versions: Update version to 4.3.1

ci: temp disable code_quality_report job
Merge branch 'bugfix/fix_esp32c3_auto_adjust_volt_v4.3' into 'release/v4.3'
2021-09-02 17:15:36 +08:00 · 2021-09-02 17:15:36 +08:00 · 2021-08-26 10:07:57 +00:00 · 2021-08-26 02:50:28 +00:00 · 2021-08-26 02:49:33 +00:00 · 2021-08-25 21:31:07 +08:00
7092 changed files with 1174552 additions and 276655 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -37,3 +37,7 @@ max_line_length = 119
 indent_style = space
 indent_size = 4
 max_line_length = 120
+
+[{*.sh,*.yml}]
+indent_style = space
+indent_size = 2
--- a/.flake8
+++ b/.flake8
@@ -141,18 +141,18 @@ exclude =
    __pycache__,
    # submodules
        components/bootloader/subproject/components/micro-ecc/micro-ecc,
+        components/bt/host/nimble/nimble,
+        components/cmock/CMock,
        components/esptool_py/esptool,
        components/expat/expat,
        components/json/cJSON,
        components/libsodium/libsodium,
        components/mbedtls/mbedtls,
        components/nghttp/nghttp2,
-        components/bt/host/nimble/nimble,
+        components/tinyusb,
        components/unity/unity,
        examples/build_system/cmake/import_lib/main/lib/tinyxml2,
-    # other third-party libraries
-        tools/kconfig_new/kconfiglib.py,
-        tools/kconfig_new/menuconfig.py,
+        examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib,
    # autogenerated scripts
        components/protocomm/python/constants_pb2.py,
        components/protocomm/python/sec0_pb2.py,
@@ -162,4 +162,4 @@ exclude =
        components/wifi_provisioning/python/wifi_config_pb2.py,
        components/wifi_provisioning/python/wifi_constants_pb2.py,
        components/esp_local_ctrl/python/esp_local_ctrl_pb2.py,
-        examples/provisioning/custom_config/components/custom_provisioning/python/custom_config_pb2.py,
+        examples/provisioning/legacy/custom_config/components/custom_provisioning/python/custom_config_pb2.py,
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -12,5 +12,3 @@ contact_links:
  - name: Hardware-related services
    url: https://www.espressif.com/en/products/hardware-services
    about: Espressif service providing hardware design and certification support
-
-
--- a/.github/workflows/python_lint.yml
+++ b/.github/workflows/python_lint.yml
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        python-version: [2.7, 3.5, 3.6, 3.7]
+        python-version: [2.7, 3.5, 3.6, 3.7, 3.8]

    steps:
      - name: Checkout
@@ -24,9 +24,10 @@ jobs:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
+          export IDF_PATH=${GITHUB_WORKSPACE}
          pip install --upgrade pip
          pip install -r requirements.txt
      - name: Lint with flake8
        run: |
          pip install flake8
-          flake8 . --config=.flake8
+          flake8 . --config=.flake8 --benchmark
--- a/.github/workflows/release_zips.yml
+++ b/.github/workflows/release_zips.yml
@@ -0,0 +1,17 @@
+name: Create zip file with recursive source clone for release
+
+on:
+  push:
+    tags:
+      - v*
+
+jobs:
+  release_zips:
+    name: Create release zip file
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Create a recursive clone source zip
+        uses: espressif/github-actions/release_zips@master
+        env:
+            RELEASE_PROJECT_NAME: ESP-IDF
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.gitignore
+++ b/.gitignore
@@ -21,19 +21,18 @@ GPATH
 # MacOS directory files
 .DS_Store

+# Components Unit Test Apps files
+components/**/build
+components/**/sdkconfig
+components/**/sdkconfig.old
+
 # Example project files
 examples/**/sdkconfig
 examples/**/sdkconfig.old
 examples/**/build

 # Doc build artifacts
-docs/*/_build/
-docs/*/doxygen-warning-log.txt
-docs/*/sphinx-warning-log.txt
-docs/*/sphinx-warning-log-sanitized.txt
-docs/*/xml/
-docs/*/xml_in/
-docs/*/man/
+docs/_build/
 docs/doxygen_sqlite3.db

 # Downloaded font files
@@ -46,6 +45,15 @@ tools/unit-test-app/sdkconfig.old
 tools/unit-test-app/build
 tools/unit-test-app/builds
 tools/unit-test-app/output
+tools/unit-test-app/test_configs
+
+# Unit Test CMake compile log folder
+log_ut_cmake
+
+# test application build files
+tools/test_apps/**/build
+tools/test_apps/**/sdkconfig
+tools/test_apps/**/sdkconfig.old

 # IDF monitor test
 tools/test_idf_monitor/outputs
@@ -79,4 +87,4 @@ flake8_output.txt
 build

 # lock files for examples and components
-dependencies.lock
+dependencies.lock
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,9 +4,22 @@ stages:
  - assign_test
  - host_test
  - target_test
+  - test_deploy
  - post_check
  - deploy
-  - post_check
+  - post_deploy
+
+# pipelines will not be created in such two cases:
+# 1. MR push
+# 2. push not on "master/release" branches, and not tagged
+# This behavior could be changed after the `rules: changes` feature is implemented
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: never
+    - if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_PIPELINE_SOURCE == "push"'
+      when: never
+    - when: always

 variables:
 # System environment
@@ -33,93 +46,68 @@ variables:
  # tell build system do not check submodule update as we download archive instead of clone
  IDF_SKIP_CHECK_SUBMODULES: 1

-  UNIT_TEST_BUILD_SYSTEM: cmake
-  EXAMPLE_TEST_BUILD_SYSTEM: cmake
  IDF_PATH: "$CI_PROJECT_DIR"
  BATCH_BUILD: "1"
  V: "0"
-  APPLY_BOT_FILTER_SCRIPT: "$CI_PROJECT_DIR/tools/ci/apply_bot_filter.py"
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"

-# Docker images
+  # Docker images
  BOT_DOCKER_IMAGE_TAG: ":latest"
-# target test config file, used by assign test job
+
+  # target test config file, used by assign test job
  CI_TARGET_TEST_CONFIG_FILE: "$CI_PROJECT_DIR/tools/ci/config/target-test.yml"

+  # target test repo parameters
+  TEST_ENV_CONFIG_REPO: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/ci-test-runner-configs.git"
+  CI_AUTO_TEST_SCRIPT_REPO_URL: "https://gitlab-ci-token:${BOT_TOKEN}@${CI_SERVER_HOST}:${CI_SERVER_PORT}/qa/auto_test_script.git"
+  CI_AUTO_TEST_SCRIPT_REPO_BRANCH: "ci/v3.1"

-
-# before each job, we need to check if this job is filtered by bot stage/job filter
-.apply_bot_filter: &apply_bot_filter
-  python $APPLY_BOT_FILTER_SCRIPT || exit 0
+  # Versioned esp-idf-doc env image to use for all document building jobs
+  ESP_IDF_DOC_ENV_IMAGE: "$CI_DOCKER_REGISTRY/esp-idf-doc-env:v8"

 .setup_tools_unless_target_test: &setup_tools_unless_target_test |
+  if [[ -n "$IDF_DONT_USE_MIRRORS" ]]; then
+  export IDF_MIRROR_PREFIX_MAP=
+  fi
  if [[ "$SETUP_TOOLS" == "1" || "$CI_JOB_STAGE" != "target_test" ]]; then
  tools/idf_tools.py --non-interactive install && eval "$(tools/idf_tools.py --non-interactive export)" || exit 1
  fi

-.fetch_submodules: &fetch_submodules |
-  python $SUBMODULE_FETCH_TOOL -s $SUBMODULES_TO_FETCH
-
 before_script:
+  - source tools/ci/utils.sh
  - source tools/ci/setup_python.sh
-  # apply bot filter in before script
-  - *apply_bot_filter
-  # add gitlab ssh key
-  - mkdir -p ~/.ssh
-  - chmod 700 ~/.ssh
-  - echo -n $GITLAB_KEY > ~/.ssh/id_rsa_base64
-  - base64 --decode --ignore-garbage ~/.ssh/id_rsa_base64 > ~/.ssh/id_rsa
-  - chmod 600 ~/.ssh/id_rsa
-  - echo -e "Host gitlab.espressif.cn\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
-  # Set some options and environment for CI
+  - apply_bot_filter
+  - add_gitlab_ssh_keys
  - source tools/ci/configure_ci_environment.sh
  - *setup_tools_unless_target_test
-
-  - *fetch_submodules
+  - fetch_submodules

 # used for check scripts which we want to run unconditionally
 .before_script_lesser_nofilter:
-  variables:
-    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - echo "Not setting up GitLab key, not fetching submodules, not applying bot filter"
+    - source tools/ci/utils.sh
    - source tools/ci/setup_python.sh
    - source tools/ci/configure_ci_environment.sh

 # used for everything else where we want to do no prep, except for bot filter
 .before_script_lesser:
-  variables:
-    GIT_SUBMODULE_STRATEGY: none
  before_script:
    - echo "Not setting up GitLab key, not fetching submodules"
+    - source tools/ci/utils.sh
    - source tools/ci/setup_python.sh
-    # apply bot filter in before script
-    - *apply_bot_filter
+    - apply_bot_filter
    - source tools/ci/configure_ci_environment.sh

-.check_job_template:
-  stage: pre_check
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
-  extends: .before_script_lesser_nofilter
-
-.check_job_template_with_filter:
-  stage: pre_check
-  image: $CI_DOCKER_REGISTRY/esp32-ci-env$BOT_DOCKER_IMAGE_TAG
-  tags:
-    - host_test
-  dependencies: []
-  extends: .before_script_lesser_nofilter
-
-.macos_build_template:
-  stage: build
-  tags:
-    - macos_shell
-  dependencies: []
+.before_script_slim:
  before_script:
-    - *apply_bot_filter
+    - echo "Only load utils.sh inside"
+    - source tools/ci/utils.sh
+
+.before_script_macos:
+  before_script:
+    - source tools/ci/utils.sh
+    - apply_bot_filter
    - $IDF_PATH/tools/idf_tools.py install-python-env
    # On macOS, these tools need to be installed
    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
@@ -130,9 +118,10 @@ before_script:
    - source tools/ci/configure_ci_environment.sh
    # Part of tools/ci/setup_python.sh; we don't use pyenv on macOS, so can't run the rest of the script.
    - export PYTHONPATH="$IDF_PATH/tools:$IDF_PATH/tools/ci/python_packages:$PYTHONPATH"
-    - *fetch_submodules
+    - fetch_submodules

 include:
+  - '/tools/ci/config/rules.yml'
  - '/tools/ci/config/pre_check.yml'
  - '/tools/ci/config/build.yml'
  - '/tools/ci/config/assign-test.yml'
@@ -140,3 +129,4 @@ include:
  - '/tools/ci/config/target-test.yml'
  - '/tools/ci/config/post_check.yml'
  - '/tools/ci/config/deploy.yml'
+  - '/tools/ci/config/post_deploy.yml'
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -0,0 +1,171 @@
+# For the syntax of this file, see:
+#
+#    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
+#
+# If more than one rule matches a given file, the latest rule is used.
+# The file should be generally kept sorted, except when it is necessary
+# to use a different order due to the fact above. In that case, use
+# '# sort-order-reset' comment line to reset the sort order.
+#
+# Recipes for a few common cases:
+#
+# 1. Specific directory with all its contents:
+#
+#    /components/app_trace/
+#
+#    Note the trailing slash!
+#
+# 2. File with certain extension in any subdirectory of a certain directory:
+#
+#    /examples/**/*.py
+#
+#    This includes an *.py files in /examples/ directory as well.
+#
+# 3. Contents of a directory with a certain name, anywhere in the tree:
+#
+#    test_*_host/
+#
+#    Will match everything under components/efuse/test_efuse_host/,
+#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
+#
+# 4. Same as above, except limited to a specific place in the tree:
+#
+#    /components/esp32*/
+#
+#    Matches everything under /components/esp32, /components/esp32s2, etc.
+#    Doesn't match /tools/some-test/components/esp32s5.
+#
+# 5. Specific file:
+#
+#    /tools/tools.json
+#
+# 6. File with a certain name anywhere in the tree
+#
+#    .gitignore
+#
+
+* @esp-idf-codeowners/other
+
+/.*                                   @esp-idf-codeowners/tools
+/.gitlab-ci.yml                       @esp-idf-codeowners/ci
+/.pre-commit-config.yaml              @esp-idf-codeowners/ci
+/.readthedocs.yml                     @esp-idf-codeowners/docs
+/CMakeLists.txt                       @esp-idf-codeowners/build-config
+/Kconfig                              @esp-idf-codeowners/build-config
+/add_path.sh                          @esp-idf-codeowners/tools
+/export.*                             @esp-idf-codeowners/tools
+/install.*                            @esp-idf-codeowners/tools
+/sdkconfig.rename                     @esp-idf-codeowners/build-config
+
+# sort-order-reset
+
+/components/app_trace/                @esp-idf-codeowners/tools
+/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
+/components/asio/                     @esp-idf-codeowners/network
+/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
+/components/bt/                       @esp-idf-codeowners/bluetooth
+/components/cbor/                     @esp-idf-codeowners/app-utilities
+/components/coap/                     @esp-idf-codeowners/app-utilities
+/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
+/components/cxx/                      @esp-idf-codeowners/system
+/components/driver/                   @esp-idf-codeowners/peripherals
+/components/efuse/                    @esp-idf-codeowners/system
+/components/esp32*/                   @esp-idf-codeowners/system
+/components/esp_adc_cal/              @esp-idf-codeowners/peripherals
+/components/esp_common/               @esp-idf-codeowners/system
+/components/esp_eth/                  @esp-idf-codeowners/network
+/components/esp_event/                @esp-idf-codeowners/system
+/components/esp_gdbstub/              @esp-idf-codeowners/tools
+/components/esp_hid/                  @esp-idf-codeowners/bluetooth
+/components/esp_http_client/          @esp-idf-codeowners/app-utilities
+/components/esp_http_server/          @esp-idf-codeowners/app-utilities
+/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
+/components/esp_https_server/         @esp-idf-codeowners/app-utilities
+/components/esp_hw_support/           @esp-idf-codeowners/system
+/components/esp_ipc/                  @esp-idf-codeowners/system
+/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
+/components/esp_netif/                @esp-idf-codeowners/network
+/components/esp_pm/                   @esp-idf-codeowners/power-management
+/components/esp_ringbuf/              @esp-idf-codeowners/system
+/components/esp_rom/                  @esp-idf-codeowners/system
+/components/esp_serial_slave_link/    @esp-idf-codeowners/peripherals
+/components/esp_system/               @esp-idf-codeowners/system
+/components/esp_timer/                @esp-idf-codeowners/system
+/components/esp-tls/                  @esp-idf-codeowners/app-utilities
+/components/esp_websocket_client/     @esp-idf-codeowners/network
+/components/esp_wifi/                 @esp-idf-codeowners/wifi
+/components/espcoredump/              @esp-idf-codeowners/tools
+/components/esptool_py/               @esp-idf-codeowners/tools
+/components/expat/                    @esp-idf-codeowners/app-utilities
+/components/fatfs/                    @esp-idf-codeowners/storage
+/components/freemodbus/               @esp-idf-codeowners/peripherals
+/components/freertos/                 @esp-idf-codeowners/system
+/components/hal/                      @esp-idf-codeowners/peripherals
+/components/heap/                     @esp-idf-codeowners/system
+/components/idf_test/                 @esp-idf-codeowners/ci
+/components/jsmn/                     @esp-idf-codeowners/app-utilities
+/components/json/                     @esp-idf-codeowners/app-utilities
+/components/libsodium/                @esp-idf-codeowners/security
+/components/log/                      @esp-idf-codeowners/system
+/components/lwip/                     @esp-idf-codeowners/lwip
+/components/mbedtls/                  @esp-idf-codeowners/app-utilities @esp-idf-codeowners/security
+/components/mdns/                     @esp-idf-codeowners/network
+/components/mqtt/                     @esp-idf-codeowners/network
+/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/tools
+/components/nghttp/                   @esp-idf-codeowners/app-utilities
+/components/nvs_flash/                @esp-idf-codeowners/storage
+/components/openssl/                  @esp-idf-codeowners/network
+/components/partition_table/          @esp-idf-codeowners/system
+/components/perfmon/                  @esp-idf-codeowners/tools
+/components/protobuf-c/               @esp-idf-codeowners/app-utilities
+/components/protocomm/                @esp-idf-codeowners/app-utilities
+/components/pthread/                  @esp-idf-codeowners/system
+/components/sdmmc/                    @esp-idf-codeowners/storage
+/components/soc/                      @esp-idf-codeowners/peripherals
+/components/spi_flash/                @esp-idf-codeowners/peripherals
+/components/spiffs/                   @esp-idf-codeowners/storage
+/components/tcp_transport/            @esp-idf-codeowners/network
+/components/tcpip_adapter/            @esp-idf-codeowners/network
+/components/tinyusb/                  @esp-idf-codeowners/peripherals
+/components/ulp/                      @esp-idf-codeowners/system
+/components/unity/                    @esp-idf-codeowners/ci
+/components/vfs/                      @esp-idf-codeowners/storage
+/components/wear_levelling/           @esp-idf-codeowners/storage
+/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities
+/components/wpa_supplicant/           @esp-idf-codeowners/wifi
+/components/xtensa/                   @esp-idf-codeowners/system
+
+/docs/    @esp-idf-codeowners/docs
+
+/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
+
+/examples/bluetooth/          @esp-idf-codeowners/bluetooth
+/examples/build_system/       @esp-idf-codeowners/build-config
+/examples/common_components/  @esp-idf-codeowners/system
+/examples/cxx/                @esp-idf-codeowners/system
+/examples/ethernet/           @esp-idf-codeowners/network
+/examples/get-started/        @esp-idf-codeowners/system
+/examples/mesh/               @esp-idf-codeowners/wifi
+/examples/peripherals/        @esp-idf-codeowners/peripherals
+/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
+/examples/provisioning/       @esp-idf-codeowners/app-utilities
+/examples/security/           @esp-idf-codeowners/security
+/examples/storage/            @esp-idf-codeowners/storage
+/examples/system/             @esp-idf-codeowners/system
+/examples/wifi/               @esp-idf-codeowners/wifi
+
+/make/    @esp-idf-codeowners/build-config
+
+/tools/                       @esp-idf-codeowners/tools
+/tools/*_apps.py              @esp-idf-codeowners/ci
+/tools/ble/                   @esp-idf-codeowners/app-utilities
+/tools/catch/                 @esp-idf-codeowners/ci
+/tools/ci/                    @esp-idf-codeowners/ci
+/tools/cmake/                 @esp-idf-codeowners/build-config
+/tools/esp_prov/              @esp-idf-codeowners/app-utilities
+/tools/find_build_apps/       @esp-idf-codeowners/ci
+/tools/kconfig*/              @esp-idf-codeowners/build-config
+/tools/ldgen/                 @esp-idf-codeowners/build-config
+/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
+
+requirements.txt              @esp-idf-codeowners/tools
--- a/.gitlab/merge_request_templates/Mixed
+++ b/.gitlab/merge_request_templates/Mixed
@@ -0,0 +1,64 @@
+_All texts in italics are instructional and should be replaced by contents or removed._
+
+## Checklist
+
+_This entire section can be deleted if all items are checked._
+
+* [ ] Enough information to help reviewers understand the issue, its root cause, impact, and the proposed solution
+* [ ] Enough information to help reviewers understand the feature, its functional description, example, documentation, test cases, test results, feature TODO list
+* [ ] The MR Title describes the change, including the component name, ie "lwip: Add support for IP over Pigeon"
+* [ ] All related links, including JIRA, backport, submodule MR, are mentioned in the `Related` subsection.
+* [ ] Any GitHub issues are linked inside the git commit message and corresponding release notes
+* [ ] Add label for the area this MR is part of
+* [ ] For documentation updates, check if label `Docs` and `needs translation:CN` or `needs translation:EN`  have been added when the other language version still needs the update. Skip adding the label if the document is not yet translated.
+* [ ] Check if documents requiring translation fall under get-started section. If yes, add the labels mentioned above. Then the documentation team will assign a translator for you. Please inform the translator to prepare translation once your MR is ready to merge. The translation should be included in your MR to get it merged. For more information, see documentation workflow in Wiki.
+* [ ] Any necessary "needs backport" labels are added
+* [ ] Check if this is a breaking change. If it is, add notes to the `Breaking change notes` subsection below
+* [ ] Release note entry if this is a new public feature, or a fix for an issue introduced in the previous release.
+* [ ] The commit log is clean and ready to merge.
+* [ ] All relevant CI jobs have been run, i.e. jobs which cover the code changed by the MR.
+* [ ] Pipeline with Python 3 has been successfully run, i.e. `@bot ...; with Python3`, if the MR adds or changes Python code.
+
+---
+
+_For issues, put enough information here to help reviewers understand the issue, its root cause, impact, and the proposed solution._
+
+_If this issue is a regression, specify in the `Related` subsection below, in which commit or MR it was introduced. This helps reviewers to check if the backport labels are set correctly._
+
+---
+
+_For features, put enough information here to help reviewers understand the feature, its functional description, example, documentation, test cases, test results, feature TODO list._
+
+---
+
+_For other small/non-public changes, which are not expected to be in the release notes, can be mentioned here, include:_
+
+ * changes that don't apply to customers, e.g. some CI fixes, test only MR and etc
+
+## Related
+
+* Mention or related JIRA tasks (e.g. IDF-0000), to make sure they get updated.
+* Mention submodule MR, if there is
+* Mention backport(ed) MR, if there is
+
+_Don't touch the subsection titles below, they will be parsed by scripts._
+
+## Release notes (Mandatory)
+
+_Changes made in this MR that should go into the **Release Notes** should be listed here. Please use **past tense** and *specify the area (see maintainers page of IDF internal wiki)*. If there is a subscope, include it and separate with slash (`/`). Minor changes can go to the descriptions above without a release notes entry._
+
+_Write all the changes in a **list** (Start at the beginning of the line with `-` or `*`). If multiple changes are made, each of them should take a single line. If there is only one change to list, it should still be the only line of a list. If this MR does not need any release notes, write "No release notes" here without the `-` or `*`. e.g._
+
+* [WiFi] Changed/fixed/updated xxx
+* [WiFi] Added support of xxx
+* [Peripheral Drivers/I2S] Fixed xxx (https://github.com/espressif/esp-idf/issues/xxxx)
+
+## Breaking change notes
+
+_Remove this subsection if not used._
+
+_If there are any breaking changes, please mention it here. Talking about (1) what is not accepted any more, (2) the alternative solution and (3) the benefits/reason. e.g._
+
+_Please strictly follow the breaking change restriction, which means, if there is a breaking change but you are merging to non-major versions, you have to separate the breaking part out to another MR for a major version. The breaking change subsection is only accepted in MRs merging to major versions._
+
+* [VFS/UART] Now vfs_uart_set_rts_cts accept one more instance argument, to support configuration to different ports.
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,8 +7,8 @@
 	path = components/esptool_py/esptool
 	url = ../../espressif/esptool.git

-[submodule "components/bt/controller/lib"]
-	path = components/bt/controller/lib
+[submodule "components/bt/controller/lib_esp32"]
+	path = components/bt/controller/lib_esp32
 	url = ../../espressif/esp32-bt-lib.git

 [submodule "components/bootloader/subproject/components/micro-ecc/micro-ecc"]
@@ -79,3 +79,18 @@
 	path = components/esp_wifi/lib
 	url = ../../espressif/esp32-wifi-lib.git

+[submodule "components/tinyusb/tinyusb"]
+	path = components/tinyusb/tinyusb
+	url = ../../espressif/tinyusb.git
+
+[submodule "examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib"]
+	path = examples/peripherals/secure_element/atecc608_ecdsa/components/esp-cryptoauthlib
+	url = ../../espressif/esp-cryptoauthlib.git
+
+[submodule "components/cmock/CMock"]
+	path = components/cmock/CMock
+	url = ../../ThrowTheSwitch/CMock.git
+
+[submodule "components/bt/controller/lib_esp32c3_family"]
+	path = components/bt/controller/lib_esp32c3_family
+	url = ../../espressif/esp32c3-bt-lib.git
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,77 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v3.4.0
+    hooks:
+      - id: trailing-whitespace
+        # note: whitespace exclusions use multiline regex, see https://pre-commit.com/#regular-expressions
+        # items are:
+        # 1 - some file extensions
+        # 2 - any file matching *test*/*expected* (for host tests, if possible use this naming pattern always)
+        # 3 - any directory named 'testdata'
+        # 4 - IDF monitor test data
+        exclude: &whitespace_excludes |
+            (?x)^(
+                .+\.(md|rst|map|bin)|
+                .+test.*\/.*expected.*|
+                .+\/testdata\/.+|
+                .+test_idf_monitor\/tests\/.+
+            )$
+      - id: end-of-file-fixer
+        exclude: *whitespace_excludes
+      - id: check-executables-have-shebangs
+      - id: file-contents-sorter
+        files: 'tools/ci/executable-list.txt'
+      - id: mixed-line-ending
+        args: ['-f=lf']
+      - id: double-quote-string-fixer
+  - repo: https://gitlab.com/pycqa/flake8
+    rev: 3.8.4
+    hooks:
+      - id: flake8
+        args: ['--config=.flake8', '--tee', '--benchmark']
+  - repo: https://github.com/pycqa/isort
+    rev: 5.6.4
+    hooks:
+      - id: isort
+        name: isort (python)
+  - repo: local
+    hooks:
+      - id: check-executables
+        name: Check File Permissions
+        entry: tools/ci/check_executables.py --action executables
+        language: python
+        types: [executable]
+        exclude: '\.pre-commit/.+'
+      - id: check-executable-list
+        name: Validate executable-list.txt
+        entry: tools/ci/check_executables.py --action list
+        language: python
+        pass_filenames: false
+        always_run: true
+      - id: check-kconfigs
+        name: Validate Kconfig files
+        entry: tools/ci/check_kconfigs.py
+        language: python
+        files: '^Kconfig$|Kconfig.*$'
+      - id: check-deprecated-kconfigs-options
+        name: Check if any Kconfig Options Deprecated
+        entry: tools/ci/check_deprecated_kconfigs.py
+        language: python
+        files: 'sdkconfig\.ci$|sdkconfig\.rename$|sdkconfig.*$'
+      - id: cmake-lint
+        name: Check CMake Files Format
+        entry: cmakelint --linelength=120 --spaces=4 --filter=-whitespace/indent
+        language: python
+        additional_dependencies:
+          - cmakelint==1.4.1
+        files: 'CMakeLists.txt$|\.cmake$'
+        exclude: '\/third_party\/'
+      - id: check-codeowners
+        name: Validate Codeowner File
+        entry: tools/ci/check_codeowners.py ci-check
+        language: python
+        files: '\.gitlab/CODEOWNERS'
+        pass_filenames: false
--- a/.pylintrc
+++ b/.pylintrc
@@ -0,0 +1,603 @@
+[MASTER]
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code.
+extension-pkg-whitelist=
+
+# Specify a score threshold to be exceeded before program exits with error.
+fail-under=10
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=CVS
+
+# Add files or directories matching the regex patterns to the blacklist. The
+# regex matches against base names, not paths.
+ignore-patterns=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
+# number of processors available to use.
+jobs=1
+
+# Control the amount of potential inferred values when inferring a single
+# object. This can help the performance when dealing with large functions or
+# complex, nested conditions.
+limit-inference-results=100
+
+# List of plugins (as comma separated values of python module names) to load,
+# usually to register additional checkers.
+load-plugins=
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# When enabled, pylint would attempt to guess common misconfiguration and emit
+# user-friendly hints instead of false-positive error messages.
+suggestion-mode=yes
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED.
+confidence=
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once). You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use "--disable=all --enable=classes
+# --disable=W".
+disable=print-statement,
+        parameter-unpacking,
+        unpacking-in-except,
+        old-raise-syntax,
+        backtick,
+        long-suffix,
+        old-ne-operator,
+        old-octal-literal,
+        import-star-module-level,
+        non-ascii-bytes-literal,
+        raw-checker-failed,
+        bad-inline-option,
+        locally-disabled,
+        file-ignored,
+        suppressed-message,
+        useless-suppression,
+        deprecated-pragma,
+        use-symbolic-message-instead,
+        apply-builtin,
+        basestring-builtin,
+        buffer-builtin,
+        cmp-builtin,
+        coerce-builtin,
+        execfile-builtin,
+        file-builtin,
+        long-builtin,
+        raw_input-builtin,
+        reduce-builtin,
+        standarderror-builtin,
+        unicode-builtin,
+        xrange-builtin,
+        coerce-method,
+        delslice-method,
+        getslice-method,
+        setslice-method,
+        no-absolute-import,
+        old-division,
+        dict-iter-method,
+        dict-view-method,
+        next-method-called,
+        metaclass-assignment,
+        indexing-exception,
+        raising-string,
+        reload-builtin,
+        oct-method,
+        hex-method,
+        nonzero-method,
+        cmp-method,
+        input-builtin,
+        round-builtin,
+        intern-builtin,
+        unichr-builtin,
+        map-builtin-not-iterating,
+        zip-builtin-not-iterating,
+        range-builtin-not-iterating,
+        filter-builtin-not-iterating,
+        using-cmp-argument,
+        eq-without-hash,
+        div-method,
+        idiv-method,
+        rdiv-method,
+        exception-message-attribute,
+        invalid-str-codec,
+        sys-max-int,
+        bad-python3-import,
+        deprecated-string-function,
+        deprecated-str-translate-call,
+        deprecated-itertools-function,
+        deprecated-types-field,
+        next-method-defined,
+        dict-items-not-iterating,
+        dict-keys-not-iterating,
+        dict-values-not-iterating,
+        deprecated-operator-function,
+        deprecated-urllib-function,
+        xreadlines-attribute,
+        deprecated-sys-function,
+        exception-escape,
+        comprehension-escape,
+        missing-function-docstring, # Modified since here, include this line
+        missing-class-docstring,
+        missing-module-docstring,
+        wrong-import-order,
+        invalid-name,
+        too-few-public-methods,
+        too-many-locals,
+        bad-super-call,  # since we still haven't drop python2 support
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+enable=c-extension-no-member
+
+
+[REPORTS]
+
+# Python expression which should return a score less than or equal to 10. You
+# have access to the variables 'error', 'warning', 'refactor', and 'convention'
+# which contain the number of messages in each category, as well as 'statement'
+# which is the total number of statements analyzed. This score is used by the
+# global evaluation report (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details.
+#msg-template=
+
+# Set the output format. Available formats are text, parseable, colorized, json
+# and msvs (visual studio). You can also give a reporter class, e.g.
+# mypackage.mymodule.MyReporterClass.
+output-format=text
+
+# Tells whether to display a full report or only the messages.
+reports=no
+
+# Activate the evaluation score.
+score=yes
+
+
+[REFACTORING]
+
+# Maximum number of nested blocks for function / method body
+max-nested-blocks=5
+
+# Complete name of functions that never returns. When checking for
+# inconsistent-return-statements if a never returning function is called then
+# it will be considered as an explicit return statement and no message will be
+# printed.
+never-returning-functions=sys.exit
+
+
+[TYPECHECK]
+
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# Tells whether to warn about missing members when the owner of the attribute
+# is inferred to be None.
+ignore-none=yes
+
+# This flag controls whether pylint should warn about no-member and similar
+# checks whenever an opaque object is returned when inferring. The inference
+# can return multiple potential results while evaluating a Python object, but
+# some branches might not be evaluated, which results in partial inference. In
+# that case, it might be useful to still emit no-member and other checks for
+# the rest of the inferred objects.
+ignore-on-opaque-inference=yes
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=optparse.Values,thread._local,_thread._local
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis). It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=
+
+# Show a hint with possible names when a member name was not found. The aspect
+# of finding the hint is based on edit distance.
+missing-member-hint=yes
+
+# The minimum edit distance a name should have in order to be considered a
+# similar match for a missing member name.
+missing-member-hint-distance=1
+
+# The total number of similar names that should be taken in consideration when
+# showing a hint for a missing member.
+missing-member-max-choices=1
+
+# List of decorators that change the signature of a decorated function.
+signature-mutators=
+
+
+[SPELLING]
+
+# Limits count of emitted suggestions for spelling mistakes.
+max-spelling-suggestions=4
+
+# Spelling dictionary name. Available dictionaries: none. To make it work,
+# install the python-enchant package.
+spelling-dict=
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains the private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to the private dictionary (see the
+# --spelling-private-dict-file option) instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[FORMAT]
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Number of spaces of indent required inside a hanging or continued line.
+indent-after-paren=4
+
+# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
+# tab).
+indent-string='    '
+
+# Maximum number of characters on a single line.
+max-line-length=160
+
+# Maximum number of lines in a module.
+max-module-lines=1000
+
+# List of optional constructs for which whitespace checking is disabled. `dict-
+# separator` is used to allow tabulation in dicts, etc.: {1  : 1,\n222: 2}.
+# `trailing-comma` allows a space between comma and closing bracket: (a, ).
+# `empty-line` allows space-only lines.
+no-space-check=trailing-comma,
+               dict-separator
+
+# Allow the body of a class to be on the same line as the declaration if body
+# contains single statement.
+single-line-class-stmt=no
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+
+[STRING]
+
+# This flag controls whether inconsistent-quotes generates a warning when the
+# character used as a quote delimiter is used inconsistently within a module.
+check-quote-consistency=no
+
+# This flag controls whether the implicit-str-concat should generate a warning
+# on implicit string concatenation in sequences defined over several lines.
+check-str-concat-over-line-jumps=no
+
+
+[LOGGING]
+
+# The type of string formatting that logging methods do. `old` means using %
+# formatting, `new` is for `{}` formatting.
+logging-format-style=old
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format.
+logging-modules=logging
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,
+      XXX,
+      TODO
+
+# Regular expression of note tags to take in consideration.
+#notes-rgx=
+
+
+[SIMILARITIES]
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+# Ignore imports when computing similarities.
+ignore-imports=no
+
+# Minimum lines number of a similarity.
+min-similarity-lines=4
+
+
+[VARIABLES]
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid defining new builtins when possible.
+additional-builtins=
+
+# Tells whether unused global variables should be treated as a violation.
+allow-global-unused-variables=yes
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,
+          _cb
+
+# A regular expression matching the name of dummy variables (i.e. expected to
+# not be used).
+dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore.
+ignored-argument-names=_.*|^ignored_|^unused_
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io
+
+
+[BASIC]
+
+# Naming style matching correct argument names.
+argument-naming-style=snake_case
+
+# Regular expression matching correct argument names. Overrides argument-
+# naming-style.
+#argument-rgx=
+
+# Naming style matching correct attribute names.
+attr-naming-style=snake_case
+
+# Regular expression matching correct attribute names. Overrides attr-naming-
+# style.
+#attr-rgx=
+
+# Bad variable names which should always be refused, separated by a comma.
+bad-names=foo,
+          bar,
+          baz,
+          toto,
+          tutu,
+          tata
+
+# Bad variable names regexes, separated by a comma. If names match any regex,
+# they will always be refused
+bad-names-rgxs=
+
+# Naming style matching correct class attribute names.
+class-attribute-naming-style=any
+
+# Regular expression matching correct class attribute names. Overrides class-
+# attribute-naming-style.
+#class-attribute-rgx=
+
+# Naming style matching correct class names.
+class-naming-style=PascalCase
+
+# Regular expression matching correct class names. Overrides class-naming-
+# style.
+#class-rgx=
+
+# Naming style matching correct constant names.
+const-naming-style=UPPER_CASE
+
+# Regular expression matching correct constant names. Overrides const-naming-
+# style.
+#const-rgx=
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=-1
+
+# Naming style matching correct function names.
+function-naming-style=snake_case
+
+# Regular expression matching correct function names. Overrides function-
+# naming-style.
+#function-rgx=
+
+# Good variable names which should always be accepted, separated by a comma.
+good-names=i,
+           j,
+           k,
+           ex,
+           Run,
+           _
+
+# Good variable names regexes, separated by a comma. If names match any regex,
+# they will always be accepted
+good-names-rgxs=
+
+# Include a hint for the correct naming format with invalid-name.
+include-naming-hint=no
+
+# Naming style matching correct inline iteration names.
+inlinevar-naming-style=any
+
+# Regular expression matching correct inline iteration names. Overrides
+# inlinevar-naming-style.
+#inlinevar-rgx=
+
+# Naming style matching correct method names.
+method-naming-style=snake_case
+
+# Regular expression matching correct method names. Overrides method-naming-
+# style.
+#method-rgx=
+
+# Naming style matching correct module names.
+module-naming-style=snake_case
+
+# Regular expression matching correct module names. Overrides module-naming-
+# style.
+#module-rgx=
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=^_
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+# These decorators are taken in consideration only for invalid-name.
+property-classes=abc.abstractproperty
+
+# Naming style matching correct variable names.
+variable-naming-style=snake_case
+
+# Regular expression matching correct variable names. Overrides variable-
+# naming-style.
+#variable-rgx=
+
+
+[DESIGN]
+
+# Maximum number of arguments for function / method.
+max-args=5
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=12
+
+# Maximum number of boolean expressions in an if statement (see R0916).
+max-bool-expr=5
+
+# Maximum number of branch for function / method body.
+max-branches=12
+
+# Maximum number of locals for function / method body.
+max-locals=15
+
+# Maximum number of parents for a class (see R0901).
+max-parents=7
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+# Maximum number of return / yield for function / method body.
+max-returns=6
+
+# Maximum number of statements in function / method body.
+max-statements=50
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+
+[CLASSES]
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,
+                      __new__,
+                      setUp,
+                      __post_init__
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,
+                  _fields,
+                  _replace,
+                  _source,
+                  _make
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=cls
+
+
+[IMPORTS]
+
+# List of modules that can be imported at any level, not just the top level
+# one.
+allow-any-import-level=
+
+# Allow wildcard imports from modules that define __all__.
+allow-wildcard-with-all=no
+
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
+
+# Deprecated modules which should not be used, separated by a comma.
+deprecated-modules=optparse,tkinter.tix
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled).
+ext-import-graph=
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled).
+import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled).
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant
+
+# Couples of modules and preferred modules, separated by a comma.
+preferred-modules=
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "BaseException, Exception".
+overgeneral-exceptions=BaseException,
+                       Exception
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -16,6 +16,6 @@ python:
    - requirements: docs/requirements.txt

 # We need to list all the submodules included in documenation build by DOxygen
-submodules: 
+submodules:
  include:
-    - components/mqtt/esp-mqtt
+    - components/mqtt/esp-mqtt
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -86,6 +86,17 @@ elseif(CONFIG_COMPILER_STACK_CHECK_MODE_ALL)
    list(APPEND compile_options "-fstack-protector-all")
 endif()

+if(CONFIG_COMPILER_DUMP_RTL_FILES)
+    list(APPEND compile_options "-fdump-rtl-expand")
+endif()
+
+# GCC-specific options
+if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+    list(APPEND compile_options "-fstrict-volatile-bitfields"
+                                "-Wno-error=unused-but-set-variable"
+                                )
+endif()
+
 list(APPEND link_options "-fno-lto")

 idf_build_set_property(COMPILE_OPTIONS "${compile_options}" APPEND)
--- a/CONTRIBUTING.rst
+++ b/CONTRIBUTING.rst
@@ -6,7 +6,7 @@ We welcome contributions to the esp-idf project!
 How to Contribute
 -----------------

-Contributions to esp-idf - fixing bugs, adding features, adding documentation - are welcome. We accept contributions via `Github Pull Requests <https://help.github.com/articles/about-pull-requests/>`_.
+Contributions to esp-idf - fixing bugs, adding features, adding documentation - are welcome. We accept contributions via `Github Pull Requests <https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests>`_.

 Before Contributing
 -------------------
@@ -17,6 +17,8 @@ Before sending us a Pull Request, please consider this list of points:

 * Does any new code conform to the esp-idf :doc:`Style Guide <style-guide>`?

+* Have you installed the :doc:`pre-commit hook <install-pre-commit-hook>` for esp-idf project?
+
 * Does the code documentation follow requirements in :doc:`documenting-code`?

 * Is the code adequately commented for people to understand how it is structured?
@@ -27,7 +29,7 @@ Before sending us a Pull Request, please consider this list of points:

 * Example contributions are also welcome. Please check the :doc:`creating-examples` guide for these.

-* If the contribution contains multiple commits, are they grouped together into logical changes (one major change per pull request)? Are any commits with names like "fixed typo" `squashed into previous commits <http://eli.thegreenplace.net/2014/02/19/squashing-github-pull-requests-into-a-single-commit/>`_?
+* If the contribution contains multiple commits, are they grouped together into logical changes (one major change per pull request)? Are any commits with names like "fixed typo" `squashed into previous commits <https://eli.thegreenplace.net/2014/02/19/squashing-github-pull-requests-into-a-single-commit/>`_?

 * If you're unsure about any of these points, please open the Pull Request anyhow and then ask us for feedback.

@@ -52,6 +54,7 @@ Related Documents
    :maxdepth: 1

    style-guide
+    install-pre-commit-hook
    documenting-code
    add-ons-reference
    creating-examples
--- a/67
+++ b/67
@@ -11,6 +11,15 @@ mainmenu "Espressif IoT Development Framework Configuration"
    config IDF_ENV_FPGA
        # This option is for internal use only
        bool
+        option env="IDF_ENV_FPGA"
+
+    config IDF_TARGET_ARCH_RISCV
+        bool
+        default "n"
+
+    config IDF_TARGET_ARCH_XTENSA
+        bool
+        default "n"

    config IDF_TARGET
        # This option records the IDF target when sdkconfig is generated the first time.
@@ -23,24 +32,54 @@ mainmenu "Espressif IoT Development Framework Configuration"
    config IDF_TARGET_ESP32
        bool
        default "y" if IDF_TARGET="esp32"
+        select IDF_TARGET_ARCH_XTENSA

-    config IDF_TARGET_ESP32S2BETA
+    config IDF_TARGET_ESP32S2
        bool
-        default "y" if IDF_TARGET="esp32s2beta"
+        default "y" if IDF_TARGET="esp32s2"
        select FREERTOS_UNICORE
+        select IDF_TARGET_ARCH_XTENSA
+
+    config IDF_TARGET_ESP32S3
+        bool
+        default "y" if IDF_TARGET="esp32s3"
+        select IDF_TARGET_ARCH_XTENSA
+
+    choice IDF_TARGET_ESP32S3_BETA_VERSION
+        prompt "ESP32-S3 beta version"
+        depends on IDF_TARGET_ESP32S3
+        default IDF_TARGET_ESP32S3_BETA_VERSION_2
+        help
+            Currently ESP32-S3 has several beta versions for internal use only.
+            Select the one that matches your chip model.
+
+        config IDF_TARGET_ESP32S3_BETA_VERSION_2
+            bool
+            prompt "ESP32-S3 beta2"
+    endchoice
+
+    config IDF_TARGET_ESP32C3
+        bool
+        default "y" if IDF_TARGET="esp32c3"
+        select FREERTOS_UNICORE
+        select IDF_TARGET_ARCH_RISCV

    config IDF_FIRMWARE_CHIP_ID
        hex
        default 0x0000 if IDF_TARGET_ESP32
-        # note: S2 beta uses Chip ID 0 still, S2 will use 0x0002
-        default 0x0000 if IDF_TARGET_ESP32S2BETA
+        default 0x0002 if IDF_TARGET_ESP32S2
+        default 0x0004 if IDF_TARGET_ESP32S3
+        default 0x0005 if IDF_TARGET_ESP32C3
        default 0xFFFF

    menu "SDK tool configuration"
        config SDK_TOOLPREFIX
            string "Compiler toolchain path/prefix"
            default "xtensa-esp32-elf-" if IDF_TARGET_ESP32
-            default "xtensa-esp32s2-elf-" if IDF_TARGET_ESP32S2BETA
+            default "xtensa-esp32s2-elf-" if IDF_TARGET_ESP32S2
+            default "xtensa-esp32s3-elf-" if IDF_TARGET_ESP32S3
+            default "riscv32-esp-elf-" if IDF_TARGET_ESP32C3
+
            help
                The prefix/path that is used to call the toolchain. The default setting assumes
                a crosstool-ng gcc setup that is in your PATH.
@@ -95,7 +134,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
                Select the way the application is built.

                By default, the application is built as a binary file in a format compatible with
-                the ESP32 bootloader. In addition to this application, 2nd stage bootloader is
+                the ESP-IDF bootloader. In addition to this application, 2nd stage bootloader is
                also built. Application and bootloader binaries can be written into flash and
                loaded/executed from there.

@@ -107,7 +146,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
                written into flash.
                Note that at the moment, ESP-IDF does not contain all the startup code required to
                initialize the CPUs and ROM memory (data/bss). Therefore it is necessary to execute
-                a bit of ROM code prior to executing the application. A gdbinit file may look as follows:
+                a bit of ROM code prior to executing the application. A gdbinit file may look as follows (for ESP32):

                    # Connect to a running instance of OpenOCD
                    target remote :3333
@@ -115,7 +154,7 @@ mainmenu "Espressif IoT Development Framework Configuration"
                    mon reset halt
                    # Run to a specific point in ROM code,
                    #  where most of initialization is complete.
-                    thb *0x40007901
+                    thb *0x40007d54
                    c
                    # Load the application into RAM
                    load
@@ -127,6 +166,8 @@ mainmenu "Espressif IoT Development Framework Configuration"

                    xtensa-esp32-elf-gdb build/app-name.elf -x gdbinit

+                Example gdbinit files for other targets can be found in tools/test_apps/system/gdb_loadable_elf/
+
                Recommended sdkconfig.defaults for building loadable ELF files is as follows.
                CONFIG_APP_BUILD_TYPE_ELF_RAM is required, other options help reduce application
                memory footprint.
@@ -134,8 +175,8 @@ mainmenu "Espressif IoT Development Framework Configuration"
                    CONFIG_APP_BUILD_TYPE_ELF_RAM=y
                    CONFIG_VFS_SUPPORT_TERMIOS=
                    CONFIG_NEWLIB_NANO_FORMAT=y
-                    CONFIG_ESP32_PANIC_PRINT_HALT=y
-                    CONFIG_ESP32_DEBUG_STUBS_ENABLE=
+                    CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT=y
+                    CONFIG_ESP_DEBUG_STUBS_ENABLE=
                    CONFIG_ESP_ERR_TO_NAME_LOOKUP=


@@ -328,6 +369,12 @@ mainmenu "Espressif IoT Development Framework Configuration"
                Enable this option if using GCC 6 or newer, and wanting to disable warnings which don't appear with
                GCC 5.

+        config COMPILER_DUMP_RTL_FILES
+            bool "Dump RTL files during compilation"
+            help
+                If enabled, RTL files will be produced during compilation. These files
+                can be used by other tools, for example to calculate call graphs.
+

    endmenu # Compiler Options

--- a/README.md
+++ b/README.md
@@ -2,18 +2,15 @@

 * [中文版](./README_CN.md)

-[![Documentation Status](https://readthedocs.com/projects/espressif-esp-idf/badge/?version=latest)](https://docs.espressif.com/projects/esp-idf/en/latest/?badge=latest)
-
-ESP-IDF is the official development framework for the [ESP32](https://espressif.com/en/products/hardware/esp32/overview) chip.
+ESP-IDF is the development framework for Espressif SoCs (released after 2016<sup>[1](#fn1)</sup>) provided for Windows, Linux and macOS.

 # Developing With ESP-IDF

 ## Setting Up ESP-IDF

-See setup guides for detailed instructions to set up the ESP-IDF:
+See https://idf.espressif.com/ for links to detailed instructions on how to set up the ESP-IDF depending on chip you use.

-* [Getting Started Guide for the stable ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
-* [Getting Started Guide for the latest (master branch) ESP-IDF version](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
+**Note:** Each SoC series and each ESP-IDF release has its own documentation. Please see Section [Versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html) on how to find documentation and how to checkout specific release of ESP-IDF.

 ### Non-GitHub forks

@@ -37,25 +34,16 @@ See the Getting Started guide links above for a detailed setup guide. This is a

 ## Setup Build Environment

-(See Getting Started guide for a full list of required steps with details.)
+(See the Getting Started guide listed above for a full list of required steps with more details.)

-* Install host build dependencies mentioned in Getting Started guide.
-* Add `tools/` directory to the PATH
-* Run `python -m pip install -r requirements.txt` to install Python dependencies
+* Install host build dependencies mentioned in the Getting Started guide.
+* Run the install script to set up the build environment. The options include `install.bat` or `install.ps1` for Windows, and `install.sh` or `install.fish` for Unix shells.
+* Run the export script on Windows (`export.bat`) or source it on Unix (`source export.sh`) in every shell environment before using ESP-IDF.

 ## Configuring the Project

-`idf.py menuconfig`
-
-* Opens a text-based configuration menu for the project.
-* Use up & down arrow keys to navigate the menu.
-* Use Enter key to go into a submenu, Escape key to go out or to exit.
-* Type `?` to see a help screen. Enter key exits the help screen.
-* Use Space key, or `Y` and `N` keys to enable (Yes) and disable (No) configuration items with checkboxes "`[*]`"
-* Pressing `?` while highlighting a configuration item displays help about that item.
-* Type `/` to search the configuration items.
-
-Once done configuring, press Escape multiple times to exit and say "Yes" to save the new configuration when prompted.
+* `idf.py set-target <chip_name>` sets the target of the project to `<chip_name>`. Run `idf.py set-target` without any arguments to see a list of supported targets.
+* `idf.py menuconfig` opens a text-based configuration menu where you can configure the project.

 ## Compiling the Project

@@ -77,7 +65,7 @@ You don't need to run `idf.py build` before running `idf.py flash`, `idf.py flas

 ## Viewing Serial Output

-The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from the ESP32. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+The `idf.py monitor` target uses the [idf_monitor tool](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html) to display serial output from Espressif SoCs. idf_monitor also has a range of features to decode crash output and interact with the device. [Check the documentation page for details](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).

 Exit the monitor by typing Ctrl-].

@@ -113,3 +101,6 @@ This can be combined with other targets, ie `idf.py -p PORT erase_flash flash` w
 * If you're interested in contributing to ESP-IDF, please check the [Contributions Guide](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html).


+________
+
+<a name="fn1">1</a>: ESP8266 and ESP8285 are not supported in ESP-IDF. See [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK) instead.
--- a/README_CN.md
+++ b/README_CN.md
@@ -2,23 +2,22 @@

 * [English Version](./README.md)

-[![Documentation Status](https://readthedocs.com/projects/espressif-esp-idf/badge/?version=latest)](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/?badge=latest)
-
-ESP-IDF 是由乐鑫官方推出的针对 [ESP32](https://espressif.com/en/products/hardware/esp32/overview) 系列芯片的开发框架。
+ESP-IDF 是由乐鑫官方针对乐鑫各系列芯片产品（发布于 2016 年后<sup>[1](#fn1)</sup>）推出的开发框架，支持 Windows、Linux 和 macOS 操作系统。

 # 使用 ESP-IDF 进行开发

 ## 搭建 ESP-IDF 开发环境

-请参阅如下指南搭建 ESP-IDF 的开发环境：
+关于不同芯片如何搭建 ESP-IDF 的开发环境，请参考 https://idf.espressif.com/。

-* [ESP-IDF 稳定版本的入门指南](https://docs.espressif.com/projects/esp-idf/en/stable/get-started/)
-* [ESP-IDF 开发版本（master 分支）的入门指南](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
+**注意：** 不同系列芯片和不同 ESP-IDF 版本都有其对应的文档。请参阅[版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html)部分，获得关于如何查找文档以及如何检出 ESP-IDF 的特定发行版的详细信息。

 ### 非 GitHub 分叉的 ESP-IDF 项目

 ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodules)），所以它们会指向 GitHub。
-如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该[脚本](tools/set-submodules-to-github.sh)。它会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
+如果 ESP-IDF 被分叉到的仓库不在 GitHub 上，那么你需要在克隆结束后运行该脚本 [tools/set-submodules-to-github.sh](tools/set-submodules-to-github.sh)。
+
+这个脚本会为所有的子模块设置绝对路径，接着可以通过 `git submodule update --init --recursive` 完成子模块的更新。
 如果 ESP-IDF 是从 GitHub 上克隆得到，则不需要此步骤。

 ## 寻找项目
@@ -35,24 +34,16 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu

 ## 设置构建环境

-（请参考入门指南中列出的详细步骤。）
-* 在主机中安装入门指南中提到的构建所依赖的工具。
-* 将 ESP-IDF 中的 `tools/` 目录加入 PATH 环境变量中。
-* 运行 `python -m pip install -r requirements.txt` 安装 Python 依赖库。
+请参考入门指南中列出的详细步骤。

+* 在主机中安装入门指南中提到的构建所依赖的工具。
+* 运行安装脚本来设置构建环境。可为 Windows shell 选择 `install.bat` 或 `install.ps1`，为 Unix shell 选择 `install.sh` 和 `install.fish`。
+* 在使用 ESP-IDF 之前，需要在 shell 中运行导出脚本。Windows 下可运行 `export.bat`，Unix 下可运行 `source export.sh`。
+  
 ## 配置项目

-`idf.py menuconfig`
-
-* 打开项目的文本配置菜单。
-* 使用上下键浏览菜单。
-* 使用回车键进入子菜单，退出键返回上一级菜单或者退出配置。
-* 输入 `?` 查看帮助界面，按下回车键可以退出帮助界面。
-* 使用空格键或者 `Y` 和 `N` 按键来启用和禁用带复选框“`[*]`”的配置项。
-* 高亮某个配置项的同时按下 `?` 键可以显示该选项的帮助文档。
-* 输入 `/` 可以搜索指定的配置项。
-
-一旦配置完成，请按下退出键多次以退出配置界面，当提示是否保存新的的配置时，选择 “Yes”。
+* `idf.py set-target <chip_name>` 可将项目的目标芯片设置为 `<chip_name>`。运行 `idf.py set-target`，不用带任何参数，可查看所有支持的目标芯片列表。
+* `idf.py menuconfig` 可打开一个基于文本的配置菜单，可以用来对项目进行配置。

 ## 编译项目

@@ -62,23 +53,23 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu

 ## 烧写项目

-当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但是你还可以运行下面这条命令来自动烧写：
+当构建结束，终端会打印出一条命令行，告知如何使用 esptool.py 工具烧写项目到芯片中。但你也可以运行下面这条命令来自动烧写：

 `idf.py -p PORT flash`

-将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 MacOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。
+将其中的 PORT 替换为系统中实际串口的名字（比如 Windows 下的 `COM3`，Linux 下的 `/dev/ttyUSB0`，或者 macOS 下的 `/dev/cu.usbserial-X`。如果省略 `-p` 选项，`idf.py flash` 会尝试使用第一个可用的串口进行烧写。

 这会烧写整个项目（包括应用程序，引导程序和分区表）到芯片中，此外还可以使用 `idf.py menuconfig` 来调整串口烧写相关的配置。

-你也不必先运行 `idf.py build`，再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。
+不必先运行 `idf.py build` 再运行 `idf.py flash`，`idf.py flash` 会根据需要自动重新构建项目。

 ## 观察串口输入

-`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示 ESP32 的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).
+`idf.py monitor` 会调用 [idf_monitor 工具](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html)来显示乐鑫芯片的串口输出。`idf_monitor` 还包含一系列的功能来解析程序崩溃后的输出结果并与设备进行交互。更多详细内容，请参阅[文档](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/idf-monitor.html).

 输入 `Ctrl-]` 可退出监视器。

-想要一次性执行构建，烧写和监视，可以运行如下命令：
+想要一次性执行构建、烧写和监视，可以运行如下命令：

 `idf.py flash monitor`

@@ -89,24 +80,27 @@ ESP-IDF 中的子模块采用相对路径（[详见 .gitmodules 文件](.gitmodu
 * `idf.py app` - 仅构建应用程序。
 * `idf.py app-flash` - 仅烧写应用程序。

-`idf.py app-flash` 会自动判断是否有源文件发生了改变而后重新构建应用程序。
+`idf.py app-flash` 会自动判断是否有源文件发生了改变然后重新构建应用程序。

 （在正常的开发中，即使引导程序和分区表没有发生变化，每次都重新烧写它们并不会带来什么危害。）

 ## 擦除 Flash

-`idf.py flash` 并不会擦除 Flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级。要擦除整块 Flash 请运行 `idf.py erase_flash`。
+`idf.py flash` 并不会擦除 flash 上所有的内容，但是有时候我们需要设备恢复到完全擦除的状态，尤其是分区表发生了变化或者 OTA 应用升级时。要擦除整块 flash 请运行 `idf.py erase_flash`。

-这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序，引导程序和分区表。
+这条命令还可以和其余命令整合在一起，`idf.py -p PORT erase_flash flash` 会擦除一切然后重新烧写新的应用程序、引导程序和分区表。

 # 其它参考资源

-* 最新版的文档：https://docs.espressif.com/projects/esp-idf/ ，该文档是由本仓库 [docs 目录](docs) 构建得到。
+* 最新版的文档：https://docs.espressif.com/projects/esp-idf/，该文档是由本仓库 [docs 目录](docs) 构建得到。

 * 可以前往 [esp32.com 论坛](https://esp32.com/) 提问，挖掘社区资源。

-* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题不会被重复提交。
+* 如果你在使用中发现了错误或者需要新的功能，请先[查看 GitHub Issues](https://github.com/espressif/esp-idf/issues)，确保该问题没有重复提交。

 * 如果你有兴趣为 ESP-IDF 作贡献，请先阅读[贡献指南](https://docs.espressif.com/projects/esp-idf/en/latest/contribute/index.html)。


+__________
+
+<a name="fn1">1</a>: ESP-IDF 不支持 ESP8266 和 ESP8285。如有需要，请参考 [RTOS SDK](https://github.com/espressif/ESP8266_RTOS_SDK)。
--- a/SUPPORT_POLICY.md
+++ b/SUPPORT_POLICY.md
@@ -5,43 +5,49 @@ Support Period Policy

 * [中文版](./SUPPORT_POLICY_CN.md)

-Each ESP-IDF major and minor release (V4.0, V4.1, etc) is supported for
-18 months after the initial stable release date.
+Each ESP-IDF major and minor release (V4.1, V4.2, etc) is supported for
+30 months after the initial stable release date.

 Supported means that the ESP-IDF team will continue to apply bug fixes,
 security fixes, etc to the release branch on GitHub, and periodically
 make new bugfix releases as needed.

-Users are encouraged to upgrade to a newer ESP-IDF release before the
-support period finishes and the release becomes End of Life (EOL). It is
-our policy to not continue fixing bugs in End of Life releases.
+Support period is divided into "Service" and "Maintenance" period:
+
+| Period      | Duration     | Recommended for new projects?         |
+| -------     | ------------ | ------------------------------------- |
+| Service     | 12 months    | Yes                                   |
+| Maintenance | 18 months    | No                                    |
+
+During the Service period, bugfixes releases are more frequent. In some cases,
+support for new features may be added during the Service period (this is
+reserved for features which are needed to meet particular regulatory
+requirements or standards for new products, and which carry a very low risk of
+introducing regressions.)
+
+During the Maintenance period, the version is still supported but only bugfixes
+for high severity issues or security issues will be applied.
+
+Using an “In Service” version is recommended when starting a new project.
+
+Users are encouraged to upgrade all projects to a newer ESP-IDF release before
+the support period finishes and the release becomes End of Life (EOL). It is our
+policy to not continue fixing bugs in End of Life releases.

 Pre-release versions (betas, previews, `-rc` and `-dev` versions, etc)
 are not covered by any support period. Sometimes a particular feature is
-marked as \"Preview\" in a release, which means it is also not covered
+marked as "Preview" in a release, which means it is also not covered
 by the support period.

 The ESP-IDF Programming Guide has information about the
 [different versions of ESP-IDF](https://docs.espressif.com/projects/esp-idf/en/latest/versions.html)
 (major, minor, bugfix, etc).

-Long Term Support releases
--------------------------
-
-Some releases (starting with ESP-IDF V3.3) are designated Long Term
-Support (LTS). LTS releases are supported for 30 months (2.5 years)
-after the initial stable release date.
-
-A new LTS release will be made at least every 18 months. This means
-there will always be a period of at least 12 months to upgrade from the
-previous LTS release to the following LTS release.
-
 Example
 -------

-ESP-IDF V3.3 was released in September 2019 and is a Long Term Support
-(LTS) release, meaning it will be supported for 30 months until February
-2022.
+ESP-IDF V3.3 was released in September 2019. It will be supported for 30 months
+until February 2022.

 - The first V3.3 release was `v3.3` in September 2019.
 - The ESP-IDF team continues to backport bug fixes, security fixes,
@@ -55,14 +61,23 @@ ESP-IDF V3.3 was released in September 2019 and is a Long Term Support
 Existing Releases
 -----------------

-ESP-IDF release V3.3 and all newer releases will follow this support
-period policy.  The support period for each release will be announced
-when the release is made.
+ESP-IDF release V4.1 and all newer releases will follow this support period
+policy. The support period for each release will be announced when the release
+is made.

-For releases made before the support period policy was announced,
-the following support periods apply:
+For releases made before the current support period policy was announced, the
+original support periods apply:

- ESP-IDF V3.1.x and V3.2.x will both be supported until October 2020.
- ESP-IDF V3.0.9 (planned for October 2019) will be the last V3.0
-  bugfix release. ESP-IDF V3.0.x is End of Life from October 2019.
- ESP-IDF versions before V3.0 are already End of Life.
+* ESP-IDF V4.0.x will be supported until October 2021
+* ESP-IDF V3.3.x will be supported until February 2022
+* ESP-IDF V3.1.x and V3.2.x will both be supported until October 2020.
+* ESP-IDF versions before V3.1 are already End of Life.
+
+Policy History
+--------------
+
+* September 2019. This policy split ESP-IDF releases into Standard and Long Term
+  Support.
+* July 2020. All releases from now will have the same support period, which is
+  equal to the previous Long Term Support period. Added “In Service” period,
+  during which versions will receive more updates.
--- a/SUPPORT_POLICY_CN.md
+++ b/SUPPORT_POLICY_CN.md
@@ -1,43 +1,55 @@
-有关 ESP-IDF 的最新支持政策，详见 [支持期限政策](./SUPPORT_POLICY_CN.md)。
+有关 ESP-IDF 的最新支持政策，详见 [支持期限政策](https://github.com/espressif/esp-idf/blob/master/SUPPORT_POLICY_CN.md)
+
 支持期限政策
-=================
+=====================

-* [English Version](./SUPPORT_POLICY.md)
+ESP-IDF 的每个主要版本和次要版本（如 V4.1、V4.2 等）自其首次稳定版本发布之日起将支持 30 个月。

-ESP-IDF 的每个主要版本和次要版本（如 V4.0、V4.1 等）自其首次稳定版本发布之日起将维护 18 个月。
+支持意味着 ESP-IDF 团队将会对 GitHub 上的发布分支继续进行 bug 修复、安全修补等，并根据需求定期发布新的 bugfix 版本。

-维护意味着 ESP-IDF 团队将会对 GitHub 上的发布分支继续进行 bug 修复、安全修补等，并根据需求定期发布新的 bugfix 版本。
+支持周期包括“服务周期“和“维护周期”：

-在某一版本支持期限结束，停止更新维护 (EOL) 前，建议用户升级到较新的 ESP-IDF 版本。根据《支持期限政策》，我们将停止对 EOL 版本进行 bug 修复。
+| 周期      | 期限     | 是否建议新项目使用？         |
+| -------     | ------------ | ------------------------------------- |
+| 服务周期     | 12 个月    | 是                                   |
+| 维护周期 | 18 个月    | 否                                    |

-《支持期限政策》不适用于预发布版本（包括 beta、preview、`-rc` 和 `-dev` 版本等）。有时，在发布的版本中存在被标记为 "Preview" 的特定功能，则该功能也不在支持期限内。
+在版本的服务周期内，bug 修复版本会较为频繁发布。某些情况下，版本在其服务周期内可能会增加对新功能的支持（这仅适用于需要达到新产品特定规管标准或要求的功能，并且引入新问题的风险极低。）

-有关 [ ESP-IDF 不同版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/versions.html)（主要版本、次要版本、bugfix 版本等）信息，可参阅《ESP-IDF 编程指南》。
+在版本的维护周期内，版本仍然会继续支持，但仅会对严重问题或安全问题进行 bug 修复。

-长期支持版本
------------
+建议在开始新项目的时候使用处于服务周期的版本。 

-有些发布版本（从 ESP-IDF V3.3 开始）属于长期支持 (LTS) 版本。LTS 版本将自其首次稳定版本发布之日起维护 30 个月（2.5 年）。
+在某一版本支持期限结束，停止更新维护 (EOL) 前，建议用户升级所有项目至较新的 ESP-IDF 版本。根据《支持期限政策》，我们将停止对 EOL 版本进行 bug 修复。

-我们将至少每 18 个月发布一个新的 LTS 版本。这意味着将至少有 12 个月的期限可更新至下一个 LTS 版本。
+《支持期限政策》不适用于预发布版本（包括 beta、preview、-rc 和 -dev 版本等）。有时，在发布的版本中存在被标记为 "Preview" 的特定功能，则该功能也不在支持期限内。
+
+有关 [ESP-IDF 不同版本](https://docs.espressif.com/projects/esp-idf/zh_CN/latest/esp32/versions.html)（主要版本、次要版本、bugfix 版本等）信息，可参阅《ESP-IDF 编程指南》。

 示例
-----
+-------

-ESP-IDF V3.3 于 2019 年 9 月发布，属于 LTS 版本，将维护 30 个月至 2022 年 2 月停止。
+ESP-IDF V3.3 于 2019 年 9 月发布，将支持 30 个月至 2022 年 2 月停止。

- V3.3 的首个发布版本为 2019 年 9 月发布的 `v3.3`。
- ESP-IDF 团队将持续进行 bug 修复、安全修补等更新，并 backport 至分支 `release/v3.3`。
- 定期从 release 分支创建稳定的 bugfix 版本，比如，`v3.3.1`、`v3.3.2` 等，并建议用户保持使用最新的 bugfix 版本。
+- V3.3 的首个发布版本为 2019 年 9 月发布的 v3.3。
+- ESP-IDF 团队将持续进行 bug 修复、安全修补等更新，并 backport 至分支 release/v3.3。
+- 定期从 release 分支创建稳定的 bugfix 版本，比如，v3.3.1、v3.3.2 等，并建议用户保持使用最新的 bugfix 版本。
 - V3.3 的 bugfix 版本发布将持续至 2022 年 2 月，届时所有 V3.3.x 将停止更新维护。

 现有版本
--------
+-----------------

-ESP-IDF V3.3 及所有后续更新版本都将遵守该《支持期限政策》。每一版本发布时将同时公布其支持期限。
+ESP-IDF V4.1 及所有后续更新版本都将遵守该《支持期限政策》。每一版本发布时将同时公布其支持期限。

 对于该政策公布之日前发布的版本，应适用下述支持期限：

- ESP-IDF V3.1.x 和 V3.2.x 将维护至 2020 年 10 月。
- ESP-IDF V3.0.9（计划 2019 年 10 月发布）将是 V3.0 的最后一个 bugfix 版本。ESP-IDF V3.0.x 自 2019 年 10 月起停止更新维护 (EOL)。
- ESP-IDF 中 V3.0 之前的版本均已停止更新维护 (EOL)。
+* ESP-IDF V4.0.x 将支持至 2021 年 10 月。
+* ESP-IDF V3.3.x 将支持至 2022 年 2 月。
+* ESP-IDF V3.1.x 和 V3.2.x 都将在 2020 年 10 月停止支持。
+* ESP-IDF v3.1.x 之前的版本已经停止支持。
+  
+政策历史
+--------------
+
+* 2019 年 9 月。该政策将 ESP-IDF 版本发布分为标准支持版本和长期支持版本。 
+* 2020 年 7 月。从现在开始，所有发布的版本都将有相同的支持周期，等同于之前的长期支持周期。新增了”服务周期“，期间版本的更新将较为频繁。
--- a/add_path.sh
+++ b/add_path.sh
@@ -16,5 +16,3 @@ else
 	export PATH="${IDF_ADD_PATHS_EXTRAS}:${PATH}"
 	echo "Added to PATH: ${IDF_ADD_PATHS_EXTRAS}"
 fi
-
-
--- a/components/app_trace/CMakeLists.txt
+++ b/components/app_trace/CMakeLists.txt
@@ -1,4 +1,4 @@
-set(srcs 
+set(srcs
    "app_trace.c"
    "app_trace_util.c"
    "host_file_io.c"
@@ -12,7 +12,7 @@ if(CONFIG_SYSVIEW_ENABLE)
        sys_view/SEGGER
        sys_view/Sample/OS)

-    list(APPEND srcs 
+    list(APPEND srcs
        "sys_view/SEGGER/SEGGER_SYSVIEW.c"
        "sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c"
        "sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.c"
@@ -33,10 +33,14 @@ idf_component_register(SRCS "${srcs}"
                       PRIV_REQUIRES soc
                       LDFRAGMENTS linker.lf)

-# disable --coverage for this component, as it is used as transport
-# for gcov
-target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")

-# Force app_trace to also appear later than gcov in link line
-idf_component_get_property(app_trace app_trace COMPONENT_LIB)
-target_link_libraries(${COMPONENT_LIB} INTERFACE $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+if(CONFIG_APPTRACE_GCOV_ENABLE)
+    # disable --coverage for this component, as it is used as transport
+    # for gcov
+    target_compile_options(${COMPONENT_LIB} PRIVATE "-fno-profile-arcs" "-fno-test-coverage")
+
+    # Force app_trace to also appear later than gcov in link line
+    idf_component_get_property(app_trace app_trace COMPONENT_LIB)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE
+        "-Wl,--undefined=gcov_rtio_atexit" $<TARGET_FILE:${app_trace}> gcov $<TARGET_FILE:${app_trace}> c)
+endif()
--- a/components/app_trace/app_trace.c
+++ b/components/app_trace/app_trace.c
@@ -156,16 +156,22 @@

 #include <string.h>
 #include <sys/param.h>
+#include "sdkconfig.h"
 #include "soc/soc.h"
+#include "soc/dport_access.h"
+#if CONFIG_IDF_TARGET_ESP32
 #include "soc/dport_reg.h"
-#if CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #include "soc/sensitive_reg.h"
 #endif
+#if __XTENSA__
 #include "eri.h"
 #include "trax.h"
+#endif
 #include "soc/timer_periph.h"
 #include "freertos/FreeRTOS.h"
 #include "esp_app_trace.h"
+#include "esp_rom_sys.h"

 #if CONFIG_APPTRACE_ENABLE
 #define ESP_APPTRACE_MAX_VPRINTF_ARGS           256
@@ -180,13 +186,13 @@ const static char *TAG = "esp_apptrace";
 #define ESP_APPTRACE_LOG( format, ... )   \
    do { \
        esp_apptrace_log_lock(); \
-        ets_printf(format, ##__VA_ARGS__); \
+        esp_rom_printf(format, ##__VA_ARGS__); \
        esp_apptrace_log_unlock(); \
    } while(0)
 #else
 #define ESP_APPTRACE_LOG( format, ... )   \
    do { \
-        ets_printf(format, ##__VA_ARGS__); \
+        esp_rom_printf(format, ##__VA_ARGS__); \
    } while(0)
 #endif

@@ -210,7 +216,7 @@ const static char *TAG = "esp_apptrace";
 #define TRACEMEM_MUX_BLK0_ONLY                  1
 #define TRACEMEM_MUX_BLK1_ONLY                  2
 #define TRACEMEM_MUX_PROBLK1_APPBLK0            3
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #define TRACEMEM_MUX_BLK0_NUM                   19
 #define TRACEMEM_MUX_BLK1_NUM                   20
 #define TRACEMEM_BLK_NUM2ADDR(_n_)              (0x3FFB8000UL + 0x4000UL*((_n_)-4))
@@ -244,7 +250,7 @@ static volatile uint8_t *s_trax_blocks[] = {
    (volatile uint8_t *) 0x3FFFC000,
    (volatile uint8_t *) 0x3FFF8000
 };
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 static volatile uint8_t *s_trax_blocks[] = {
    (volatile uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK0_NUM),
    (volatile uint8_t *)TRACEMEM_BLK_NUM2ADDR(TRACEMEM_MUX_BLK1_NUM)
@@ -435,7 +441,7 @@ static inline void esp_apptrace_trax_select_memory_block(int block_num)
    // select memory block to be exposed to the TRAX module (accessed by host)
 #if CONFIG_IDF_TARGET_ESP32
    DPORT_WRITE_PERI_REG(DPORT_TRACEMEM_MUX_MODE_REG, block_num ? TRACEMEM_MUX_BLK0_ONLY : TRACEMEM_MUX_BLK1_ONLY);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
    DPORT_WRITE_PERI_REG(DPORT_PMS_OCCUPY_3_REG, block_num ? BIT(TRACEMEM_MUX_BLK0_NUM-4) : BIT(TRACEMEM_MUX_BLK1_NUM-4));
 #endif
 }
@@ -494,7 +500,7 @@ static uint16_t esp_apptrace_trax_pend_chunk_sz_get(void)
 #endif

 // assumed to be protected by caller from multi-core/thread access
-static esp_err_t esp_apptrace_trax_block_switch(void)
+static __attribute__((noinline)) esp_err_t esp_apptrace_trax_block_switch(void)
 {
    int prev_block_num = s_trace_buf.trax.state.in_block % 2;
    int new_block_num = prev_block_num ? (0) : (1);
@@ -874,7 +880,7 @@ static esp_err_t esp_apptrace_trax_status_reg_get(uint32_t *val)

 static esp_err_t esp_apptrace_trax_dest_init(void)
 {
-    for (int i = 0; i < ESP_APPTRACE_TRAX_BLOCKS_NUM; i++) {
+    for (size_t i = 0; i < ESP_APPTRACE_TRAX_BLOCKS_NUM; i++) {
        s_trace_buf.trax.blocks[i].start = (uint8_t *)s_trax_blocks[i];
        s_trace_buf.trax.blocks[i].sz = ESP_APPTRACE_TRAX_BLOCK_SIZE;
        s_trace_buf.trax.state.markers[i] = 0;
--- a/components/app_trace/app_trace_util.c
+++ b/components/app_trace/app_trace_util.c
@@ -18,8 +18,12 @@
 #include "sdkconfig.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32C3
+#include "esp32c3/clk.h"
 #endif

 ///////////////////////////////////////////////////////////////////////////////
--- a/components/app_trace/component.mk
+++ b/components/app_trace/component.mk
@@ -8,11 +8,7 @@ COMPONENT_ADD_INCLUDEDIRS = include

 COMPONENT_ADD_LDFLAGS = -lapp_trace

-# do not produce gcov info for this module, it is used as transport for gcov
-CFLAGS := $(subst --coverage,,$(CFLAGS))
-
 ifdef CONFIG_SYSVIEW_ENABLE
-
 COMPONENT_ADD_INCLUDEDIRS += \
 	sys_view/Config \
 	sys_view/SEGGER \
@@ -26,7 +22,12 @@ COMPONENT_SRCDIRS += \
 	sys_view/esp32 \
 	sys_view/ext
 else
+ifdef CONFIG_APPTRACE_GCOV_ENABLE
+# do not produce gcov info for this module, it is used as transport for gcov
+CFLAGS := $(subst --coverage,,$(CFLAGS))
+COMPONENT_ADD_LDFLAGS += -Wl,--undefined=gcov_rtio_atexit
 COMPONENT_SRCDIRS += gcov
 endif
+endif

 COMPONENT_ADD_LDFRAGMENTS += linker.lf
--- a/components/app_trace/gcov/gcov_rtio.c
+++ b/components/app_trace/gcov/gcov_rtio.c
@@ -23,11 +23,11 @@
 #include "soc/timer_periph.h"
 #include "esp_app_trace.h"
 #include "esp_private/dbg_stubs.h"
-#include "hal/timer_ll.h"
+#include "hal/wdt_hal.h"
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/libc_stubs.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/libc_stubs.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/libc_stubs.h"
 #endif

 #if CONFIG_APPTRACE_GCOV_ENABLE
@@ -68,8 +68,12 @@ static int esp_dbg_stub_gcov_dump_do(void)
    int ret = ESP_OK;
    FILE* old_stderr = stderr;
    FILE* old_stdout = stdout;
-    struct syscall_stub_table* old_table = syscall_table_ptr_pro;
+    static struct syscall_stub_table *old_tables[portNUM_PROCESSORS];

+    old_tables[0] = syscall_table_ptr_pro;
+#if portNUM_PROCESSORS > 1
+    old_tables[1] = syscall_table_ptr_app;
+#endif
    ESP_EARLY_LOGV(TAG, "Alloc apptrace down buf %d bytes", ESP_GCOV_DOWN_BUF_SIZE);
    void *down_buf = malloc(ESP_GCOV_DOWN_BUF_SIZE);
    if (down_buf == NULL) {
@@ -80,12 +84,14 @@ static int esp_dbg_stub_gcov_dump_do(void)
    esp_apptrace_down_buffer_config(down_buf, ESP_GCOV_DOWN_BUF_SIZE);
    ESP_EARLY_LOGV(TAG, "Dump data...");
    // incase of dual-core chip APP and PRO CPUs share the same table, so it is safe to save only PRO's table
-    memcpy(&s_gcov_stub_table, old_table, sizeof(s_gcov_stub_table));
+    memcpy(&s_gcov_stub_table, syscall_table_ptr_pro, sizeof(s_gcov_stub_table));
    s_gcov_stub_table._lock_acquire_recursive = &gcov_stub_lock_acquire_recursive;
    s_gcov_stub_table._lock_release_recursive = &gcov_stub_lock_release_recursive;
    s_gcov_stub_table._lock_try_acquire_recursive = &gcov_stub_lock_try_acquire_recursive,
-
    syscall_table_ptr_pro = &s_gcov_stub_table;
+#if portNUM_PROCESSORS > 1
+    syscall_table_ptr_app = &s_gcov_stub_table;
+#endif
    stderr = (FILE*) &__sf_fake_stderr;
    stdout = (FILE*) &__sf_fake_stdout;
    __gcov_dump();
@@ -93,8 +99,10 @@ static int esp_dbg_stub_gcov_dump_do(void)
    __gcov_reset();
    stdout = old_stdout;
    stderr = old_stderr;
-    syscall_table_ptr_pro = old_table;
-
+    syscall_table_ptr_pro = old_tables[0];
+#if portNUM_PROCESSORS > 1
+    syscall_table_ptr_app = old_tables[1];
+#endif
    ESP_EARLY_LOGV(TAG, "Free apptrace down buf");
    free(down_buf);
    ESP_EARLY_LOGV(TAG, "Finish file transfer session");
@@ -102,6 +110,7 @@ static int esp_dbg_stub_gcov_dump_do(void)
    if (ret != ESP_OK) {
        ESP_EARLY_LOGE(TAG, "Failed to send files transfer stop cmd (%d)!", ret);
    }
+    ESP_EARLY_LOGV(TAG, "exit %d", ret);
    return ret;
 }

@@ -133,14 +142,16 @@ void esp_gcov_dump(void)
    esp_cpu_stall(other_core);
 #endif
    while (!esp_apptrace_host_is_connected(ESP_APPTRACE_DEST_TRAX)) {
-        // to avoid complains that task watchdog got triggered for other tasks
-        timer_ll_wdt_set_protect(&TIMERG0, false);
-        timer_ll_wdt_feed(&TIMERG0);
-        timer_ll_wdt_set_protect(&TIMERG0, true);
-        // to avoid reboot on INT_WDT
-        timer_ll_wdt_set_protect(&TIMERG1, false);
-        timer_ll_wdt_feed(&TIMERG1);
-        timer_ll_wdt_set_protect(&TIMERG1, true);
+        wdt_hal_context_t twdt = {.inst = WDT_MWDT0, .mwdt_dev = &TIMERG0};
+        wdt_hal_context_t iwdt = {.inst = WDT_MWDT1, .mwdt_dev = &TIMERG1};
+        //Feed the Task Watchdog (TG0) to prevent it from timing out
+        wdt_hal_write_protect_disable(&twdt);
+        wdt_hal_feed(&twdt);
+        wdt_hal_write_protect_enable(&twdt);
+        //Likewise, feed the Interrupt Watchdog (TG1) to prevent a reboot
+        wdt_hal_write_protect_disable(&iwdt);
+        wdt_hal_feed(&iwdt);
+        wdt_hal_write_protect_enable(&iwdt);
    }

    esp_dbg_stub_gcov_dump_do();
@@ -153,7 +164,9 @@ void esp_gcov_dump(void)
 void *gcov_rtio_fopen(const char *path, const char *mode)
 {
    ESP_EARLY_LOGV(TAG, "%s '%s' '%s'", __FUNCTION__, path, mode);
-    return esp_apptrace_fopen(ESP_APPTRACE_DEST_TRAX, path, mode);
+    void *f = esp_apptrace_fopen(ESP_APPTRACE_DEST_TRAX, path, mode);
+    ESP_EARLY_LOGV(TAG, "%s ret %p", __FUNCTION__, f);
+    return f;
 }

 int gcov_rtio_fclose(void *stream)
--- a/components/app_trace/heap_trace_tohost.c
+++ b/components/app_trace/heap_trace_tohost.c
@@ -111,4 +111,3 @@ static IRAM_ATTR void record_free(void *p, void **callers)
 #include "heap_trace.inc"

 #endif /*CONFIG_HEAP_TRACING_TOHOST*/
-
--- a/components/app_trace/host_file_io.c
+++ b/components/app_trace/host_file_io.c
@@ -146,7 +146,7 @@ void *esp_apptrace_fopen(esp_apptrace_dest_t dest, const char *path, const char

    ESP_EARLY_LOGV(TAG, "esp_apptrace_fopen '%s' '%s'", path, mode);
    if (path == NULL || mode == NULL) {
-        return 0;        
+        return 0;
    }

    cmd_args.path = path;
@@ -217,7 +217,7 @@ size_t esp_apptrace_fwrite(esp_apptrace_dest_t dest, const void *ptr, size_t siz
    ESP_EARLY_LOGV(TAG, "esp_apptrace_fwrite f %p l %d", stream, size*nmemb);

    if (ptr == NULL) {
-        return 0;        
+        return 0;
    }

    cmd_args.buf = (void *)ptr;
@@ -256,7 +256,7 @@ size_t esp_apptrace_fread(esp_apptrace_dest_t dest, void *ptr, size_t size, size
    ESP_EARLY_LOGV(TAG, "esp_apptrace_fread f %p l %d", stream, size*nmemb);

    if (ptr == NULL) {
-        return 0;        
+        return 0;
    }

    cmd_args.size = size * nmemb;
--- a/components/app_trace/include/esp_app_trace_util.h
+++ b/components/app_trace/include/esp_app_trace_util.h
@@ -24,7 +24,7 @@ extern "C" {
 /** Infinite waiting timeout */
 #define ESP_APPTRACE_TMO_INFINITE               ((uint32_t)-1)

-/** Structure which holds data necessary for measuring time intervals. 
+/** Structure which holds data necessary for measuring time intervals.
 *
 *  After initialization via esp_apptrace_tmo_init() user needs to call esp_apptrace_tmo_check()
 *  periodically to check timeout for expiration.
@@ -100,7 +100,7 @@ esp_err_t esp_apptrace_lock_give(esp_apptrace_lock_t *lock);

 /** Ring buffer control structure.
 *
- * @note For purposes of application tracing module if there is no enough space for user data and write pointer can be wrapped 
+ * @note For purposes of application tracing module if there is no enough space for user data and write pointer can be wrapped
 *       current ring buffer size can be temporarily shrinked in order to provide buffer with requested size.
 */
 typedef struct {
--- a/components/app_trace/linker.lf
+++ b/components/app_trace/linker.lf
@@ -1,14 +1,15 @@
 [mapping:app_trace]
 archive: libapp_trace.a
-entries: 
+entries:
    app_trace (noflash)
    app_trace_util (noflash)
-    SEGGER_SYSVIEW (noflash)
-    SEGGER_RTT_esp32 (noflash)
-    SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
-    SEGGER_SYSVIEW_FreeRTOS (noflash)
+    if SYSVIEW_ENABLE = y:
+      SEGGER_SYSVIEW (noflash)
+      SEGGER_RTT_esp32 (noflash)
+      SEGGER_SYSVIEW_Config_FreeRTOS (noflash)
+      SEGGER_SYSVIEW_FreeRTOS (noflash)

-[mapping:driver]
+[mapping:app_trace_driver]
 archive: libdriver.a
 entries:
    if SYSVIEW_TS_SOURCE_TIMER_00 = y || SYSVIEW_TS_SOURCE_TIMER_01 = y
--- a/components/app_trace/project_include.cmake
+++ b/components/app_trace/project_include.cmake
@@ -5,12 +5,24 @@ function(idf_create_coverage_report report_dir)
    set(gcov_tool ${CONFIG_SDK_TOOLPREFIX}gcov)
    idf_build_get_property(project_name PROJECT_NAME)

-    add_custom_target(lcov-report
+    add_custom_target(pre-cov-report
        COMMENT "Generating coverage report in: ${report_dir}"
        COMMAND ${CMAKE_COMMAND} -E echo "Using gcov: ${gcov_tool}"
        COMMAND ${CMAKE_COMMAND} -E make_directory ${report_dir}/html
+        )
+
+    add_custom_target(lcov-report
+        COMMENT "WARNING: lcov-report is deprecated. Please use gcovr-report instead."
        COMMAND lcov --gcov-tool ${gcov_tool} -c -d ${CMAKE_CURRENT_BINARY_DIR} -o ${report_dir}/${project_name}.info
-        COMMAND genhtml -o ${report_dir}/html ${report_dir}/${project_name}.info)
+        COMMAND genhtml -o ${report_dir}/html ${report_dir}/${project_name}.info
+        DEPENDS pre-cov-report
+        )
+
+    add_custom_target(gcovr-report
+        COMMAND gcovr -r ${project_dir} --gcov-executable ${gcov_tool} -s --html-details ${report_dir}/html/index.html
+        WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+        DEPENDS pre-cov-report
+        )
 endfunction()

 # idf_clean_coverage_report
@@ -20,4 +32,4 @@ function(idf_clean_coverage_report report_dir)
    add_custom_target(cov-data-clean
        COMMENT "Clean coverage report in: ${report_dir}"
        COMMAND ${CMAKE_COMMAND} -E remove_directory ${report_dir})
-endfunction()
+endfunction()
--- a/components/app_trace/sdkconfig.rename
+++ b/components/app_trace/sdkconfig.rename
@@ -9,4 +9,4 @@ CONFIG_ESP32_APPTRACE_LOCK_ENABLE						CONFIG_APPTRACE_LOCK_ENABLE
 CONFIG_ESP32_APPTRACE_ONPANIC_HOST_FLUSH_TMO			CONFIG_APPTRACE_ONPANIC_HOST_FLUSH_TMO
 CONFIG_ESP32_APPTRACE_POSTMORTEM_FLUSH_TRAX_THRESH      CONFIG_APPTRACE_POSTMORTEM_FLUSH_THRESH
 CONFIG_ESP32_APPTRACE_PENDING_DATA_SIZE_MAX				CONFIG_APPTRACE_PENDING_DATA_SIZE_MAX
-CONFIG_ESP32_GCOV_ENABLE								CONFIG_APPTRACE_GCOV_ENABLE
+CONFIG_ESP32_GCOV_ENABLE								CONFIG_APPTRACE_GCOV_ENABLE
--- a/components/app_trace/sys_view/Config/Global.h
+++ b/components/app_trace/sys_view/Config/Global.h
@@ -88,7 +88,7 @@ Purpose : Global types
  #else
    #define U64_C(x) x##ULL
  #endif
-#else 
+#else
  //
  // C99 compliant compiler
  //
--- a/components/app_trace/sys_view/SEGGER/SEGGER_RTT.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_RTT.h
@@ -58,7 +58,7 @@
 ---------------------------END-OF-HEADER------------------------------
 File    : SEGGER_RTT.h
 Purpose : Implementation of SEGGER real-time transfer which allows
-          real-time communication on targets which support debugger 
+          real-time communication on targets which support debugger
          memory accesses while the CPU is running.
 Revision: $Rev: 5626 $
 ----------------------------------------------------------------------
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.c
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.c
@@ -402,7 +402,7 @@ static U8 *_EncodeStr(U8 *pPayload, const char *pText, unsigned int Limit) {
  // Write Len
  //
  if (Len < 255)  {
-    *pPayload++ = Len; 
+    *pPayload++ = Len;
  } else {
    *pPayload++ = 255;
    *pPayload++ = (Len & 255);
@@ -556,7 +556,7 @@ static int _TrySendOverflowPacket(void) {
 *       _SendSyncInfo()
 *
 *  Function description
-*    Send SystemView sync packet and system information in 
+*    Send SystemView sync packet and system information in
 *    post mortem mode.
 *
 *  Additional information
@@ -792,7 +792,7 @@ static void _VPrintHost(const char* s, U32 Options, va_list* pParamList) {
  U32 aParas[SEGGER_SYSVIEW_MAX_ARGUMENTS];
  U32 NumArguments;
  const char* p;
-  
+
  p = s;
  NumArguments = 0;
  while (*p) {
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_ConfDefaults.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_ConfDefaults.h
@@ -118,7 +118,7 @@ extern "C" {
 #endif

 // Lowest Id reported by the Application.
-#ifndef   SEGGER_SYSVIEW_ID_BASE 
+#ifndef   SEGGER_SYSVIEW_ID_BASE
  #define SEGGER_SYSVIEW_ID_BASE            0
 #endif

--- a/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/Config/SEGGER_SYSVIEW_Config_FreeRTOS.c
@@ -61,26 +61,18 @@ File    : SEGGER_SYSVIEW_Config_FreeRTOS.c
 Purpose : Sample setup configuration of SystemView with FreeRTOS.
 Revision: $Rev: 3734 $
 */
+#include "sdkconfig.h"
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
-#if CONFIG_IDF_TARGET_ESP32
-#include "esp32/rom/ets_sys.h"
-#include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/clk.h"
-#endif
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
 #include "soc/soc.h"
 #include "soc/interrupts.h"
 #if CONFIG_IDF_TARGET_ESP32
-#include "esp32/rom/ets_sys.h"
 #include "esp32/clk.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
-#include "esp32s2beta/clk.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/clk.h"
 #endif


@@ -140,7 +132,7 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // CCOUNT is incremented at CPU frequency
 #if CONFIG_IDF_TARGET_ESP32
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32_DEFAULT_CPU_FREQ_MHZ * 1000000)
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#elif CONFIG_IDF_TARGET_ESP32S2
 #define SYSVIEW_TIMESTAMP_FREQ  (CONFIG_ESP32S2_DEFAULT_CPU_FREQ_MHZ * 1000000)
 #endif
 #endif // TS_USE_CCOUNT
--- a/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.c
@@ -136,11 +136,11 @@ static U64 _cbGetTime(void) {
 */
 void SYSVIEW_AddTask(U32 xHandle, const char* pcTaskName, unsigned uxCurrentPriority, U32  pxStack, unsigned uStackHighWaterMark) {
  unsigned n;
-  
+
  if (memcmp(pcTaskName, "IDLE", 5) == 0) {
    return;
  }
-  
+
  for (n = 0; n < SYSVIEW_FREERTOS_MAX_NOF_TASKS; n++) {
    if (_aTasks[n].xHandle == 0) {
      break;
@@ -170,7 +170,7 @@ void SYSVIEW_AddTask(U32 xHandle, const char* pcTaskName, unsigned uxCurrentPrio
 */
 void SYSVIEW_UpdateTask(U32 xHandle, const char* pcTaskName, unsigned uxCurrentPriority, U32 pxStack, unsigned uStackHighWaterMark) {
  unsigned n;
-  
+
  if (memcmp(pcTaskName, "IDLE", 5) == 0) {
    return;
  }
--- a/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
+++ b/components/app_trace/sys_view/Sample/OS/SEGGER_SYSVIEW_FreeRTOS.h
@@ -230,11 +230,12 @@ Notes:

 #define traceQUEUE_CREATE( pxNewQueue )                               SEGGER_SYSVIEW_RecordU32x3(apiFastID_OFFSET + apiID_XQUEUEGENERICCREATE, uxQueueLength, uxItemSize, ucQueueType)
 #define traceQUEUE_DELETE( pxQueue )                                  SEGGER_SYSVIEW_RecordU32(apiFastID_OFFSET + apiID_VQUEUEDELETE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue))
-#define traceQUEUE_PEEK( pxQueue )                                    SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), xTicksToWait, xJustPeeking)
+#define traceQUEUE_PEEK( pxQueue )                                    SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), xTicksToWait, 0)
 #define traceQUEUE_PEEK_FROM_ISR( pxQueue )                           SEGGER_SYSVIEW_RecordU32x2(apiFastID_OFFSET + apiID_XQUEUEPEEKFROMISR, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer))
 #define traceQUEUE_PEEK_FROM_ISR_FAILED( pxQueue )                    SEGGER_SYSVIEW_RecordU32x2(apiFastID_OFFSET + apiID_XQUEUEPEEKFROMISR, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer))
-#define traceQUEUE_RECEIVE( pxQueue )                                 SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), xTicksToWait, xJustPeeking)
-#define traceQUEUE_RECEIVE_FAILED( pxQueue )                          SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), xTicksToWait, xJustPeeking)
+#define traceQUEUE_RECEIVE( pxQueue )                                 SEGGER_SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)0), xTicksToWait, 1)
+#define traceQUEUE_RECEIVE_FAILED( pxQueue )                          SEGGER_SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)0), xTicksToWait, 1)
+#define traceQUEUE_SEMAPHORE_RECEIVE( pxQueue )                       SEGGER_SYSVIEW_RecordU32x4(apiFastID_OFFSET + apiID_XQUEUEGENERICRECEIVE, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)0), xTicksToWait, 0)
 #define traceQUEUE_RECEIVE_FROM_ISR( pxQueue )                        SEGGER_SYSVIEW_RecordU32x3(apiFastID_OFFSET + apiID_XQUEUERECEIVEFROMISR, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), (U32)pxHigherPriorityTaskWoken)
 #define traceQUEUE_RECEIVE_FROM_ISR_FAILED( pxQueue )                 SEGGER_SYSVIEW_RecordU32x3(apiFastID_OFFSET + apiID_XQUEUERECEIVEFROMISR, SEGGER_SYSVIEW_ShrinkId((U32)pxQueue), SEGGER_SYSVIEW_ShrinkId((U32)pvBuffer), (U32)pxHigherPriorityTaskWoken)
 #define traceQUEUE_REGISTRY_ADD( xQueue, pcQueueName )                SEGGER_SYSVIEW_RecordU32x2(apiFastID_OFFSET + apiID_VQUEUEADDTOREGISTRY, SEGGER_SYSVIEW_ShrinkId((U32)xQueue), (U32)pcQueueName)
--- a/components/app_trace/sys_view/esp32/SEGGER_RTT_esp32.c
+++ b/components/app_trace/sys_view/esp32/SEGGER_RTT_esp32.c
@@ -18,14 +18,9 @@
 #include "SEGGER_SYSVIEW.h"
 #include "SEGGER_SYSVIEW_Conf.h"

-#if CONFIG_IDF_TARGET_ESP32
-#include "esp32/rom/ets_sys.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/ets_sys.h"
-#endif
 #include "esp_app_trace.h"
-
 #include "esp_log.h"
+
 const static char *TAG = "segger_rtt";

 #define SYSVIEW_EVENTS_BUF_SZ         255U
--- a/components/app_trace/test/CMakeLists.txt
+++ b/components/app_trace/test/CMakeLists.txt
@@ -1,3 +1,3 @@
 idf_component_register(SRC_DIRS "."
-                    INCLUDE_DIRS "."
-                    REQUIRES unity)
+                    PRIV_INCLUDE_DIRS "."
+                    PRIV_REQUIRES cmock)
--- a/components/app_trace/test/test_trace.c
+++ b/components/app_trace/test/test_trace.c
@@ -5,6 +5,7 @@
 #include <stdarg.h>
 #include "unity.h"
 #include "driver/timer.h"
+#include "esp_rom_sys.h"
 #include "soc/cpu.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/semphr.h"
@@ -31,7 +32,7 @@ const static char *TAG = "esp_apptrace_test";
        else \
            ret = xSemaphoreTake(s_print_lock, portMAX_DELAY); \
        if (ret == pdTRUE) { \
-            ets_printf(format, ##__VA_ARGS__); \
+            esp_rom_printf(format, ##__VA_ARGS__); \
            if (xPortInIsrContext()) \
                xSemaphoreGiveFromISR(s_print_lock, NULL); \
            else \
@@ -41,7 +42,7 @@ const static char *TAG = "esp_apptrace_test";
 #else
 #define ESP_APPTRACE_TEST_LOG( format, ... )   \
    do { \
-        ets_printf(format, ##__VA_ARGS__); \
+        esp_rom_printf(format, ##__VA_ARGS__); \
    } while(0)
 #endif

@@ -138,7 +139,7 @@ static void esp_apptrace_test_timer_isr(void *arg)
    if (res != ESP_OK) {
    } else {
        if (0) {
-            ets_printf("tim-%d-%d: Written chunk%d %d bytes, %x\n",
+            esp_rom_printf("tim-%d-%d: Written chunk%d %d bytes, %x\n",
                       tim_arg->group, tim_arg->id, tim_arg->data.wr_cnt, tim_arg->data.buf_sz, tim_arg->data.wr_cnt & tim_arg->data.mask);
        }
        tim_arg->data.wr_err = 0;
@@ -161,9 +162,9 @@ static void esp_apptrace_test_timer_isr_crash(void *arg)
        memset(tim_arg->data.buf + 2 * sizeof(uint32_t), tim_arg->data.wr_cnt & tim_arg->data.mask, tim_arg->data.buf_sz - 2 * sizeof(uint32_t));
        int res = ESP_APPTRACE_TEST_WRITE_FROM_ISR(tim_arg->data.buf, tim_arg->data.buf_sz);
        if (res != ESP_OK) {
-            ets_printf("tim-%d-%d: Failed to write trace %d %x!\n", tim_arg->group, tim_arg->id, res, tim_arg->data.wr_cnt & tim_arg->data.mask);
+            esp_rom_printf("tim-%d-%d: Failed to write trace %d %x!\n", tim_arg->group, tim_arg->id, res, tim_arg->data.wr_cnt & tim_arg->data.mask);
        } else {
-            ets_printf("tim-%d-%d: Written chunk%d %d bytes, %x\n",
+            esp_rom_printf("tim-%d-%d: Written chunk%d %d bytes, %x\n",
                       tim_arg->group, tim_arg->id, tim_arg->data.wr_cnt, tim_arg->data.buf_sz, tim_arg->data.wr_cnt & tim_arg->data.mask);
            tim_arg->data.wr_cnt++;
        }
@@ -404,7 +405,7 @@ static void esp_apptrace_test(esp_apptrace_test_cfg_t *test_cfg)
 #if ESP_APPTRACE_TEST_USE_PRINT_LOCK == 1
    s_print_lock = xSemaphoreCreateBinary();
    if (!s_print_lock) {
-        ets_printf("%s: Failed to create print lock!", TAG);
+        esp_rom_printf("%s: Failed to create print lock!", TAG);
        return;
    }
    xSemaphoreGive(s_print_lock);
--- a/components/app_update/CMakeLists.txt
+++ b/components/app_update/CMakeLists.txt
@@ -1,4 +1,4 @@
-idf_component_register(SRCS "esp_ota_ops.c" 
+idf_component_register(SRCS "esp_ota_ops.c"
                            "esp_app_desc.c"
                    INCLUDE_DIRS "include"
                    REQUIRES spi_flash partition_table bootloader_support)
@@ -7,11 +7,18 @@ idf_component_register(SRCS "esp_ota_ops.c"
 # linker will ignore this structure as it has no other files depending on it.
 target_link_libraries(${COMPONENT_LIB} INTERFACE "-u esp_app_desc")

+if(CONFIG_APP_PROJECT_VER_FROM_CONFIG)
+    # Ignore current PROJECT_VER (which was set in __project_get_revision()).
+    # Gets the version from the CONFIG_APP_PROJECT_VER.
+    idf_build_set_property(PROJECT_VER "${CONFIG_APP_PROJECT_VER}")
+endif()
+
 # cut PROJECT_VER and PROJECT_NAME to required 32 characters.
 idf_build_get_property(project_ver PROJECT_VER)
 idf_build_get_property(project_name PROJECT_NAME)
 string(SUBSTRING "${project_ver}" 0 31 PROJECT_VER_CUT)
 string(SUBSTRING "${project_name}" 0 31 PROJECT_NAME_CUT)
+message(STATUS "App \"${PROJECT_NAME_CUT}\" version: ${PROJECT_VER_CUT}")

 set_source_files_properties(
    SOURCE "esp_app_desc.c"
@@ -41,20 +48,38 @@ if(NOT BOOTLOADER_BUILD)

        set(otatool_py ${python} ${COMPONENT_DIR}/otatool.py)

-        set(esptool_args --esptool-args before=${CONFIG_ESPTOOLPY_BEFORE} after=${CONFIG_ESPTOOLPY_AFTER})
+        set(esptool_args "--esptool-args;before=${CONFIG_ESPTOOLPY_BEFORE};after=${CONFIG_ESPTOOLPY_AFTER}")
+        set(otatool_args "--partition-table-file;${PARTITION_CSV_PATH}"
+                         "--partition-table-offset;${PARTITION_TABLE_OFFSET}")
+        idf_component_get_property(esptool_py_dir esptool_py COMPONENT_DIR)

        add_custom_target(read_otadata DEPENDS "${PARTITION_CSV_PATH}"
-                        COMMAND ${otatool_py} ${esptool_args}
-                        --partition-table-file ${PARTITION_CSV_PATH} 
-                        --partition-table-offset ${PARTITION_TABLE_OFFSET}
-                        read_otadata)
+            COMMAND ${CMAKE_COMMAND}
+            -D IDF_PATH="${idf_path}"
+            -D SERIAL_TOOL="${otatool_py}"
+            -D SERIAL_TOOL_ARGS="${esptool_args};${otatool_args};read_otadata"
+            -D WORKING_DIRECTORY="${build_dir}"
+            -P ${esptool_py_dir}/run_serial_tool.cmake
+            WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}
+            USES_TERMINAL
+            )

        add_custom_target(erase_otadata DEPENDS "${PARTITION_CSV_PATH}"
-                        COMMAND ${otatool_py} ${esptool_args}
-                        --partition-table-file ${PARTITION_CSV_PATH}
-                        --partition-table-offset ${PARTITION_TABLE_OFFSET}
-                        erase_otadata)
+            COMMAND ${CMAKE_COMMAND}
+            -D IDF_PATH="${idf_path}"
+            -D SERIAL_TOOL="${otatool_py}"
+            -D SERIAL_TOOL_ARGS="${esptool_args};${otatool_args};erase_otadata"
+            -D WORKING_DIRECTORY="${build_dir}"
+            -P ${esptool_py_dir}/run_serial_tool.cmake
+            WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}
+            USES_TERMINAL
+            )

-        esptool_py_flash_project_args(otadata ${otadata_offset} "${blank_otadata_file}" FLASH_IN_PROJECT)
+        idf_component_get_property(main_args esptool_py FLASH_ARGS)
+        idf_component_get_property(sub_args esptool_py FLASH_SUB_ARGS)
+        esptool_py_flash_target(otadata-flash "${main_args}" "${sub_args}")
+        esptool_py_flash_target_image(otadata-flash otadata "${otadata_offset}" "${blank_otadata_file}")
+
+        esptool_py_flash_target_image(flash otadata "${otadata_offset}" "${blank_otadata_file}")
    endif()
 endif()
--- a/components/app_update/Kconfig.projbuild
+++ b/components/app_update/Kconfig.projbuild
@@ -22,6 +22,20 @@ menu "Application manager"
            The PROJECT_NAME variable from the build system will not affect the firmware image.
            This value will not be contained in the esp_app_desc structure.

+    config APP_PROJECT_VER_FROM_CONFIG
+        bool "Get the project version from Kconfig"
+        default n
+        help
+            If this is enabled, then config item APP_PROJECT_VER will be used for the variable PROJECT_VER.
+            Other ways to set PROJECT_VER will be ignored.
+
+    config APP_PROJECT_VER
+        string "Project version"
+        default "1"
+        depends on APP_PROJECT_VER_FROM_CONFIG
+        help
+            Project version
+
    config APP_RETRIEVE_LEN_ELF_SHA
        int "The length of APP ELF SHA is stored in RAM(chars)"
        default 16
--- a/components/app_update/Makefile.projbuild
+++ b/components/app_update/Makefile.projbuild
@@ -24,7 +24,7 @@ $(BLANK_OTA_DATA_FILE): partition_table_get_info $(PARTITION_TABLE_CSV_PATH) | c

 blank_ota_data: $(BLANK_OTA_DATA_FILE)

-# If there is no otadata partition, both OTA_DATA_OFFSET and BLANK_OTA_DATA_FILE 
+# If there is no otadata partition, both OTA_DATA_OFFSET and BLANK_OTA_DATA_FILE
 # expand to empty values.
 ESPTOOL_ALL_FLASH_ARGS += $(OTA_DATA_OFFSET) $(BLANK_OTA_DATA_FILE)

@@ -36,8 +36,8 @@ erase_otadata: $(PARTITION_TABLE_CSV_PATH) partition_table_get_info | check_pyth
 	erase_otadata

 read_otadata: $(PARTITION_TABLE_CSV_PATH) partition_table_get_info | check_python_dependencies
-	$(OTATOOL_PY) $(ESPTOOL_ARGS) --partition-table-file $(PARTITION_TABLE_CSV_PATH) \ 
-	--partition-table-offset $(partition_table_offset) \ 
+	$(OTATOOL_PY) $(ESPTOOL_ARGS) --partition-table-file $(PARTITION_TABLE_CSV_PATH) \
+	--partition-table-offset $(partition_table_offset) \
 	read_otadata

 all: blank_ota_data
--- a/components/app_update/component.mk
+++ b/components/app_update/component.mk
@@ -3,54 +3,54 @@
 #
 # (Uses default behaviour of compiling all source files in directory, adding 'include' to include path.)

-# esp_app_desc structure is added as an undefined symbol because otherwise the 
+# esp_app_desc structure is added as an undefined symbol because otherwise the
 # linker will ignore this structure as it has no other files depending on it.
 COMPONENT_ADD_LDFLAGS += -u esp_app_desc

 ifndef IS_BOOTLOADER_BUILD
-GET_PROJECT_VER ?=
-ifeq ("${PROJECT_VER}", "")
-ifeq ("$(wildcard ${PROJECT_PATH}/version.txt)","")
+    # If ``CONFIG_APP_PROJECT_VER_FROM_CONFIG`` option is set, the value of ``CONFIG_APP_PROJECT_VER`` will be used
+    # Else, if ``PROJECT_VER`` variable set in project Makefile file, its value will be used.
+    # Else, if the ``$PROJECT_PATH/version.txt`` exists, its contents will be used as ``PROJECT_VER``.
+    # Else, if the project is located inside a Git repository, the output of git describe will be used.
+    # Otherwise, ``PROJECT_VER`` will be "1".
+    ifdef CONFIG_APP_PROJECT_VER_FROM_CONFIG
+        PROJECT_VER:= $(CONFIG_APP_PROJECT_VER)
+    else
+        ifneq ("${PROJECT_VER}", "")
+            PROJECT_VER:= $(PROJECT_VER)
+        else
+            ifneq ("$(wildcard ${PROJECT_PATH}/version.txt)","")
+                PROJECT_VER := $(shell cat ${PROJECT_PATH}/version.txt)
+            else
+                GIT_PROJECT_VER := $(shell cd ${PROJECT_PATH} && git describe --always --tags --dirty 2> /dev/null)
+                ifeq ("${GIT_PROJECT_VER}", "")
+                    PROJECT_VER := "1"
+                    $(info Project is not inside a git repository, or git repository has no commits)
+                    $(info will not use 'git describe' to determine PROJECT_VER.)
+                else
+                    PROJECT_VER:= $(GIT_PROJECT_VER)
+                endif # a git repository
+            endif # version.txt
+        endif # PROJECT_VER
+    endif # CONFIG_APP_PROJECT_VER_FROM_CONFIG

-GET_PROJECT_VER := $(shell cd ${PROJECT_PATH} && git describe --always --tags --dirty 2> /dev/null)
-ifeq ("${GET_PROJECT_VER}", "")
-GET_PROJECT_VER := "1"
-$(info Project is not inside a git repository, will not use 'git describe' to determine PROJECT_VER.)
-endif
+    # cut PROJECT_VER and PROJECT_NAME to required 32 characters.
+    PROJECT_VER_CUT  := $(shell echo "$(PROJECT_VER)"  | cut -c 1-31)
+    PROJECT_NAME_CUT := $(shell echo "$(PROJECT_NAME)" | cut -c 1-31)

-else
-# read from version.txt
-GET_PROJECT_VER := $(shell cat ${PROJECT_PATH}/version.txt)
-endif
-endif
-# If ``PROJECT_VER`` variable set in project Makefile file, its value will be used.
-# Else, if the ``$PROJECT_PATH/version.txt`` exists, its contents will be used as ``PROJECT_VER``.
-# Else, if the project is located inside a Git repository, the output of git describe will be used.
-# Otherwise, ``PROJECT_VER`` will be "1".
+    $(info App "$(PROJECT_NAME_CUT)" version: $(PROJECT_VER_CUT))

-ifeq ("${PROJECT_VER}", "")
-PROJECT_VER:= $(GET_PROJECT_VER)
-else
-PROJECT_VER:= $(PROJECT_VER)
-endif
+    NEW_DEFINES:= "$(PROJECT_VER_CUT) $(PROJECT_NAME_CUT) $(IDF_VER)"
+    ifeq ("$(wildcard ${TMP_DEFINES})","")
+        OLD_DEFINES:= ""
+    else
+        OLD_DEFINES:= "$(shell cat $(TMP_DEFINES))"
+    endif

-# cut PROJECT_VER and PROJECT_NAME to required 32 characters.
-PROJECT_VER_CUT  := $(shell echo "$(PROJECT_VER)"  | cut -c 1-31)
-PROJECT_NAME_CUT := $(shell echo "$(PROJECT_NAME)" | cut -c 1-31)
+    # If NEW_DEFINES (PROJECT_VER, PROJECT_NAME) were changed then rebuild only esp_app_desc.
+    ifneq (${NEW_DEFINES}, ${OLD_DEFINES})
+        $(shell echo $(NEW_DEFINES) > $(TMP_DEFINES); rm -f esp_app_desc.o;)
+    endif

-$(info App "$(PROJECT_NAME_CUT)" version: $(PROJECT_VER_CUT))
-
-NEW_DEFINES:= "$(PROJECT_VER_CUT) $(PROJECT_NAME_CUT) $(IDF_VER)"
-ifeq ("$(wildcard ${TMP_DEFINES})","")
-OLD_DEFINES:= ""
-else
-OLD_DEFINES:= "$(shell cat $(TMP_DEFINES))"
-endif
-
-# If NEW_DEFINES (PROJECT_VER, PROJECT_NAME) were changed then rebuild only esp_app_desc.
-ifneq (${NEW_DEFINES}, ${OLD_DEFINES})
-$(shell echo $(NEW_DEFINES) > $(TMP_DEFINES); rm -f esp_app_desc.o;)
-endif
-
-esp_app_desc.o: CPPFLAGS += -D PROJECT_VER=\""$(PROJECT_VER_CUT)"\" -D PROJECT_NAME=\""$(PROJECT_NAME_CUT)"\"
-endif
+    esp_app_desc.o: CPPFLAGS += -D PROJECT_VER=\""$(PROJECT_VER_CUT)"\" -D PROJECT_NAME=\""$(PROJECT_NAME_CUT)"\"
+endif # IS_BOOTLOADER_BUILD
--- a/components/app_update/esp_app_desc.c
+++ b/components/app_update/esp_app_desc.c
@@ -80,7 +80,7 @@ __attribute__((constructor)) void esp_ota_init_app_elf_sha256(void)
 /* The esp_app_desc.app_elf_sha256 should be possible to print in panic handler during cache is disabled.
 * But because the cache is disabled the reading esp_app_desc.app_elf_sha256 is not right and
 * can lead to a complete lock-up of the CPU.
- * For this reason we do a reading of esp_app_desc.app_elf_sha256 while start up in esp_ota_init_app_elf_sha256() 
+ * For this reason we do a reading of esp_app_desc.app_elf_sha256 while start up in esp_ota_init_app_elf_sha256()
 * and keep it in the static s_app_elf_sha256 value.
 */
 int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
@@ -89,7 +89,10 @@ int IRAM_ATTR esp_ota_get_app_elf_sha256(char* dst, size_t size)
    static bool first_call = true;
    if (first_call) {
        first_call = false;
-        const uint8_t* src = esp_app_desc.app_elf_sha256;
+        // At -O2 optimization level, GCC optimizes out the copying of the first byte of the app_elf_sha256,
+        // because it is zero at compile time, and only modified afterwards by esptool.
+        // Casting to volatile disables the optimization.
+        const volatile uint8_t* src = (const volatile uint8_t*)esp_app_desc.app_elf_sha256;
        for (size_t i = 0; i < sizeof(s_app_elf_sha256); ++i) {
            s_app_elf_sha256[i] = src[i];
        }
--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -33,24 +33,24 @@

 #include "esp_ota_ops.h"
 #include "sys/queue.h"
-#include "esp32/rom/crc.h"
 #include "esp_log.h"
 #include "esp_flash_partitions.h"
 #include "bootloader_common.h"
 #include "sys/param.h"
 #include "esp_system.h"
 #include "esp_efuse.h"
-
+#include "esp_attr.h"

 #define SUB_TYPE_ID(i) (i & 0x0F)

+/* Partial_data is word aligned so no reallocation is necessary for encrypted flash write */
 typedef struct ota_ops_entry_ {
    uint32_t handle;
    const esp_partition_t *part;
-    uint32_t erased_size;
+    bool need_erase;
    uint32_t wrote_size;
    uint8_t partial_bytes;
-    uint8_t partial_data[16];
+    WORD_ALIGNED_ATTR uint8_t partial_data[16];
    LIST_ENTRY(ota_ops_entry_) entries;
 } ota_ops_entry_t;

@@ -153,16 +153,17 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
    }
 #endif

-    // If input image size is 0 or OTA_SIZE_UNKNOWN, erase entire partition
-    if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
-        ret = esp_partition_erase_range(partition, 0, partition->size);
-    } else {
-        const int aligned_erase_size = (image_size + SPI_FLASH_SEC_SIZE - 1) & ~(SPI_FLASH_SEC_SIZE - 1);
-        ret = esp_partition_erase_range(partition, 0, aligned_erase_size);
-    }
-
-    if (ret != ESP_OK) {
-        return ret;
+    if (image_size != OTA_WITH_SEQUENTIAL_WRITES) {
+        // If input image size is 0 or OTA_SIZE_UNKNOWN, erase entire partition
+        if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
+            ret = esp_partition_erase_range(partition, 0, partition->size);
+        } else {
+            const int aligned_erase_size = (image_size + SPI_FLASH_SEC_SIZE - 1) & ~(SPI_FLASH_SEC_SIZE - 1);
+            ret = esp_partition_erase_range(partition, 0, aligned_erase_size);
+        }
+        if (ret != ESP_OK) {
+            return ret;
+        }
    }

    new_entry = (ota_ops_entry_t *) calloc(sizeof(ota_ops_entry_t), 1);
@@ -172,14 +173,9 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp

    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);

-    if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
-        new_entry->erased_size = partition->size;
-    } else {
-        new_entry->erased_size = image_size;
-    }
-
    new_entry->part = partition;
    new_entry->handle = ++s_ota_ops_last_handle;
+    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
    *out_handle = new_entry->handle;
    return ESP_OK;
 }
@@ -198,8 +194,22 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
    // find ota handle in linked list
    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
        if (it->handle == handle) {
-            // must erase the partition before writing to it
-            assert(it->erased_size > 0 && "must erase the partition before writing to it");
+            if (it->need_erase) {
+                // must erase the partition before writing to it
+                uint32_t first_sector = it->wrote_size / SPI_FLASH_SEC_SIZE;
+                uint32_t last_sector = (it->wrote_size + size) / SPI_FLASH_SEC_SIZE;
+
+                ret = ESP_OK;
+                if ((it->wrote_size % SPI_FLASH_SEC_SIZE) == 0) {
+                    ret = esp_partition_erase_range(it->part, it->wrote_size, ((last_sector - first_sector) + 1) * SPI_FLASH_SEC_SIZE);
+                } else if (first_sector != last_sector) {
+                    ret = esp_partition_erase_range(it->part, (first_sector + 1) * SPI_FLASH_SEC_SIZE, (last_sector - first_sector) * SPI_FLASH_SEC_SIZE);
+                }
+                if (ret != ESP_OK) {
+                    return ret;
+                }
+            }
+
            if (it->wrote_size == 0 && it->partial_bytes == 0 && size > 0 && data_bytes[0] != ESP_IMAGE_HEADER_MAGIC) {
                ESP_LOGE(TAG, "OTA image has invalid magic byte (expected 0xE9, saw 0x%02x)", data_bytes[0]);
                return ESP_ERR_OTA_VALIDATE_FAILED;
@@ -250,16 +260,70 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void *data, size_t size)
    return ESP_ERR_INVALID_ARG;
 }

-esp_err_t esp_ota_end(esp_ota_handle_t handle)
+esp_err_t esp_ota_write_with_offset(esp_ota_handle_t handle, const void *data, size_t size, uint32_t offset)
 {
+    const uint8_t *data_bytes = (const uint8_t *)data;
+    esp_err_t ret;
    ota_ops_entry_t *it;
-    esp_err_t ret = ESP_OK;

+    if (data == NULL) {
+        ESP_LOGE(TAG, "write data is invalid");
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    // find ota handle in linked list
+    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
+        if (it->handle == handle) {
+            // must erase the partition before writing to it
+            assert(it->need_erase == 0 && "must erase the partition before writing to it");
+
+            /* esp_ota_write_with_offset is used to write data in non contiguous manner.
+             * Hence, unaligned data(less than 16 bytes) cannot be cached if flash encryption is enabled.
+             */
+            if (esp_flash_encryption_enabled() && (size % 16)) {
+                ESP_LOGE(TAG, "Size should be 16byte aligned for flash encryption case");
+                return ESP_ERR_INVALID_ARG;
+            }
+            ret = esp_partition_write(it->part, offset, data_bytes, size);
+            if (ret == ESP_OK) {
+                it->wrote_size += size;
+            }
+            return ret;
+        }
+    }
+
+    // OTA handle is not found in linked list
+    ESP_LOGE(TAG,"OTA handle not found");
+    return ESP_ERR_INVALID_ARG;
+}
+
+static ota_ops_entry_t *get_ota_ops_entry(esp_ota_handle_t handle)
+{
+    ota_ops_entry_t *it = NULL;
    for (it = LIST_FIRST(&s_ota_ops_entries_head); it != NULL; it = LIST_NEXT(it, entries)) {
        if (it->handle == handle) {
            break;
        }
    }
+   return it;
+}
+
+esp_err_t esp_ota_abort(esp_ota_handle_t handle)
+{
+    ota_ops_entry_t *it = get_ota_ops_entry(handle);
+
+    if (it == NULL) {
+        return ESP_ERR_NOT_FOUND;
+    }
+    LIST_REMOVE(it, entries);
+    free(it);
+    return ESP_OK;
+}
+
+esp_err_t esp_ota_end(esp_ota_handle_t handle)
+{
+    ota_ops_entry_t *it = get_ota_ops_entry(handle);
+    esp_err_t ret = ESP_OK;

    if (it == NULL) {
        return ESP_ERR_NOT_FOUND;
@@ -268,7 +332,7 @@ esp_err_t esp_ota_end(esp_ota_handle_t handle)
    /* 'it' holds the ota_ops_entry_t for 'handle' */

    // esp_ota_end() is only valid if some data was written to this handle
-    if ((it->erased_size == 0) || (it->wrote_size == 0)) {
+    if (it->wrote_size == 0) {
        ret = ESP_ERR_INVALID_ARG;
        goto cleanup;
    }
@@ -335,7 +399,7 @@ static esp_err_t esp_rewrite_ota_data(esp_partition_subtype_t subtype)
        return ESP_ERR_NOT_FOUND;
    }

-    int ota_app_count = get_ota_partition_count();
+    uint8_t ota_app_count = get_ota_partition_count();
    if (SUB_TYPE_ID(subtype) >= ota_app_count) {
        return ESP_ERR_INVALID_ARG;
    }
@@ -821,3 +885,24 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void)

    return ESP_OK;
 }
+
+#if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS > 1 && CONFIG_SECURE_BOOT_V2_ENABLED
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index) {
+
+    if (!esp_secure_boot_enabled()) {
+        ESP_LOGE(TAG, "Secure boot v2 has not been enabled.");
+        return ESP_FAIL;
+    }
+
+    if (index != SECURE_BOOT_PUBLIC_KEY_INDEX_0 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_1 &&
+         index != SECURE_BOOT_PUBLIC_KEY_INDEX_2) {
+        ESP_LOGE(TAG, "Invalid Index found for public key revocation %d.", index);
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    ets_secure_boot_revoke_public_key_digest(index);
+    ESP_LOGI(TAG, "Revoked signature block %d.", index);
+    return ESP_OK;
+}
+#endif
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@@ -29,6 +29,7 @@ extern "C"
 #endif

 #define OTA_SIZE_UNKNOWN 0xffffffff /*!< Used for esp_ota_begin() if new image size is unknown */
+#define OTA_WITH_SEQUENTIAL_WRITES 0xfffffffe /*!< Used for esp_ota_begin() if new image size is unknown and erase can be done in incremental manner (assuming write operation is in continuous sequence) */

 #define ESP_ERR_OTA_BASE                         0x1500                     /*!< Base error code for ota_ops api */
 #define ESP_ERR_OTA_PARTITION_CONFLICT           (ESP_ERR_OTA_BASE + 0x01)  /*!< Error if request was to write or erase the current running partition */
@@ -49,7 +50,7 @@ typedef uint32_t esp_ota_handle_t;

 /**
 * @brief   Return esp_app_desc structure. This structure includes app version.
- * 
+ *
 * Return description for running app.
 * @return Pointer to esp_app_desc structure.
 */
@@ -117,6 +118,29 @@ esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp
 */
 esp_err_t esp_ota_write(esp_ota_handle_t handle, const void* data, size_t size);

+/**
+ * @brief   Write OTA update data to partition
+ *
+ * This function can write data in non contiguous manner.
+ * If flash encryption is enabled, data should be 16 byte aligned.
+ *
+ * @param handle  Handle obtained from esp_ota_begin
+ * @param data    Data buffer to write
+ * @param size    Size of data buffer in bytes
+ * @param offset  Offset in flash partition
+ *
+ * @note While performing OTA, if the packets arrive out of order, esp_ota_write_with_offset() can be used to write data in non contiguous manner.
+ *       Use of esp_ota_write_with_offset() in combination with esp_ota_write() is not recommended.
+ *
+ * @return
+ *    - ESP_OK: Data was written to flash successfully.
+ *    - ESP_ERR_INVALID_ARG: handle is invalid.
+ *    - ESP_ERR_OTA_VALIDATE_FAILED: First byte of image contains invalid app image magic byte.
+ *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
+ *    - ESP_ERR_OTA_SELECT_INFO_INVALID: OTA data partition has invalid contents
+ */
+esp_err_t esp_ota_write_with_offset(esp_ota_handle_t handle, const void *data, size_t size, uint32_t offset);
+
 /**
 * @brief Finish OTA update and validate newly written app image.
 *
@@ -133,6 +157,18 @@ esp_err_t esp_ota_write(esp_ota_handle_t handle, const void* data, size_t size);
 */
 esp_err_t esp_ota_end(esp_ota_handle_t handle);

+/**
+ * @brief Abort OTA update, free the handle and memory associated with it.
+ *
+ * @param handle obtained from esp_ota_begin().
+ *
+ * @return
+ *    - ESP_OK: Handle and its associated memory is freed successfully.
+ *    - ESP_ERR_NOT_FOUND: OTA handle was not found.
+ */
+esp_err_t esp_ota_abort(esp_ota_handle_t handle);
+
+
 /**
 * @brief Configure OTA data for a new boot partition
 *
@@ -201,7 +237,7 @@ const esp_partition_t* esp_ota_get_next_update_partition(const esp_partition_t *

 /**
 * @brief Returns esp_app_desc structure for app partition. This structure includes app version.
- * 
+ *
 * Returns a description for the requested app partition.
 * @param[in] partition     Pointer to app partition. (only app partition)
 * @param[out] app_desc     Structure of info about app.
@@ -276,6 +312,34 @@ esp_err_t esp_ota_erase_last_boot_app_partition(void);
 */
 bool esp_ota_check_rollback_is_possible(void);

+#if SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS > 1 && (CONFIG_SECURE_BOOT_V2_ENABLED || __DOXYGEN__)
+
+/**
+ * Secure Boot V2 public key indexes.
+ */
+typedef enum {
+    SECURE_BOOT_PUBLIC_KEY_INDEX_0,     /*!< Points to the 0th index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_1,     /*!< Points to the 1st index of the Secure Boot v2 public key */
+    SECURE_BOOT_PUBLIC_KEY_INDEX_2      /*!< Points to the 2nd index of the Secure Boot v2 public key */
+} esp_ota_secure_boot_public_key_index_t;
+
+/**
+ * @brief Revokes the old signature digest. To be called in the application after the rollback logic.
+ *
+ * Relevant for Secure boot v2 on ESP32-S2 where upto 3 key digests can be stored (Key #N-1, Key #N, Key #N+1).
+ * When key #N-1 used to sign an app is invalidated, an OTA update is to be sent with an app signed with key #N-1 & Key #N.
+ * After successfully booting the OTA app should call this function to revoke Key #N-1.
+ *
+ * @param index - The index of the signature block to be revoked
+ *
+ * @return
+ *        - ESP_OK: If revocation is successful.
+ *        - ESP_ERR_INVALID_ARG: If the index of the public key to be revoked is incorrect.
+ *        - ESP_FAIL: If secure boot v2 has not been enabled.
+ */
+esp_err_t esp_ota_revoke_secure_boot_public_key(esp_ota_secure_boot_public_key_index_t index);
+#endif /* SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS > 1 */
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/app_update/otatool.py
+++ b/components/app_update/otatool.py
@@ -16,23 +16,23 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-from __future__ import print_function, division
+from __future__ import division, print_function
+
 import argparse
-import os
-import sys
 import binascii
-import tempfile
 import collections
+import os
 import struct
+import sys
+import tempfile

 try:
-    from parttool import PartitionName, PartitionType, ParttoolTarget, PARTITION_TABLE_OFFSET
+    from parttool import PARTITION_TABLE_OFFSET, PartitionName, PartitionType, ParttoolTarget
 except ImportError:
-    COMPONENTS_PATH = os.path.expandvars(os.path.join("$IDF_PATH", "components"))
-    PARTTOOL_DIR = os.path.join(COMPONENTS_PATH, "partition_table")
-
+    COMPONENTS_PATH = os.path.expandvars(os.path.join('$IDF_PATH', 'components'))
+    PARTTOOL_DIR = os.path.join(COMPONENTS_PATH, 'partition_table')
    sys.path.append(PARTTOOL_DIR)
-    from parttool import PartitionName, PartitionType, ParttoolTarget, PARTITION_TABLE_OFFSET
+    from parttool import PARTITION_TABLE_OFFSET, PartitionName, PartitionType, ParttoolTarget

 __version__ = '2.0'

@@ -48,7 +48,7 @@ def status(msg):

 class OtatoolTarget():

-    OTADATA_PARTITION = PartitionType("data", "ota")
+    OTADATA_PARTITION = PartitionType('data', 'ota')

    def __init__(self, port=None, baud=None, partition_table_offset=PARTITION_TABLE_OFFSET, partition_table_file=None,
                 spi_flash_sec_size=SPI_FLASH_SEC_SIZE, esptool_args=[], esptool_write_args=[],
@@ -61,16 +61,14 @@ class OtatoolTarget():
        temp_file.close()
        try:
            self.target.read_partition(OtatoolTarget.OTADATA_PARTITION, temp_file.name)
-            with open(temp_file.name, "rb") as f:
+            with open(temp_file.name, 'rb') as f:
                self.otadata = f.read()
-        except Exception:
-            self.otadata = None
        finally:
            os.unlink(temp_file.name)

    def _check_otadata_partition(self):
        if not self.otadata:
-            raise Exception("No otadata partition found")
+            raise Exception('No otadata partition found')

    def erase_otadata(self):
        self._check_otadata_partition()
@@ -79,7 +77,7 @@ class OtatoolTarget():
    def _get_otadata_info(self):
        info = []

-        otadata_info = collections.namedtuple("otadata_info", "seq crc")
+        otadata_info = collections.namedtuple('otadata_info', 'seq crc')

        for i in range(2):
            start = i * (self.spi_flash_sec_size >> 1)
@@ -87,28 +85,26 @@ class OtatoolTarget():
            seq = bytearray(self.otadata[start:start + 4])
            crc = bytearray(self.otadata[start + 28:start + 32])

-            seq = struct.unpack('>I', seq)
-            crc = struct.unpack('>I', crc)
-
+            seq = struct.unpack('I', seq)
+            crc = struct.unpack('I', crc)
            info.append(otadata_info(seq[0], crc[0]))

        return info

    def _get_partition_id_from_ota_id(self, ota_id):
        if isinstance(ota_id, int):
-            return PartitionType("app", "ota_" + str(ota_id))
+            return PartitionType('app', 'ota_' + str(ota_id))
        else:
            return PartitionName(ota_id)

    def switch_ota_partition(self, ota_id):
        self._check_otadata_partition()

-        sys.path.append(PARTTOOL_DIR)
        import gen_esp32part as gen

        def is_otadata_info_valid(status):
            seq = status.seq % (1 << 32)
-            crc = hex(binascii.crc32(struct.pack("I", seq), 0xFFFFFFFF) % (1 << 32))
+            crc = binascii.crc32(struct.pack('I', seq), 0xFFFFFFFF) % (1 << 32)
            return seq < (int('0xFFFFFFFF', 16) % (1 << 32)) and status.crc == crc

        partition_table = self.target.partition_table
@@ -126,7 +122,7 @@ class OtatoolTarget():
        ota_partitions = sorted(ota_partitions, key=lambda p: p.subtype)

        if not ota_partitions:
-            raise Exception("No ota app partitions found")
+            raise Exception('No ota app partitions found')

        # Look for the app partition to switch to
        ota_partition_next = None
@@ -139,7 +135,7 @@ class OtatoolTarget():

            ota_partition_next = list(ota_partition_next)[0]
        except IndexError:
-            raise Exception("Partition to switch to not found")
+            raise Exception('Partition to switch to not found')

        otadata_info = self._get_otadata_info()

@@ -179,15 +175,15 @@ class OtatoolTarget():
            ota_seq_next = target_seq

        # Create binary data from computed values
-        ota_seq_next = struct.pack("I", ota_seq_next)
+        ota_seq_next = struct.pack('I', ota_seq_next)
        ota_seq_crc_next = binascii.crc32(ota_seq_next, 0xFFFFFFFF) % (1 << 32)
-        ota_seq_crc_next = struct.pack("I", ota_seq_crc_next)
+        ota_seq_crc_next = struct.pack('I', ota_seq_crc_next)

        temp_file = tempfile.NamedTemporaryFile(delete=False)
        temp_file.close()

        try:
-            with open(temp_file.name, "wb") as otadata_next_file:
+            with open(temp_file.name, 'wb') as otadata_next_file:
                start = (1 if otadata_compute_base == 0 else 0) * (self.spi_flash_sec_size >> 1)

                otadata_next_file.write(self.otadata)
@@ -219,14 +215,14 @@ def _read_otadata(target):

    otadata_info = target._get_otadata_info()

-    print("             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}".format("OTA_SEQ", "CRC", "OTA_SEQ", "CRC"))
-    print("Firmware:  0x{:8x} \t0x{:8x} | \t0x{:8x} \t 0x{:8x}".format(otadata_info[0].seq, otadata_info[0].crc,
+    print('             {:8s} \t  {:8s} | \t  {:8s} \t   {:8s}'.format('OTA_SEQ', 'CRC', 'OTA_SEQ', 'CRC'))
+    print('Firmware:  0x{:08x} \t0x{:08x} | \t0x{:08x} \t 0x{:08x}'.format(otadata_info[0].seq, otadata_info[0].crc,
          otadata_info[1].seq, otadata_info[1].crc))


 def _erase_otadata(target):
    target.erase_otadata()
-    status("Erased ota_data partition contents")
+    status('Erased ota_data partition contents')


 def _switch_ota_partition(target, ota_id):
@@ -235,64 +231,68 @@ def _switch_ota_partition(target, ota_id):

 def _read_ota_partition(target, ota_id, output):
    target.read_ota_partition(ota_id, output)
-    status("Read ota partition contents to file {}".format(output))
+    status('Read ota partition contents to file {}'.format(output))


 def _write_ota_partition(target, ota_id, input):
    target.write_ota_partition(ota_id, input)
-    status("Written contents of file {} to ota partition".format(input))
+    status('Written contents of file {} to ota partition'.format(input))


 def _erase_ota_partition(target, ota_id):
    target.erase_ota_partition(ota_id)
-    status("Erased contents of ota partition")
+    status('Erased contents of ota partition')


 def main():
+    if sys.version_info[0] < 3:
+        print('WARNING: Support for Python 2 is deprecated and will be removed in future versions.', file=sys.stderr)
+    elif sys.version_info[0] == 3 and sys.version_info[1] < 6:
+        print('WARNING: Python 3 versions older than 3.6 are not supported.', file=sys.stderr)
    global quiet

-    parser = argparse.ArgumentParser("ESP-IDF OTA Partitions Tool")
+    parser = argparse.ArgumentParser('ESP-IDF OTA Partitions Tool')

-    parser.add_argument("--quiet", "-q", help="suppress stderr messages", action="store_true")
-    parser.add_argument("--esptool-args", help="additional main arguments for esptool", nargs="+")
-    parser.add_argument("--esptool-write-args", help="additional subcommand arguments for esptool write_flash", nargs="+")
-    parser.add_argument("--esptool-read-args", help="additional subcommand arguments for esptool read_flash", nargs="+")
-    parser.add_argument("--esptool-erase-args", help="additional subcommand arguments for esptool erase_region", nargs="+")
+    parser.add_argument('--quiet', '-q', help='suppress stderr messages', action='store_true')
+    parser.add_argument('--esptool-args', help='additional main arguments for esptool', nargs='+')
+    parser.add_argument('--esptool-write-args', help='additional subcommand arguments for esptool write_flash', nargs='+')
+    parser.add_argument('--esptool-read-args', help='additional subcommand arguments for esptool read_flash', nargs='+')
+    parser.add_argument('--esptool-erase-args', help='additional subcommand arguments for esptool erase_region', nargs='+')

    # There are two possible sources for the partition table: a device attached to the host
    # or a partition table CSV/binary file. These sources are mutually exclusive.
-    parser.add_argument("--port", "-p", help="port where the device to read the partition table from is attached")
+    parser.add_argument('--port', '-p', help='port where the device to read the partition table from is attached')

-    parser.add_argument("--baud", "-b", help="baudrate to use", type=int)
+    parser.add_argument('--baud', '-b', help='baudrate to use', type=int)

-    parser.add_argument("--partition-table-offset", "-o", help="offset to read the partition table from",  type=str)
+    parser.add_argument('--partition-table-offset', '-o', help='offset to read the partition table from',  type=str)

-    parser.add_argument("--partition-table-file", "-f", help="file (CSV/binary) to read the partition table from; \
-                                                            overrides device attached to specified port as the partition table source when defined")
+    parser.add_argument('--partition-table-file', '-f', help='file (CSV/binary) to read the partition table from; \
+                                                            overrides device attached to specified port as the partition table source when defined')

-    subparsers = parser.add_subparsers(dest="operation", help="run otatool -h for additional help")
+    subparsers = parser.add_subparsers(dest='operation', help='run otatool -h for additional help')

    spi_flash_sec_size = argparse.ArgumentParser(add_help=False)
-    spi_flash_sec_size.add_argument("--spi-flash-sec-size", help="value of SPI_FLASH_SEC_SIZE macro", type=str)
+    spi_flash_sec_size.add_argument('--spi-flash-sec-size', help='value of SPI_FLASH_SEC_SIZE macro', type=str)

    # Specify the supported operations
-    subparsers.add_parser("read_otadata", help="read otadata partition", parents=[spi_flash_sec_size])
-    subparsers.add_parser("erase_otadata", help="erase otadata partition")
+    subparsers.add_parser('read_otadata', help='read otadata partition', parents=[spi_flash_sec_size])
+    subparsers.add_parser('erase_otadata', help='erase otadata partition')

    slot_or_name_parser = argparse.ArgumentParser(add_help=False)
    slot_or_name_parser_args = slot_or_name_parser.add_mutually_exclusive_group()
-    slot_or_name_parser_args.add_argument("--slot", help="slot number of the ota partition", type=int)
-    slot_or_name_parser_args.add_argument("--name", help="name of the ota partition")
+    slot_or_name_parser_args.add_argument('--slot', help='slot number of the ota partition', type=int)
+    slot_or_name_parser_args.add_argument('--name', help='name of the ota partition')

-    subparsers.add_parser("switch_ota_partition", help="switch otadata partition", parents=[slot_or_name_parser, spi_flash_sec_size])
+    subparsers.add_parser('switch_ota_partition', help='switch otadata partition', parents=[slot_or_name_parser, spi_flash_sec_size])

-    read_ota_partition_subparser = subparsers.add_parser("read_ota_partition", help="read contents of an ota partition", parents=[slot_or_name_parser])
-    read_ota_partition_subparser.add_argument("--output", help="file to write the contents of the ota partition to")
+    read_ota_partition_subparser = subparsers.add_parser('read_ota_partition', help='read contents of an ota partition', parents=[slot_or_name_parser])
+    read_ota_partition_subparser.add_argument('--output', help='file to write the contents of the ota partition to', required=True)

-    write_ota_partition_subparser = subparsers.add_parser("write_ota_partition", help="write contents to an ota partition", parents=[slot_or_name_parser])
-    write_ota_partition_subparser.add_argument("--input", help="file whose contents to write to the ota partition")
+    write_ota_partition_subparser = subparsers.add_parser('write_ota_partition', help='write contents to an ota partition', parents=[slot_or_name_parser])
+    write_ota_partition_subparser.add_argument('--input', help='file whose contents to write to the ota partition')

-    subparsers.add_parser("erase_ota_partition", help="erase contents of an ota partition", parents=[slot_or_name_parser])
+    subparsers.add_parser('erase_ota_partition', help='erase contents of an ota partition', parents=[slot_or_name_parser])

    args = parser.parse_args()

@@ -307,34 +307,34 @@ def main():
    target_args = {}

    if args.port:
-        target_args["port"] = args.port
+        target_args['port'] = args.port

    if args.partition_table_file:
-        target_args["partition_table_file"] = args.partition_table_file
+        target_args['partition_table_file'] = args.partition_table_file

    if args.partition_table_offset:
-        target_args["partition_table_offset"] = int(args.partition_table_offset, 0)
+        target_args['partition_table_offset'] = int(args.partition_table_offset, 0)

    try:
        if args.spi_flash_sec_size:
-            target_args["spi_flash_sec_size"] = int(args.spi_flash_sec_size, 0)
+            target_args['spi_flash_sec_size'] = int(args.spi_flash_sec_size, 0)
    except AttributeError:
        pass

    if args.esptool_args:
-        target_args["esptool_args"] = args.esptool_args
+        target_args['esptool_args'] = args.esptool_args

    if args.esptool_write_args:
-        target_args["esptool_write_args"] = args.esptool_write_args
+        target_args['esptool_write_args'] = args.esptool_write_args

    if args.esptool_read_args:
-        target_args["esptool_read_args"] = args.esptool_read_args
+        target_args['esptool_read_args'] = args.esptool_read_args

    if args.esptool_erase_args:
-        target_args["esptool_erase_args"] = args.esptool_erase_args
+        target_args['esptool_erase_args'] = args.esptool_erase_args

    if args.baud:
-        target_args["baud"] = args.baud
+        target_args['baud'] = args.baud

    target = OtatoolTarget(**target_args)

@@ -345,10 +345,10 @@ def main():

    try:
        if args.name is not None:
-            ota_id = ["name"]
+            ota_id = ['name']
        else:
            if args.slot is not None:
-                ota_id = ["slot"]
+                ota_id = ['slot']
    except AttributeError:
        pass

@@ -356,8 +356,8 @@ def main():
        'read_otadata':(_read_otadata, []),
        'erase_otadata':(_erase_otadata, []),
        'switch_ota_partition':(_switch_ota_partition, ota_id),
-        'read_ota_partition':(_read_ota_partition, ["output"] + ota_id),
-        'write_ota_partition':(_write_ota_partition, ["input"] + ota_id),
+        'read_ota_partition':(_read_ota_partition, ['output'] + ota_id),
+        'write_ota_partition':(_write_ota_partition, ['input'] + ota_id),
        'erase_ota_partition':(_erase_ota_partition, ota_id)
    }

--- a/components/app_update/test/CMakeLists.txt
+++ b/components/app_update/test/CMakeLists.txt
@@ -1,4 +1,4 @@
 idf_component_register(SRC_DIRS "."
-                       INCLUDE_DIRS "."
-                       REQUIRES unity test_utils app_update bootloader_support nvs_flash
-                      )
+                       PRIV_INCLUDE_DIRS "."
+                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash
+                      )
--- a/components/app_update/test/test_ota_ops.c
+++ b/components/app_update/test/test_ota_ops.c
@@ -84,7 +84,7 @@ TEST_CASE("esp_ota_get_next_update_partition logic", "[ota]")
    TEST_ASSERT_EQUAL_PTR(ota_0, p);
 }

-TEST_CASE("esp_ota_get_partition_description ", "[ota]")
+TEST_CASE("esp_ota_get_partition_description", "[ota]")
 {
    const esp_partition_t *running = esp_ota_get_running_partition();
    TEST_ASSERT_NOT_NULL(running);
--- a/components/app_update/test/test_switch_ota.c
+++ b/components/app_update/test/test_switch_ota.c
@@ -10,20 +10,19 @@
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/spi_flash.h"
 #include "esp32/rom/rtc.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/spi_flash.h"
-#include "esp32s2beta/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/spi_flash.h"
+#include "esp32s2/rom/rtc.h"
 #endif

 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include "freertos/semphr.h"
 #include "freertos/queue.h"
-#include "freertos/xtensa_api.h"
 #include "unity.h"

 #include "bootloader_common.h"
-#include "../include_bootloader/bootloader_flash.h"
+#include "../include_bootloader/bootloader_flash_priv.h"

 #include "esp_log.h"
 #include "esp_ota_ops.h"
@@ -48,9 +47,34 @@ static void copy_app_partition(esp_ota_handle_t update_handle, const esp_partiti
 {
    const void *partition_bin = NULL;
    spi_flash_mmap_handle_t  data_map;
+    ESP_LOGI(TAG, "start the copy process");
    TEST_ESP_OK(esp_partition_mmap(curr_app, 0, curr_app->size, SPI_FLASH_MMAP_DATA, &partition_bin, &data_map));
    TEST_ESP_OK(esp_ota_write(update_handle, (const void *)partition_bin, curr_app->size));
    spi_flash_munmap(data_map);
+    ESP_LOGI(TAG, "finish the copy process");
+}
+
+/* @brief Copies a current app to next partition using handle.
+ *
+ * @param[in] update_handle - Handle of API ota.
+ * @param[in] cur_app - Current app.
+ */
+static void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
+{
+    const void *partition_bin = NULL;
+    spi_flash_mmap_handle_t  data_map;
+    ESP_LOGI(TAG, "start the copy process");
+    uint32_t offset = 0, bytes_to_write = curr_app->size;
+    uint32_t write_bytes;
+    while (bytes_to_write > 0) {
+        write_bytes = (bytes_to_write > (4 * 1024)) ? (4 * 1024) : bytes_to_write;
+        TEST_ESP_OK(esp_partition_mmap(curr_app, offset, write_bytes, SPI_FLASH_MMAP_DATA, &partition_bin, &data_map));
+        TEST_ESP_OK(esp_ota_write_with_offset(update_handle, (const void *)partition_bin, write_bytes, offset));
+        spi_flash_munmap(data_map);
+        bytes_to_write -= write_bytes;
+        offset += write_bytes;
+    }
+    ESP_LOGI(TAG, "finish the copy process");
 }

 #if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
@@ -103,6 +127,26 @@ static void copy_current_app_to_next_part(const esp_partition_t *cur_app_partiti
    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
 }

+/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
+ *
+ * @param[in] cur_app_partition - Current app.
+ * @param[in] next_app_partition - Next app for boot.
+ */
+static void copy_current_app_to_next_part_with_offset(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
+{
+    esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
+    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%x", next_app_partition->subtype, next_app_partition->address);
+
+    esp_ota_handle_t update_handle = 0;
+    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
+
+    copy_app_partition_with_offset(update_handle, cur_app_partition);
+
+    TEST_ESP_OK(esp_ota_end(update_handle));
+    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
+}
+
 /* @brief Erase otadata partition
 */
 static void erase_ota_data(void)
@@ -116,6 +160,7 @@ static void erase_ota_data(void)
 */
 static void reboot_as_deep_sleep(void)
 {
+    ESP_LOGI(TAG, "reboot as deep sleep");
    esp_sleep_enable_timer_wakeup(2000);
    esp_deep_sleep_start();
 }
@@ -125,10 +170,21 @@ static void reboot_as_deep_sleep(void)
 static void copy_current_app_to_next_part_and_reboot(void)
 {
    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
    copy_current_app_to_next_part(cur_app, get_next_update_partition());
    reboot_as_deep_sleep();
 }

+/* @brief Copies a current app to next partition (OTA0-15) using esp_ota_write_with_offest(), after that ESP is rebooting and run this (the next) OTAx.
+ */
+static void copy_current_app_to_next_part_with_offset_and_reboot(void)
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    copy_current_app_to_next_part_with_offset(cur_app, get_next_update_partition());
+    reboot_as_deep_sleep();
+}
+
 /* @brief Get running app.
 *
 * @return The next partition of OTA(OTA0-15).
@@ -222,7 +278,7 @@ static void set_output_pin(uint32_t num_pin)
    TEST_ESP_OK(gpio_hold_dis(num_pin));

    gpio_config_t io_conf;
-    io_conf.intr_type = GPIO_PIN_INTR_DISABLE;
+    io_conf.intr_type = GPIO_INTR_DISABLE;
    io_conf.mode = GPIO_MODE_OUTPUT;
    io_conf.pin_bit_mask = (1ULL << num_pin);
    io_conf.pull_down_en = 0;
@@ -256,6 +312,7 @@ static void start_test(void)
    ESP_LOGI(TAG, "boot count 1 - reset");
    boot_count = 1;
    erase_ota_data();
+    ESP_LOGI(TAG, "ota_data erased");
    reboot_as_deep_sleep();
 }

@@ -392,7 +449,7 @@ static void test_flow4(void)
    ESP_LOGI(TAG, "boot count %d", boot_count);
    const esp_partition_t *cur_app = get_running_firmware();
    nvs_handle_t handle = 0;
-    int boot_count_nvs = 0;
+    int32_t boot_count_nvs = 0;
    switch (boot_count) {
        case 2:
            ESP_LOGI(TAG, "Factory");
@@ -428,7 +485,7 @@ static void test_flow4(void)
            ESP_LOGI(TAG, "Factory");
            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_FACTORY, cur_app->subtype);

-            int boot_count_nvs;
+            int32_t boot_count_nvs;
            TEST_ESP_OK(nvs_flash_init());
            TEST_ESP_OK(nvs_open(STORAGE_NAMESPACE, NVS_READWRITE, &handle));
            TEST_ESP_ERR(ESP_ERR_NVS_NOT_FOUND, nvs_get_i32(handle, "boot_count", &boot_count_nvs));
@@ -735,3 +792,32 @@ static void test_erase_last_app_rollback(void)
 // 4 Stage: run OTA1           -> check it -> erase OTA0 and rollback                          -> reboot
 // 5 Stage: run factory        -> check it -> erase OTA_DATA for next tests                    -> PASS
 TEST_CASE_MULTIPLE_STAGES("Test erase_last_boot_app_partition. factory, OTA1, OTA0, factory", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET, DEEPSLEEP_RESET, SW_CPU_RESET]", start_test, test_erase_last_app_flow, test_erase_last_app_flow, test_erase_last_app_flow, test_erase_last_app_rollback);
+
+static void test_flow6(void)
+{
+    boot_count++;
+    ESP_LOGI(TAG, "boot count %d", boot_count);
+    const esp_partition_t *cur_app = get_running_firmware();
+    switch (boot_count) {
+        case 2:
+            ESP_LOGI(TAG, "Factory");
+            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_FACTORY, cur_app->subtype);
+            copy_current_app_to_next_part_with_offset_and_reboot();
+            break;
+        case 3:
+            ESP_LOGI(TAG, "OTA0");
+            TEST_ASSERT_EQUAL(ESP_PARTITION_SUBTYPE_APP_OTA_0, cur_app->subtype);
+            mark_app_valid();
+            erase_ota_data();
+            break;
+        default:
+            erase_ota_data();
+            TEST_FAIL_MESSAGE("Unexpected stage");
+            break;
+    }
+}
+
+// 1 Stage: After POWER_RESET erase OTA_DATA for this test              -> reboot through deep sleep.
+// 2 Stage: run factory -> check it -> copy factory to OTA0             -> reboot  --//--
+// 3 Stage: run OTA0    -> check it -> erase OTA_DATA for next tests    -> PASS
+TEST_CASE_MULTIPLE_STAGES("Switching between factory, OTA0 using esp_ota_write_with_offset", "[app_update][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow6, test_flow6);
--- a/components/asio/CMakeLists.txt
+++ b/components/asio/CMakeLists.txt
@@ -1,3 +1,33 @@
-idf_component_register(SRCS "asio/asio/src/asio.cpp"
+set(asio_sources "asio/asio/src/asio.cpp")
+
+if(CONFIG_ASIO_SSL_SUPPORT)
+    if(CONFIG_ASIO_USE_ESP_OPENSSL)
+        list(APPEND asio_sources
+                "asio/asio/src/asio_ssl.cpp"
+                "port/src/esp_asio_openssl_stubs.c")
+    endif()
+
+    if(CONFIG_ASIO_USE_ESP_WOLFSSL)
+        list(APPEND asio_sources
+                "asio/asio/src/asio_ssl.cpp")
+    endif()
+endif()
+
+idf_component_register(SRCS ${asio_sources}
                    INCLUDE_DIRS "asio/asio/include" "port/include"
                    REQUIRES lwip)
+
+if(CONFIG_ASIO_SSL_SUPPORT)
+    if(CONFIG_ASIO_USE_ESP_WOLFSSL)
+        idf_component_get_property(wolflib esp-wolfssl COMPONENT_LIB)
+        idf_component_get_property(wolfdir esp-wolfssl COMPONENT_DIR)
+
+        target_link_libraries(${COMPONENT_LIB} PUBLIC ${wolflib})
+        target_include_directories(${COMPONENT_LIB} PUBLIC ${wolfdir}/wolfssl/wolfssl)
+    endif()
+
+    if(CONFIG_ASIO_USE_ESP_OPENSSL)
+        idf_component_get_property(esp_openssl openssl COMPONENT_LIB)
+        target_link_libraries(${COMPONENT_LIB} PUBLIC ${esp_openssl})
+    endif()
+endif()
--- a/components/asio/Kconfig
+++ b/components/asio/Kconfig
@@ -0,0 +1,25 @@
+menu "ESP-ASIO"
+    config ASIO_SSL_SUPPORT
+        bool "Enable SSL/TLS support of ASIO"
+        default n
+        help
+            Enable support for basic SSL/TLS features, available for mbedTLS/OpenSSL
+            as well as wolfSSL TLS library.
+
+    choice ASIO_SSL_LIBRARY_CHOICE
+        prompt "Choose SSL/TLS library for ESP-TLS (See help for more Info)"
+        default ASIO_USE_ESP_OPENSSL
+        depends on ASIO_SSL_SUPPORT
+        help
+            The ASIO support multiple backend TLS libraries. Currently the mbedTLS with a thin ESP-OpenSSL
+            port layer (default choice) and WolfSSL are supported.
+            Different TLS libraries may support different features and have different resource
+            usage. Consult the ESP-TLS documentation in ESP-IDF Programming guide for more details.
+        config ASIO_USE_ESP_OPENSSL
+            bool "esp-openssl"
+        config ASIO_USE_ESP_WOLFSSL
+            depends on TLS_STACK_WOLFSSL
+            bool "wolfSSL (License info in wolfSSL directory README)"
+    endchoice
+
+endmenu
--- a/components/asio/asio
+++ b/components/asio/asio
--- a/components/asio/component.mk
+++ b/components/asio/component.mk
@@ -1,6 +1,9 @@
 COMPONENT_ADD_INCLUDEDIRS := asio/asio/include port/include
 COMPONENT_PRIV_INCLUDEDIRS := private_include
-COMPONENT_SRCDIRS := asio/asio/src
-COMPONENT_OBJEXCLUDE := asio/asio/src/asio_ssl.o
+COMPONENT_SRCDIRS := asio/asio/src port/src
+
+ifeq ($(CONFIG_ASIO_SSL_SUPPORT), )
+COMPONENT_OBJEXCLUDE := asio/asio/src/asio_ssl.o port/src/esp_asio_openssl_stubs.o
+endif

 COMPONENT_SUBMODULES += asio
--- a/components/asio/port/include/esp_asio_config.h
+++ b/components/asio/port/include/esp_asio_config.h
@@ -40,4 +40,11 @@
 # define ASIO_STANDALONE
 # define ASIO_HAS_PTHREADS

+# ifdef CONFIG_ASIO_USE_ESP_OPENSSL
+#  define ASIO_USE_ESP_OPENSSL
+#  define OPENSSL_NO_ENGINE
+# elif CONFIG_ASIO_USE_ESP_WOLFSSL
+#  define ASIO_USE_WOLFSSL
+# endif   // CONFIG_ASIO_USE_ESP_OPENSSL
+
 #endif // _ESP_ASIO_CONFIG_H_
--- a/components/asio/port/include/esp_exception.h
+++ b/components/asio/port/include/esp_exception.h
@@ -30,7 +30,7 @@ namespace detail {
 template <typename Exception>
 void throw_exception(const Exception& e)
 {
-  ESP_LOGE("esp32_asio_exception", "Caught exception: %s!", e.what());   
+  ESP_LOGE("esp32_asio_exception", "Caught exception: %s!", e.what());
  abort();
 }
 }}
--- a/components/asio/port/include/openssl/conf.h
+++ b/components/asio/port/include/openssl/conf.h
@@ -0,0 +1,26 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _ESP_ASIO_OPENSSL_CONF_H
+#define _ESP_ASIO_OPENSSL_CONF_H
+#include "esp_asio_config.h"
+#include "openssl/esp_asio_openssl_stubs.h"
+
+#if defined(ASIO_USE_WOLFSSL)
+// SSLv3 Methods not present in current wolfSSL library
+#define OPENSSL_NO_SSL3
+#include_next "openssl/conf.h"
+#endif // ASIO_USE_WOLFSSL
+
+#endif // _ESP_ASIO_OPENSSL_CONF_H
--- a/components/asio/port/include/openssl/dh.h
+++ b/components/asio/port/include/openssl/dh.h
@@ -0,0 +1,23 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _ESP_ASIO_OPENSSL_DH_STUB_H
+#define _ESP_ASIO_OPENSSL_DH_STUB_H
+// Dummy header needed for ASIO compilation with esp-openssl
+
+#if defined(ASIO_USE_WOLFSSL)
+#include_next "openssl/dh.h"
+#endif // ASIO_USE_WOLFSSL
+
+#endif // _ESP_ASIO_OPENSSL_DH_STUB_H
--- a/components/asio/port/include/openssl/esp_asio_openssl_stubs.h
+++ b/components/asio/port/include/openssl/esp_asio_openssl_stubs.h
@@ -0,0 +1,209 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _ESP_ASIO_OPENSSL_STUBS_H
+#define _ESP_ASIO_OPENSSL_STUBS_H
+
+/**
+ * @note This header contains openssl API which are NOT implemented, and are only provided
+ * as stubs or no-operations to get the ASIO library compiled and working with most
+ * practical use cases as an embedded application on ESP platform
+ */
+
+#if defined(ASIO_USE_WOLFSSL)
+
+#include "wolfssl/ssl.h"
+// esp-wolfssl disables filesystem by default, but the ssl filesystem functions are needed for the ASIO to compile
+//  - so we could either configure wolfSSL to use filesystem
+//  - or use the default wolfSSL and declare the filesystem functions -- preferred option, as whenever
+//    the filesystem functions are used from app code (potential security impact if private keys in a filesystem)
+//    compilation fails with linking errors.
+
+#if defined(NO_FILESYSTEM)
+// WolfSSL methods that are not included in standard esp-wolfssl config, must be defined here
+// as function stubs,  so ASIO compiles, but would get link errors, if these functions were used.
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct WOLFSSL_CTX      WOLFSSL_CTX;
+
+void wolfSSL_CTX_set_verify_depth(WOLFSSL_CTX *ctx,int depth);
+int SSL_CTX_load_verify_locations(WOLFSSL_CTX*, const char*, const char*);
+int SSL_CTX_use_certificate_file(WOLFSSL_CTX*, const char*, int);
+int SSL_CTX_use_certificate_chain_file(WOLFSSL_CTX*, const char*);
+int SSL_CTX_use_PrivateKey_file(WOLFSSL_CTX*, const char*, int);
+int SSL_CTX_use_RSAPrivateKey_file(WOLFSSL_CTX*, const char*, int);
+
+#if defined(__cplusplus)
+} /* extern C */
+#endif
+
+#endif // NO_FILESYSTEM
+
+#elif defined(ASIO_USE_ESP_OPENSSL)
+
+#include "internal/ssl_x509.h"
+#include "internal/ssl_pkey.h"
+#include "mbedtls/pem.h"
+#include <stdint.h>
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+// The most applicable OpenSSL version wrtt ASIO usage
+#define OPENSSL_VERSION_NUMBER 0x10100001L
+// SSLv2 methods not supported
+// OpenSSL port supports: TLS_ANY, TLS_1, TLS_1_1, TLS_1_2, SSL_3
+#define OPENSSL_NO_SSL2
+#define SSL2_VERSION 0x0002
+
+#define SSL_R_SHORT_READ 219
+#define SSL_OP_ALL 0
+#define SSL_OP_SINGLE_DH_USE 0
+#define SSL_OP_NO_COMPRESSION 0
+// Translates mbedTLS PEM parse error, used by ASIO
+#define PEM_R_NO_START_LINE -MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT
+
+#define SSL_OP_NO_SSLv2					0x01000000L
+#define SSL_OP_NO_SSLv3					0x02000000L
+#define SSL_OP_NO_TLSv1					0x04000000L
+
+#define X509_FILETYPE_PEM	1
+#define X509_FILETYPE_ASN1	2
+#define SSL_FILETYPE_ASN1	X509_FILETYPE_ASN1
+#define SSL_FILETYPE_PEM	X509_FILETYPE_PEM
+
+#define NID_subject_alt_name 85
+
+
+#define GEN_DNS		2
+#define GEN_IPADD	7
+#define V_ASN1_OCTET_STRING		4
+#define V_ASN1_IA5STRING		22
+#define NID_commonName 13
+
+#define SSL_CTX_get_app_data(ctx) ((void*)SSL_CTX_get_ex_data(ctx, 0))
+
+/**
+* @brief Frees DH object -- not implemented
+*
+* Current implementation calls SSL_ASSERT
+*
+* @param r DH object
+*/
+void DH_free(DH *r);
+
+/**
+ * @brief Frees GENERAL_NAMES -- not implemented
+ *
+ * Current implementation calls SSL_ASSERT
+ *
+ * @param r GENERAL_NAMES object
+ */
+void GENERAL_NAMES_free(GENERAL_NAMES * gens);
+
+/**
+ * @brief Returns subject name from X509 -- not implemented
+ *
+ * Current implementation calls SSL_ASSERT
+ *
+ * @param r X509 object
+ */
+X509_NAME *X509_get_subject_name(X509 *a);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+int	X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+int X509_NAME_get_index_by_NID(X509_NAME *name, int nid, int lastpos);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+ASN1_STRING *X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+X509 *	X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
+
+/**
+ * @brief Reads DH params from a bio object -- not implemented
+ *
+ * Current implementation calls SSL_ASSERT
+ */
+DH *PEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+void *	X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
+
+/**
+ * @brief Sets DH params to ssl ctx -- not implemented
+ *
+ * Current implementation calls SSL_ASSERT
+ */
+int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *data);
+
+/**
+ * @brief API provaded as declaration only
+ *
+ */
+void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);
+
+/**
+ * @brief Clears any existing chain associated with the current certificate of ctx.
+ *
+ */
+int SSL_CTX_clear_chain_certs(SSL_CTX *ctx);
+
+#if defined(__cplusplus)
+} /* extern C */
+#endif
+
+#endif /* ASIO_USE_ESP_OPENSSL, ASIO_USE_WOLFSSL */
+#endif /* _ESP_ASIO_OPENSSL_STUBS_H */
--- a/components/asio/port/include/openssl/rsa.h
+++ b/components/asio/port/include/openssl/rsa.h
@@ -0,0 +1,23 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _ESP_ASIO_OPENSSL_RSA_STUB_H
+#define _ESP_ASIO_OPENSSL_RSA_STUB_H
+// Dummy header needed for ASIO compilation with esp-openssl
+
+#if defined(ASIO_USE_WOLFSSL)
+#include_next "openssl/rsa.h"
+#endif // ASIO_USE_WOLFSSL
+
+#endif // _ESP_ASIO_OPENSSL_RSA_STUB_H
--- a/components/asio/port/include/openssl/x509v3.h
+++ b/components/asio/port/include/openssl/x509v3.h
@@ -0,0 +1,23 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _ESP_ASIO_OPENSSL_X509V3_STUB_H
+#define _ESP_ASIO_OPENSSL_X509V3_STUB_H
+// Dummy header needed for ASIO compilation with esp-openssl
+
+#if defined(ASIO_USE_WOLFSSL)
+#include_next "openssl/x509v3.h"
+#endif // ASIO_USE_WOLFSSL
+
+#endif // _ESP_ASIO_OPENSSL_X509V3_STUB_H
--- a/components/asio/port/src/esp_asio_openssl_stubs.c
+++ b/components/asio/port/src/esp_asio_openssl_stubs.c
@@ -0,0 +1,55 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "esp_asio_config.h"
+#include "internal/ssl_dbg.h"
+#include "openssl/esp_asio_openssl_stubs.h"
+
+// Unsupported features as macros to make the assertions more readable
+#define ESP_OPENSSL_DH_IS_SUPPORTED 0
+#define ESP_OPENSSL_GENERAL_NAMES_IS_SUPPORTED 0
+
+void DH_free (DH *r)
+{
+    SSL_ASSERT3(ESP_OPENSSL_DH_IS_SUPPORTED);
+}
+
+DH *PEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u)
+{
+    SSL_ASSERT2(ESP_OPENSSL_DH_IS_SUPPORTED);
+    return NULL;
+}
+
+int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh)
+{
+    SSL_ASSERT1(ESP_OPENSSL_DH_IS_SUPPORTED);
+    return -1;
+}
+
+void GENERAL_NAMES_free(GENERAL_NAMES * gens)
+{
+    SSL_ASSERT3(ESP_OPENSSL_GENERAL_NAMES_IS_SUPPORTED);
+}
+
+X509_NAME *X509_get_subject_name(X509 *a)
+{
+    SSL_ASSERT2(ESP_OPENSSL_GENERAL_NAMES_IS_SUPPORTED);
+    return NULL;
+}
+
+int SSL_CTX_clear_chain_certs(SSL_CTX *ctx)
+{
+    return 1;
+}
--- a/components/bootloader/CMakeLists.txt
+++ b/components/bootloader/CMakeLists.txt
@@ -5,17 +5,21 @@ if(BOOTLOADER_BUILD OR NOT CONFIG_APP_BUILD_BOOTLOADER)
    return()
 endif()

+add_dependencies(bootloader partition_table_bin)
+
 # When secure boot is enabled, do not flash bootloader along with invocation of `idf.py flash`
 if(NOT CONFIG_SECURE_BOOT)
    set(flash_bootloader FLASH_IN_PROJECT)
 endif()

-# Set values used in flash_bootloader_args.in and generate flash file
-# for bootloader
-esptool_py_flash_project_args(bootloader 0x1000
-                            ${BOOTLOADER_BUILD_DIR}/bootloader.bin
-                            ${flash_bootloader}
-                            FLASH_FILE_TEMPLATE flash_bootloader_args.in)
-
 esptool_py_custom_target(bootloader-flash bootloader "bootloader")
-add_dependencies(bootloader partition_table)
+esptool_py_flash_target_image(bootloader-flash bootloader
+    ${CONFIG_BOOTLOADER_OFFSET_IN_FLASH}
+    "${BOOTLOADER_BUILD_DIR}/bootloader.bin")
+
+# Also attach an image to the project flash target
+if(NOT CONFIG_SECURE_BOOT)
+    esptool_py_flash_target_image(flash bootloader
+        ${CONFIG_BOOTLOADER_OFFSET_IN_FLASH}
+        "${BOOTLOADER_BUILD_DIR}/bootloader.bin")
+endif()
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -1,5 +1,14 @@
 menu "Bootloader config"

+    config BOOTLOADER_OFFSET_IN_FLASH
+        hex
+        default 0x1000 if IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2
+        default 0x0
+        help
+            Offset address that 2nd bootloader will be flashed to.
+            The value is determined by the ROM bootloader.
+            It's not configurable in ESP-IDF.
+
    choice BOOTLOADER_COMPILER_OPTIMIZATION
        prompt "Bootloader optimization Level"
        default BOOTLOADER_COMPILER_OPTIMIZATION_SIZE
@@ -53,20 +62,34 @@ menu "Bootloader config"
        default 4 if BOOTLOADER_LOG_LEVEL_DEBUG
        default 5 if BOOTLOADER_LOG_LEVEL_VERBOSE

+    config BOOTLOADER_SPI_CUSTOM_WP_PIN
+        bool "Use custom SPI Flash WP Pin when flash pins set in eFuse (read help)"
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        default y if BOOTLOADER_SPI_WP_PIN != 7  # backwards compatibility, can remove in IDF 5
+        default n
+        help
+            This setting is only used if the SPI flash pins have been overridden by setting the eFuses
+            SPI_PAD_CONFIG_xxx, and the SPI flash mode is QIO or QOUT.
+
+            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka
+            ESP32 pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. The same pin is also used
+            for external SPIRAM if it is enabled.
+
+            If this config item is set to N (default), the correct WP pin will be automatically used for any
+            Espressif chip or module with integrated flash. If a custom setting is needed, set this config item to
+            Y and specify the GPIO number connected to the WP.
+
    config BOOTLOADER_SPI_WP_PIN
-        int "SPI Flash WP Pin when customising pins via eFuse (read help)"
+        int "Custom SPI Flash WP Pin"
        range 0 33
        default 7
-        depends on ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT
+        depends on IDF_TARGET_ESP32 && (ESPTOOLPY_FLASHMODE_QIO || ESPTOOLPY_FLASHMODE_QOUT)
+        #depends on BOOTLOADER_SPI_CUSTOM_WP_PIN  # backwards compatibility, can uncomment in IDF 5
        help
-            This value is ignored unless flash mode is set to QIO or QOUT *and* the SPI flash pins have been
-            overriden by setting the eFuses SPI_PAD_CONFIG_xxx.
+            The option "Use custom SPI Flash WP Pin" must be set or this value is ignored

-            When this is the case, the eFuse config only defines 3 of the 4 Quad I/O data pins. The WP pin (aka ESP32
-            pin "SD_DATA_3" or SPI flash pin "IO2") is not specified in eFuse. That pin number is compiled into the
-            bootloader instead.
-
-            The default value (GPIO 7) is correct for WP pin on ESP32-D2WD integrated flash.
+            If burning a customized set of SPI flash pins in eFuse and using QIO or QOUT mode for flash, set this
+            value to the GPIO number of the SPI flash WP pin.

    choice BOOTLOADER_VDDSDIO_BOOST
        bool "VDDSDIO LDO voltage"
@@ -100,7 +123,8 @@ menu "Bootloader config"
    config BOOTLOADER_NUM_PIN_FACTORY_RESET
        int "Number of the GPIO input for factory reset"
        depends on BOOTLOADER_FACTORY_RESET
-        range 0 39
+        range 0 39 if IDF_TARGET_ESP32
+        range 0 44 if IDF_TARGET_ESP32S2
        default 4
        help
            The selected GPIO will be configured as an input with internal pull-up enabled.
@@ -129,6 +153,7 @@ menu "Bootloader config"
    config BOOTLOADER_APP_TEST
        bool "GPIO triggers boot from test app partition"
        default N
+        depends on !BOOTLOADER_APP_ANTI_ROLLBACK
        help
            Allows to run the test app from "TEST" partition.
            A boot from "test" partition will occur if there is a GPIO input pulled low while device starts up.
@@ -231,11 +256,11 @@ menu "Bootloader config"
        depends on BOOTLOADER_APP_ANTI_ROLLBACK
        range 1 32 if IDF_TARGET_ESP32
        default 32 if IDF_TARGET_ESP32
-        range 1 16 if IDF_TARGET_ESP32S2BETA
-        default 16 if IDF_TARGET_ESP32S2BETA
+        range 1 16
+        default 16
        help
            The size of the efuse secure version field.
-            Its length is limited to 32 bits for ESP32 and 16 bits for ESP32S2BETA.
+            Its length is limited to 32 bits for ESP32 and 16 bits for ESP32-S2.
            This determines how many times the security version can be increased.

    config BOOTLOADER_EFUSE_SECURE_VERSION_EMULATE
@@ -249,6 +274,10 @@ menu "Bootloader config"

    config BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP
        bool "Skip image validation when exiting deep sleep"
+        # note: dependencies for this config item are different to other "skip image validation"
+        # options, allowing to turn on "allow insecure options" and have secure boot with
+        # "skip validation when existing deep sleep". Keeping this to avoid a breaking change,
+        # but - as noted in help - it invalidates the integrity of Secure Boot checks
        depends on (SECURE_BOOT && SECURE_BOOT_INSECURE) || !SECURE_BOOT
        default n
        help
@@ -261,6 +290,48 @@ menu "Bootloader config"
            partition as this would skip the validation upon first load of the new
            OTA partition.

+            It is possible to enable this option with Secure Boot if "allow insecure
+            options" is enabled, however it's strongly recommended to NOT enable it as
+            it may allow a Secure Boot bypass.
+
+    config BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
+        bool "Skip image validation from power on reset (READ HELP FIRST)"
+        # only available if both Secure Boot and Check Signature on Boot are disabled
+        depends on !SECURE_SIGNED_ON_BOOT
+        default n
+        help
+            Some applications need to boot very quickly from power on. By default, the entire app binary
+            is read from flash and verified which takes up a significant portion of the boot time.
+
+            Enabling this option will skip validation of the app when the SoC boots from power on.
+            Note that in this case it's not possible for the bootloader to detect if an app image is
+            corrupted in the flash, therefore it's not possible to safely fall back to a different app
+            partition. Flash corruption of this kind is unlikely but can happen if there is a serious
+            firmware bug or physical damage.
+
+            Following other reset types, the bootloader will still validate the app image. This increases
+            the chances that flash corruption resulting in a crash can be detected following soft reset, and
+            the bootloader will fall back to a valid app image. To increase the chances of successfully recovering
+            from a flash corruption event, keep the option BOOTLOADER_WDT_ENABLE enabled and consider also enabling
+            BOOTLOADER_WDT_DISABLE_IN_USER_CODE - then manually disable the RTC Watchdog once the app is running.
+            In addition, enable both the Task and Interrupt watchdog timers with reset options set.
+
+    config BOOTLOADER_SKIP_VALIDATE_ALWAYS
+        bool "Skip image validation always (READ HELP FIRST)"
+        # only available if both Secure Boot and Check Signature on Boot are disabled
+        depends on !SECURE_SIGNED_ON_BOOT
+        default n
+        select BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP
+        select BOOTLOADER_SKIP_VALIDATE_ON_POWER_ON
+        help
+            Selecting this option prevents the bootloader from ever validating the app image before
+            booting it. Any flash corruption of the selected app partition will make the entire SoC
+            unbootable.
+
+            Although flash corruption is a very rare case, it is not recommended to select this option.
+            Consider selecting "Skip image validation from power on reset" instead. However, if boot time
+            is the only important factor then it can be enabled.
+
    config BOOTLOADER_RESERVE_RTC_SIZE
        hex
        default 0x10 if BOOTLOADER_SKIP_VALIDATE_IN_DEEP_SLEEP || BOOTLOADER_CUSTOM_RESERVE_RTC
@@ -320,6 +391,16 @@ menu "Security features"
        select MBEDTLS_ECDSA_C
        depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE

+    config SECURE_BOOT_SUPPORTS_RSA
+        bool
+        default y
+        depends on ESP32_REV_MIN_3 || IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3
+
+    config SECURE_TARGET_HAS_SECURE_ROM_DL_MODE
+        bool
+        default y
+        depends on IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32C3
+

    config SECURE_SIGNED_APPS_NO_SECURE_BOOT
        bool "Require signed app images"
@@ -343,7 +424,7 @@ menu "Security features"
            1. ECDSA based secure boot scheme. (Only choice for Secure Boot V1)
            Supported in ESP32 and ESP32-ECO3.
            2. The RSA based secure boot scheme. (Only choice for Secure Boot V2)
-            Supported in ESP32-ECO3. (ESP32 Chip Revision 3 onwards)
+            Supported in ESP32-ECO3 (ESP32 Chip Revision 3 onwards), ESP32-S2, ESP32-C3, ESP32-S3.

        config SECURE_SIGNED_APPS_ECDSA_SCHEME
            bool "ECDSA"
@@ -355,7 +436,7 @@ menu "Security features"

        config SECURE_SIGNED_APPS_RSA_SCHEME
            bool "RSA"
-            depends on ESP32_REV_MIN_3 && SECURE_BOOT_V2_ENABLED
+            depends on SECURE_BOOT_SUPPORTS_RSA && (SECURE_SIGNED_APPS_NO_SECURE_BOOT || SECURE_BOOT_V2_ENABLED)
            help
                Appends the RSA-3072 based Signature block to the application.
                Refer to <Secure Boot Version 2 documentation link> before enabling.
@@ -364,7 +445,7 @@ menu "Security features"
    config SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
        bool "Bootloader verifies app signatures"
        default n
-        depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT
+        depends on SECURE_SIGNED_APPS_NO_SECURE_BOOT && SECURE_SIGNED_APPS_ECDSA_SCHEME
        help
            If this option is set, the bootloader will be compiled with code to verify that an app is signed before
            booting it.
@@ -390,6 +471,7 @@ menu "Security features"
    config SECURE_BOOT
        bool "Enable hardware Secure Boot in bootloader (READ DOCS FIRST)"
        default n
+        depends on IDF_TARGET_ESP32 || IDF_TARGET_ESP32S2 || ESP32C3_REV_MIN_3
        help
            Build a bootloader which enables Secure Boot on first boot.

@@ -406,7 +488,7 @@ menu "Security features"
        help
            Select the Secure Boot Version. Depends on the Chip Revision.
            Secure Boot V2 is the new RSA based secure boot scheme.
-            Supported in ESP32-ECO3. (ESP32 Chip Revision 3 onwards)
+            Supported in ESP32-ECO3 (ESP32 Chip Revision 3 onwards), ESP32-S2, ESP32-C3 ECO3.
            Secure Boot V1 is the AES based secure boot scheme.
            Supported in ESP32 and ESP32-ECO3.

@@ -419,7 +501,7 @@ menu "Security features"

        config SECURE_BOOT_V2_ENABLED
            bool "Enable Secure Boot version 2"
-            depends on ESP32_REV_MIN_3
+            depends on SECURE_BOOT_SUPPORTS_RSA
            help
                Build a bootloader which enables Secure Boot version 2 on first boot.
                Refer to Secure Boot V2 section of the ESP-IDF Programmer's Guide for this version before enabling.
@@ -539,6 +621,7 @@ menu "Security features"
    config SECURE_FLASH_ENC_ENABLED
        bool "Enable flash encryption on boot (READ DOCS FIRST)"
        default N
+        select SPI_FLASH_ENABLE_ENCRYPTED_READ_WRITE
        help
            If this option is set, flash contents will be encrypted by the bootloader on first boot.

@@ -551,7 +634,7 @@ menu "Security features"
    choice SECURE_FLASH_ENCRYPTION_KEYSIZE
        bool "Size of generated AES-XTS key"
        default SECURE_FLASH_ENCRYPTION_AES128
-        depends on IDF_TARGET_ESP32S2BETA && SECURE_FLASH_ENC_ENABLED
+        depends on IDF_TARGET_ESP32S2 && SECURE_FLASH_ENC_ENABLED
        help
            Size of generated AES-XTS key.

@@ -587,6 +670,7 @@ menu "Security features"

        config SECURE_FLASH_ENCRYPTION_MODE_RELEASE
            bool "Release"
+            select PARTITION_TABLE_MD5 if !ESP32_COMPATIBLE_PRE_V3_1_BOOTLOADERS

    endchoice

@@ -601,7 +685,7 @@ menu "Security features"

        config SECURE_BOOT_ALLOW_ROM_BASIC
            bool "Leave ROM BASIC Interpreter available on reset"
-            depends on SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+            depends on (SECURE_BOOT_INSECURE || SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT) && IDF_TARGET_ESP32
            default N
            help
                By default, the BASIC ROM Console starts on reset if no valid bootloader is
@@ -664,7 +748,7 @@ menu "Security features"

        config SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC
            bool "Leave UART bootloader decryption enabled"
-            depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
+            depends on SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT && IDF_TARGET_ESP32
            default N
            help
                If not set (default), the bootloader will permanently disable UART bootloader decryption access on
@@ -698,5 +782,59 @@ menu "Security features"
                the wrong device. The device needs to have flash encryption already enabled using espefuse.py.

    endmenu  # Potentially Insecure
-endmenu  # Security features

+    choice SECURE_UART_ROM_DL_MODE
+        bool "UART ROM download mode"
+        default SECURE_ENABLE_SECURE_ROM_DL_MODE if SECURE_TARGET_HAS_SECURE_ROM_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT # NOERROR
+        default SECURE_INSECURE_ALLOW_DL_MODE
+        depends on SECURE_BOOT_V2_ENABLED || SECURE_FLASH_ENC_ENABLED
+        depends on !IDF_TARGET_ESP32 || ESP32_REV_MIN_3
+
+        config SECURE_DISABLE_ROM_DL_MODE
+            bool "UART ROM download mode (Permanently disabled (recommended))"
+            help
+                If set, during startup the app will burn an eFuse bit to permanently disable the UART ROM
+                Download Mode. This prevents any future use of esptool.py, espefuse.py and similar tools.
+
+                Once disabled, if the SoC is booted with strapping pins set for ROM Download Mode
+                then an error is printed instead.
+
+                It is recommended to enable this option in any production application where Flash
+                Encryption and/or Secure Boot is enabled and access to Download Mode is not required.
+
+                It is also possible to permanently disable Download Mode by calling
+                esp_efuse_disable_rom_download_mode() at runtime.
+
+        config SECURE_ENABLE_SECURE_ROM_DL_MODE
+            bool "UART ROM download mode (Permanently switch to Secure mode (recommended))"
+            depends on SECURE_TARGET_HAS_SECURE_ROM_DL_MODE
+            select ESPTOOLPY_NO_STUB
+            help
+                If set, during startup the app will burn an eFuse bit to permanently switch the UART ROM
+                Download Mode into a separate Secure Download mode. This option can only work if
+                Download Mode is not already disabled by eFuse.
+
+                Secure Download mode limits the use of Download Mode functions to simple flash read,
+                write and erase operations, plus a command to return a summary of currently enabled
+                security features.
+
+                Secure Download mode is not compatible with the esptool.py flasher stub feature,
+                espefuse.py, read/writing memory or registers, encrypted download, or any other
+                features that interact with unsupported Download Mode commands.
+
+                Secure Download mode should be enabled in any application where Flash Encryption
+                and/or Secure Boot is enabled. Disabling this option does not immediately cancel
+                the benefits of the security features, but it increases the potential "attack
+                surface" for an attacker to try and bypass them with a successful physical attack.
+
+                It is also possible to enable secure download mode at runtime by calling
+                esp_efuse_enable_rom_secure_download_mode()
+
+        config SECURE_INSECURE_ALLOW_DL_MODE
+            bool "UART ROM download mode (Enabled (not recommended))"
+            help
+                This is a potentially insecure option.
+                Enabling this option will allow the full UART download mode to stay enabled.
+                This option SHOULD NOT BE ENABLED for production use cases.
+    endchoice
+endmenu  # Security features
--- a/components/bootloader/Makefile.projbuild
+++ b/components/bootloader/Makefile.projbuild
@@ -17,6 +17,8 @@ CONFIG_SECURE_BOOT_SIGNING_KEY ?=
 SECURE_BOOT_SIGNING_KEY=$(abspath $(call dequote,$(CONFIG_SECURE_BOOT_SIGNING_KEY)))
 export SECURE_BOOT_SIGNING_KEY  # used by bootloader_support component

+BOOTLOADER_SIGNED_BIN ?=
+
 # Has a matching value in bootloader_support esp_flash_partitions.h
 BOOTLOADER_OFFSET := 0x1000

@@ -55,6 +57,7 @@ bootloader: $(BOOTLOADER_BIN) | check_python_dependencies
 	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $^"

 ESPTOOL_ALL_FLASH_ARGS += $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)
+UF2_ADD_BINARIES += $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)

 bootloader-flash: $(BOOTLOADER_BIN) $(call prereq_if_explicit,erase_flash) | check_python_dependencies
 	$(ESPTOOLPY_WRITE_FLASH) 0x1000 $^
@@ -102,7 +105,7 @@ endif
 bootloader: $(BOOTLOADER_DIGEST_BIN)
 	@echo $(SEPARATOR)
 	@echo "Bootloader built and secure digest generated. First time flash command is:"
-	@echo "$(ESPEFUSEPY) burn_key secure_boot $(SECURE_BOOTLOADER_KEY)"
+	@echo "$(ESPEFUSEPY) burn_key secure_boot_v1 $(SECURE_BOOTLOADER_KEY)"
 	@echo "$(ESPTOOLPY_WRITE_FLASH) $(BOOTLOADER_OFFSET) $(BOOTLOADER_BIN)"
 	@echo $(SEPARATOR)
 	@echo "To reflash the bootloader after initial flash:"
@@ -157,4 +160,4 @@ ifdef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
 ifdef CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES
 	rm -f $(BOOTLOADER_SIGNED_BIN)
 endif
-endif
+endif
--- a/components/bootloader/component.mk
+++ b/components/bootloader/component.mk
@@ -4,4 +4,3 @@
 #
 # See Makefile.projbuild for the targets which actually build the bootloader.
 COMPONENT_CONFIG_ONLY := 1
-
--- a/components/bootloader/flash_bootloader_args.in
+++ b/components/bootloader/flash_bootloader_args.in
@@ -1,4 +0,0 @@
--flash_mode ${ESPFLASHMODE}
--flash_size ${ESPFLASHSIZE}
--flash_freq ${ESPFLASHFREQ}
-${OFFSET} ${IMAGE}
--- a/components/bootloader/project_include.cmake
+++ b/components/bootloader/project_include.cmake
@@ -1,4 +1,4 @@
-set(BOOTLOADER_OFFSET 0x1000)
+set(BOOTLOADER_OFFSET CONFIG_BOOTLOADER_OFFSET_IN_FLASH)

 # Do not generate flash file when building bootloader
 if(BOOTLOADER_BUILD OR NOT CONFIG_APP_BUILD_BOOTLOADER)
--- a/components/bootloader/subproject/CMakeLists.txt
+++ b/components/bootloader/subproject/CMakeLists.txt
@@ -15,12 +15,26 @@ if(NOT IDF_TARGET)
        "in by the parent build process.")
 endif()

-set(COMPONENTS bootloader esptool_py partition_table soc bootloader_support log spi_flash micro-ecc main efuse)
+set(COMPONENTS
+    bootloader
+    esptool_py
+    esp_hw_support
+    hal
+    partition_table
+    soc
+    bootloader_support
+    log
+    spi_flash
+    micro-ecc
+    main
+    efuse
+    esp_system
+    newlib)
 set(BOOTLOADER_BUILD 1)
 include("${IDF_PATH}/tools/cmake/project.cmake")
-set(common_req log esp_rom esp_common xtensa)
+set(common_req log esp_rom esp_common esp_hw_support hal newlib)
 if(LEGACY_INCLUDE_COMMON_HEADERS)
-    list(APPEND common_req soc)
+    list(APPEND common_req soc hal)
 endif()
 idf_build_set_property(__COMPONENT_REQUIRES_COMMON "${common_req}")
 idf_build_set_property(__OUTPUT_SDKCONFIG 0)
@@ -29,9 +43,19 @@ project(bootloader)
 idf_build_set_property(COMPILE_DEFINITIONS "-DBOOTLOADER_BUILD=1" APPEND)
 idf_build_set_property(COMPILE_OPTIONS "-fno-stack-protector" APPEND)

+idf_component_get_property(main_args esptool_py FLASH_ARGS)
+idf_component_get_property(sub_args esptool_py FLASH_SUB_ARGS)
+
+# String for printing flash command
+string(REPLACE ";" " " esptoolpy_write_flash
+    "${ESPTOOLPY} --port=(PORT) --baud=(BAUD) ${main_args} "
+    "write_flash ${sub_args}")
+
 string(REPLACE ";" " " espsecurepy "${ESPSECUREPY}")
 string(REPLACE ";" " " espefusepy "${ESPEFUSEPY}")
-set(esptoolpy_write_flash "${ESPTOOLPY_WRITE_FLASH_STR}")
+
+# Suppress warning: "Manually-specified variables were not used by the project: SECURE_BOOT_SIGNING_KEY"
+set(ignore_signing_key "${SECURE_BOOT_SIGNING_KEY}")

 if(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
    if(CONFIG_SECURE_BOOTLOADER_KEY_ENCODING_192BIT)
@@ -80,40 +104,42 @@ if(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
        DEPENDS gen_secure_bootloader_key gen_project_binary
        VERBATIM)

-    add_custom_target (gen_bootloader_digest_bin ALL DEPENDS "${bootloader_digest_bin}")
+    add_custom_target(gen_bootloader_digest_bin ALL DEPENDS "${bootloader_digest_bin}")
 endif()

 if(CONFIG_SECURE_BOOT_V2_ENABLED)
    if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
-        get_filename_component(secure_boot_signing_key 
+        get_filename_component(secure_boot_signing_key
            "${SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")

        if(NOT EXISTS "${secure_boot_signing_key}")
-            message(FATAL_ERROR
-                "Secure Boot Signing Key Not found."
-                "\nGenerate the Secure Boot V2 RSA-PSS 3072 Key."
-                "\nTo generate one, you can use this command:"
-                "\n\t${espsecurepy} generate_signing_key --version 2 ${SECURE_BOOT_SIGNING_KEY}")
+        message(FATAL_ERROR
+            "Secure Boot Signing Key Not found."
+            "\nGenerate the Secure Boot V2 RSA-PSS 3072 Key."
+            "\nTo generate one, you can use this command:"
+            "\n\t${espsecurepy} generate_signing_key --version 2 ${SECURE_BOOT_SIGNING_KEY}")
        endif()

        set(bootloader_unsigned_bin "bootloader-unsigned.bin")
        add_custom_command(OUTPUT ".signed_bin_timestamp"
-            COMMAND cp "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
+            COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_BINARY_DIR}/${PROJECT_BIN}"
+            "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
            COMMAND ${ESPSECUREPY} sign_data --version 2 --keyfile "${secure_boot_signing_key}"
            -o "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" "${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
            COMMAND ${CMAKE_COMMAND} -E echo "Generated signed binary image ${build_dir}/${PROJECT_BIN}"
            "from ${CMAKE_BINARY_DIR}/${bootloader_unsigned_bin}"
-            COMMAND ${CMAKE_COMMAND} -E md5sum "${CMAKE_BINARY_DIR}/${PROJECT_BIN}" > "${CMAKE_BINARY_DIR}/.signed_bin_timestamp"
+            COMMAND ${CMAKE_COMMAND} -E md5sum "${CMAKE_BINARY_DIR}/${PROJECT_BIN}"
+            > "${CMAKE_BINARY_DIR}/.signed_bin_timestamp"
            DEPENDS "${build_dir}/.bin_timestamp"
            VERBATIM
            COMMENT "Generated the signed Bootloader")
    else()
        add_custom_command(OUTPUT ".signed_bin_timestamp"
        VERBATIM
-        COMMENT "Bootloader generated but not signed")    
+        COMMENT "Bootloader generated but not signed")
    endif()

-    add_custom_target (gen_signed_bootloader ALL DEPENDS "${build_dir}/.signed_bin_timestamp")
+    add_custom_target(gen_signed_bootloader ALL DEPENDS "${build_dir}/.signed_bin_timestamp")
 endif()

 if(CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH)
@@ -140,7 +166,7 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
        COMMAND ${CMAKE_COMMAND} -E echo
            "Burn secure boot key to efuse using:"
        COMMAND ${CMAKE_COMMAND} -E echo
-            "\t${espefusepy} burn_key secure_boot ${secure_bootloader_key}"
+            "\t${espefusepy} burn_key secure_boot_v1 ${secure_bootloader_key}"
        COMMAND ${CMAKE_COMMAND} -E echo
            "First time flash command is:"
        COMMAND ${CMAKE_COMMAND} -E echo
@@ -159,6 +185,25 @@ elseif(CONFIG_SECURE_BOOTLOADER_REFLASHABLE)
            "* Not recommended to re-use the same secure boot keyfile on multiple production devices."
        DEPENDS gen_secure_bootloader_key gen_bootloader_digest_bin
        VERBATIM)
+elseif(CONFIG_SECURE_BOOT_V2_ENABLED AND (CONFIG_IDF_TARGET_ESP32S2 OR CONFIG_IDF_TARGET_ESP32C3))
+    add_custom_command(TARGET bootloader.elf POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Bootloader built. Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "To sign the bootloader with additional private keys."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${espsecurepy} sign_data -k secure_boot_signing_key2.pem -v 2 \
+--append_signatures -o signed_bootloader.bin build/bootloader/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "Secure boot enabled, so bootloader not flashed automatically."
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "\t${esptoolpy_write_flash} ${BOOTLOADER_OFFSET} ${CMAKE_BINARY_DIR}/bootloader.bin"
+    COMMAND ${CMAKE_COMMAND} -E echo
+        "=============================================================================="
+    DEPENDS gen_signed_bootloader
+    VERBATIM)
 elseif(CONFIG_SECURE_BOOT_V2_ENABLED)
    add_custom_command(TARGET bootloader.elf POST_BUILD
    COMMAND ${CMAKE_COMMAND} -E echo
--- a/components/bootloader/subproject/Makefile
+++ b/components/bootloader/subproject/Makefile
@@ -8,16 +8,16 @@ endif

 PROJECT_NAME := bootloader

-COMPONENTS := esptool_py bootloader_support log spi_flash micro-ecc soc main efuse
+COMPONENTS := esp_hw_support esptool_py bootloader_support log spi_flash micro-ecc soc main efuse esp_rom hal xtensa

 # Clear C and CXX from top level project
 CFLAGS =
 CXXFLAGS =

-#We cannot include the idf_target, esp_rom, esp_common component directly but we need their includes.
+#We cannot include the some components like idf_target, esp_common directly but we need their includes.
 CFLAGS += -I $(IDF_PATH)/components/$(IDF_TARGET)/include
-CFLAGS += -I $(IDF_PATH)/components/esp_rom/include
 CFLAGS += -I $(IDF_PATH)/components/esp_common/include
+CFLAGS += -I $(IDF_PATH)/components/newlib/platform_include
 CFLAGS += -I $(IDF_PATH)/components/xtensa/include -I $(IDF_PATH)/components/xtensa/$(IDF_TARGET)/include

 # The bootloader pseudo-component is also included in this build, for its Kconfig.projbuild to be included.
--- a/components/bootloader/subproject/components/micro-ecc/uECC_verify_antifault.c
+++ b/components/bootloader/subproject/components/micro-ecc/uECC_verify_antifault.c
@@ -34,7 +34,7 @@ int uECC_verify_antifault(const uint8_t *public_key,
    uECC_word_t *_public = (uECC_word_t *)public_key;
 #else
    uECC_word_t _public[uECC_MAX_WORDS * 2];
-#endif    
+#endif
    uECC_word_t r[uECC_MAX_WORDS], s[uECC_MAX_WORDS];
    wordcount_t num_words = curve->num_words;
    wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
@@ -127,7 +127,7 @@ int uECC_verify_antifault(const uint8_t *public_key,
    const uECC_word_t *mhash_words = (const uECC_word_t *)message_hash;
    uECC_word_t *vhash_words = (uECC_word_t *)verified_hash;
    unsigned hash_words = hash_size / sizeof(uECC_word_t);
-    for (int w = 0; w < hash_words; w++) {
+    for (unsigned int w = 0; w < hash_words; w++) {
        /* note: using curve->num_words here to encourage compiler to re-read this variable */
        vhash_words[w] = mhash_words[w] ^ rx[w % curve->num_words] ^ r[w % curve->num_words];
    }
--- a/components/bootloader/subproject/main/CMakeLists.txt
+++ b/components/bootloader/subproject/main/CMakeLists.txt
@@ -2,8 +2,10 @@ idf_component_register(SRCS "bootloader_start.c"
                    REQUIRES bootloader bootloader_support)

 idf_build_get_property(target IDF_TARGET)
-set(scripts "ld/${target}/bootloader.ld"
-            "ld/${target}/bootloader.rom.ld")
+set(scripts "ld/${target}/bootloader.ld")
+
+if(NOT CONFIG_IDF_TARGET_ESP32C3)
+    list(APPEND scripts "ld/${target}/bootloader.rom.ld")
+endif()

 target_linker_script(${COMPONENT_LIB} INTERFACE "${scripts}")
-
--- a/components/bootloader/subproject/main/component.mk
+++ b/components/bootloader/subproject/main/component.mk
@@ -10,6 +10,7 @@ LINKER_SCRIPTS := \
    $(COMPONENT_PATH)/ld/$(IDF_TARGET)/bootloader.rom.ld \
    $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.ld \
    $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.newlib-funcs.ld \
+    $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.api.ld \
    $(IDF_PATH)/components/$(IDF_TARGET)/ld/$(IDF_TARGET).peripherals.ld

 # SPI driver patch for ROM is only needed in ESP32
@@ -17,7 +18,7 @@ ifdef CONFIG_IDF_TARGET_ESP32
    ifndef CONFIG_SPI_FLASH_ROM_DRIVER_PATCH
        LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.spiflash.ld
    endif
-    ifdef CONFIG_ESP32_REV_MIN_3 
+    ifdef CONFIG_ESP32_REV_MIN_3
        LINKER_SCRIPTS += $(IDF_PATH)/components/esp_rom/$(IDF_TARGET)/ld/$(IDF_TARGET).rom.eco3.ld
    endif
 endif
--- a/components/bootloader/subproject/main/ld/esp32/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32/bootloader.ld
@@ -11,8 +11,6 @@ Linker file used to link the bootloader.

 MEMORY
 {
-  /* I/O */
-  dport0_seg (RW) :                 	org = 0x3FF00000, len = 0x10
  /* IRAM POOL1, used for APP CPU cache. Bootloader runs from here during the final stage of loading the app because APP CPU is still held in reset, the main app enables APP CPU cache */
  iram_loader_seg (RWX) :           org = 0x40078000, len = 0x8000  /* 32KB, APP CPU cache */
  /* 63kB, IRAM. We skip the first 1k to prevent the entry point being
@@ -40,22 +38,26 @@ SECTIONS
     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
    *liblog.a:(.literal .text .literal.* .text.*)
    *libgcc.a:(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_clock.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common_loader.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
    *libbootloader_support.a:bootloader_efuse_esp32.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*)
    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
-    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
-    *libsoc.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
    *libefuse.a:*.*(.literal .text .literal.* .text.*)
    *(.fini.literal)
    *(.fini)
@@ -165,6 +167,14 @@ SECTIONS
    *(.fini.literal)
    *(.fini)
    *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
    _text_end = ABSOLUTE(.);
    _etext = .;
  } > iram_seg
--- a/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32c3/bootloader.ld
@@ -0,0 +1,190 @@
+/** Simplified memory map for the bootloader.
+ *  Make sure the bootloader can load into main memory without overwriting itself.
+ *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
+ *  See memory usage for ROM bootloader at the end of this file.
+ */
+
+MEMORY
+{
+  iram_seg (RWX) :                  org = 0x403CE000, len = 0x2000
+  iram_loader_seg (RWX) :           org = 0x403D0000, len = 0x6000
+  dram_seg (RW) :                   org = 0x3FCD6000, len = 0x4000
+}
+
+/* Default entry point: */
+ENTRY(call_start_cpu0);
+
+SECTIONS
+{
+
+  .iram_loader.text :
+  {
+    . = ALIGN (16);
+    _loader_text_start = ABSOLUTE(.);
+    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
+    *liblog.a:(.literal .text .literal.* .text.*)
+    *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
+    *libbootloader_support.a:bootloader_efuse_esp32c3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
+    *libefuse.a:*.*(.literal .text .literal.* .text.*)
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+    _loader_text_end = ABSOLUTE(.);
+  } > iram_loader_seg
+
+  .iram.text :
+  {
+    . = ALIGN (16);
+    *(.entry.text)
+    *(.init.literal)
+    *(.init)
+  } > iram_seg
+
+
+  /* Shared RAM */
+  .dram0.bss (NOLOAD) :
+  {
+    . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
+    _bss_start = ABSOLUTE(.);
+    *(.dynsbss)
+    *(.sbss)
+    *(.sbss.*)
+    *(.gnu.linkonce.sb.*)
+    *(.scommon)
+    *(.sbss2)
+    *(.sbss2.*)
+    *(.gnu.linkonce.sb2.*)
+    *(.dynbss)
+    *(.bss)
+    *(.bss.*)
+    *(.gnu.linkonce.b.*)
+    *(COMMON)
+    . = ALIGN (8);
+    _bss_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.data :
+  {
+    _data_start = ABSOLUTE(.);
+    *(.data)
+    *(.data.*)
+    *(.gnu.linkonce.d.*)
+    *(.data1)
+    *(.sdata)
+    *(.sdata.*)
+    *(.gnu.linkonce.s.*)
+    *(.sdata2)
+    *(.sdata2.*)
+    *(.gnu.linkonce.s2.*)
+    *(.jcr)
+    _data_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.rodata :
+  {
+    _rodata_start = ABSOLUTE(.);
+    *(.rodata)
+    *(.rodata.*)
+    *(.gnu.linkonce.r.*)
+    *(.rodata1)
+    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
+    *(.xt_except_table)
+    *(.gcc_except_table)
+    *(.gnu.linkonce.e.*)
+    *(.gnu.version_r)
+    *(.eh_frame)
+    . = (. + 3) & ~ 3;
+    /* C++ constructor and destructor tables, properly ordered: */
+    __init_array_start = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.ctors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
+    __init_array_end = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))
+    /*  C++ exception handlers table:  */
+    __XT_EXCEPTION_DESCS_ = ABSOLUTE(.);
+    *(.xt_except_desc)
+    *(.gnu.linkonce.h.*)
+    __XT_EXCEPTION_DESCS_END__ = ABSOLUTE(.);
+    *(.xt_except_desc_end)
+    *(.dynamic)
+    *(.gnu.version_d)
+    _rodata_end = ABSOLUTE(.);
+    /* Literals are also RO data. */
+    _lit4_start = ABSOLUTE(.);
+    *(*.lit4)
+    *(.lit4.*)
+    *(.gnu.linkonce.lit4.*)
+    _lit4_end = ABSOLUTE(.);
+    . = ALIGN(4);
+    _dram_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .iram.text :
+  {
+    _stext = .;
+    _text_start = ABSOLUTE(.);
+    *(.literal .text .literal.* .text.* .stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+    *(.iram .iram.*) /* catch stray IRAM_ATTR */
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } > iram_seg
+
+}
+
+
+/**
+ *  Appendix: Memory Usage of ROM bootloader
+ *
+ *  +--------+--------------+------+ 0x3FCC_B000
+ *  |        ^              |
+ *  |        |              |
+ *  |        | data/bss     |
+ *  |        |              |
+ *  |        v              |
+ *  +------------------------------+ 0x3FCD_C910
+ *  |        ^              |
+ *  |        |              |
+ *  |        | stack        |
+ *  |        |              |
+ *  |        v              |
+ *  +------------------------------+ 0x3FCD_E910
+ */
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.ld
@@ -0,0 +1,170 @@
+/* Simplified memory map for the bootloader.
+ * Make sure the bootloader can load into main memory without overwriting itself.
+ */
+
+
+MEMORY
+{
+  iram_seg (RWX) :                  org = 0x4004c000, len = 0x4000  /* SRAM Block 13 */
+  iram_loader_seg (RWX) :           org = 0x40050000, len = 0x6000  /* SRAM Block 14 & part of 15 */
+  dram_seg (RW) :                   org = 0x3FFE6000, len = 0x4B00  /* Part SRAM Blocks 15 & 16, ROM static buffer starts at end of this region (reclaimed after app runs) */
+}
+
+/*  Default entry point:  */
+ENTRY(call_start_cpu0);
+
+
+SECTIONS
+{
+
+  .iram_loader.text :
+  {
+    . = ALIGN (16);
+    _loader_text_start = ABSOLUTE(.);
+    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
+    *liblog.a:(.literal .text .literal.* .text.*)
+    *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
+    *libefuse.a:*.*(.literal .text .literal.* .text.*)
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+    _loader_text_end = ABSOLUTE(.);
+  } > iram_loader_seg
+
+  .iram.text :
+  {
+    . = ALIGN (16);
+    *(.entry.text)
+    *(.init.literal)
+    *(.init)
+  } > iram_seg
+
+
+  /* Shared RAM */
+  .dram0.bss (NOLOAD) :
+  {
+    . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
+    _bss_start = ABSOLUTE(.);
+    *(.dynsbss)
+    *(.sbss)
+    *(.sbss.*)
+    *(.gnu.linkonce.sb.*)
+    *(.scommon)
+    *(.sbss2)
+    *(.sbss2.*)
+    *(.gnu.linkonce.sb2.*)
+    *(.dynbss)
+    *(.bss)
+    *(.bss.*)
+    *(.gnu.linkonce.b.*)
+    *(COMMON)
+    . = ALIGN (8);
+    _bss_end = ABSOLUTE(.);
+  } >dram_seg
+
+  .dram0.data :
+  {
+    _data_start = ABSOLUTE(.);
+    *(.data)
+    *(.data.*)
+    *(.gnu.linkonce.d.*)
+    *(.data1)
+    *(.sdata)
+    *(.sdata.*)
+    *(.gnu.linkonce.s.*)
+    *(.sdata2)
+    *(.sdata2.*)
+    *(.gnu.linkonce.s2.*)
+    *(.jcr)
+    _data_end = ABSOLUTE(.);
+  } >dram_seg
+
+  .dram0.rodata :
+  {
+    _rodata_start = ABSOLUTE(.);
+    *(.rodata)
+    *(.rodata.*)
+    *(.gnu.linkonce.r.*)
+    *(.rodata1)
+    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
+    *(.xt_except_table)
+    *(.gcc_except_table)
+    *(.gnu.linkonce.e.*)
+    *(.gnu.version_r)
+    *(.eh_frame)
+    . = (. + 3) & ~ 3;
+    /*  C++ constructor and destructor tables, properly ordered:  */
+    __init_array_start = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.ctors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
+    __init_array_end = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))
+    /*  C++ exception handlers table:  */
+    __XT_EXCEPTION_DESCS_ = ABSOLUTE(.);
+    *(.xt_except_desc)
+    *(.gnu.linkonce.h.*)
+    __XT_EXCEPTION_DESCS_END__ = ABSOLUTE(.);
+    *(.xt_except_desc_end)
+    *(.dynamic)
+    *(.gnu.version_d)
+    _rodata_end = ABSOLUTE(.);
+	/* Literals are also RO data. */
+    _lit4_start = ABSOLUTE(.);
+    *(*.lit4)
+    *(.lit4.*)
+    *(.gnu.linkonce.lit4.*)
+    _lit4_end = ABSOLUTE(.);
+    . = ALIGN(4);
+    _dram_end = ABSOLUTE(.);
+  } >dram_seg
+
+  .iram.text :
+  {
+    _stext = .;
+    _text_start = ABSOLUTE(.);
+    *(.literal .text .literal.* .text.* .stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+    *(.iram .iram.*) /* catch stray IRAM_ATTR */
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } > iram_seg
+
+}
--- a/components/bootloader/subproject/main/ld/esp32s2/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2/bootloader.rom.ld
@@ -0,0 +1,13 @@
+/*
+ * ESP32S2 ROM address table
+ * Generated for ROM with MD5sum: 0a2c7ec5109c17884606d23b47045796
+*/
+PROVIDE (ets_update_cpu_frequency = 0x4000d8a4);
+
+PROVIDE (MD5Final = 0x4000530c);
+PROVIDE (MD5Init = 0x4000526c);
+PROVIDE (MD5Update = 0x4000528c);
+/* bootloader will use following functions from xtensa hal library */
+xthal_get_ccount = 0x4001aa90;
+xthal_get_ccompare = 0x4001aabc;
+xthal_set_ccompare = 0x4001aa98;
--- a/components/bootloader/subproject/main/ld/esp32s2beta/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2beta/bootloader.ld
@@ -1,164 +0,0 @@
-/*
-Linker file used to link the bootloader.
-*/
-
-
-/* Simplified memory map for the bootloader
-
-   The main purpose is to make sure the bootloader can load into main memory
-   without overwriting itself.
-*/
-
-MEMORY
-{
-  /* I/O */
-  dport0_seg (RW) :                 org = 0x3FF00000, len = 0x10
-  iram_loader_seg (RWX) :           org = 0x40062000, len = 0x4000  /* 16KB, IRAM */
-  iram_seg (RWX) :                  org = 0x40066000, len = 0x4000  /* 16KB, IRAM */
-  /* 8k at the end of DRAM, before ROM data & stack */
-  dram_seg (RW) :                   org = 0x3FFFA000, len = 0x2000
-}
-
-/*  Default entry point:  */
-ENTRY(call_start_cpu0);
-
-
-SECTIONS
-{
-
-  .iram_loader.text :
-  {
-    . = ALIGN (16);
-    _loader_text_start = ABSOLUTE(.);
-    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
-     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
-    *liblog.a:(.literal .text .literal.* .text.*)
-    *libgcc.a:(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_common.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_efuse_esp32s2.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
-    *libbootloader_support.a:secure_boot_signatures.*(.literal .text .literal.* .text.*)
-    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
-    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
-    *libsoc.a:rtc_wdt.*(.literal .text .literal.* .text.*)
-    *libefuse.a:*.*(.literal .text .literal.* .text.*)
-    *(.fini.literal)
-    *(.fini)
-    *(.gnu.version)
-    _loader_text_end = ABSOLUTE(.);
-  } > iram_loader_seg
-
-  .iram.text :
-  {
-    . = ALIGN (16);
-    *(.entry.text)
-    *(.init.literal)
-    *(.init)
-  } > iram_seg
-
-
-  /* Shared RAM */
-  .dram0.bss (NOLOAD) :
-  {
-    . = ALIGN (8);
-    _dram_start = ABSOLUTE(.);
-    _bss_start = ABSOLUTE(.);
-    *(.dynsbss)
-    *(.sbss)
-    *(.sbss.*)
-    *(.gnu.linkonce.sb.*)
-    *(.scommon)
-    *(.sbss2)
-    *(.sbss2.*)
-    *(.gnu.linkonce.sb2.*)
-    *(.dynbss)
-    *(.bss)
-    *(.bss.*)
-    *(.gnu.linkonce.b.*)
-    *(COMMON)
-    . = ALIGN (8);
-    _bss_end = ABSOLUTE(.);
-  } >dram_seg
-
-  .dram0.data :
-  {
-    _data_start = ABSOLUTE(.);
-    *(.data)
-    *(.data.*)
-    *(.gnu.linkonce.d.*)
-    *(.data1)
-    *(.sdata)
-    *(.sdata.*)
-    *(.gnu.linkonce.s.*)
-    *(.sdata2)
-    *(.sdata2.*)
-    *(.gnu.linkonce.s2.*)
-    *(.jcr)
-    _data_end = ABSOLUTE(.);
-  } >dram_seg
-
-  .dram0.rodata :
-  {
-    _rodata_start = ABSOLUTE(.);
-    *(.rodata)
-    *(.rodata.*)
-    *(.gnu.linkonce.r.*)
-    *(.rodata1)
-    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
-    *(.xt_except_table)
-    *(.gcc_except_table)
-    *(.gnu.linkonce.e.*)
-    *(.gnu.version_r)
-    *(.eh_frame)
-    . = (. + 3) & ~ 3;
-    /*  C++ constructor and destructor tables, properly ordered:  */
-    __init_array_start = ABSOLUTE(.);
-    KEEP (*crtbegin.*(.ctors))
-    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
-    KEEP (*(SORT(.ctors.*)))
-    KEEP (*(.ctors))
-    __init_array_end = ABSOLUTE(.);
-    KEEP (*crtbegin.*(.dtors))
-    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
-    KEEP (*(SORT(.dtors.*)))
-    KEEP (*(.dtors))
-    /*  C++ exception handlers table:  */
-    __XT_EXCEPTION_DESCS_ = ABSOLUTE(.);
-    *(.xt_except_desc)
-    *(.gnu.linkonce.h.*)
-    __XT_EXCEPTION_DESCS_END__ = ABSOLUTE(.);
-    *(.xt_except_desc_end)
-    *(.dynamic)
-    *(.gnu.version_d)
-    _rodata_end = ABSOLUTE(.);
-	/* Literals are also RO data. */
-    _lit4_start = ABSOLUTE(.);
-    *(*.lit4)
-    *(.lit4.*)
-    *(.gnu.linkonce.lit4.*)
-    _lit4_end = ABSOLUTE(.);
-    . = ALIGN(4);
-    _dram_end = ABSOLUTE(.);
-  } >dram_seg
-
-  .iram.text :
-  {
-    _stext = .;
-    _text_start = ABSOLUTE(.);
-    *(.literal .text .literal.* .text.* .stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
-    *(.iram .iram.*) /* catch stray IRAM_ATTR */
-    *(.fini.literal)
-    *(.fini)
-    *(.gnu.version)
-    _text_end = ABSOLUTE(.);
-    _etext = .;
-  } > iram_seg
-
-}
--- a/components/bootloader/subproject/main/ld/esp32s2beta/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32s2beta/bootloader.rom.ld
@@ -1,14 +0,0 @@
-/*
- * ESP32S2 ROM address table
- * Generated for ROM with MD5sum: f054d40c5f6b9207d3827460a6f5748c
-*/
-PROVIDE ( ets_update_cpu_frequency = 0x4000d954 );
-
-/* ToDo: Following address may need modification */
-PROVIDE ( MD5Final = 0x400056e8 );
-PROVIDE ( MD5Init = 0x40005648 );
-PROVIDE ( MD5Update = 0x40005668 );
-/* bootloader will use following functions from xtensa hal library */
-xthal_get_ccount = 0x40015cbc;
-xthal_get_ccompare = 0x40015ce8;
-xthal_set_ccompare = 0x40015cc4;
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.ld
@@ -0,0 +1,196 @@
+/** Simplified memory map for the bootloader.
+ *  Make sure the bootloader can load into main memory without overwriting itself.
+ *  We put 2nd bootloader in the high address space (before ROM stack/data/bss).
+ *  See memory usage for ROM bootloader at the end of this file.
+ */
+
+MEMORY
+{
+  iram_seg (RWX) :                  org = 0x403B6000, len = 0x4000
+  iram_loader_seg (RWX) :           org = 0x403BA000, len = 0x6000
+  dram_seg (RW) :                   org = 0x3FCD0000, len = 0x4000
+}
+
+/* Default entry point: */
+ENTRY(call_start_cpu0);
+
+SECTIONS
+{
+
+  .iram_loader.text :
+  {
+    . = ALIGN (16);
+    _loader_text_start = ABSOLUTE(.);
+    *(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+     *(.iram1 .iram1.*) /* catch stray IRAM_ATTR */
+    *liblog.a:(.literal .text .literal.* .text.*)
+    *libgcc.a:(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_clock_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_common_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_flash.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_disable .text.bootloader_random_disable)
+    *libbootloader_support.a:bootloader_random*.*(.literal.bootloader_random_enable .text.bootloader_random_enable)
+    *libbootloader_support.a:bootloader_efuse_esp32s3.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_utility.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_sha.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_console_loader.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:bootloader_panic.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:esp_image_format.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_encrypt.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:flash_partitions.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot.*(.literal .text .literal.* .text.*)
+    *libbootloader_support.a:secure_boot_signatures_bootloader.*(.literal .text .literal.* .text.*)
+    *libmicro-ecc.a:*.*(.literal .text .literal.* .text.*)
+    *libspi_flash.a:*.*(.literal .text .literal.* .text.*)
+    *libhal.a:wdt_hal_iram.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_clk.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:rtc_time.*(.literal .text .literal.* .text.*)
+    *libesp_hw_support.a:regi2c_ctrl.*(.literal .text .literal.* .text.*)
+    *libefuse.a:*.*(.literal .text .literal.* .text.*)
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+    _loader_text_end = ABSOLUTE(.);
+  } > iram_loader_seg
+
+  .iram.text :
+  {
+    . = ALIGN (16);
+    *(.entry.text)
+    *(.init.literal)
+    *(.init)
+  } > iram_seg
+
+
+  /* Shared RAM */
+  .dram0.bss (NOLOAD) :
+  {
+    . = ALIGN (8);
+    _dram_start = ABSOLUTE(.);
+    _bss_start = ABSOLUTE(.);
+    *(.dynsbss)
+    *(.sbss)
+    *(.sbss.*)
+    *(.gnu.linkonce.sb.*)
+    *(.scommon)
+    *(.sbss2)
+    *(.sbss2.*)
+    *(.gnu.linkonce.sb2.*)
+    *(.dynbss)
+    *(.bss)
+    *(.bss.*)
+    *(.gnu.linkonce.b.*)
+    *(COMMON)
+    . = ALIGN (8);
+    _bss_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.data :
+  {
+    _data_start = ABSOLUTE(.);
+    *(.data)
+    *(.data.*)
+    *(.gnu.linkonce.d.*)
+    *(.data1)
+    *(.sdata)
+    *(.sdata.*)
+    *(.gnu.linkonce.s.*)
+    *(.sdata2)
+    *(.sdata2.*)
+    *(.gnu.linkonce.s2.*)
+    *(.jcr)
+    _data_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .dram0.rodata :
+  {
+    _rodata_start = ABSOLUTE(.);
+    *(.rodata)
+    *(.rodata.*)
+    *(.gnu.linkonce.r.*)
+    *(.rodata1)
+    __XT_EXCEPTION_TABLE_ = ABSOLUTE(.);
+    *(.xt_except_table)
+    *(.gcc_except_table)
+    *(.gnu.linkonce.e.*)
+    *(.gnu.version_r)
+    *(.eh_frame)
+    . = (. + 3) & ~ 3;
+    /* C++ constructor and destructor tables, properly ordered: */
+    __init_array_start = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.ctors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .ctors))
+    KEEP (*(SORT(.ctors.*)))
+    KEEP (*(.ctors))
+    __init_array_end = ABSOLUTE(.);
+    KEEP (*crtbegin.*(.dtors))
+    KEEP (*(EXCLUDE_FILE (*crtend.*) .dtors))
+    KEEP (*(SORT(.dtors.*)))
+    KEEP (*(.dtors))
+    /*  C++ exception handlers table:  */
+    __XT_EXCEPTION_DESCS_ = ABSOLUTE(.);
+    *(.xt_except_desc)
+    *(.gnu.linkonce.h.*)
+    __XT_EXCEPTION_DESCS_END__ = ABSOLUTE(.);
+    *(.xt_except_desc_end)
+    *(.dynamic)
+    *(.gnu.version_d)
+    _rodata_end = ABSOLUTE(.);
+	  /* Literals are also RO data. */
+    _lit4_start = ABSOLUTE(.);
+    *(*.lit4)
+    *(.lit4.*)
+    *(.gnu.linkonce.lit4.*)
+    _lit4_end = ABSOLUTE(.);
+    . = ALIGN(4);
+    _dram_end = ABSOLUTE(.);
+  } > dram_seg
+
+  .iram.text :
+  {
+    _stext = .;
+    _text_start = ABSOLUTE(.);
+    *(.literal .text .literal.* .text.* .stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
+    *(.iram .iram.*) /* catch stray IRAM_ATTR */
+    *(.fini.literal)
+    *(.fini)
+    *(.gnu.version)
+
+    /** CPU will try to prefetch up to 16 bytes of
+      * of instructions. This means that any configuration (e.g. MMU, PMS) must allow
+      * safe access to up to 16 bytes after the last real instruction, add
+      * dummy bytes to ensure this
+      */
+    . += 16;
+
+    _text_end = ABSOLUTE(.);
+    _etext = .;
+  } > iram_seg
+
+}
+
+
+/**
+ *  Appendix: Memory Usage of ROM bootloader
+ *
+ *  +--------+--------------+------+ 0x3FCD_8000
+ *  |        ^              |
+ *  |        |              |
+ *  |        | data/bss     |
+ *  |        |              |
+ *  |        v              |
+ *  +------------------------------+ 0x3FCE_9910
+ *  |        ^              |
+ *  |        |              |
+ *  |        | stack (pro)  |
+ *  |        |              |
+ *  |        v              |
+ *  +------------------------------+ 0x3FCE_B910
+ *  |        ^              |
+ *  |        |              |
+ *  |        | stack (app)  |
+ *  |        |              |
+ *  |        v              |
+ *  +--------+--------------+------+ 0x3FCE_D910
+ */
--- a/components/bootloader/subproject/main/ld/esp32s3/bootloader.rom.ld
+++ b/components/bootloader/subproject/main/ld/esp32s3/bootloader.rom.ld
@@ -0,0 +1,6 @@
+/**
+ * ESP32S3 ROM address table
+ * Generated for ROM with MD5sum: d20fb231463ce337432b1fa9cba0b3c9
+ */
+
+PROVIDE ( ets_update_cpu_frequency = 0x40043164 );
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -1,45 +1,62 @@
 set(srcs
-    "src/bootloader_clock.c"
    "src/bootloader_common.c"
+    "src/bootloader_common_loader.c"
+    "src/bootloader_clock_init.c"
    "src/bootloader_flash.c"
+    "src/bootloader_mem.c"
    "src/bootloader_random.c"
+    "src/bootloader_random_${IDF_TARGET}.c"
    "src/bootloader_utility.c"
    "src/esp_image_format.c"
+    "src/flash_encrypt.c"
+    "src/secure_boot.c"
    "src/flash_partitions.c"
    "src/flash_qio_mode.c"
    "src/bootloader_flash_config_${IDF_TARGET}.c"
    "src/bootloader_efuse_${IDF_TARGET}.c"
    )

-if(IDF_TARGET STREQUAL "esp32")
-    # Not supported on ESP32S2Beta yet
-    list(APPEND srcs "src/flash_encrypt.c")
-endif()
-
 if(BOOTLOADER_BUILD)
    set(include_dirs "include" "include_bootloader")
    set(priv_requires micro-ecc spi_flash efuse)
    list(APPEND srcs
    "src/bootloader_init.c"
+    "src/bootloader_clock_loader.c"
+    "src/bootloader_console.c"
+    "src/bootloader_console_loader.c"
+    "src/bootloader_panic.c"
    "src/${IDF_TARGET}/bootloader_sha.c"
    "src/${IDF_TARGET}/flash_encrypt.c"
    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
    )
+    list(APPEND priv_requires hal)
 else()
    list(APPEND srcs
        "src/idf/bootloader_sha.c")
    set(include_dirs "include")
    set(priv_include_dirs "include_bootloader")
-    set(priv_requires spi_flash mbedtls efuse)
+    set(priv_requires spi_flash mbedtls efuse app_update)
 endif()

-if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
-    if(BOOTLOADER_BUILD)
-        list(APPEND srcs
-        "src/${IDF_TARGET}/secure_boot_signatures.c")
-    else()
-        list(APPEND srcs
-            "src/idf/secure_boot_signatures.c")
+if(BOOTLOADER_BUILD)
+    if(CONFIG_SECURE_SIGNED_ON_BOOT)
+        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+            list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_bootloader.c")
+        endif()
+
+        if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
+            list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c")
+        endif()
+    endif()
+else()
+    if(CONFIG_SECURE_SIGNED_ON_UPDATE)
+        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+            list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_app.c")
+        endif()
+
+        if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
+            list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c")
+        endif()
    endif()
 endif()

@@ -114,3 +131,7 @@ if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE
        APPEND PROPERTY ADDITIONAL_MAKE_CLEAN_FILES
        "${secure_boot_verification_key}")
 endif()
+
+if(BOOTLOADER_BUILD)
+    target_link_libraries(${COMPONENT_LIB} INTERFACE "-u abort")
+endif()
--- a/components/bootloader_support/component.mk
+++ b/components/bootloader_support/component.mk
@@ -7,7 +7,9 @@ else
 COMPONENT_PRIV_INCLUDEDIRS := include_bootloader
 endif

-COMPONENT_SRCDIRS := src
+COMPONENT_SRCDIRS := src \
+			src/secure_boot_v2 \
+			src/secure_boot_v1

 ifndef IS_BOOTLOADER_BUILD
 COMPONENT_SRCDIRS += src/idf  # idf sub-directory contains platform agnostic IDF versions
@@ -16,18 +18,44 @@ COMPONENT_SRCDIRS += src/$(IDF_TARGET)  # one sub-dir per chip
 endif

 ifndef IS_BOOTLOADER_BUILD
-COMPONENT_OBJEXCLUDE := src/bootloader_init.o
+COMPONENT_OBJEXCLUDE := src/bootloader_init.o \
+			src/bootloader_panic.o \
+			src/bootloader_clock_loader.o \
+			src/bootloader_console.o \
+			src/bootloader_console_loader.o
 endif

-COMPONENT_OBJEXCLUDE += src/bootloader_flash_config_esp32s2beta.o \
-			src/bootloader_efuse_esp32s2beta.o
+COMPONENT_OBJEXCLUDE += src/bootloader_flash_config_esp32s2.o \
+			src/bootloader_flash_config_esp32s3.o \
+			src/bootloader_flash_config_esp32c3.o \
+			src/bootloader_efuse_esp32s2.o \
+			src/bootloader_efuse_esp32s3.o \
+			src/bootloader_efuse_esp32c3.o \
+			src/bootloader_random_esp32s2.o \
+			src/bootloader_random_esp32s3.o \
+			src/bootloader_random_esp32c3.o

-ifndef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
-ifndef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
-COMPONENT_OBJEXCLUDE += src/$(IDF_TARGET)/secure_boot_signatures.o \
-			src/idf/secure_boot_signatures.o
-endif
-endif
+ifdef IS_BOOTLOADER_BUILD
+	ifndef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+		COMPONENT_OBJEXCLUDE += src/secure_boot_v1/secure_boot_signatures_bootloader.o
+	endif
+
+	ifndef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+		COMPONENT_OBJEXCLUDE += src/secure_boot_v2/secure_boot_signatures_bootloader.o
+	endif
+	COMPONENT_OBJEXCLUDE += src/secure_boot_v1/secure_boot_signatures_app.o \
+				src/secure_boot_v2/secure_boot_signatures_app.o
+else
+	ifndef CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME
+		COMPONENT_OBJEXCLUDE += src/secure_boot_v1/secure_boot_signatures_app.o
+	endif
+
+	ifndef CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+		COMPONENT_OBJEXCLUDE += src/secure_boot_v2/secure_boot_signatures_app.o
+	endif
+	COMPONENT_OBJEXCLUDE += src/secure_boot_v1/secure_boot_signatures_bootloader.o \
+				src/secure_boot_v2/secure_boot_signatures_bootloader.o
+endif # IS_BOOTLOADER_BUILD

 ifndef CONFIG_SECURE_BOOT
 COMPONENT_OBJEXCLUDE += src/$(IDF_TARGET)/secure_boot.o
--- a/components/bootloader_support/include/bootloader_clock.h
+++ b/components/bootloader_support/include/bootloader_clock.h
@@ -31,4 +31,3 @@ int bootloader_clock_get_rated_freq_mhz(void);
 #ifdef __cplusplus
 }
 #endif
-
--- a/components/bootloader_support/include/bootloader_common.h
+++ b/components/bootloader_support/include/bootloader_common.h
@@ -19,8 +19,12 @@
 // RESET_REASON is declared in rom/rtc.h
 #if CONFIG_IDF_TARGET_ESP32
 #include "esp32/rom/rtc.h"
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/rom/rtc.h"
+#elif CONFIG_IDF_TARGET_ESP32C3
+#include "esp32c3/rom/rtc.h"
 #endif

 #ifdef __cplusplus
@@ -167,6 +171,13 @@ esp_err_t bootloader_common_get_partition_description(const esp_partition_pos_t
 */
 uint8_t bootloader_common_get_chip_revision(void);

+/**
+ * @brief Get chip package
+ *
+ * @return Chip package number
+ */
+uint32_t bootloader_common_get_chip_ver_pkg(void);
+
 /**
 * @brief Query reset reason
 *
--- a/components/bootloader_support/include/bootloader_flash.h
+++ b/components/bootloader_support/include/bootloader_flash.h
@@ -0,0 +1,29 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#pragma once
+
+#include <esp_err.h>
+#include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "soc/soc_caps.h"
+
+#if SOC_CACHE_SUPPORT_WRAP
+/**
+ * @brief Set the burst mode setting command for specified wrap mode.
+ *
+ * @param mode The specified warp mode.
+ * @return always ESP_OK
+ */
+esp_err_t bootloader_flash_wrap_set(spi_flash_wrap_mode_t mode);
+#endif
--- a/components/bootloader_support/include/bootloader_flash_config.h
+++ b/components/bootloader_support/include/bootloader_flash_config.h
@@ -14,6 +14,7 @@

 #pragma once

+#include "sdkconfig.h"
 #include "esp_image_format.h"

 #ifdef __cplusplus
@@ -27,6 +28,14 @@ extern "C" {
 */
 void bootloader_flash_update_id(void);

+/**
+ * @brief Update the flash size in g_rom_flashchip (global esp_rom_spiflash_chip_t structure).
+ *
+ * @param size The size to store, in bytes.
+ * @return None
+ */
+void bootloader_flash_update_size(uint32_t size);
+
 /**
 * @brief Set the flash CS setup and hold time.
 *
@@ -66,6 +75,22 @@ void bootloader_flash_gpio_config(const esp_image_header_t* pfhdr);
 */
 void bootloader_flash_dummy_config(const esp_image_header_t* pfhdr);

+#ifdef CONFIG_IDF_TARGET_ESP32
+/**
+ * @brief Return the pin number used for custom SPI flash and/or SPIRAM WP pin
+ *
+ * Can be determined by eFuse values in most cases, or overriden in configuration
+ *
+ * This value is only meaningful if the other SPI flash pins are overriden via eFuse.
+ *
+ * This value is only meaningful if flash is set to QIO or QOUT mode, or if
+ * SPIRAM is enabled.
+ *
+ * @return Pin number to use, or -1 if the default should be kept
+ */
+int bootloader_flash_get_wp_pin(void);
+#endif
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/include/bootloader_mem.h
+++ b/components/bootloader_support/include/bootloader_mem.h
@@ -0,0 +1,24 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void bootloader_init_mem(void);
+
+#ifdef __cplusplus
+}
+#endif
--- a/components/bootloader_support/include/esp_app_format.h
+++ b/components/bootloader_support/include/esp_app_format.h
@@ -13,12 +13,17 @@
 // limitations under the License.
 #pragma once

+#include <inttypes.h>
+
 /**
 * @brief ESP chip ID
 *
 */
 typedef enum {
    ESP_CHIP_ID_ESP32 = 0x0000,  /*!< chip ID: ESP32 */
+    ESP_CHIP_ID_ESP32S2 = 0x0002,  /*!< chip ID: ESP32-S2 */
+    ESP_CHIP_ID_ESP32S3 = 0x0004, /*!< chip ID: ESP32-S3 */
+    ESP_CHIP_ID_ESP32C3 = 0x0005, /*!< chip ID: ESP32-C3 */
    ESP_CHIP_ID_INVALID = 0xFFFF /*!< Invalid chip ID (we defined it to make sure the esp_chip_id_t is 2 bytes size) */
 } __attribute__((packed)) esp_chip_id_t;

--- a/components/bootloader_support/include/esp_flash_encrypt.h
+++ b/components/bootloader_support/include/esp_flash_encrypt.h
@@ -49,10 +49,10 @@ typedef enum {
 */
 static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_enabled(void)
 {
-    uint32_t flash_crypt_cnt;
+    uint32_t flash_crypt_cnt = 0;
 #if CONFIG_IDF_TARGET_ESP32
    flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
+#else
    flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
 #endif
    /* __builtin_parity is in flash, so we calculate parity inline */
@@ -128,6 +128,10 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
 * is enabled but secure boot is not used. This should protect against
 * serial re-flashing of an unauthorised code in absence of secure boot.
 *
+ * @note On ESP32 V3 only, write protecting FLASH_CRYPT_CNT will also prevent
+ * disabling UART Download Mode. If both are wanted, call
+ * esp_efuse_disable_rom_download_mode() before calling this function.
+ *
 */
 void esp_flash_write_protect_crypt_cnt(void);

--- a/components/bootloader_support/include/esp_flash_partitions.h
+++ b/components/bootloader_support/include/esp_flash_partitions.h
@@ -42,9 +42,12 @@ extern "C" {

 #define PART_FLAG_ENCRYPTED (1<<0)

+/* The md5sum value is found this many bytes after the ESP_PARTITION_MAGIC_MD5 offset */
+#define ESP_PARTITION_MD5_OFFSET 16
+
 /* Pre-partition table fixed flash offsets */
 #define ESP_BOOTLOADER_DIGEST_OFFSET 0x0
-#define ESP_BOOTLOADER_OFFSET 0x1000 /* Offset of bootloader image. Has matching value in bootloader KConfig.projbuild file. */
+#define ESP_BOOTLOADER_OFFSET CONFIG_BOOTLOADER_OFFSET_IN_FLASH  /* Offset of bootloader image. Has matching value in bootloader KConfig.projbuild file. */
 #define ESP_PARTITION_TABLE_OFFSET CONFIG_PARTITION_TABLE_OFFSET /* Offset of partition table. Backwards-compatible name.*/

 #define ESP_PARTITION_TABLE_MAX_LEN 0xC00 /* Maximum length of partition table data */
--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@@ -106,6 +106,20 @@ _Static_assert(sizeof(rtc_retain_mem_t) <= ESP_BOOTLOADER_RESERVE_RTC, "Reserved
 */
 esp_err_t esp_image_verify(esp_image_load_mode_t mode, const esp_partition_pos_t *part, esp_image_metadata_t *data);

+/**
+ * @brief Get metadata of app
+ *
+ * If encryption is enabled, data will be transparently decrypted.
+ *
+ * @param part Partition to load the app from.
+ * @param[out] metadata Pointer to the image metadata structure which is be filled in by this function.
+ *                      Fields will all be initialised by this function.
+ *
+ * @return
+ * - ESP_OK if filling of metadata was successful
+ */
+esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_metadata_t *metadata);
+
 /**
 * @brief Verify and load an app image (available only in space of bootloader).
 *
@@ -169,6 +183,14 @@ esp_err_t esp_image_verify_bootloader(uint32_t *length);
 */
 esp_err_t esp_image_verify_bootloader_data(esp_image_metadata_t *data);

+/**
+ * @brief Get the flash size of the image
+ *
+ * @param app_flash_size The value configured in the image header
+ * @return Actual size, in bytes.
+ */
+int esp_image_get_flash_size(esp_image_flash_size_t app_flash_size);
+

 typedef struct {
    uint32_t drom_addr;
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@@ -17,15 +17,23 @@
 #include <esp_err.h>
 #include "soc/efuse_periph.h"
 #include "esp_image_format.h"
-
+#include "esp_rom_efuse.h"
 #include "sdkconfig.h"
-#if CONFIG_IDF_TARGET_ESP32S2BETA
-#include "esp32s2beta/rom/efuse.h"
-#else
-#include "esp32/rom/secure_boot.h"
-#endif
+#include "esp_rom_crc.h"

-typedef struct ets_secure_boot_signature ets_secure_boot_signature_t;
+#if CONFIG_IDF_TARGET_ESP32
+#include "esp32/rom/efuse.h"
+#include "esp32/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32S2
+#include "esp32s2/rom/efuse.h"
+#include "esp32s2/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32C3
+#include "esp32c3/rom/efuse.h"
+#include "esp32c3/rom/secure_boot.h"
+#elif CONFIG_IDF_TARGET_ESP32S3
+#include "esp32s3/rom/efuse.h"
+#include "esp32s3/rom/secure_boot.h"
+#endif

 #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
 #if !defined(CONFIG_SECURE_SIGNED_ON_BOOT) || !defined(CONFIG_SECURE_SIGNED_ON_UPDATE) || !defined(CONFIG_SECURE_SIGNED_APPS)
@@ -42,6 +50,8 @@ extern "C" {
   Can be compiled as part of app or bootloader code.
 */

+#define ESP_SECURE_BOOT_DIGEST_LEN 32
+
 /** @brief Is secure boot currently enabled in hardware?
 *
 * This means that the ROM bootloader code will only boot
@@ -57,8 +67,8 @@ static inline bool esp_secure_boot_enabled(void)
    #elif CONFIG_SECURE_BOOT_V2_ENABLED
        return ets_use_secure_boot_v2();
    #endif
-#elif CONFIG_IDF_TARGET_ESP32S2BETA
-    return ets_efuse_secure_boot_enabled();
+#else
+    return esp_rom_efuse_is_secure_boot_enabled();
 #endif
    return false; /* Secure Boot not enabled in menuconfig */
 }
@@ -68,7 +78,7 @@ static inline bool esp_secure_boot_enabled(void)
 * @important This function is intended to be called from bootloader code only.
 *
 * This function is only used in the context of the Secure Boot V1 scheme.
- * 
+ *
 * If secure boot is not yet enabled for bootloader, this will:
 *     1) generate the secure boot key and burn it on EFUSE
 *        (without enabling R/W protection)
@@ -92,9 +102,9 @@ esp_err_t esp_secure_boot_generate_digest(void);
 *
 * @important This function is intended to be called from bootloader code only.
 *
- * @important In case of Secure Boot V1, this will enable r/w protection 
- * of secure boot key on EFUSE, therefore it is to be ensured that 
- * esp_secure_boot_generate_digest() is called before this .If secure boot is not 
+ * @important In case of Secure Boot V1, this will enable r/w protection
+ * of secure boot key on EFUSE, therefore it is to be ensured that
+ * esp_secure_boot_generate_digest() is called before this .If secure boot is not
 * yet enabled for bootloader, this will
 *     1) enable R/W protection of secure boot key on EFUSE
 *     2) enable secure boot by blowing the EFUSE_RD_ABS_DONE_0 efuse.
@@ -117,9 +127,9 @@ esp_err_t esp_secure_boot_permanently_enable(void);
 * enabled on the chip via efuse.
 *
 * @important This function is intended to be called from bootloader code only.
- * 
- * @important In case of Secure Boot V2, this will enable write protection 
- * of secure boot key on EFUSE in BLK2. .If secure boot is not 
+ *
+ * @important In case of Secure Boot V2, this will enable write protection
+ * of secure boot key on EFUSE in BLK2. .If secure boot is not
 * yet enabled for bootloader, this will
 *     1) enable W protection of secure boot key on EFUSE
 *     2) enable secure boot by blowing the EFUSE_RD_ABS_DONE_1 efuse.
@@ -128,7 +138,7 @@ esp_err_t esp_secure_boot_permanently_enable(void);
 * ROM bootloader does this.)
 *
 * @param image_data Image metadata of the application to be loaded.
- * 
+ *
 * Will fail if efuses have been part-burned in a way that indicates
 * secure boot should not or could not be correctly enabled.
 *
@@ -142,7 +152,7 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
 *
 * For ECDSA Scheme (Secure Boot V1) - deterministic ECDSA w/ SHA256 image
 * For RSA Scheme (Secure Boot V2) - RSA-PSS Verification of the SHA-256 image
- * 
+ *
 * Public key is compiled into the calling program in the ECDSA Scheme.
 * See the apt docs/security/secure-boot-v1.rst or docs/security/secure-boot-v2.rst for details.
 *
@@ -178,6 +188,16 @@ typedef struct {
 */
 esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);

+#if !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3
+/**
+ * @brief Structure to hold public key digests calculated from the signature blocks of a single image.
+ *
+ * Each image can have one or more signature blocks (up to SECURE_BOOT_NUM_BLOCKS). Each signature block includes a public key.
+ */
+typedef struct {
+    uint8_t key_digests[SECURE_BOOT_NUM_BLOCKS][ESP_SECURE_BOOT_DIGEST_LEN];    /* SHA of the public key components in the signature block */
+    unsigned num_digests;                                       /* Number of valid digests, starting at index 0 */
+} esp_image_sig_public_key_digests_t;

 /** @brief Verify the RSA secure boot signature block for Secure Boot V2.
 *
@@ -191,6 +211,7 @@ esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig
 *
 */
 esp_err_t esp_secure_boot_verify_rsa_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
+#endif // !CONFIG_IDF_TARGET_ESP32 || CONFIG_ESP32_REV_MIN_3

 /** @brief Legacy ECDSA verification function
 *
@@ -211,6 +232,45 @@ typedef struct {
    uint8_t digest[64];
 } esp_secure_boot_iv_digest_t;

+/** @brief Check the secure boot V2 during startup
+ *
+ * @note This function is called automatically during app startup,
+ * it doesn't need to be called from the app.
+ *
+ * Verifies the secure boot config during startup:
+ *
+ * - Correct any insecure secure boot settings
+ */
+void esp_secure_boot_init_checks(void);
+
+#if !BOOTLOADER_BUILD && CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+
+/** @brief Scan the current running app for signature blocks
+ *
+ * @note This function doesn't verify that the signatures are valid or the
+ * corresponding public keys are trusted, it only reads the number of signature
+ * blocks present and optionally calculates the digests of the public keys
+ * provided in the signature blocks.
+ *
+ * @param digest_public_keys If true, the key_digests fields in the
+ * public_key_digests structure will be filled with the digests of the public
+ * key provided in each signature block. Note that if Secure Boot V2 is enabled,
+ * each public key will only be trusted if the same digest is also present in
+ * eFuse (but this is not checked by this function).
+ *
+ * @param public_key_digests[out] Structure is initialized with the num_digests
+ * field set to the number of signatures found. If digest_public_keys is set,
+ * the public key digests are also calculated and stored here.
+ *
+ * @return
+ *  - ESP_OK - At least one signature was found
+ *  - ESP_ERR_NOT_FOUND - No signatures were found, num_digests value will be zero
+ *  - ESP_FAIL - An error occured trying to read the signature blocks from flash
+ */
+esp_err_t esp_secure_boot_get_signature_blocks_for_running_app(bool digest_public_keys, esp_image_sig_public_key_digests_t *public_key_digests);
+
+#endif // !BOOTLOADER_BUILD && CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/include_bootloader/bootloader_console.h
+++ b/components/bootloader_support/include_bootloader/bootloader_console.h
@@ -0,0 +1,31 @@
+// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+/**
+ * @brief Initialize console output (UART or USB)
+ */
+void bootloader_console_init(void);
+
+/**
+ * @brief Flush and otherwise de-initialize console output.
+ */
+void bootloader_console_deinit(void);
+
+/**
+ * @brief "Write character to USB" function for ets_install_putc1.
+ * Only defined if USB CDC is used for console output.
+ */
+void bootloader_console_write_char_usb(char c);
--- a/components/bootloader_support/include_bootloader/bootloader_flash.h
+++ b/components/bootloader_support/include_bootloader/bootloader_flash.h
@@ -1,139 +0,0 @@
-// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-#ifndef __BOOTLOADER_FLASH_H
-#define __BOOTLOADER_FLASH_H
-
-#include <stddef.h>
-#include <stdbool.h>
-#include <stdint.h>
-#include <esp_err.h>
-#include <esp_spi_flash.h> /* including in bootloader for error values */
-
-#define FLASH_SECTOR_SIZE 0x1000
-#define FLASH_BLOCK_SIZE 0x10000
-#define MMAP_ALIGNED_MASK 0x0000FFFF
-
-/* Provide a Flash API for bootloader_support code,
-   that can be used from bootloader or app code.
-
-   This header is available to source code in the bootloader &
-   bootloader_support components only.
-*/
-
-/**
- * @brief Get number of free pages
- *
- * @return Number of free pages
- */
-uint32_t bootloader_mmap_get_free_pages(void);
-
-/**
- * @brief Map a region of flash to data memory
- *
- * @important In bootloader code, only one region can be bootloader_mmaped at once. The previous region must be bootloader_munmapped before another region is mapped.
- *
- * @important In app code, these functions are not thread safe.
- *
- * Call bootloader_munmap once for each successful call to bootloader_mmap.
- *
- * In esp-idf app, this function maps directly to spi_flash_mmap.
- *
- * @param offset - Starting flash offset to map to memory.
- * @param length - Length of data to map.
- *
- * @return Pointer to mapped data memory (at src_addr), or NULL
- * if an allocation error occured.
- */
-const void *bootloader_mmap(uint32_t src_addr, uint32_t size);
-
-
-/**
- * @brief Unmap a previously mapped region of flash
- *
- * Call bootloader_munmap once for each successful call to bootloader_mmap.
- */
-void bootloader_munmap(const void *mapping);
-
-/**
- * @brief  Read data from Flash.
- *
- *
- * @note All of src, dest and size have to be 4-byte aligned.
- *
- * @param  src   source address of the data in Flash.
- * @param  dest  pointer to the destination buffer
- * @param  size  length of data
- * @param  allow_decrypt If true and flash encryption is enabled, data on flash
- *         will be decrypted transparently as part of the read.
- *
- * @return ESP_OK on success, ESP_ERR_FLASH_OP_FAIL on SPI failure,
- * ESP_ERR_FLASH_OP_TIMEOUT on SPI timeout.
- */
-esp_err_t bootloader_flash_read(size_t src_addr, void *dest, size_t size, bool allow_decrypt);
-
-
-/**
- * @brief  Write data to Flash.
- *
- * @note All of dest_addr, src and size have to be 4-byte aligned. If write_encrypted is set, dest_addr and size must be 32-byte aligned.
- *
- * Note: In bootloader, when write_encrypted == true, the src buffer is encrypted in place.
- *
- * @param  dest_addr Destination address to write in Flash.
- * @param  src Pointer to the data to write to flash
- * @param  size Length of data in bytes.
- * @param  write_encrypted If true, data will be written encrypted on flash.
- *
- * @return ESP_OK on success, ESP_ERR_FLASH_OP_FAIL on SPI failure,
- * ESP_ERR_FLASH_OP_TIMEOUT on SPI timeout.
- */
-esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted);
-
-/**
- * @brief  Erase the Flash sector.
- *
- * @param  sector  Sector number, the count starts at sector 0, 4KB per sector.
- *
- * @return esp_err_t
- */
-esp_err_t bootloader_flash_erase_sector(size_t sector);
-
-/**
- * @brief  Erase the Flash range.
- *
- * @param  start_addr start address of flash offset
- * @param  size       sector aligned size to be erased
- *
- * @return esp_err_t
- */
-esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size);
-
-/* Cache MMU block size */
-#define MMU_BLOCK_SIZE    0x00010000
-
-/* Cache MMU address mask (MMU tables ignore bits which are zero) */
-#define MMU_FLASH_MASK    (~(MMU_BLOCK_SIZE - 1))
-
-/**
- * @brief Calculate the number of cache pages to map
- * @param size  size of data to map
- * @param vaddr  virtual address where data will be mapped
- * @return number of cache MMU pages required to do the mapping
- */
-static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vaddr)
-{
-    return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
-}
-
-#endif
--- a/components/bootloader_support/include_bootloader/bootloader_flash_priv.h
+++ b/components/bootloader_support/include_bootloader/bootloader_flash_priv.h
@@ -0,0 +1,172 @@
+// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#ifndef __BOOTLOADER_FLASH_H
+#define __BOOTLOADER_FLASH_H
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <esp_err.h>
+#include <esp_spi_flash.h> /* including in bootloader for error values */
+#include "sdkconfig.h"
+#include "bootloader_flash.h"
+
+#define FLASH_SECTOR_SIZE 0x1000
+#define FLASH_BLOCK_SIZE 0x10000
+#define MMAP_ALIGNED_MASK 0x0000FFFF
+
+/* SPI commands (actual on-wire commands not SPI controller bitmasks)
+   Suitable for use with the bootloader_execute_flash_command static function.
+*/
+#define CMD_RDID       0x9F
+#define CMD_WRSR       0x01
+#define CMD_WRSR2      0x31 /* Not all SPI flash uses this command */
+#define CMD_WREN       0x06
+#define CMD_WRDI       0x04
+#define CMD_RDSR       0x05
+#define CMD_RDSR2      0x35 /* Not all SPI flash uses this command */
+#define CMD_OTPEN      0x3A /* Enable OTP mode, not all SPI flash uses this command */
+#define CMD_WRAP       0x77 /* Set burst with wrap command */
+#define CMD_RESUME     0x7A /* Resume command to clear flash suspend bit */
+
+
+/* Provide a Flash API for bootloader_support code,
+   that can be used from bootloader or app code.
+
+   This header is available to source code in the bootloader &
+   bootloader_support components only.
+*/
+
+/**
+ * @brief Get number of free pages
+ *
+ * @return Number of free pages
+ */
+uint32_t bootloader_mmap_get_free_pages(void);
+
+/**
+ * @brief Map a region of flash to data memory
+ *
+ * @important In bootloader code, only one region can be bootloader_mmaped at once. The previous region must be bootloader_munmapped before another region is mapped.
+ *
+ * @important In app code, these functions are not thread safe.
+ *
+ * Call bootloader_munmap once for each successful call to bootloader_mmap.
+ *
+ * In esp-idf app, this function maps directly to spi_flash_mmap.
+ *
+ * @param offset - Starting flash offset to map to memory.
+ * @param length - Length of data to map.
+ *
+ * @return Pointer to mapped data memory (at src_addr), or NULL
+ * if an allocation error occured.
+ */
+const void *bootloader_mmap(uint32_t src_addr, uint32_t size);
+
+
+/**
+ * @brief Unmap a previously mapped region of flash
+ *
+ * Call bootloader_munmap once for each successful call to bootloader_mmap.
+ */
+void bootloader_munmap(const void *mapping);
+
+/**
+ * @brief  Read data from Flash.
+ *
+ *
+ * @note All of src, dest and size have to be 4-byte aligned.
+ *
+ * @param  src   source address of the data in Flash.
+ * @param  dest  pointer to the destination buffer
+ * @param  size  length of data
+ * @param  allow_decrypt If true and flash encryption is enabled, data on flash
+ *         will be decrypted transparently as part of the read.
+ *
+ * @return ESP_OK on success, ESP_ERR_FLASH_OP_FAIL on SPI failure,
+ * ESP_ERR_FLASH_OP_TIMEOUT on SPI timeout.
+ */
+esp_err_t bootloader_flash_read(size_t src_addr, void *dest, size_t size, bool allow_decrypt);
+
+
+/**
+ * @brief  Write data to Flash.
+ *
+ * @note All of dest_addr, src and size have to be 4-byte aligned. If write_encrypted is set, dest_addr and size must be 32-byte aligned.
+ *
+ * Note: In bootloader, when write_encrypted == true, the src buffer is encrypted in place.
+ *
+ * @param  dest_addr Destination address to write in Flash.
+ * @param  src Pointer to the data to write to flash
+ * @param  size Length of data in bytes.
+ * @param  write_encrypted If true, data will be written encrypted on flash.
+ *
+ * @return ESP_OK on success, ESP_ERR_FLASH_OP_FAIL on SPI failure,
+ * ESP_ERR_FLASH_OP_TIMEOUT on SPI timeout.
+ */
+esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted);
+
+/**
+ * @brief  Erase the Flash sector.
+ *
+ * @param  sector  Sector number, the count starts at sector 0, 4KB per sector.
+ *
+ * @return esp_err_t
+ */
+esp_err_t bootloader_flash_erase_sector(size_t sector);
+
+/**
+ * @brief  Erase the Flash range.
+ *
+ * @param  start_addr start address of flash offset
+ * @param  size       sector aligned size to be erased
+ *
+ * @return esp_err_t
+ */
+esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size);
+
+/* Cache MMU block size */
+#define MMU_BLOCK_SIZE    0x00010000
+
+/* Cache MMU address mask (MMU tables ignore bits which are zero) */
+#define MMU_FLASH_MASK    (~(MMU_BLOCK_SIZE - 1))
+
+/**
+ * @brief Calculate the number of cache pages to map
+ * @param size  size of data to map
+ * @param vaddr  virtual address where data will be mapped
+ * @return number of cache MMU pages required to do the mapping
+ */
+static inline uint32_t bootloader_cache_pages_to_map(uint32_t size, uint32_t vaddr)
+{
+    return (size + (vaddr - (vaddr & MMU_FLASH_MASK)) + MMU_BLOCK_SIZE - 1) / MMU_BLOCK_SIZE;
+}
+
+/**
+ * @brief Execute a user command on the flash
+ *
+ * @param command The command value to execute.
+ * @param mosi_data MOSI data to send
+ * @param mosi_len Length of MOSI data, in bits
+ * @param miso_len Length of MISO data to receive, in bits
+ * @return Received MISO data
+ */
+uint32_t bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len);
+
+/**
+ * @brief Enable the flash write protect (WEL bit).
+ */
+void bootloader_enable_wp(void);
+
+#endif
--- a/components/bootloader_support/include_bootloader/bootloader_utility.h
+++ b/components/bootloader_support/include_bootloader/bootloader_utility.h
@@ -75,6 +75,11 @@ void bootloader_utility_load_boot_image_from_deep_sleep(void);
 */
 __attribute__((noreturn)) void bootloader_reset(void);

+/**
+ * @brief Do any cleanup before exiting the bootloader, before starting the app or resetting
+ */
+void bootloader_atexit(void);
+
 /**
 * @brief Converts an array to a printable string.
 *
@@ -112,13 +117,13 @@ void bootloader_debug_buffer(const void *buffer, size_t length, const char *labe
 /** @brief Generates the digest of the data between offset & offset+length.
 *
 * This function should be used when the size of the data is larger than 3.2MB.
- * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256 
- * of the data in chunks of 3.2MB, considering the MMU capacity. 
- * 
+ * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-256
+ * of the data in chunks of 3.2MB, considering the MMU capacity.
+ *
 * @param[in]  flash_offset  Offset of the data in flash.
 * @param[in]  len           Length of data in bytes.
- * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned. 
- * 
+ * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned.
+ *
 * @return ESP_OK if secure boot digest is generated successfully.
 */
 esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
--- a/Show More
+++ b/Show More