h"
 #endif
-#if CONFIG_ESP_CONSOLE_USB_CDC
-#include "hal/usb_wrap_ll.h"
-#endif
 #include "esp_rom_gpio.h"
 #include "esp_rom_uart.h"
 #include "esp_rom_sys.h"
@@ -99,11 +95,8 @@ void bootloader_console_init(void)
 #endif

    esp_rom_uart_usb_acm_init(s_usb_cdc_buf, sizeof(s_usb_cdc_buf));
-    esp_rom_uart_set_as_console(ESP_ROM_USB_OTG_NUM);
+    esp_rom_uart_set_as_console(ESP_ROM_UART_USB);
    esp_rom_install_channel_putc(1, bootloader_console_write_char_usb);
-    // Ensure that the USB FSLS PHY is mapped to the USB WRAP
-    usb_wrap_ll_phy_enable_pad(&USB_WRAP, true);
-    usb_wrap_ll_phy_enable_external(&USB_WRAP, false);
 }
 #endif //CONFIG_ESP_CONSOLE_USB_CDC

--- a/components/bootloader_support/src/bootloader_efuse.c
+++ b/components/bootloader_support/src/bootloader_efuse.c
@@ -27,6 +27,9 @@ int bootloader_clock_get_rated_freq_mhz(void)
 #elif CONFIG_IDF_TARGET_ESP32C3
    return 160;

+#elif CONFIG_IDF_TARGET_ESP32H4
+    return 96;
+
 #elif CONFIG_IDF_TARGET_ESP32C6
    return 160;

--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@@ -41,17 +41,10 @@ esp_err_t bootloader_read_bootloader_header(void)

 esp_err_t bootloader_check_bootloader_validity(void)
 {
-    unsigned int chip_revision = efuse_hal_chip_revision();
-    unsigned int chip_major_rev = chip_revision / 100;
-    unsigned int chip_minor_rev = chip_revision % 100;
-    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", chip_major_rev, chip_minor_rev);
-/* ESP32 doesn't have more memory and more efuse bits for block major version. */
-#if !CONFIG_IDF_TARGET_ESP32
-    unsigned int efuse_revision = efuse_hal_blk_version();
-    unsigned int efuse_major_rev = efuse_revision / 100;
-    unsigned int efuse_minor_rev = efuse_revision % 100;
-    ESP_EARLY_LOGI(TAG, "efuse block revision: v%d.%d", efuse_major_rev, efuse_minor_rev);
-#endif  // !CONFIG_IDF_TARGET_ESP32
+    unsigned int revision = efuse_hal_chip_revision();
+    unsigned int major = revision / 100;
+    unsigned int minor = revision % 100;
+    ESP_EARLY_LOGI(TAG, "chip revision: v%d.%d", major, minor);
    /* compare with the one set in bootloader image header */
    if (bootloader_common_check_chip_validity(&bootloader_image_hdr, ESP_IMAGE_BOOTLOADER) != ESP_OK) {
        return ESP_FAIL;
--- a/components/bootloader_support/src/bootloader_panic.c
+++ b/components/bootloader_support/src/bootloader_panic.c
@@ -26,11 +26,9 @@ void abort(void)
 #if !CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT
    esp_rom_printf("abort() was called at PC 0x%08x\r\n", (intptr_t)__builtin_return_address(0) - 3);
 #endif
-#if CONFIG_ESP_DEBUG_OCDAWARE
    if (esp_cpu_dbgr_is_attached()) {
        esp_cpu_dbgr_break();
    }
-#endif
    while (1) {
    }
 }
--- a/components/bootloader_support/src/bootloader_random.c
+++ b/components/bootloader_support/src/bootloader_random.c
@@ -8,10 +8,6 @@
 #include "esp_cpu.h"
 #include "soc/wdev_reg.h"

-#if SOC_LP_TIMER_SUPPORTED
-#include "hal/lp_timer_hal.h"
-#endif
-
 #ifndef BOOTLOADER_BUILD
 #include "esp_random.h"
 #include "esp_private/periph_ctrl.h"
@@ -24,14 +20,9 @@
 #else

 #if !defined CONFIG_IDF_TARGET_ESP32S3
-  #if (defined CONFIG_IDF_TARGET_ESP32C6 || defined CONFIG_IDF_TARGET_ESP32H2)
-    #define RNG_CPU_WAIT_CYCLE_NUM (80 * 16) // Keep the byte sampling frequency in the ~62KHz range which has been
-                                             // tested.
-  #else
-    #define RNG_CPU_WAIT_CYCLE_NUM (80 * 32 * 2) /* extra factor of 2 is precautionary */
-  #endif
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 32 * 2) /* extra factor of 2 is precautionary */
 #else
-  #define RNG_CPU_WAIT_CYCLE_NUM (80 * 23) /* 45 KHz reading frequency is the maximum we have tested so far on S3 */
+#define RNG_CPU_WAIT_CYCLE_NUM (80 * 23) /* 45 KHz reading frequency is the maximum we have tested so far on S3 */
 #endif

 __attribute__((weak)) void bootloader_fill_random(void *buffer, size_t length)
@@ -43,21 +34,6 @@
    assert(buffer != NULL);

    for (size_t i = 0; i < length; i++) {
-#if SOC_LP_TIMER_SUPPORTED
-        random = REG_READ(WDEV_RND_REG);
-        start = esp_cpu_get_cycle_count();
-        do {
-            random ^= REG_READ(WDEV_RND_REG);
-            now = esp_cpu_get_cycle_count();
-        } while (now - start < RNG_CPU_WAIT_CYCLE_NUM);
-
-        // XOR the RT slow clock, which is asynchronous, to add some entropy and improve
-        // the distribution
-        uint32_t current_rtc_timer_counter = (lp_timer_hal_get_cycle_count() & 0xFF);
-        random = random ^ current_rtc_timer_counter;
-
-        buffer_bytes[i] = random & 0xFF;
-#else
        if (i == 0 || i % 4 == 0) { /* redundant check is for a compiler warning */
            /* in bootloader with ADC feeding HWRNG, we accumulate 1
               bit of entropy per 40 APB cycles (==80 CPU cycles.)
@@ -74,7 +50,6 @@
            } while (now - start < RNG_CPU_WAIT_CYCLE_NUM);
        }
        buffer_bytes[i] = random >> ((i % 4) * 8);
-#endif
    }
 }

--- a/components/bootloader_support/src/bootloader_random_esp32c6.c
+++ b/components/bootloader_support/src/bootloader_random_esp32c6.c
@@ -1,96 +1,22 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 #include "sdkconfig.h"
 #include "bootloader_random.h"
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-#include "soc/apb_saradc_reg.h"
-#include "soc/pmu_reg.h"
-#include "hal/regi2c_ctrl.h"
-#include "soc/regi2c_saradc.h"
 #include "esp_log.h"

-static const uint32_t SAR2_CHANNEL = 9;
-static const uint32_t PATTERN_BIT_WIDTH = 6;
-static const uint32_t SAR1_ATTEN = 1;
-static const uint32_t SAR2_ATTEN = 1;
+static const char *TAG = "bootloader_random";

 void bootloader_random_enable(void)
 {
-    // pull SAR ADC out of reset
-    REG_SET_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_RST_EN);
-    REG_CLR_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_RST_EN);
-
-    // enable SAR ADC APB clock
-    REG_SET_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_REG_CLK_EN);
-
-    // enable ADC_CTRL_CLK (SAR ADC function clock)
-    REG_SET_BIT(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_EN);
-
-    // select XTAL clock (40 MHz) source for ADC_CTRL_CLK
-    REG_SET_FIELD(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_SEL, 0);
-
-    // set the clock divider for ADC_CTRL_CLK to default value (in case it has been changed)
-    REG_SET_FIELD(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_DIV_NUM, 0);
-
-    // some ADC sensor registers are in power group PERIF_I2C and need to be enabled via PMU
-    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
-    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
-
-    // Config ADC circuit (Analog part) with I2C(HOST ID 0x69) and chose internal voltage as sampling source
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR , 2);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR   , 1);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC1_ENCAL_REF_ADDR, 1);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC2_ENCAL_REF_ADDR, 1);
-
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_INITIAL_CODE_HIGH_ADDR, 0x08);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_INITIAL_CODE_LOW_ADDR, 0x66);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, 0x08);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, 0x66);
-
-    // create patterns and set them in pattern table
-    uint32_t pattern_one = (SAR2_CHANNEL << 2) | SAR2_ATTEN; // we want channel 9 with max attenuation
-    uint32_t pattern_two = (SAR2_CHANNEL << 2) | SAR1_ATTEN; // we want channel 9 with max attenuation
-    uint32_t pattern_table = 0 | (pattern_two << 3 * PATTERN_BIT_WIDTH) | pattern_one << 2 * PATTERN_BIT_WIDTH;
-    REG_WRITE(APB_SARADC_SAR_PATT_TAB1_REG, pattern_table);
-
-    // set pattern length to 2 (APB_SARADC_SAR_PATT_LEN counts from 0)
-    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SARADC_SAR_PATT_LEN, 1);
-
-    // Same as in C3
-    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SARADC_SAR_CLK_DIV, 15);
-
-    // set timer expiry (timer is ADC_CTRL_CLK)
-    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_TARGET, 200);
-
-    // enable timer
-    REG_SET_BIT(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_EN);
+    // TODO: IDF-5352
+    ESP_EARLY_LOGW(TAG, "bootloader_random_enable() has not been implemented yet");
 }

 void bootloader_random_disable(void)
 {
-    // disable timer
-    REG_CLR_BIT(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_EN);
-
-    // Write reset value of this register
-    REG_WRITE(APB_SARADC_SAR_PATT_TAB1_REG, 0xFFFFFF);
-
-    // Revert ADC I2C configuration and initial voltage source setting
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_INITIAL_CODE_HIGH_ADDR, 0x60);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR2_INITIAL_CODE_LOW_ADDR, 0x0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, 0x60);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, 0x0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_DTEST_RTC_ADDR, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC_ENT_RTC_ADDR, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC1_ENCAL_REF_ADDR, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SARADC2_ENCAL_REF_ADDR, 0);
-
-    // disable ADC_CTRL_CLK (SAR ADC function clock)
-    REG_WRITE(PCR_SARADC_CLKM_CONF_REG, 0x00404000);
-
-    // Set PCR_SARADC_CONF_REG to initial state
-    REG_WRITE(PCR_SARADC_CONF_REG, 0x5);
+    // TODO: IDF-5352
+    ESP_EARLY_LOGW(TAG, "bootloader_random_enable() has not been implemented yet");
 }
--- a/components/bootloader_support/src/bootloader_random_esp32h2.c
+++ b/components/bootloader_support/src/bootloader_random_esp32h2.c
@@ -1,88 +1,21 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 #include "sdkconfig.h"
 #include "bootloader_random.h"
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-#include "soc/apb_saradc_reg.h"
-#include "soc/pmu_reg.h"
-#include "hal/regi2c_ctrl.h"
-#include "soc/regi2c_saradc.h"
 #include "esp_log.h"

-static const uint32_t SAR2_CHANNEL = 9;
-static const uint32_t PATTERN_BIT_WIDTH = 6;
-static const uint32_t SAR1_ATTEN = 1;
-static const uint32_t SAR2_ATTEN = 1;
-
+static const char *TAG = "bootloader_random";
 void bootloader_random_enable(void)
 {
-    REG_SET_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_RST_EN);
-    REG_CLR_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_RST_EN);
-
-    REG_SET_BIT(PCR_SARADC_CONF_REG, PCR_SARADC_REG_CLK_EN);
-
-    REG_SET_BIT(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_EN);
-
-    // select XTAL clock (40 MHz) source for ADC_CTRL_CLK
-    REG_SET_FIELD(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_SEL, 0);
-
-    REG_SET_FIELD(PCR_SARADC_CLKM_CONF_REG, PCR_SARADC_CLKM_DIV_NUM, 0);
-
-    // some ADC sensor registers are in power group PERIF_I2C and need to be enabled via PMU
-    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
-
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_DTEST, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_ENT_SAR, 1);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_EN_TOUT_SAR1_BUS, 1);
-
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR2_INIT_CODE_MSB, 0X08);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR2_INIT_CODE_LSB, 0X66);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR1_INIT_CODE_MSB, 0X08);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR1_INIT_CODE_LSB, 0X66);
-
-    // create patterns and set them in pattern table
-    uint32_t pattern_one = (SAR2_CHANNEL << 2) | SAR2_ATTEN;
-    uint32_t pattern_two = SAR1_ATTEN; // we want channel 0 with max attenuation, channel doesn't really matter here
-    uint32_t pattern_table = 0 | (pattern_two << 3 * PATTERN_BIT_WIDTH) | pattern_one << 2 * PATTERN_BIT_WIDTH;
-    REG_WRITE(APB_SARADC_SAR_PATT_TAB1_REG, pattern_table);
-
-    // set pattern length to 2 (APB_SARADC_SAR_PATT_LEN counts from 0)
-    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SARADC_SAR_PATT_LEN, 0);
-
-    // Same as in C3
-    REG_SET_FIELD(APB_SARADC_CTRL_REG, APB_SARADC_SARADC_SAR_CLK_DIV, 15);
-
-    // set timer expiry (timer is ADC_CTRL_CLK)
-    REG_SET_FIELD(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_TARGET, 200);
-
-    // ENABLE_TIMER
-    REG_SET_BIT(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_EN);
+    // ESP32H2-TODO: IDF-6274
+    ESP_EARLY_LOGW(TAG, "bootloader_random_enable() has not been implemented yet");
 }

 void bootloader_random_disable(void)
 {
-    // disable timer
-    REG_CLR_BIT(APB_SARADC_CTRL2_REG, APB_SARADC_SARADC_TIMER_EN);
-
-    // Write reset value of this register
-    REG_WRITE(APB_SARADC_SAR_PATT_TAB1_REG, 0xFFFFFF);
-
-    // Revert ADC I2C configuration and initial voltage source setting
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR2_INIT_CODE_MSB, 0x60);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR2_INIT_CODE_LSB, 0x0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR1_INIT_CODE_MSB, 0x60);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_SAR1_INIT_CODE_LSB, 0x0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_DTEST, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_ENT_SAR, 0);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SARADC_EN_TOUT_SAR1_BUS, 0);
-
-    // disable ADC_CTRL_CLK (SAR ADC function clock)
-    REG_WRITE(PCR_SARADC_CLKM_CONF_REG, 0x00404000);
-
-    // Set PCR_SARADC_CONF_REG to initial state
-    REG_WRITE(PCR_SARADC_CONF_REG, 0x5);
+    // ESP32H2-TODO: IDF-6274
+    ESP_EARLY_LOGW(TAG, "bootloader_random_disable() has not been implemented yet");
 }
--- a/components/bootloader_support/src/bootloader_random_esp32h4.c
+++ b/components/bootloader_support/src/bootloader_random_esp32h4.c
@@ -0,0 +1,24 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "sdkconfig.h"
+#include "bootloader_random.h"
+#include "esp_log.h"
+#include "soc/syscon_reg.h"
+#include "soc/rtc_cntl_reg.h"
+#include "soc/apb_saradc_reg.h"
+#include "soc/system_reg.h"
+#include "esp_private/regi2c_ctrl.h"
+
+// ESP32H4-TODO: IDF-3381
+void bootloader_random_enable(void)
+{
+
+}
+
+void bootloader_random_disable(void)
+{
+
+}
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -28,6 +28,12 @@
 #include "esp32c3/rom/uart.h"
 #include "esp32c3/rom/gpio.h"
 #include "esp32c3/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32H4
+#include "esp32h4/rom/efuse.h"
+#include "esp32h4/rom/crc.h"
+#include "esp32h4/rom/uart.h"
+#include "esp32h4/rom/gpio.h"
+#include "esp32h4/rom/secure_boot.h"
 #elif CONFIG_IDF_TARGET_ESP32C2
 #include "esp32c2/rom/efuse.h"
 #include "esp32c2/rom/crc.h"
--- a/components/bootloader_support/src/esp32/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32/bootloader_soc.c
@@ -3,10 +3,18 @@
 *
 * SPDX-License-Identifier: Apache-2.0
 */
-
 #include <stdbool.h>

-//Not supported but common bootloader calls the function. Do nothing
+void bootloader_ana_super_wdt_reset_config(bool enable)
+{
+    (void)enable;
+}
+
+void bootloader_ana_bod_reset_config(bool enable)
+{
+    (void)enable;
+}
+
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
    (void)enable;
--- a/components/bootloader_support/src/esp32c2/bootloader_esp32c2.c
+++ b/components/bootloader_support/src/esp32c2/bootloader_esp32c2.c
@@ -34,7 +34,6 @@
 #include "bootloader_mem.h"
 #include "bootloader_console.h"
 #include "bootloader_flash_priv.h"
-#include "bootloader_soc.h"
 #include "esp_private/bootloader_flash_internal.h"
 #include "esp_efuse.h"
 #include "hal/mmu_hal.h"
@@ -79,19 +78,10 @@ static void bootloader_super_wdt_auto_feed(void)
    REG_WRITE(RTC_CNTL_SWD_WPROTECT_REG, 0);
 }

-static inline void bootloader_ana_reset_config(void)
-{
-    //Enable super WDT reset.
-    bootloader_ana_super_wdt_reset_config(true);
-    //Enable BOD reset
-    bootloader_ana_bod_reset_config(true);
-}
-
 esp_err_t bootloader_init(void)
 {
    esp_err_t ret = ESP_OK;

-    bootloader_ana_reset_config();
    bootloader_super_wdt_auto_feed();

 // In RAM_APP, memory will be initialized in `call_start_cpu0`
--- a/components/bootloader_support/src/esp32c2/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c2/bootloader_soc.c
@@ -3,34 +3,19 @@
 *
 * SPDX-License-Identifier: Apache-2.0
 */
-
 #include <stdbool.h>
-#include "soc/rtc_cntl_reg.h"

 void bootloader_ana_super_wdt_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
-
-    if (enable) {
-        REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
-        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    }
+    (void)enable; // ESP32-C2 has none of these features.
 }

 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
-
-    if (enable) {
-        REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);
-    } else {
-        REG_CLR_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);
-    }
+    (void)enable; // ESP32-C2 has none of these features.
 }

-//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
-    (void)enable;
+    (void)enable; // ESP32-C2 has none of these features.
 }
--- a/components/bootloader_support/src/esp32c3/bootloader_esp32c3.c
+++ b/components/bootloader_support/src/esp32c3/bootloader_esp32c3.c
@@ -96,29 +96,29 @@ static inline void bootloader_hardware_init(void)

 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable super WDT reset.
-    bootloader_ana_super_wdt_reset_config(true);
-
    /*
-      For origin chip & ECO1: brownout & clock glitch reset not available
-      For ECO2: fix brownout reset bug
-      For ECO3: fix clock glitch reset bug
+      For origin chip & ECO1: only support swt reset;
+      For ECO2: fix brownout reset bug, support swt & brownout reset;
+      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
    */
    switch (efuse_hal_chip_revision()) {
        case 0:
        case 1:
-            //Disable BOD and GLITCH reset
+            //Enable WDT reset. Disable BOR and GLITCH reset
+            bootloader_ana_super_wdt_reset_config(true);
            bootloader_ana_bod_reset_config(false);
            bootloader_ana_clock_glitch_reset_config(false);
            break;
        case 2:
-            //Enable BOD reset. Disable GLITCH reset
+            //Enable WDT and BOR reset. Disable GLITCH reset
+            bootloader_ana_super_wdt_reset_config(true);
            bootloader_ana_bod_reset_config(true);
            bootloader_ana_clock_glitch_reset_config(false);
            break;
        case 3:
        default:
-            //Enable BOD, and GLITCH reset
+            //Enable WDT, BOR, and GLITCH reset
+            bootloader_ana_super_wdt_reset_config(true);
            bootloader_ana_bod_reset_config(true);
            bootloader_ana_clock_glitch_reset_config(true);
            break;
--- a/components/bootloader_support/src/esp32c3/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c3/bootloader_soc.c
@@ -12,15 +12,15 @@ void bootloader_ana_super_wdt_reset_config(bool enable)
    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);

    if (enable) {
-        REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
-    } else {
        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
    }
 }

 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOD_RST);
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);

    if (enable) {
        REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);
--- a/components/bootloader_support/src/esp32c6/bootloader_esp32c6.c
+++ b/components/bootloader_support/src/esp32c6/bootloader_esp32c6.c
@@ -103,10 +103,33 @@ static inline void bootloader_hardware_init(void)

 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable super WDT reset.
-    bootloader_ana_super_wdt_reset_config(true);
-    //Enable BOD reset
-    bootloader_ana_bod_reset_config(true);
+    // TODO: IDF-5990 copied from C3, need update
+    // Have removed bootloader_ana_super_wdt_reset_config for now; can be evaluated later to see whether needs to add it back
+    /*
+      For origin chip & ECO1: only support swt reset;
+      For ECO2: fix brownout reset bug, support swt & brownout reset;
+      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
+    */
+    uint8_t chip_version = efuse_hal_get_minor_chip_version();
+    switch (chip_version) {
+        case 0:
+        case 1:
+            //Disable BOR and GLITCH reset
+            bootloader_ana_bod_reset_config(false);
+            bootloader_ana_clock_glitch_reset_config(false);
+            break;
+        case 2:
+            //Enable BOR reset. Disable GLITCH reset
+            bootloader_ana_bod_reset_config(true);
+            bootloader_ana_clock_glitch_reset_config(false);
+            break;
+        case 3:
+        default:
+            //Enable BOR, and GLITCH reset
+            bootloader_ana_bod_reset_config(true);
+            bootloader_ana_clock_glitch_reset_config(true);
+            break;
+    }
 }

 esp_err_t bootloader_init(void)
--- a/components/bootloader_support/src/esp32c6/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c6/bootloader_soc.c
@@ -1,24 +1,15 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 #include <stdbool.h>
-#include <assert.h>
 #include "soc/soc.h"
 #include "soc/lp_analog_peri_reg.h"

-void bootloader_ana_super_wdt_reset_config(bool enable)
-{
-    //C6 doesn't support bypass super WDT reset
-    assert(enable);
-    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_SUPER_WDT_RST);
-}
-
 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_BOD_RST);
-
+    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_BOR_RST);
    if (enable) {
        REG_SET_BIT(LP_ANALOG_PERI_LP_ANA_BOD_MODE1_CNTL_REG, LP_ANALOG_PERI_LP_ANA_BOD_MODE1_RESET_ENA);
    } else {
@@ -26,8 +17,12 @@ void bootloader_ana_bod_reset_config(bool enable)
    }
 }

-//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
-    (void)enable;
+    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_GLITCH_RST);
+    if (enable) {
+        REG_SET_BIT(LP_ANALOG_PERI_LP_ANA_CK_GLITCH_CNTL_REG, LP_ANALOG_PERI_LP_ANA_CK_GLITCH_RESET_ENA);
+    } else {
+        REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_CK_GLITCH_CNTL_REG, LP_ANALOG_PERI_LP_ANA_CK_GLITCH_RESET_ENA);
+    }
 }
--- a/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
+++ b/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
@@ -86,18 +86,40 @@ static void bootloader_super_wdt_auto_feed(void)

 static inline void bootloader_hardware_init(void)
 {
+    // TODO: IDF-6267
    /* Enable analog i2c master clock */
    SET_PERI_REG_MASK(MODEM_LPCON_CLK_CONF_REG, MODEM_LPCON_CLK_I2C_MST_EN);
-    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
-
 }

 static inline void bootloader_ana_reset_config(void)
 {
-    //Enable super WDT reset.
-    bootloader_ana_super_wdt_reset_config(true);
-    //Enable BOD reset
-    bootloader_ana_bod_reset_config(true);
+    // TODO: IDF-5990 copied from C6, need update
+    // Have removed bootloader_ana_super_wdt_reset_config for now; can be evaluated later to see whether needs to add it back
+    /*
+      For origin chip & ECO1: only support swt reset;
+      For ECO2: fix brownout reset bug, support swt & brownout reset;
+      For ECO3: fix clock glitch reset bug, support all reset, include: swt & brownout & clock glitch reset.
+    */
+    uint8_t chip_version = efuse_hal_get_minor_chip_version();
+    switch (chip_version) {
+        case 0:
+        case 1:
+            //Disable BOR and GLITCH reset
+            bootloader_ana_bod_reset_config(false);
+            bootloader_ana_clock_glitch_reset_config(false);
+            break;
+        case 2:
+            //Enable BOR reset. Disable GLITCH reset
+            bootloader_ana_bod_reset_config(true);
+            bootloader_ana_clock_glitch_reset_config(false);
+            break;
+        case 3:
+        default:
+            //Enable BOR, and GLITCH reset
+            bootloader_ana_bod_reset_config(true);
+            bootloader_ana_clock_glitch_reset_config(true);
+            break;
+    }
 }

 esp_err_t bootloader_init(void)
--- a/components/bootloader_support/src/esp32h2/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32h2/bootloader_soc.c
@@ -1,22 +1,20 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 #include <stdbool.h>
+#include "soc/soc.h"
 #include "soc/lp_analog_peri_reg.h"

 void bootloader_ana_super_wdt_reset_config(bool enable)
 {
-    //H2 doesn't support bypass super WDT reset
-    assert(enable);
-    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_SUPER_WDT_RST);
+    // ESP32H2 has removed the super wdt
 }

 void bootloader_ana_bod_reset_config(bool enable)
 {
-    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_BOD_RST);
-
+    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_BOR_RST);
    if (enable) {
        REG_SET_BIT(LP_ANALOG_PERI_LP_ANA_BOD_MODE1_CNTL_REG, LP_ANALOG_PERI_LP_ANA_BOD_MODE1_RESET_ENA);
    } else {
@@ -24,8 +22,12 @@ void bootloader_ana_bod_reset_config(bool enable)
    }
 }

-//Not supported but common bootloader calls the function. Do nothing
 void bootloader_ana_clock_glitch_reset_config(bool enable)
 {
-    (void)enable;
+    REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_FIB_ENABLE_REG, LP_ANALOG_PERI_LP_ANA_FIB_GLITCH_RST);
+    if (enable) {
+        REG_SET_BIT(LP_ANALOG_PERI_LP_ANA_CK_GLITCH_CNTL_REG, LP_ANALOG_PERI_LP_ANA_CK_GLITCH_RESET_ENA);
+    } else {
+        REG_CLR_BIT(LP_ANALOG_PERI_LP_ANA_CK_GLITCH_CNTL_REG, LP_ANALOG_PERI_LP_ANA_CK_GLITCH_RESET_ENA);
+    }
 }
--- a/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
@@ -1,18 +1,15 @@
 /*
- * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

-#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
-#include "hal/spi_flash_encrypted_ll.h"
-#include "soc/soc_caps.h"
 #include "sdkconfig.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -36,14 +33,6 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

-#if defined(CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE) && defined(SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND)
-    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
-        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
-        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
-        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
-    }
-#endif
-
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
    // otherwise the Flash Encryption key cannot be read protected
--- a/components/bootloader_support/src/esp32h4/bootloader_esp32h4.c
+++ b/components/bootloader_support/src/esp32h4/bootloader_esp32h4.c
@@ -0,0 +1,155 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdint.h>
+#include "sdkconfig.h"
+#include "esp_attr.h"
+#include "esp_log.h"
+#include "esp_image_format.h"
+#include "flash_qio_mode.h"
+#include "esp_rom_gpio.h"
+#include "esp_rom_efuse.h"
+#include "esp_rom_uart.h"
+#include "esp_rom_sys.h"
+#include "esp_rom_spiflash.h"
+#include "soc/efuse_reg.h"
+#include "soc/gpio_sig_map.h"
+#include "soc/io_mux_reg.h"
+#include "soc/assist_debug_reg.h"
+#include "esp_cpu.h"
+#include "soc/rtc.h"
+#include "soc/rtc_cntl_reg.h"
+#include "soc/spi_periph.h"
+#include "soc/extmem_reg.h"
+#include "soc/io_mux_reg.h"
+#include "soc/system_reg.h"
+#include "esp32h4/rom/efuse.h"
+#include "esp32h4/rom/ets_sys.h"
+#include "bootloader_common.h"
+#include "bootloader_init.h"
+#include "bootloader_clock.h"
+#include "bootloader_flash_config.h"
+#include "bootloader_mem.h"
+#include "bootloader_console.h"
+#include "bootloader_flash_priv.h"
+#include "bootloader_soc.h"
+#include "esp_private/bootloader_flash_internal.h"
+#include "hal/mmu_hal.h"
+#include "hal/cache_hal.h"
+
+static const char *TAG = "boot.esp32h4";
+
+static void wdt_reset_cpu0_info_enable(void)
+{
+    REG_SET_BIT(SYSTEM_CPU_PERI_CLK_EN_REG, SYSTEM_CLK_EN_ASSIST_DEBUG);
+    REG_CLR_BIT(SYSTEM_CPU_PERI_RST_EN_REG, SYSTEM_RST_EN_ASSIST_DEBUG);
+    REG_WRITE(ASSIST_DEBUG_CORE_0_RCD_EN_REG, ASSIST_DEBUG_CORE_0_RCD_PDEBUGEN | ASSIST_DEBUG_CORE_0_RCD_RECORDEN);
+}
+
+static void wdt_reset_info_dump(int cpu)
+{
+    (void) cpu;
+    // saved PC was already printed by the ROM bootloader.
+    // nothing to do here.
+}
+
+static void bootloader_check_wdt_reset(void)
+{
+    int wdt_rst = 0;
+    soc_reset_reason_t rst_reason = esp_rom_get_reset_reason(0);
+    if (rst_reason == RESET_REASON_CORE_RTC_WDT || rst_reason == RESET_REASON_CORE_MWDT0 || rst_reason == RESET_REASON_CORE_MWDT1 ||
+        rst_reason == RESET_REASON_CPU0_MWDT0 || rst_reason == RESET_REASON_CPU0_MWDT1 || rst_reason == RESET_REASON_CPU0_RTC_WDT) {
+        ESP_LOGW(TAG, "PRO CPU has been reset by WDT.");
+        wdt_rst = 1;
+    }
+    if (wdt_rst) {
+        // if reset by WDT dump info from trace port
+        wdt_reset_info_dump(0);
+    }
+    wdt_reset_cpu0_info_enable();
+}
+
+static void bootloader_super_wdt_auto_feed(void)
+{
+    REG_WRITE(RTC_CNTL_SWD_WPROTECT_REG, RTC_CNTL_SWD_WKEY_VALUE);
+    REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_AUTO_FEED_EN);
+    REG_WRITE(RTC_CNTL_SWD_WPROTECT_REG, 0);
+}
+
+static inline void bootloader_hardware_init(void)
+{
+
+}
+
+static inline void bootloader_ana_reset_config(void)
+{
+    //Enable WDT, BOR, and GLITCH reset
+    bootloader_ana_super_wdt_reset_config(true);
+    bootloader_ana_bod_reset_config(true);
+    bootloader_ana_clock_glitch_reset_config(true);
+}
+
+esp_err_t bootloader_init(void)
+{
+    esp_err_t ret = ESP_OK;
+
+    bootloader_hardware_init();
+    bootloader_ana_reset_config();
+    bootloader_super_wdt_auto_feed();
+
+// In RAM_APP, memory will be initialized in `call_start_cpu0`
+#if !CONFIG_APP_BUILD_TYPE_RAM
+    // protect memory region
+    bootloader_init_mem();
+    /* check that static RAM is after the stack */
+    assert(&_bss_start <= &_bss_end);
+    assert(&_data_start <= &_data_end);
+    // clear bss section
+    bootloader_clear_bss_section();
+#endif // !CONFIG_APP_BUILD_TYPE_RAM
+
+    // config clock
+    bootloader_clock_configure();
+    // initialize console, from now on, we can use esp_log
+    bootloader_console_init();
+    /* print 2nd bootloader banner */
+    bootloader_print_banner();
+
+#if !CONFIG_APP_BUILD_TYPE_PURE_RAM_APP
+    //init cache hal
+    cache_hal_init();   //TODO IDF-4649
+    //init mmu
+    mmu_hal_init();
+    // update flash ID
+    bootloader_flash_update_id();
+    // Check and run XMC startup flow
+    if ((ret = bootloader_flash_xmc_startup()) != ESP_OK) {
+        ESP_LOGE(TAG, "failed when running XMC startup flow, reboot!");
+        return ret;
+    }
+#if !CONFIG_APP_BUILD_TYPE_RAM
+    // read bootloader header
+    if ((ret = bootloader_read_bootloader_header()) != ESP_OK) {
+        return ret;
+    }
+    // read chip revision and check if it's compatible to bootloader
+    if ((ret = bootloader_check_bootloader_validity()) != ESP_OK) {
+        return ret;
+    }
+#endif // !CONFIG_APP_BUILD_TYPE_RAM
+    // initialize spi flash
+    if ((ret = bootloader_init_spi_flash()) != ESP_OK) {
+        return ret;
+    }
+#endif // #if !CONFIG_APP_BUILD_TYPE_PURE_RAM_APP
+
+    // check whether a WDT reset happend
+    bootloader_check_wdt_reset();
+    // config WDT
+    bootloader_config_wdt();
+    // enable RNG early entropy source
+    bootloader_enable_random();
+    return ret;
+}
--- a/components/bootloader_support/src/esp32h4/bootloader_sha.c
+++ b/components/bootloader_support/src/esp32h4/bootloader_sha.c
@@ -0,0 +1,40 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "bootloader_sha.h"
+#include <stdbool.h>
+#include <string.h>
+#include <assert.h>
+#include <sys/param.h>
+
+#include "esp32h4/rom/sha.h"
+
+static SHA_CTX ctx;
+
+bootloader_sha256_handle_t bootloader_sha256_start()
+{
+    // Enable SHA hardware
+    ets_sha_enable();
+    ets_sha_init(&ctx, SHA2_256);
+    return &ctx; // Meaningless non-NULL value
+}
+
+void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len)
+{
+    assert(handle != NULL);
+    assert(data_len % 4 == 0);
+    ets_sha_update(&ctx, data, data_len, false);
+}
+
+void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest)
+{
+    assert(handle != NULL);
+
+    if (digest == NULL) {
+        bzero(&ctx, sizeof(ctx));
+        return;
+    }
+    ets_sha_finish(&ctx, digest);
+}
--- a/components/bootloader_support/src/esp32h4/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32h4/bootloader_soc.c
@@ -0,0 +1,41 @@
+/*
+ * SPDX-FileCopyrightText: 2019-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include <stdbool.h>
+#include "soc/soc.h"
+#include "soc/rtc_cntl_reg.h"
+
+void bootloader_ana_super_wdt_reset_config(bool enable)
+{
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_SUPER_WDT_RST);
+
+    if (enable) {
+        REG_SET_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    } else {
+        REG_CLR_BIT(RTC_CNTL_SWD_CONF_REG, RTC_CNTL_SWD_BYPASS_RST);
+    }
+}
+
+void bootloader_ana_bod_reset_config(bool enable)
+{
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_BOR_RST);
+
+    if (enable) {
+        REG_SET_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);
+    } else {
+        REG_CLR_BIT(RTC_CNTL_BROWN_OUT_REG, RTC_CNTL_BROWN_OUT_ANA_RST_EN);
+    }
+}
+
+void bootloader_ana_clock_glitch_reset_config(bool enable)
+{
+    REG_CLR_BIT(RTC_CNTL_FIB_SEL_REG, RTC_CNTL_FIB_GLITCH_RST);
+
+    if (enable) {
+        REG_SET_BIT(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_GLITCH_RST_EN);
+    } else {
+        REG_CLR_BIT(RTC_CNTL_ANA_CONF_REG, RTC_CNTL_GLITCH_RST_EN);
+    }
+}
--- a/components/bootloader_support/src/esp32h4/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32h4/flash_encryption_secure_features.c
@@ -0,0 +1,59 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <strings.h>
+#include "esp_flash_encrypt.h"
+#include "esp_secure_boot.h"
+#include "esp_efuse.h"
+#include "esp_efuse_table.h"
+#include "esp_log.h"
+#include "sdkconfig.h"
+
+static __attribute__((unused)) const char *TAG = "flash_encrypt";
+
+esp_err_t esp_flash_encryption_enable_secure_features(void)
+{
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC
+    ESP_LOGI(TAG, "Disable UART bootloader encryption...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader encryption");
+#endif
+
+#ifndef CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE
+    ESP_LOGI(TAG, "Disable UART bootloader cache...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DOWNLOAD_ICACHE);
+#else
+    ESP_LOGW(TAG, "Not disabling UART bootloader cache - SECURITY COMPROMISED");
+#endif
+
+#ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
+    ESP_LOGI(TAG, "Disable JTAG...");
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_USB_JTAG);
+#else
+    ESP_LOGW(TAG, "Not disabling JTAG - SECURITY COMPROMISED");
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);
+
+#if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
+    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
+    // otherwise the Flash Encryption key cannot be read protected
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
+#endif
+
+#ifndef CONFIG_SECURE_FLASH_SKIP_WRITE_PROTECTION_CACHE
+    // Set write-protection for DIS_ICACHE to prevent bricking chip in case it will be set accidentally.
+    // esp32h4 has DIS_ICACHE. Write-protection bit = 2.
+    // List of eFuses with the same write protection bit:
+    // DIS_ICACHE, DIS_USB_JTAG, POWERGLITCH_EN, DIS_FORCE_DOWNLOAD, SPI_DOWNLOAD_MSPI_DIS,
+    // DIS_TWAI, JTAG_SEL_ENABLE, DIS_PAD_JTAG, DIS_DOWNLOAD_MANUAL_ENCRYPT
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_ICACHE);
+#endif
+
+    return ESP_OK;
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sachin Parekh	f8d2c0894c	Merge branch 'fix/ecdsa_hal' into 'master' ecdsa: Support multiple ECDSA keys Closes IDF-7027 and IDF-7176 See merge request espressif/esp-idf!23023	2023-04-07 21:51:45 +08:00
Sachin Parekh	109afcb311	ci: Add patterns and target-tests for `ecdsa_efuse` runner	2023-04-07 14:56:37 +05:30
Sachin Parekh	39a5604c29	mbedtls/ecdsa: Add ECDSA signature generation test	2023-04-07 14:55:21 +05:30
Sachin Parekh	d634970ed1	ecdsa: Support multiple ECDSA keys Add provision to choose which efuse block should be used as ECDSA private key	2023-04-07 14:55:21 +05:30
Sachin Parekh	aa7660c9b4	ecdsa_hal.c: Add missing configuration for signature generation	2023-04-07 14:55:21 +05:30