change(version): Update version to 5.4.3

Merge branch 'ci/github-docker-build_v5.4' into 'release/v5.4'
GitHUB CI fix: Add GH hosted large runner for Docker builds (v5.4) See merge request espressif/esp-idf!42747
2025-10-21 13:13:31 +02:00 · 2025-10-21 12:24:03 +02:00 · 2025-10-21 10:26:34 +02:00 · 2025-10-11 14:12:09 +08:00 · 2025-10-11 14:03:42 +08:00 · 2025-10-11 11:43:33 +08:00
3937 changed files with 564074 additions and 301487 deletions
--- a/.codespellrc
+++ b/.codespellrc
@@ -1,4 +1,4 @@
 [codespell]
 skip = build,*.yuv,components/fatfs/src/*,alice.txt,*.rgb,components/wpa_supplicant/*,components/esp_wifi/*,*.pem
-ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn,registr,oen
+ignore-words-list = ser,dout,rsource,fram,inout,shs,ans,aci,unstall,unstalling,hart,wheight,wel,ot,fane,assertIn,registr,oen,parms
 write-changes = true
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -21,7 +21,7 @@ jobs:
    # Disable the job in forks
    if: ${{ github.repository_owner == 'espressif' }}

-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-X64-large
    steps:
      # Depending on the branch/tag, set CLONE_BRANCH_OR_TAG variable (used in the Dockerfile
      # as a build arg) and TAG_NAME (used when tagging the image).
--- a/.github/workflows/release_zips.yml
+++ b/.github/workflows/release_zips.yml
@@ -8,10 +8,11 @@ on:
 jobs:
  release_zips:
    name: Create release zip file
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    steps:
      - name: Create a recursive clone source zip
-        uses: espressif/github-actions/release_zips@master
-        env:
-            RELEASE_PROJECT_NAME: ESP-IDF
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: espressif/release-zips-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_project_name: ESP-IDF
+          git_extra_args: --shallow-since="1 year ago"
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -2,248 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.codespellrc                         @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/ROADMAP*.md                          @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_driver_*/             @esp-idf-codeowners/peripherals
-/components/esp_driver_sdmmc/         @esp-idf-codeowners/peripherals @esp-idf-codeowners/storage
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_hw_support/lowpower/  @esp-idf-codeowners/power-management
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_security/             @esp-idf-codeowners/security
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_vfs_*/                @esp-idf-codeowners/storage
-/components/esp_vfs_console/          @esp-idf-codeowners/storage @esp-idf-codeowners/system
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/hal/test_apps/crypto/     @esp-idf-codeowners/peripherals @esp-idf-codeowners/security
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/ci
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/rt/                       @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/ci
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                      @esp-idf-codeowners/docs
-/docs/docs_not_updated/                     @esp-idf-codeowners/all-maintainers
-/docs/**/api-guides/tools/                  @esp-idf-codeowners/tools
-/docs/en/api-guides/core_dump.rst           @esp-idf-codeowners/debugging
-/docs/**/api-guides/wifi*                   @esp-idf-codeowners/wifi
-/docs/**/api-guides/esp-wifi-mesh.rst       @esp-idf-codeowners/wifi
-/docs/en/api-guides/jtag-debugging/         @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/           @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/             @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/         @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb*     @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/peripherals/usb*/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/           @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/             @esp-idf-codeowners/storage
-/docs/**/api-reference/system/              @esp-idf-codeowners/system
-/docs/**/security/                          @esp-idf-codeowners/security
-/docs/**/migration-guides/                  @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-/docs/**/contribute/install-pre-commit-hook.rst @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/ieee802154/         @esp-idf-codeowners/ieee802154
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-/tools/test_apps/                    @esp-idf-codeowners/ci
-/tools/test_apps/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/configs/            @esp-idf-codeowners/system
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/peripherals/        @esp-idf-codeowners/peripherals
-/tools/test_apps/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/storage/            @esp-idf-codeowners/storage
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -1,7 +1,7 @@
 .build_template:
  stage: build
  extends:
-    - .after_script:build:ccache:upload-when-fail
+    - .after_script:build:ccache-show-stats:upload-failed-job-logs
  image: $ESP_ENV_IMAGE
  tags:
    - build
@@ -12,11 +12,11 @@
    IDF_CCACHE_ENABLE: "1"
  dependencies: []

-.build_cmake_template:
+.build_cmake_clang_template:
  extends:
    - .build_template
    - .before_script:build
-    - .after_script:build:ccache
+    - .after_script:build:ccache-show-stats
  dependencies: # set dependencies to null to avoid missing artifacts issue
  needs:
    - job: fast_template_app
@@ -34,29 +34,11 @@
      - "**/build*/size.json"
    expire_in: 1 week
    when: always
-  script:
-    # CI specific options start from "--parallel-count xxx". could ignore when running locally
-    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
-      -t $IDF_TARGET
-      --copy-sdkconfig
-      --parallel-count ${CI_NODE_TOTAL:-1}
-      --parallel-index ${CI_NODE_INDEX:-1}
-      --extra-preserve-dirs
-        examples/bluetooth/esp_ble_mesh/ble_mesh_console
-        examples/bluetooth/hci/controller_hci_uart_esp32
-        examples/wifi/iperf
-      --modified-components ${MR_MODIFIED_COMPONENTS}
-      --modified-files ${MR_MODIFIED_FILES}
-    # for detailed documents, please refer to .gitlab/ci/README.md#uploaddownload-artifacts-to-internal-minio-server
-    - python tools/ci/artifacts_handler.py upload
-
-.build_cmake_clang_template:
-  extends:
-    - .build_cmake_template
  variables:
    IDF_TOOLCHAIN: clang
    TEST_BUILD_OPTS_EXTRA: ""
    TEST_DIR: tools/test_apps/system/clang_build_test
+    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
    # CI specific options start from "--parallel-count xxx". could ignore when running locally
    - run_cmd python tools/ci/ci_build_apps.py $TEST_DIR -v
@@ -126,7 +108,7 @@ gcc_static_analyzer:
    ANALYZING_APP: "examples/get-started/hello_world"
  script:
    - echo "CONFIG_COMPILER_STATIC_ANALYZER=y" >> ${ANALYZING_APP}/sdkconfig.defaults
-    - python -m idf_build_apps build -vv -p ${ANALYZING_APP} -t all
+    - python -m idf_build_apps build -v -p ${ANALYZING_APP} -t all

 ########################################
 # Clang Build Apps Without Tests Cases #
@@ -246,14 +228,15 @@ pytest_build_system_macos:
  extends:
    - .test_build_system_template
    - .before_script:build:macos
-    - .after_script:build:macos:upload-when-fail
+    - .after_script:build:macos:upload-failed-job-logs:ccache-show-stats
    - .rules:build:macos
  tags:
    - macos_shell
  parallel: 3
  variables:
    PYENV_VERSION: "3.8"
-    CI_CCACHE_DISABLE: "1"  # ccache: error: Read-only file system
+    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
+    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".

 build_docker:
  extends:
--- a/.gitlab/ci/common.yml
+++ b/.gitlab/ci/common.yml
@@ -6,9 +6,9 @@ stages:
  - pre_check
  - build
  - assign_test
+  - build_doc
  - target_test
  - host_test
-  - build_doc
  - test_deploy
  - deploy
  - post_deploy
@@ -40,7 +40,7 @@ variables:
  GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
  # we're using .cache folder for caches
  GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.4-dev
+  LATEST_GIT_TAG: v5.4.3

  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
  # by default we will fetch all submodules
@@ -55,9 +55,9 @@ variables:
  CHECKOUT_REF_SCRIPT: "$CI_PROJECT_DIR/tools/ci/checkout_project_ref.py"

  # Docker images
-  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:1"
-  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:1-1"
-  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:1"
+  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.4:2"
+  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.4:2-1"
+  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.4:2"
  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
  PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"

@@ -88,7 +88,7 @@ variables:
  CI_CLANG_DISTRO_URL: ""

  # Set this variable to specify the file name for the known failure cases.
-  KNOWN_FAILURE_CASES_FILE_NAME: "master.txt"
+  KNOWN_FAILURE_CASES_FILE_NAME: "5.4.txt"

  IDF_CI_BUILD: 1

@@ -141,40 +141,48 @@ variables:
    export IDF_MIRROR_PREFIX_MAP=
  fi

-  # install latest python packages
-  # target test jobs
-  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
-  elif [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
-    run_cmd bash install.sh --enable-ci --enable-docs
-  elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
-    run_cmd bash install.sh --enable-ci
-  else
-    if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+  if [[ "${CI_JOB_STAGE}" != "target_test" ]]; then
+    section_start "running_install_sh" "Running install.sh"
+    if [[ "${CI_JOB_STAGE}" == "build_doc" ]]; then
+      run_cmd bash install.sh --enable-ci --enable-docs
+    elif [[ "${CI_JOB_STAGE}" == "build" ]]; then
      run_cmd bash install.sh --enable-ci
    else
-      run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      if ! echo "${CI_JOB_NAME}" | egrep ".*pytest.*"; then
+        run_cmd bash install.sh --enable-ci
+      else
+        run_cmd bash install.sh --enable-ci --enable-pytest --enable-test-specific
+      fi
    fi
+    section_end "running_install_sh"
+  else
+    section_start "install_python_env" "Install Python environment"
+    run_cmd python tools/idf_tools.py install-python-env --features ci,pytest,test-specific
+    section_end "install_python_env"
  fi

-  # Install esp-clang if necessary
+  if [[ ! -z "$INSTALL_EXTRA_TOOLS" ]]; then
+    section_start "installing_optional_tools" "Install optional tools ${INSTALL_EXTRA_TOOLS}"
+    $IDF_PATH/tools/idf_tools.py --non-interactive install $INSTALL_EXTRA_TOOLS
+    section_end "installing_optional_tools"
+  fi
+
+  # Install esp-clang if necessary (esp-clang is separately installed)
  if [[ "$IDF_TOOLCHAIN" == "clang" && -z "$CI_CLANG_DISTRO_URL" ]]; then
    $IDF_PATH/tools/idf_tools.py --non-interactive install esp-clang
  fi

-  # Install QEMU if necessary
-  if [[ ! -z "$INSTALL_QEMU" ]]; then
-    $IDF_PATH/tools/idf_tools.py --non-interactive install qemu-xtensa qemu-riscv32
+  if [[ "${CI_JOB_STAGE}" == "target_test" ]]; then
+    section_start "IDF_SKIP_TOOLS_CHECK" "Skip required tools check"
+    export IDF_SKIP_TOOLS_CHECK=1
+    section_end "IDF_SKIP_TOOLS_CHECK"
  fi
-
-  # Since the version 3.21 CMake passes source files and include dirs to ninja using absolute paths.
-  # Needed for pytest junit reports.
-  $IDF_PATH/tools/idf_tools.py --non-interactive install cmake
-
+  section_start "source_export" "Source export.sh"
  source ./export.sh
+  section_end "source_export"

  # Custom clang toolchain
-  if [[ ! -z "$CI_CLANG_DISTRO_URL" ]]; then
+  if [[ "$IDF_TOOLCHAIN" == "clang" && ! -z "$CI_CLANG_DISTRO_URL" ]]; then
    echo "Using custom clang from ${CI_CLANG_DISTRO_URL}"
    wget $CI_CLANG_DISTRO_URL
    ARCH_NAME=$(basename $CI_CLANG_DISTRO_URL)
@@ -183,13 +191,21 @@ variables:
  fi

  # Custom OpenOCD
-  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
+  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
+    machine="$(uname -m)"
+    if [[ "$machine" == "armv7l" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
+    elif [[ "$machine" == "aarch64" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
+    fi
+    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
+      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+      wget $OOCD_DISTRO_URL
+      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+      tar -x -f $ARCH_NAME
+      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+      export PATH=$PWD/openocd-esp32/bin:$PATH
+    fi
  fi

  if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then
@@ -198,6 +214,8 @@ variables:
    rm -rf ${CI_PYTHON_TOOL_REPO}
  fi

+  info "setup tools and python venv done"
+
 .show_ccache_statistics: &show_ccache_statistics |
  # Show ccache statistics if enabled globally
  test "$CI_CCACHE_STATS" == 1 && test -n "$(which ccache)" && ccache --show-stats -vv || true
@@ -222,18 +240,20 @@ variables:
    - export IDF_TOOLS_PATH="${HOME}/.espressif_runner_${CI_RUNNER_ID}_${CI_CONCURRENT_ID}"
    # remove idf-env.json, since it may contains enabled "features"
    - rm -f $IDF_TOOLS_PATH/idf-env.json
-    - $IDF_PATH/tools/idf_tools.py --non-interactive install cmake ninja
    # This adds tools (compilers) and the version-specific Python environment to PATH
    - *setup_tools_and_idf_python_venv
    - fetch_submodules
+  variables:
+    INSTALL_EXTRA_TOOLS: cmake ninja

-.after_script:build:macos:upload-when-fail:
+.after_script:build:macos:upload-failed-job-logs:ccache-show-stats:
  after_script:
    # macos is running shell executor, which means it would use
    # the system installed /usr/local/bin/python3 by default.
    # Ensure pyenv and PYENV_VERSION installed
    - eval "$(pyenv init -)"
    - *upload_failed_job_log_artifacts
+    - *show_ccache_statistics

 .before_script:build:
  before_script:
@@ -244,11 +264,11 @@ variables:
    - export EXTRA_CFLAGS=${PEDANTIC_CFLAGS}
    - export EXTRA_CXXFLAGS=${PEDANTIC_CXXFLAGS}

-.after_script:build:ccache:
+.after_script:build:ccache-show-stats:
  after_script:
    - *show_ccache_statistics

-.after_script:build:ccache:upload-when-fail:
+.after_script:build:ccache-show-stats:upload-failed-job-logs:
  after_script:
    - *show_ccache_statistics
    - *upload_failed_job_log_artifacts
--- a/.gitlab/ci/default-build-test-rules.yml
+++ b/.gitlab/ci/default-build-test-rules.yml
@@ -7,10 +7,11 @@
 #
 # This file should ONLY be used during bringup. Should be reset to empty after the bringup process
 extra_default_build_targets:
-  - esp32c5
-  - esp32c61
+

 bypass_check_test_targets:
+  - esp32c5
+  - esp32c61

 #
 # These lines would
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@@ -19,6 +19,7 @@ check_submodule_sync:
  dependencies: []
  script:
    - git submodule deinit --force .
+    - rm -rf .git/modules  # remove all the cached metadata
    # setting the default remote URL to the public one, to resolve relative location URLs
    - git config remote.origin.url ${PUBLIC_IDF_URL}
    # check if all submodules are correctly synced to public repository
--- a/.gitlab/ci/docs.yml
+++ b/.gitlab/ci/docs.yml
@@ -37,25 +37,16 @@
 .if-dev-push: &if-dev-push
  if: '$CI_COMMIT_REF_NAME != "master" && $CI_COMMIT_BRANCH !~ /^release\/v/ && $CI_COMMIT_TAG !~ /^v\d+\.\d+(\.\d+)?($|-)/ && $CI_COMMIT_TAG !~ /^qa-test/ && ($CI_PIPELINE_SOURCE == "push" || $CI_PIPELINE_SOURCE == "merge_request_event")'

-.if-schedule: &if-schedule
-  if: '$CI_PIPELINE_SOURCE == "schedule"'
-
 .doc-rules:build:docs-full:
  rules:
    - <<: *if-qa-test-tag
      when: never
-    - <<: *if-schedule
+    - <<: *if-protected
    - <<: *if-label-build_docs
    - <<: *if-label-docs_full
    - <<: *if-dev-push
      changes: *patterns-docs-full

-.doc-rules:build:docs-full-prod:
-  rules:
-    - <<: *if-qa-test-tag
-      when: never
-    - <<: *if-protected-no_label
-
 .doc-rules:build:docs-partial:
  rules:
    - <<: *if-qa-test-tag
@@ -92,13 +83,14 @@ check_docs_lang_sync:
  stage: build_doc
  tags:
    - build_docs
+  needs:
+    - job: fast_template_app
+      artifacts: false
+      optional: true
  script:
    - if [ -n "${BREATHE_ALT_INSTALL_URL}" ]; then pip uninstall -y breathe && pip install -U ${BREATHE_ALT_INSTALL_URL}; fi
    - cd docs
    - build-docs -t $DOCTGT -bs $DOC_BUILDERS -l $DOCLANG build
-  artifacts:
-    expire_in: 4 days
-    when: always
  parallel:
    matrix:
      - DOCLANG: ["en", "zh_CN"]
@@ -119,26 +111,12 @@ build_docs_html_full:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  artifacts:
-    paths:
-      - docs/_build/*/*/*.txt
-      - docs/_build/*/*/html/*
-  variables:
-    DOC_BUILDERS: "html"
-
-build_docs_html_full_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/html/*
+    expire_in: 4 days
  variables:
    DOC_BUILDERS: "html"

@@ -146,14 +124,12 @@ build_docs_html_partial:
  extends:
    - .build_docs_template
    - .doc-rules:build:docs-partial
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/html/*
+    expire_in: 4 days
  variables:
    DOC_BUILDERS: "html"
  parallel:
@@ -163,43 +139,21 @@ build_docs_html_partial:
      - DOCLANG: "zh_CN"
        DOCTGT: "esp32p4"

-build_docs_pdf:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full
-  needs:
-    - job: fast_template_app
-      artifacts: false
-      optional: true
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
-build_docs_pdf_prod:
-  extends:
-    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
-  dependencies: [] # Stop build_docs jobs from downloading all previous job's artifacts
-  allow_failure: true # TODO IDFCI-2216
-  artifacts:
-    paths:
-      - docs/_build/*/*/latex/*
-  variables:
-    DOC_BUILDERS: "latex"
-
 .deploy_docs_template:
  image: $ESP_IDF_DOC_ENV_IMAGE
  variables:
    DOCS_BUILD_DIR: "${IDF_PATH}/docs/_build/"
    PYTHONUNBUFFERED: 1
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 0
  stage: test_deploy
  tags:
    - deploy
    - shiny
  script:
+    # ensure all tags are fetched, need to know the latest/stable tag for the docs
+    - git fetch --tags --prune
    - add_doc_server_ssh_keys $DOCS_DEPLOY_PRIVATEKEY $DOCS_DEPLOY_SERVER $DOCS_DEPLOY_SERVER_USER
    - export GIT_VER=$(git describe --always ${PIPELINE_COMMIT_SHA} --)
    - deploy-docs
@@ -218,8 +172,6 @@ deploy_docs_preview:
      optional: true
    - job: build_docs_html_full
      optional: true
-    - job: build_docs_pdf
-      optional: true
  variables:
    TYPE: "preview"
    # older branches use DOCS_DEPLOY_KEY, DOCS_SERVER, DOCS_SERVER_USER, DOCS_PATH for preview server so we keep these names for 'preview'
@@ -234,12 +186,12 @@ deploy_docs_production:
  # The DOCS_PROD_* variables used by this job are "Protected" so these branches must all be marked "Protected" in Gitlab settings
  extends:
    - .deploy_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
  stage: post_deploy
  dependencies:  # set dependencies to null to avoid missing artifacts issue
  needs: # ensure runs after push_to_github succeeded
-    - build_docs_html_full_prod
-    - build_docs_pdf_prod
+    - build_docs_html_full
    - job: push_to_github
      artifacts: false
  variables:
@@ -254,16 +206,19 @@ deploy_docs_production:
 check_doc_links:
  extends:
    - .build_docs_template
-    - .doc-rules:build:docs-full-prod
+  rules:
+    - <<: *if-protected-no_label
  stage: post_deploy
  needs:
    - job: deploy_docs_production
      artifacts: false
  tags: ["build", "amd64", "internet"]
  artifacts:
+    when: always
    paths:
      - docs/_build/*/*/*.txt
      - docs/_build/*/*/linkcheck/*.txt
+    expire_in: 1 week
  allow_failure: true
  script:
    - cd docs
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@@ -111,7 +111,8 @@ test_cli_installer:
  script:
    # Tools must be downloaded for testing
    # We could use "idf_tools.py download all", but we don't want to install clang because of its huge size
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                      cmake@version that is supported
+    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
    - cd ${IDF_PATH}/tools/test_idf_tools
    - python3 -m pip install jsonschema
    - python3 ./test_idf_tools.py -v
@@ -195,7 +196,7 @@ test_tools:
      junit: ${IDF_PATH}/XUNIT_*.xml
  variables:
    LC_ALL: C.UTF-8
-    INSTALL_QEMU: 1  # for test_idf_qemu.py
+    INSTALL_EXTRA_TOOLS: "qemu-xtensa qemu-riscv32"  # for test_idf_qemu.py
  script:
    - stat=0
    - cd ${IDF_PATH}/tools/ci/test_autocomplete
@@ -233,6 +234,7 @@ test_mqtt_on_host:

 test_transport_on_host:
  extends: .host_test_template
+  allow_failure: true # IDFCI-2781 [v5.5, v5.4] test_transport_on_host fails on ubuntu 24.04
  script:
    - cd ${IDF_PATH}/components/tcp_transport/host_test
    - idf.py build
@@ -282,9 +284,10 @@ test_pytest_qemu:
      junit: XUNIT_RESULT.xml
  parallel:
    matrix:
-      - IDF_TARGET: [esp32, esp32c3]
-  variables:
-    INSTALL_QEMU: 1
+      - IDF_TARGET: "esp32"
+        INSTALL_EXTRA_TOOLS: "qemu-xtensa"
+      - IDF_TARGET: "esp32c3"
+        INSTALL_EXTRA_TOOLS: "qemu-riscv32"
  script:
    - run_cmd python tools/ci/ci_build_apps.py . -v
      --target $IDF_TARGET
@@ -348,7 +351,7 @@ test_pytest_macos:
  variables:
    PYTEST_IGNORE_COLLECT_IMPORT_ERROR: "1"
  script:
-    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -vv
+    - run_cmd python tools/ci/ci_build_apps.py components examples tools/test_apps -v
      --target linux
      --pytest-apps
      -m \"host_test and macos_shell\"
@@ -397,6 +400,17 @@ test_nvs_gen_check:
    - cd ${IDF_PATH}/components/nvs_flash/nvs_partition_tool
    - pytest --noconftest test_nvs_gen_check.py --junitxml=XUNIT_RESULT.xml

+test_esp_rom:
+  extends: .host_test_template
+  artifacts:
+    paths:
+      - XUNIT_RESULT.xml
+    reports:
+      junit: XUNIT_RESULT.xml
+  script:
+    - cd ${IDF_PATH}/components/esp_rom/
+    - pytest --noconftest test_esp_rom.py --junitxml=XUNIT_RESULT.xml
+
 make_sure_soc_caps_compatible_in_idf_build_apps:
    extends:
      - .host_test_template
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@@ -165,6 +165,8 @@ pipeline_variables:
      if [ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]; then
        echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
      fi
+    - echo "OOCD_DISTRO_URL_ARMHF=$OOCD_DISTRO_URL_ARMHF" >> pipeline.env
+    - echo "OOCD_DISTRO_URL_ARM64=$OOCD_DISTRO_URL_ARM64" >> pipeline.env
    - python tools/ci/ci_process_description.py
    - cat pipeline.env
    - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
@@ -183,12 +185,24 @@ baseline_manifest_sha:
  tags: [fast_run, shiny]
  script:
    - |
-      if [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
+      # merged results pipelines, by default
+      # diff between target-branch-head and merged-result-head
+      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_SHA" ]; then
+        git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_SHA --depth=1
+        git checkout FETCH_HEAD
+        idf-build-apps dump-manifest-sha \
+          --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
+          --output .manifest_sha
+      # merge request pipelines, when the mr got conflicts
+      # diff between diff-base-sha and merge-request-head
+      elif [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
        git fetch origin $CI_MERGE_REQUEST_DIFF_BASE_SHA --depth=1
        git checkout FETCH_HEAD
        idf-build-apps dump-manifest-sha \
          --manifest-files $(find . -name ".build-test-rules.yml" | xargs) \
          --output .manifest_sha
+      # other pipelines, like the protected branches pipelines
+      # not triggered in this job
      fi
  artifacts:
    paths:
--- a/.gitlab/ci/test-win.yml
+++ b/.gitlab/ci/test-win.yml
@@ -31,7 +31,8 @@ test_cli_installer_win:
    IDF_PATH: "$CI_PROJECT_DIR"
  script:
    # Tools must be downloaded for testing
-    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                     cmake@version that is supported
+    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
    - cd ${IDF_PATH}\tools\test_idf_tools
    - python -m pip install jsonschema
    - python .\test_idf_tools.py
--- a/.gitmodules
+++ b/.gitmodules
@@ -49,13 +49,13 @@
 [submodule "components/json/cJSON"]
 	path = components/json/cJSON
 	url = ../../DaveGamble/cJSON.git
-	sbom-version = 1.7.18
+	sbom-version = 1.7.19
 	sbom-cpe = cpe:2.3:a:cjson_project:cjson:{}:*:*:*:*:*:*:*
+	sbom-cpe = cpe:2.3:a:davegamble:cjson:{}:*:*:*:*:*:*:*
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
-	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
+	sbom-hash = c859b25da02955fef659d658b8f324b5cde87be3

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,7 +23,8 @@ repos:
            .*.pb-c.h|
            .*.pb-c.c|
            .*.yuv|
-            .*.rgb
+            .*.rgb|
+            docs/sphinx-known-warnings\.txt
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@@ -56,6 +57,7 @@ repos:
    rev: v2.3.0
    hooks:
      - id: codespell
+        exclude: ^docs/sphinx-known-warnings\.txt$
  - repo: local
    hooks:
      - id: check-executables
@@ -70,11 +72,6 @@ repos:
        language: python
        pass_filenames: false
        always_run: true
-      - id: check-deprecated-kconfigs-options
-        name: Check if any Kconfig Options Deprecated
-        entry: tools/ci/check_deprecated_kconfigs.py
-        language: python
-        files: 'sdkconfig\.ci$|sdkconfig\.rename$|sdkconfig.*$'
      - id: cmake-lint
        name: Check CMake Files Format
        entry: cmakelint --linelength=120 --spaces=4 --filter=-whitespace/indent
@@ -154,7 +151,7 @@ repos:
        require_serial: true
        additional_dependencies:
          - PyYAML == 5.3.1
-          - idf-build-apps~=2.0
+          - idf-build-apps~=2.5
      - id: sort-yaml-files
        name: sort yaml files
        entry: tools/ci/sort_yaml.py
@@ -241,6 +238,7 @@ repos:
        name: Lint rST files in docs folder using Sphinx Lint
        files: ^(docs/en|docs/zh_CN)/.*\.(rst|inc)$
  - repo: https://github.com/espressif/esp-idf-kconfig.git
-    rev: v2.3.0
+    rev: v2.5.0
    hooks:
      - id: check-kconfig-files
+      - id: check-deprecated-kconfig-options
--- a/1
+++ b/1
@@ -678,5 +678,4 @@ mainmenu "Espressif IoT Development Framework Configuration"
            - CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH
            - CONFIG_ESP_WIFI_EAP_TLS1_3
            - CONFIG_ESP_WIFI_ENABLE_ROAMING_APP
-            - CONFIG_USB_HOST_EXT_PORT_SUPPORT_LS
            - CONFIG_USB_HOST_EXT_PORT_RESET_ATTEMPTS
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -92,7 +92,7 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
    // switch to new block
    proto->state.in_block++;

-    proto->hw->swap(new_block_num);
+    proto->hw->swap(new_block_num, proto->state.markers[prev_block_num]);

    // handle data from host
    esp_hostdata_hdr_t *hdr = (esp_hostdata_hdr_t *)proto->blocks[new_block_num].start;
@@ -148,6 +148,18 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
        if (res != ESP_OK) {
            break;
        }
+#if CONFIG_IDF_TARGET_ESP32S3
+        /*
+        * ESP32S3 has a serious data corruption issue with the transferred data to host.
+        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
+        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
+        * the current thread continues execution. While this doesn't completely prevent
+        * memory access from other threads/cores/ISRs, it has shown to significantly improve
+        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
+        * number of retries needed to read an entire block without corruption.
+        */
+        esp_rom_delay_us(100);
+#endif
    }
    return res;
 }
@@ -339,7 +351,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
    esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
    // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
    // higher prio tasks and the latter can not allocate buffers at all
    // this is abnormal situation can be detected on host which will receive only uncompleted buffers
--- a/components/app_trace/port/riscv/port.c
+++ b/components/app_trace/port/riscv/port.c
@@ -50,7 +50,7 @@ static uint8_t *esp_apptrace_riscv_down_buffer_get(esp_apptrace_riscv_data_t *hw
 static esp_err_t esp_apptrace_riscv_down_buffer_put(esp_apptrace_riscv_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_riscv_host_is_connected(esp_apptrace_riscv_data_t *hw_data);
 static esp_err_t esp_apptrace_riscv_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_riscv_host_data_pending(void);

@@ -353,7 +353,7 @@ static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint3
    return ESP_OK;
 }

-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
    /* do nothing */
    return ESP_OK;
--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -12,7 +12,7 @@
 // ======================

 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================

-// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,9 +55,15 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//   See 'Targets Connection' setion for details.
+//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//    See 'Targets Connection' section for details.
+//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
+//    The register has the following format:
+//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
+//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
+//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
+//    This allows the host to verify data integrity of the received trace data.

 // 3. Modes of operation
 // =====================
@@ -127,7 +133,7 @@

 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -142,9 +148,9 @@

 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When wating on trace data lock.
+// - Trace data are locked by another task/ISR. When waiting on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -159,11 +165,15 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "esp_rom_crc.h"

 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
+#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
+
+#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)

 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -198,7 +208,7 @@ static uint8_t *esp_apptrace_trax_down_buffer_get(esp_apptrace_trax_data_t *hw_d
 static esp_err_t esp_apptrace_trax_down_buffer_put(esp_apptrace_trax_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_trax_host_is_connected(esp_apptrace_trax_data_t *hw_data);
 static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_trax_host_data_pending(void);

@@ -498,7 +508,8 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
        uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
        uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
        if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32, esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
+                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
            res = ESP_ERR_NO_MEM;
            goto _on_err;
@@ -514,14 +525,22 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
    uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
    uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
+
    eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
              host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
    esp_apptrace_trax_buffer_swap_unlock();
    return ESP_OK;
 }

-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
+    /* Before switching to the new block, calculate CRC16 of the current block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
    esp_apptrace_trax_select_memory_block(new_block_id);
    return ESP_OK;
 }
--- a/components/app_trace/private_include/esp_app_trace_membufs_proto.h
+++ b/components/app_trace/private_include/esp_app_trace_membufs_proto.h
@@ -29,7 +29,7 @@ typedef struct {

 typedef struct {
    esp_err_t (*swap_start)(uint32_t curr_block_id);
-    esp_err_t (*swap)(uint32_t new_block_id);
+    esp_err_t (*swap)(uint32_t new_block_id, uint32_t prev_block_len);
    esp_err_t (*swap_end)(uint32_t new_block_id, uint32_t prev_block_len);
    bool (*host_data_pending)(void);
 } esp_apptrace_membufs_proto_hw_t;
--- a/components/app_trace/sys_view/SEGGER/SEGGER.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER.h
@@ -10,7 +10,7 @@
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -49,7 +49,7 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 ----------------------------------------------------------------------
--- a/components/app_trace/sys_view/SEGGER/SEGGER_RTT.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_RTT.h
@@ -8,7 +8,7 @@
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -47,7 +47,7 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 ---------------------------END-OF-HEADER------------------------------
@@ -100,6 +100,10 @@ Revision: $Rev: 25842 $
      #define _CORE_HAS_RTT_ASM_SUPPORT 1
      #define _CORE_NEEDS_DMB           1
      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
+    #elif (defined(__ARM_ARCH_8_1M_MAIN__))       // Cortex-M85
+      #define _CORE_HAS_RTT_ASM_SUPPORT 1
+      #define _CORE_NEEDS_DMB           1
+      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
    #else
      #define _CORE_HAS_RTT_ASM_SUPPORT 0
    #endif
@@ -130,6 +134,10 @@ Revision: $Rev: 25842 $
      #define _CORE_HAS_RTT_ASM_SUPPORT 1
      #define _CORE_NEEDS_DMB           1
      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
+    #elif (defined __ARM_ARCH_8_1M_MAIN__)        // Cortex-M85
+      #define _CORE_HAS_RTT_ASM_SUPPORT 1
+      #define _CORE_NEEDS_DMB           1
+      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
    #elif ((defined __ARM_ARCH_7A__) || (defined __ARM_ARCH_7R__))  // Cortex-A/R 32-bit ARMv7-A/R
      #define _CORE_NEEDS_DMB           1
      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
@@ -156,6 +164,10 @@ Revision: $Rev: 25842 $
      #define _CORE_HAS_RTT_ASM_SUPPORT 1
      #define _CORE_NEEDS_DMB           1
      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
+    #elif (defined __ARM_ARCH_8_1M_MAIN__)        // Cortex-M85
+      #define _CORE_HAS_RTT_ASM_SUPPORT 1
+      #define _CORE_NEEDS_DMB           1
+      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
    #elif ((defined __ARM_ARCH_7A__) || (defined __ARM_ARCH_7R__))  // Cortex-A/R 32-bit ARMv7-A/R
      #define _CORE_NEEDS_DMB           1
      #define RTT__DMB() __asm volatile ("dmb\n" : : :);
@@ -271,6 +283,7 @@ Revision: $Rev: 25842 $
 #ifndef SEGGER_RTT_ASM  // defined when SEGGER_RTT.h is included from assembly file
 #include <stdlib.h>
 #include <stdarg.h>
+#include <stdint.h>

 /*********************************************************************
 *
@@ -412,7 +425,7 @@ unsigned     SEGGER_RTT_ReadUpBufferNoLock      (unsigned BufferIndex, void* pDa
 unsigned     SEGGER_RTT_WriteDownBuffer         (unsigned BufferIndex, const void* pBuffer, unsigned NumBytes);
 unsigned     SEGGER_RTT_WriteDownBufferNoLock   (unsigned BufferIndex, const void* pBuffer, unsigned NumBytes);

-#define      SEGGER_RTT_HASDATA_UP(n)    (((SEGGER_RTT_BUFFER_UP*)((char*)&_SEGGER_RTT.aUp[n] + SEGGER_RTT_UNCACHED_OFF))->WrOff - ((SEGGER_RTT_BUFFER_UP*)((char*)&_SEGGER_RTT.aUp[n] + SEGGER_RTT_UNCACHED_OFF))->RdOff)   // Access uncached to make sure we see changes made by the J-Link side and all of our changes go into HW directly
+#define      SEGGER_RTT_HASDATA_UP(n)    (((SEGGER_RTT_BUFFER_UP*)((uintptr_t)&_SEGGER_RTT.aUp[n] + SEGGER_RTT_UNCACHED_OFF))->WrOff - ((SEGGER_RTT_BUFFER_UP*)((uintptr_t)&_SEGGER_RTT.aUp[n] + SEGGER_RTT_UNCACHED_OFF))->RdOff)   // Access uncached to make sure we see changes made by the J-Link side and all of our changes go into HW directly

 /*********************************************************************
 *
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.c
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.c
@@ -3,14 +3,14 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2023-2024 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -49,14 +49,14 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 -------------------------- END-OF-HEADER -----------------------------

 File    : SEGGER_SYSVIEW.c
 Purpose : System visualization API implementation.
-Revision: $Rev: 28341 $
+Revision: $Rev: 29105 $

 Additional information:
  Packet format:
@@ -66,10 +66,10 @@ Additional information:

    Packets with IDs 24..31 are standard packets with extendible
    structure and contain a length field.
-    <ID><Lenght><Data><TimeStampDelta>
+    <ID><Length><Data><TimeStampDelta>

    Packet ID 31 is used for SystemView extended events.
-    <ID><Lenght><ID_EX><Data><TimeStampDelta>
+    <ID><Length><ID_EX><Data><TimeStampDelta>

    Packets with IDs >= 32 always contain a length field.
    <ID><Length><Data><TimeStampDelta>
@@ -150,6 +150,7 @@ Additional information:
 #include <string.h>
 #include <stdlib.h>
 #include <stdarg.h>
+#include <assert.h>
 #include "SEGGER_SYSVIEW_Int.h"
 #include "SEGGER_RTT.h"

@@ -188,7 +189,7 @@ Additional information:
 // Timestamps may be less than full 32-bits, in which case we need to zero
 // the unused bits to properly handle overflows.
 // Note that this is a quite common scenario, as a 32-bit time such as
-// SysTick might be scaled down to reduce bandwith
+// SysTick might be scaled down to reduce bandwidth
 // or a 16-bit hardware time might be used.
 #if SEGGER_SYSVIEW_TIMESTAMP_BITS < 32  // Eliminate unused bits in case hardware timestamps are less than 32 bits
  #define MAKE_DELTA_32BIT(Delta) Delta <<= 32 - SEGGER_SYSVIEW_TIMESTAMP_BITS; \
@@ -388,8 +389,6 @@ static U8                     _NumModules;
                                   pDest = pSysviewPointer;                         \
                                 };

-
-
 #if (SEGGER_SYSVIEW_USE_STATIC_BUFFER == 1)
 static U8 _aPacket[SEGGER_SYSVIEW_MAX_PACKET_SIZE];

@@ -432,6 +431,9 @@ static U8 _aPacket[SEGGER_SYSVIEW_MAX_PACKET_SIZE];
 static U8* _EncodeData(U8* pPayload, const char* pSrc, unsigned int NumBytes) {
  unsigned int  n;
  const U8*     p;
+
+  // Espressif doesn't support larger packages yet. Encode data length must be less than 255.
+  assert(NumBytes < 255);
  //
  n = 0;
  p = (const U8*)pSrc;
@@ -442,8 +444,8 @@ static U8* _EncodeData(U8* pPayload, const char* pSrc, unsigned int NumBytes) {
    *pPayload++ = (U8)NumBytes;
  } else {
    *pPayload++ = 255;
-    *pPayload++ = (NumBytes & 255);
    *pPayload++ = ((NumBytes >> 8) & 255);
+    *pPayload++ = (NumBytes & 255);
  }
  while (n < NumBytes) {
    *pPayload++ = *p++;
@@ -452,6 +454,38 @@ static U8* _EncodeData(U8* pPayload, const char* pSrc, unsigned int NumBytes) {
  return pPayload;
 }

+/*********************************************************************
+*
+*       _EncodeFloat()
+*
+*  Function description
+*    Encode a float value in variable-length format.
+*
+*  Parameters
+*    pPayload - Pointer to where value will be encoded.
+*    Value    - Value to be encoded.
+*
+*  Return value
+*    Pointer to the byte following the value, i.e. the first free
+*    byte in the payload and the next position to store payload
+*    content.
+*/
+static U8* _EncodeFloat(U8* pPayload, float Value) {
+   float Val = Value;
+   U8* pSysviewPointer;
+   U32* SysViewData;
+   pSysviewPointer = pPayload;
+   SysViewData = (U32*)&Val;
+   while((*SysViewData) > 0x7F) {
+     *pSysviewPointer++ = (U8)((*SysViewData) | 0x80);
+     (*SysViewData) >>= 7;
+   };
+   *pSysviewPointer++ = (U8)(*SysViewData);
+   pPayload = pSysviewPointer;
+
+   return pPayload;
+}
+
 /*********************************************************************
 *
 *       _EncodeStr()
@@ -475,38 +509,42 @@ static U8* _EncodeData(U8* pPayload, const char* pSrc, unsigned int NumBytes) {
 *    No more than 1 + Limit bytes will be encoded to the payload.
 */
 static U8 *_EncodeStr(U8 *pPayload, const char *pText, unsigned int Limit) {
-  unsigned int n;
-  unsigned int Len;
-  //
-  // Compute string len
-  //
-  Len = 0;
-  if (pText != NULL) {
-    while(*(pText + Len) != 0) {
-      Len++;
-    }
-    if (Len > Limit) {
-      Len = Limit;
-    }
-  }
-  //
-  // Write Len
-  //
-  if (Len < 255)  {
-    *pPayload++ = (U8)Len;
+  U8* pLen;
+  const char* sStart;
+
+  if (pText == NULL) {
+    *pPayload++ = (U8)0;
  } else {
-    *pPayload++ = 255;
-    *pPayload++ = (Len & 255);
-    *pPayload++ = ((Len >> 8) & 255);
+    sStart = pText; // Remember start of string.
+    //
+    // Save space to store count byte(s).
+    //
+    pLen = pPayload++;
+#if (SEGGER_SYSVIEW_MAX_STRING_LEN >= 255)  // Length always encodes in 3 bytes
+    pPayload += 2;
+#endif
+    //
+    // Limit string to maximum length and copy into payload buffer.
+    //
+    if (Limit > SEGGER_SYSVIEW_MAX_STRING_LEN) {
+      Limit = SEGGER_SYSVIEW_MAX_STRING_LEN;
+    }
+    while ((Limit-- > 0) && (*pText != '\0')) {
+      *pPayload++ = *pText++;
+    }
+    //
+    // Save string length to buffer.
+    //
+#if (SEGGER_SYSVIEW_MAX_STRING_LEN >= 255)  // Length always encodes in 3 bytes
+    Limit = (unsigned int)(pText - sStart);
+    *pLen++ = (U8)255;
+    *pLen++ = (U8)((Limit >> 8) & 255);
+    *pLen++ = (U8)(Limit & 255);
+#else   // Length always encodes in 1 byte
+    *pLen = (U8)(pText - sStart);
+#endif
  }
  //
-  // copy string
-  //
-  n = 0;
-  while (n < Len) {
-    *pPayload++ = *pText++;
-    n++;
-  }
  return pPayload;
 }

@@ -693,7 +731,6 @@ static void _SendSyncInfo(void) {
    for (n = 0; n < _NumModules; n++) {
      SEGGER_SYSVIEW_SendModule(n);
    }
-    SEGGER_SYSVIEW_SendModuleDescription();
  }
 }
 #endif  // (SEGGER_SYSVIEW_POST_MORTEM_MODE == 1)
@@ -1218,6 +1255,7 @@ static void _VPrintTarget(const char* sFormat, U32 Options, va_list* pParamList)
  unsigned int  FormatFlags;
  unsigned int  FieldWidth;
  U8*           pPayloadStart;
+  const char*   s;
 #if SEGGER_SYSVIEW_USE_STATIC_BUFFER == 0
  RECORD_START(SEGGER_SYSVIEW_INFO_SIZE + SEGGER_SYSVIEW_MAX_STRING_LEN + 1 + 2 * SEGGER_SYSVIEW_QUANTA_U32);
  SEGGER_SYSVIEW_LOCK();
@@ -1322,6 +1360,20 @@ static void _VPrintTarget(const char* sFormat, U32 Options, va_list* pParamList)
        v = va_arg(*pParamList, int);
        _PrintUnsigned(&BufferDesc, (unsigned int)v, 16u, NumDigits, FieldWidth, FormatFlags);
        break;
+      case 's':
+        s = va_arg(*pParamList, const char*);
+        if (s == NULL) {
+          s = "(null)";
+        }
+        do {
+          c = *s;
+          s++;
+          if (c == '\0') {
+            break;
+          }
+         _StoreChar(&BufferDesc, c);
+        } while (BufferDesc.Cnt < SEGGER_SYSVIEW_MAX_STRING_LEN);
+        break;
      case 'p':
        v = va_arg(*pParamList, int);
        _PrintUnsigned(&BufferDesc, (unsigned int)v, 16u, 8u, 8u, 0u);
@@ -1954,11 +2006,61 @@ void SEGGER_SYSVIEW_SendTaskInfo(const SEGGER_SYSVIEW_TASKINFO *pInfo) {
  ENCODE_U32(pPayload, SHRINK_ID(pInfo->TaskID));
  ENCODE_U32(pPayload, pInfo->StackBase);
  ENCODE_U32(pPayload, pInfo->StackSize);
-  ENCODE_U32(pPayload, 0); // Stack End, future use
+  ENCODE_U32(pPayload, pInfo->StackUsage);
  _SendPacket(pPayloadStart, pPayload, SYSVIEW_EVTID_STACK_INFO);
  RECORD_END();
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_SendStackInfo()
+*
+*  Function description
+*    Send a Stack Info Packet, containing TaskId for identification,
+*    stack base, stack size and stack usage.
+*
+*
+*  Parameters
+*    pInfo - Pointer to stack information to send.
+*/
+void SEGGER_SYSVIEW_SendStackInfo(const SEGGER_SYSVIEW_STACKINFO *pInfo) {
+  U8* pPayload;
+  U8* pPayloadStart;
+  RECORD_START(SEGGER_SYSVIEW_INFO_SIZE + 4 * SEGGER_SYSVIEW_QUANTA_U32);
+  //
+  pPayload = pPayloadStart;
+  ENCODE_U32(pPayload, SHRINK_ID(pInfo->TaskID));
+  ENCODE_U32(pPayload, pInfo->StackBase);
+  ENCODE_U32(pPayload, pInfo->StackSize);
+  ENCODE_U32(pPayload, pInfo->StackUsage);
+
+  RECORD_END();
+}
+
+/*********************************************************************
+*
+*        SEGGER_SYSVIEW_SampleData()
+*
+*  Function description
+*    Send a Data Sample Packet, containing the data Id and the value.
+*
+*
+*  Parameters
+*    pInfo - Pointer to data sample struct to send.
+*/
+void SEGGER_SYSVIEW_SampleData(const SEGGER_SYSVIEW_DATA_SAMPLE *pInfo) {
+  U8* pPayload;
+  U8* pPayloadStart;
+  RECORD_START(SEGGER_SYSVIEW_INFO_SIZE + 2 * SEGGER_SYSVIEW_QUANTA_U32);
+  //
+  pPayload = pPayloadStart;
+  ENCODE_U32(pPayload, pInfo->ID);
+  pPayload = _EncodeFloat(pPayload, *(pInfo->pFloat_Value));
+  _SendPacket(pPayloadStart, pPayload, SYSVIEW_EVTID_DATA_SAMPLE);
+
+  RECORD_END();
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_SendTaskList()
@@ -2448,6 +2550,63 @@ void SEGGER_SYSVIEW_NameResource(U32 ResourceId, const char* sName) {
  RECORD_END();
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_RegisterData()
+*
+*  Function description
+*    Register data to sample the values via SystemView.
+*
+*    Register functions are usually set in the system description
+*    callback, to ensure it is only sent when the SystemView Application
+*    is connected.
+*
+*  Parameters
+*    pInfo - Struct containing all possible properties that can be sent via this registration event.
+*/
+void SEGGER_SYSVIEW_RegisterData(SEGGER_SYSVIEW_DATA_REGISTER* pInfo) {
+  U8* pPayload;
+  U8* pPayloadStart;
+  RECORD_START(SEGGER_SYSVIEW_INFO_SIZE + 8 * SEGGER_SYSVIEW_QUANTA_U32 + 1 + SEGGER_SYSVIEW_MAX_STRING_LEN);
+  //
+  pPayload = pPayloadStart;
+  ENCODE_U32(pPayload, SYSVIEW_EVTID_EX_REGISTER_DATA);
+  ENCODE_U32(pPayload, pInfo->ID);
+  pPayload = _EncodeStr(pPayload, pInfo->sName, SEGGER_SYSVIEW_MAX_STRING_LEN);
+
+  if (pInfo->sName != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+    ENCODE_U32(pPayload, pInfo->Offset);
+    ENCODE_U32(pPayload, pInfo->RangeMin);
+    ENCODE_U32(pPayload, pInfo->RangeMax);
+    pPayload = _EncodeFloat(pPayload, pInfo->ScalingFactor);
+    pPayload = _EncodeStr(pPayload, pInfo->sUnit, SEGGER_SYSVIEW_MAX_STRING_LEN);
+  } else if (pInfo->ScalingFactor != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+    ENCODE_U32(pPayload, pInfo->Offset);
+    ENCODE_U32(pPayload, pInfo->RangeMin);
+    ENCODE_U32(pPayload, pInfo->RangeMax);
+    pPayload = _EncodeFloat(pPayload, pInfo->ScalingFactor);
+  } else if (pInfo->RangeMax != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+    ENCODE_U32(pPayload, pInfo->Offset);
+    ENCODE_U32(pPayload, pInfo->RangeMin);
+    ENCODE_U32(pPayload, pInfo->RangeMax);
+  } else if (pInfo->RangeMin != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+    ENCODE_U32(pPayload, pInfo->Offset);
+    ENCODE_U32(pPayload, pInfo->RangeMin);
+  } else if (pInfo->Offset != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+    ENCODE_U32(pPayload, pInfo->Offset);
+  } else if (pInfo->DataType != 0) {
+    ENCODE_U32(pPayload, pInfo->DataType);
+  }
+
+  _SendPacket(pPayloadStart, pPayload, SYSVIEW_EVTID_EX);
+  RECORD_END();
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_HeapDefine()
@@ -2820,9 +2979,6 @@ void SEGGER_SYSVIEW_RegisterModule(SEGGER_SYSVIEW_MODULE* pModule) {
    _NumModules++;
  }
  SEGGER_SYSVIEW_SendModule(0);
-  if (pModule->pfSendModuleDesc) {
-    pModule->pfSendModuleDesc();
-  }
  SEGGER_SYSVIEW_UNLOCK();
 }

@@ -2906,6 +3062,9 @@ void SEGGER_SYSVIEW_SendModule(U8 ModuleId) {
      _SendPacket(pPayloadStart, pPayload, SYSVIEW_EVTID_MODULEDESC);
      RECORD_END();
    }
+    if (pModule && pModule->pfSendModuleDesc) {
+      pModule->pfSendModuleDesc();
+    }
  }
 }

@@ -2986,6 +3145,39 @@ void SEGGER_SYSVIEW_PrintfHostEx(const char* s, U32 Options, ...) {
 #endif
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VPrintfHostEx()
+*
+*  Function description
+*    Print a string which is formatted on the host by the SystemView Application
+*    with Additional information.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    Options    - Options for the string. i.e. Log level.
+*    pParamList - Pointer to the list of arguments for the format string
+*
+*  Additional information
+*    All format arguments are treated as 32-bit scalar values.
+*/
+void SEGGER_SYSVIEW_VPrintfHostEx(const char* s, U32 Options, va_list *pParamList) {
+#if SEGGER_SYSVIEW_PRINTF_IMPLICIT_FORMAT
+  int r;
+  va_list ParamListCopy;
+  va_copy(ParamListCopy, *pParamList);
+
+  r = _VPrintHost(s, Options, pParamList);
+
+  if (r == -1) {
+    _VPrintTarget(s, Options, &ParamListCopy);
+  }
+  va_end(ParamListCopy);
+#else
+  _VPrintHost(s, Options, pParamList);
+#endif
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_PrintfHost()
@@ -3020,6 +3212,37 @@ void SEGGER_SYSVIEW_PrintfHost(const char* s, ...) {
 #endif
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VPrintfHost()
+*
+*  Function description
+*    Print a string which is formatted on the host by the SystemView Application.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*
+*  Additional information
+*    All format arguments are treated as 32-bit scalar values.
+*/
+void SEGGER_SYSVIEW_VPrintfHost(const char* s, va_list *pParamList) {
+#if SEGGER_SYSVIEW_PRINTF_IMPLICIT_FORMAT
+  int r;
+  va_list ParamListCopy;
+  va_copy(ParamListCopy, *pParamList);
+
+  r = _VPrintHost(s, SEGGER_SYSVIEW_LOG, pParamList);
+
+  if (r == -1) {
+    _VPrintTarget(s, SEGGER_SYSVIEW_LOG, &ParamListCopy);
+  }
+  va_end(ParamListCopy);
+#else
+  _VPrintHost(s, SEGGER_SYSVIEW_LOG, pParamList);
+#endif
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_WarnfHost()
@@ -3055,6 +3278,38 @@ void SEGGER_SYSVIEW_WarnfHost(const char* s, ...) {
 #endif
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VWarnfHost()
+*
+*  Function description
+*    Print a warning string which is formatted on the host by
+*    the SystemView Application.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*
+*  Additional information
+*    All format arguments are treated as 32-bit scalar values.
+*/
+void SEGGER_SYSVIEW_VWarnfHost(const char* s, va_list *pParamList) {
+#if SEGGER_SYSVIEW_PRINTF_IMPLICIT_FORMAT
+  int r;
+  va_list ParamListCopy;
+  va_copy(ParamListCopy, *pParamList);
+
+  r = _VPrintHost(s, SEGGER_SYSVIEW_WARNING, pParamList);
+
+  if (r == -1) {
+    _VPrintTarget(s, SEGGER_SYSVIEW_WARNING, &ParamListCopy);
+  }
+  va_end(ParamListCopy);
+#else
+  _VPrintHost(s, SEGGER_SYSVIEW_WARNING, pParamList);
+#endif
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_ErrorfHost()
@@ -3090,6 +3345,38 @@ void SEGGER_SYSVIEW_ErrorfHost(const char* s, ...) {
 #endif
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VErrorfHost()
+*
+*  Function description
+*    Print a warning string which is formatted on the host by
+*    the SystemView Application.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*
+*  Additional information
+*    All format arguments are treated as 32-bit scalar values.
+*/
+void SEGGER_SYSVIEW_VErrorfHost(const char* s, va_list *pParamList) {
+#if SEGGER_SYSVIEW_PRINTF_IMPLICIT_FORMAT
+  int r;
+  va_list ParamListCopy;
+  va_copy(ParamListCopy, *pParamList);
+
+  r = _VPrintHost(s, SEGGER_SYSVIEW_ERROR, pParamList);
+
+  if (r == -1) {
+    _VPrintTarget(s, SEGGER_SYSVIEW_ERROR, &ParamListCopy);
+  }
+  va_end(ParamListCopy);
+#else
+  _VPrintHost(s, SEGGER_SYSVIEW_ERROR, pParamList);
+#endif
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_PrintfTargetEx()
@@ -3110,6 +3397,23 @@ void SEGGER_SYSVIEW_PrintfTargetEx(const char* s, U32 Options, ...) {
  va_end(ParamList);
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VPrintfTargetEx()
+*
+*  Function description
+*    Print a string which is formatted on the target before sent to
+*    the host with Additional information.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    Options    - Options for the string. i.e. Log level.
+*    pParamList - Pointer to the list of arguments for the format string
+*/
+void SEGGER_SYSVIEW_VPrintfTargetEx(const char* s, U32 Options, va_list *pParamList) {
+  _VPrintTarget(s, Options, pParamList);
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_PrintfTarget()
@@ -3129,6 +3433,22 @@ void SEGGER_SYSVIEW_PrintfTarget(const char* s, ...) {
  va_end(ParamList);
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VPrintfTarget()
+*
+*  Function description
+*    Print a string which is formatted on the target before sent to
+*    the host.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*/
+void SEGGER_SYSVIEW_VPrintfTarget(const char* s, va_list* pParamList) {
+  _VPrintTarget(s, SEGGER_SYSVIEW_LOG, pParamList);
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_WarnfTarget()
@@ -3148,6 +3468,22 @@ void SEGGER_SYSVIEW_WarnfTarget(const char* s, ...) {
  va_end(ParamList);
 }

+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VWarnfTarget()
+*
+*  Function description
+*    Print a warning string which is formatted on the target before
+*    sent to the host.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*/
+void SEGGER_SYSVIEW_VWarnfTarget(const char* s, va_list* pParamList) {
+  _VPrintTarget(s, SEGGER_SYSVIEW_WARNING, pParamList);
+}
+
 /*********************************************************************
 *
 *       SEGGER_SYSVIEW_ErrorfTarget()
@@ -3166,6 +3502,22 @@ void SEGGER_SYSVIEW_ErrorfTarget(const char* s, ...) {
  _VPrintTarget(s, SEGGER_SYSVIEW_ERROR, &ParamList);
  va_end(ParamList);
 }
+
+/*********************************************************************
+*
+*       SEGGER_SYSVIEW_VErrorfTarget()
+*
+*  Function description
+*    Print an error string which is formatted on the target before
+*    sent to the host.
+*
+*  Parameters
+*    s          - String to be formatted.
+*    pParamList - Pointer to the list of arguments for the format string
+*/
+void SEGGER_SYSVIEW_VErrorfTarget(const char* s, va_list* pParamList) {
+  _VPrintTarget(s, SEGGER_SYSVIEW_ERROR, pParamList);
+}
 #endif // SEGGER_SYSVIEW_EXCLUDE_PRINTF

 /*********************************************************************
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW.h
@@ -3,14 +3,14 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2023-2024 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -49,13 +49,13 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 -------------------------- END-OF-HEADER -----------------------------
 File    : SEGGER_SYSVIEW.h
 Purpose : System visualization API.
-Revision: $Rev: 28237 $
+Revision: $Rev: 28768 $
 */

 #ifndef SEGGER_SYSVIEW_H
@@ -123,7 +123,7 @@ extern "C" {
 #define   SYSVIEW_EVTID_TIMER_EXIT        20
 #define   SYSVIEW_EVTID_STACK_INFO        21
 #define   SYSVIEW_EVTID_MODULEDESC        22
-
+#define   SYSVIEW_EVTID_DATA_SAMPLE       23
 #define   SYSVIEW_EVTID_INIT              24
 #define   SYSVIEW_EVTID_NAME_RESOURCE     25
 #define   SYSVIEW_EVTID_PRINT_FORMATTED   26
@@ -135,12 +135,13 @@ extern "C" {
 //
 // SystemView extended events. Sent with ID 31.
 //
-#define   SYSVIEW_EVTID_EX_MARK            0
-#define   SYSVIEW_EVTID_EX_NAME_MARKER     1
-#define   SYSVIEW_EVTID_EX_HEAP_DEFINE     2
-#define   SYSVIEW_EVTID_EX_HEAP_ALLOC      3
-#define   SYSVIEW_EVTID_EX_HEAP_ALLOC_EX   4
-#define   SYSVIEW_EVTID_EX_HEAP_FREE       5
+#define   SYSVIEW_EVTID_EX_MARK           0
+#define   SYSVIEW_EVTID_EX_NAME_MARKER    1
+#define   SYSVIEW_EVTID_EX_HEAP_DEFINE    2
+#define   SYSVIEW_EVTID_EX_HEAP_ALLOC     3
+#define   SYSVIEW_EVTID_EX_HEAP_ALLOC_EX  4
+#define   SYSVIEW_EVTID_EX_HEAP_FREE      5
+#define   SYSVIEW_EVTID_EX_REGISTER_DATA  6
 //
 // Event masks to disable/enable events
 //
@@ -167,7 +168,7 @@ extern "C" {
 #define   SYSVIEW_EVTMASK_TIMER_EXIT        (1 << SYSVIEW_EVTID_TIMER_EXIT)
 #define   SYSVIEW_EVTMASK_STACK_INFO        (1 << SYSVIEW_EVTID_STACK_INFO)
 #define   SYSVIEW_EVTMASK_MODULEDESC        (1 << SYSVIEW_EVTID_MODULEDESC)
-
+#define   SYSVIEW_EVTMASK_DATA_SAMPLE       (1 << SYSVIEW_EVTID_DATA_SAMPLE)
 #define   SYSVIEW_EVTMASK_INIT              (1 << SYSVIEW_EVTID_INIT)
 #define   SYSVIEW_EVTMASK_NAME_RESOURCE     (1 << SYSVIEW_EVTID_NAME_RESOURCE)
 #define   SYSVIEW_EVTMASK_PRINT_FORMATTED   (1 << SYSVIEW_EVTID_PRINT_FORMATTED)
@@ -202,8 +203,42 @@ typedef struct {
  U32          Prio;
  U32          StackBase;
  U32          StackSize;
+  U32          StackUsage;
 } SEGGER_SYSVIEW_TASKINFO;

+typedef struct {
+  U32          TaskID;
+  U32          StackBase;
+  U32          StackSize;
+  U32          StackUsage;
+} SEGGER_SYSVIEW_STACKINFO;
+
+typedef struct {
+  U32          ID;
+  union {
+    U32*   pU32_Value;
+    I32*   pI32_Value;
+    float* pFloat_Value;
+  };
+} SEGGER_SYSVIEW_DATA_SAMPLE;
+
+typedef enum {
+  SEGGER_SYSVIEW_TYPE_U32   = 0,
+  SEGGER_SYSVIEW_TYPE_I32   = 1,
+  SEGGER_SYSVIEW_TYPE_FLOAT = 2
+} SEGGER_SYSVIEW_DATA_TYPE;
+
+typedef struct {
+  U32                           ID;
+  SEGGER_SYSVIEW_DATA_TYPE      DataType;
+  I32                           Offset;
+  I32                           RangeMin;
+  I32                           RangeMax;
+  float                         ScalingFactor;
+  const char*                   sName;
+  const char*                   sUnit;
+}  SEGGER_SYSVIEW_DATA_REGISTER;
+
 typedef struct SEGGER_SYSVIEW_MODULE_STRUCT SEGGER_SYSVIEW_MODULE;

 struct SEGGER_SYSVIEW_MODULE_STRUCT {
@@ -247,8 +282,8 @@ EXTERN unsigned int SEGGER_SYSVIEW_InterruptId;
 */

 typedef struct {
-  U64  (*pfGetTime)      (void);
-  void (*pfSendTaskList) (void);
+  U64  (*pfGetTime)               (void);
+  void (*pfSendTaskList)          (void);
 } SEGGER_SYSVIEW_OS_API;

 /*********************************************************************
@@ -262,9 +297,13 @@ void SEGGER_SYSVIEW_Stop                          (void);
 void SEGGER_SYSVIEW_GetSysDesc                    (void);
 void SEGGER_SYSVIEW_SendTaskList                  (void);
 void SEGGER_SYSVIEW_SendTaskInfo                  (const SEGGER_SYSVIEW_TASKINFO* pInfo);
+void SEGGER_SYSVIEW_SendStackInfo                 (const SEGGER_SYSVIEW_STACKINFO* pInfo);
 void SEGGER_SYSVIEW_SendSysDesc                   (const char* sSysDesc);
 int  SEGGER_SYSVIEW_IsStarted                     (void);
 int  SEGGER_SYSVIEW_GetChannelID                  (void);
+
+void  SEGGER_SYSVIEW_SampleData                   (const SEGGER_SYSVIEW_DATA_SAMPLE *pInfo);
+
 // Checks whether tracing has been started
 U8 SEGGER_SYSVIEW_Started(void);

@@ -311,6 +350,7 @@ void SEGGER_SYSVIEW_HeapAllocEx                   (void* pHeap, void* pUserData,
 void SEGGER_SYSVIEW_HeapFree                      (void* pHeap, void* pUserData);

 void SEGGER_SYSVIEW_NameResource                  (U32 ResourceId, const char* sName);
+void SEGGER_SYSVIEW_RegisterData                  ( SEGGER_SYSVIEW_DATA_REGISTER* pInfo);

 int  SEGGER_SYSVIEW_SendPacket                    (U8* pPacket, U8* pPayloadEnd, unsigned int EventId);

@@ -341,13 +381,21 @@ void SEGGER_SYSVIEW_SendNumModules                (void);
 */
 #ifndef SEGGER_SYSVIEW_EXCLUDE_PRINTF // Define in project to avoid warnings about variable parameter list
 void SEGGER_SYSVIEW_PrintfHostEx                  (const char* s, U32 Options, ...);
+void SEGGER_SYSVIEW_VPrintfHostEx                 (const char* s, U32 Options, va_list* pParamList);
 void SEGGER_SYSVIEW_PrintfTargetEx                (const char* s, U32 Options, ...);
+void SEGGER_SYSVIEW_VPrintfTargetEx               (const char* s, U32 Options, va_list* pParamList);
 void SEGGER_SYSVIEW_PrintfHost                    (const char* s, ...);
+void SEGGER_SYSVIEW_VPrintfHost                   (const char* s, va_list* pParamList);
 void SEGGER_SYSVIEW_PrintfTarget                  (const char* s, ...);
+void SEGGER_SYSVIEW_VPrintfTarget                 (const char* s, va_list* pParamList);
 void SEGGER_SYSVIEW_WarnfHost                     (const char* s, ...);
+void SEGGER_SYSVIEW_VWarnfHost                    (const char* s, va_list* pParamList);
 void SEGGER_SYSVIEW_WarnfTarget                   (const char* s, ...);
+void SEGGER_SYSVIEW_VWarnfTarget                  (const char* s, va_list* pParamList);
 void SEGGER_SYSVIEW_ErrorfHost                    (const char* s, ...);
+void SEGGER_SYSVIEW_VErrorfHost                   (const char* s, va_list* pParamList);
 void SEGGER_SYSVIEW_ErrorfTarget                  (const char* s, ...);
+void SEGGER_SYSVIEW_VErrorfTarget                 (const char* s, va_list* pParamList);
 #endif

 void SEGGER_SYSVIEW_Print                         (const char* s);
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_ConfDefaults.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_ConfDefaults.h
@@ -3,14 +3,14 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2023-2024 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -49,7 +49,7 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 -------------------------- END-OF-HEADER -----------------------------
@@ -72,6 +72,8 @@ Revision: $Rev: 26230 $
 #include "SEGGER_SYSVIEW_Conf.h"
 #include "SEGGER_RTT_Conf.h"

+#include "esp_assert.h"
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -370,12 +372,14 @@ extern "C" {
  #define SEGGER_SYSVIEW_MAX_STRING_LEN           128
 #endif

+ESP_STATIC_ASSERT(SEGGER_SYSVIEW_MAX_STRING_LEN < 255, "SEGGER Sysview string length must be less than 255.");
+
 /*********************************************************************
 *
 *       Define: SEGGER_SYSVIEW_SUPPORT_LONG_ID
 *
 *  Description
-*    It set, support enconding Evend Ids longer than 14 bit.
+*    It set, support encoding Evend Ids longer than 14 bit.
 *  Default
 *    1
 */
@@ -388,7 +392,7 @@ extern "C" {
 *       Define: SEGGER_SYSVIEW_SUPPORT_LONG_DATA
 *
 *  Description
-*    It set, support enconding event data longer than 14 bit.
+*    It set, support encoding event data longer than 14 bit.
 *  Default
 *    0
 */
@@ -517,7 +521,7 @@ extern "C" {
 *       Define: SEGGER_SYSVIEW_SYNC_PERIOD_SHIFT
 *
 *  Description
-*    Configure how frequently syncronization is sent in post-mortem
+*    Configure how frequently synchronization is sent in post-mortem
 *    mode.
 *  Default
 *    8: (1 << 8) = Every 256 Events.
--- a/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_Int.h
+++ b/components/app_trace/sys_view/SEGGER/SEGGER_SYSVIEW_Int.h
@@ -8,7 +8,7 @@
 *                        The Embedded Experts                        *
 **********************************************************************
 *                                                                    *
-*            (c) 1995 - 2021 SEGGER Microcontroller GmbH             *
+*            (c) 1995 - 2024 SEGGER Microcontroller GmbH             *
 *                                                                    *
 *       www.segger.com     Support: support@segger.com               *
 *                                                                    *
@@ -47,7 +47,7 @@
 *                                                                    *
 **********************************************************************
 *                                                                    *
-*       SystemView version: 3.42                                    *
+*       SystemView version: 3.56                                    *
 *                                                                    *
 **********************************************************************
 -------------------------- END-OF-HEADER -----------------------------
--- a/components/app_trace/sys_view/SEGGER/sbom.yml
+++ b/components/app_trace/sys_view/SEGGER/sbom.yml
@@ -1,5 +1,5 @@
 name: 'SystemView'
-version: '3.42'
+version: '3.56'
 cpe: cpe:2.3:a:segger:systemview:{}:*:*:*:*:*:*:*
 supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
 originator: 'Organization: SEGGER Microcontroller GmbH'
--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
@@ -3,7 +3,7 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2017-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2017-2025 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
@@ -58,12 +58,14 @@ File    : SEGGER_SYSVIEW_Config_FreeRTOS.c
 Purpose : Sample setup configuration of SystemView with FreeRTOS.
 Revision: $Rev: 7745 $
 */
+#include <string.h>
 #include "sdkconfig.h"
 #include "freertos/FreeRTOS.h"
 #include "SEGGER_SYSVIEW.h"
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
+#include "esp_clk_tree.h"
 #include "esp_cpu.h"
 #include "soc/soc.h"
 #include "soc/interrupts.h"
@@ -83,11 +85,7 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // The target device name
 #define SYSVIEW_DEVICE_NAME     CONFIG_IDF_TARGET
 // The target core name
-#if CONFIG_IDF_TARGET_ARCH_XTENSA
-#define SYSVIEW_CORE_NAME       "xtensa"
-#elif CONFIG_IDF_TARGET_ARCH_RISCV
-#define SYSVIEW_CORE_NAME       "riscv"
-#endif
+#define SYSVIEW_CORE_NAME       "core0" // In dual core, this will be renamed by OpenOCD as core1

 // Determine which timer to use as timestamp source
 #if CONFIG_APPTRACE_SV_TS_SOURCE_CCOUNT
@@ -104,9 +102,6 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // Timer group timer divisor
 #define SYSVIEW_TIMER_DIV       2

-// Frequency of the timestamp, using APB as GPTimer source clock
-#define SYSVIEW_TIMESTAMP_FREQ  (esp_clk_apb_freq() / SYSVIEW_TIMER_DIV)
-
 // GPTimer handle
 gptimer_handle_t s_sv_gptimer;

@@ -156,15 +151,16 @@ static esp_apptrace_lock_t s_sys_view_lock = {.mux = portMUX_INITIALIZER_UNLOCKE
 *    Sends SystemView description strings.
 */
 static void _cbSendSystemDesc(void) {
-    char irq_str[32];
+    char irq_str[32] = "I#";
    SEGGER_SYSVIEW_SendSysDesc("N="SYSVIEW_APP_NAME",D="SYSVIEW_DEVICE_NAME",C="SYSVIEW_CORE_NAME",O=FreeRTOS");
-    snprintf(irq_str, sizeof(irq_str), "I#%d=SysTick", SYSTICK_INTR_ID);
+    strcat(itoa(SYSTICK_INTR_ID, irq_str + 2, 10), "=SysTick");
    SEGGER_SYSVIEW_SendSysDesc(irq_str);
    size_t isr_count = sizeof(esp_isr_names)/sizeof(esp_isr_names[0]);
    for (size_t i = 0; i < isr_count; ++i) {
        if (esp_isr_names[i] == NULL || (ETS_INTERNAL_INTR_SOURCE_OFF + i) == SYSTICK_INTR_ID)
            continue;
-        snprintf(irq_str, sizeof(irq_str), "I#%d=%s", ETS_INTERNAL_INTR_SOURCE_OFF + i, esp_isr_names[i]);
+        strcat(itoa(ETS_INTERNAL_INTR_SOURCE_OFF + i, irq_str + 2, 10), "=");
+        strncat(irq_str, esp_isr_names[i], sizeof(irq_str) - strlen(irq_str) - 1);
        SEGGER_SYSVIEW_SendSysDesc(irq_str);
    }
 }
@@ -175,30 +171,38 @@ static void _cbSendSystemDesc(void) {
 *
 **********************************************************************
 */
-static void SEGGER_SYSVIEW_TS_Init(void)
+static int SEGGER_SYSVIEW_TS_Init(void)
 {
    /* We only need to initialize something if we use Timer Group.
     * esp_timer and ccount can be used as is.
     */
 #if TS_USE_TIMERGROUP
+    // get clock source frequency
+    uint32_t counter_src_hz = 0;
+    ESP_ERROR_CHECK(esp_clk_tree_src_get_freq_hz(
+        (soc_module_clk_t)GPTIMER_CLK_SRC_DEFAULT,
+        ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED, &counter_src_hz));
    gptimer_config_t config = {
        .clk_src = GPTIMER_CLK_SRC_DEFAULT,
        .direction = GPTIMER_COUNT_UP,
-        .resolution_hz = SYSVIEW_TIMESTAMP_FREQ,
+        .resolution_hz = counter_src_hz / SYSVIEW_TIMER_DIV,
    };
    // pick any free GPTimer instance
    ESP_ERROR_CHECK(gptimer_new_timer(&config, &s_sv_gptimer));
    /* Start counting */
    gptimer_enable(s_sv_gptimer);
    gptimer_start(s_sv_gptimer);
+    return config.resolution_hz;
+#else
+    return SYSVIEW_TIMESTAMP_FREQ;
 #endif // TS_USE_TIMERGROUP
 }

 void SEGGER_SYSVIEW_Conf(void) {
    U32 disable_evts = 0;

-    SEGGER_SYSVIEW_TS_Init();
-    SEGGER_SYSVIEW_Init(SYSVIEW_TIMESTAMP_FREQ, SYSVIEW_CPU_FREQ,
+    int timestamp_freq = SEGGER_SYSVIEW_TS_Init();
+    SEGGER_SYSVIEW_Init(timestamp_freq, SYSVIEW_CPU_FREQ,
                        &SYSVIEW_X_OS_TraceAPI, _cbSendSystemDesc);
    SEGGER_SYSVIEW_SetRAMBase(SYSVIEW_RAM_BASE);

--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-static U64 _cbGetTime(void) {
+__attribute__((unused)) static U64 _cbGetTime(void) {
  U64 Time;

  Time = xTaskGetTickCountFromISR();
@@ -260,7 +260,10 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  _cbGetTime,
+  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
+     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
+     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
+  NULL,
  _cbSendTaskList,
 };

--- a/components/app_trace/sys_view/ext/heap_trace_module.c
+++ b/components/app_trace/sys_view/ext/heap_trace_module.c
@@ -21,7 +21,7 @@ const static char *TAG = "sysview_heap_trace";
 #endif

 static SEGGER_SYSVIEW_MODULE s_esp_sysview_heap_module = {
-    .sModule = "ESP32 SystemView Heap Tracing Module",
+    .sModule = "M=ESP32 SystemView Heap Tracing Module",
    .NumEvents = 2,
 };

--- a/components/app_update/esp_ota_ops.c
+++ b/components/app_update/esp_ota_ops.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -41,6 +41,7 @@ typedef struct ota_ops_entry_ {
    bool need_erase;
    uint32_t wrote_size;
    uint8_t partial_bytes;
+    bool ota_resumption;
    WORD_ALIGNED_ATTR uint8_t partial_data[16];
    LIST_ENTRY(ota_ops_entry_) entries;
 } ota_ops_entry_t;
@@ -111,6 +112,22 @@ static esp_ota_img_states_t set_new_state_otadata(void)
 #endif
 }

+static ota_ops_entry_t* esp_ota_init_entry(const esp_partition_t *partition)
+{
+    ota_ops_entry_t *new_entry = (ota_ops_entry_t *) calloc(1, sizeof(ota_ops_entry_t));
+    if (new_entry == NULL) {
+        return NULL;
+    }
+
+    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
+
+    new_entry->part = partition;
+    new_entry->handle = ++s_ota_ops_last_handle;
+
+    return new_entry;
+}
+
+
 esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp_ota_handle_t *out_handle)
 {
    ota_ops_entry_t *new_entry;
@@ -144,6 +161,13 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
    }
 #endif

+    new_entry = esp_ota_init_entry(partition);
+    if (new_entry == NULL) {
+        return ESP_ERR_NO_MEM;
+    }
+    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    *out_handle = new_entry->handle;
+
    if (image_size != OTA_WITH_SEQUENTIAL_WRITES) {
        // If input image size is 0 or OTA_SIZE_UNKNOWN, erase entire partition
        if ((image_size == 0) || (image_size == OTA_SIZE_UNKNOWN)) {
@@ -157,16 +181,44 @@ esp_err_t esp_ota_begin(const esp_partition_t *partition, size_t image_size, esp
        }
    }

-    new_entry = (ota_ops_entry_t *) calloc(1, sizeof(ota_ops_entry_t));
+    return ESP_OK;
+}
+
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle)
+{
+    ota_ops_entry_t *new_entry;
+
+    if ((partition == NULL) || (out_handle == NULL)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    if (image_offset > partition->size) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    partition = esp_partition_verify(partition);
+    if (partition == NULL) {
+        return ESP_ERR_NOT_FOUND;
+    }
+
+    // The staging partition cannot be of type Factory, but the final partition can be.
+    if (!is_ota_partition(partition)) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    const esp_partition_t* running_partition = esp_ota_get_running_partition();
+    if (partition == running_partition) {
+        return ESP_ERR_OTA_PARTITION_CONFLICT;
+    }
+
+    new_entry = esp_ota_init_entry(partition);
    if (new_entry == NULL) {
        return ESP_ERR_NO_MEM;
    }

-    LIST_INSERT_HEAD(&s_ota_ops_entries_head, new_entry, entries);
-
-    new_entry->part = partition;
-    new_entry->handle = ++s_ota_ops_last_handle;
-    new_entry->need_erase = (image_size == OTA_WITH_SEQUENTIAL_WRITES);
+    new_entry->ota_resumption = true;
+    new_entry->wrote_size = image_offset;
+    new_entry->need_erase = (erase_size == OTA_WITH_SEQUENTIAL_WRITES);
    *out_handle = new_entry->handle;
    return ESP_OK;
 }
--- a/components/app_update/include/esp_ota_ops.h
+++ b/components/app_update/include/esp_ota_ops.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -99,6 +99,32 @@ int esp_ota_get_app_elf_sha256(char* dst, size_t size) __attribute__((deprecated
 */
 esp_err_t esp_ota_begin(const esp_partition_t* partition, size_t image_size, esp_ota_handle_t* out_handle);

+/**
+ * @brief   Resume an interrupted OTA update by continuing to write to the specified partition.
+ *
+ * This function is used when an OTA update was previously started and needs to be resumed after an interruption.
+ * It continues the OTA process from the specified offset within the partition.
+ *
+ * Unlike esp_ota_begin(), this function does not erase the partition which receives the OTA update, but rather expects that part of the image
+ * has already been written correctly, and it resumes writing from the given offset.
+ *
+ * @param partition Pointer to info for the partition which is receiving the OTA update. Required.
+ * @param erase_size Specifies how much flash memory to erase before resuming OTA, depending on whether a sequential write or a bulk erase is being used.
+ * @param image_offset Offset from where to resume the OTA process. Should be set to the number of bytes already written.
+ * @param out_handle On success, returns a handle that should be used for subsequent esp_ota_write() and esp_ota_end() calls.
+ *
+ * @return
+ *    - ESP_OK: OTA operation resumed successfully.
+ *    - ESP_ERR_INVALID_ARG: partition, out_handle were NULL or image_offset arguments is negative, or partition doesn't point to an OTA app partition.
+ *    - ESP_ERR_NO_MEM: Cannot allocate memory for OTA operation.
+ *    - ESP_ERR_OTA_PARTITION_CONFLICT: Partition holds the currently running firmware, cannot update in place.
+ *    - ESP_ERR_NOT_FOUND: Partition argument not found in partition table.
+ *    - ESP_ERR_OTA_SELECT_INFO_INVALID: The OTA data partition contains invalid data.
+ *    - ESP_ERR_INVALID_SIZE: Partition doesn't fit in configured flash size.
+ *    - ESP_ERR_FLASH_OP_TIMEOUT or ESP_ERR_FLASH_OP_FAIL: Flash write failed.
+ */
+esp_err_t esp_ota_resume(const esp_partition_t *partition, const size_t erase_size, const size_t image_offset, esp_ota_handle_t *out_handle);
+
 /**
 * @brief   Write OTA update data to partition
 *
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -1107,7 +1107,7 @@ menu "Security features"
    endmenu  # Potentially Insecure

    config SECURE_FLASH_ENCRYPT_ONLY_IMAGE_LEN_IN_APP_PART
-        bool "Encrypt only the app image that is present in the partition of type app"
+        bool "Encrypt contents upto app image length in app partition"
        depends on SECURE_FLASH_ENC_ENABLED && !SECURE_FLASH_REQUIRE_ALREADY_ENABLED
        default y
        help
@@ -1134,6 +1134,45 @@ menu "Security features"

            If not set, the app does not care if the flash encryption eFuse bit is set or not.

+    config SECURE_FLASH_PSEUDO_ROUND_FUNC
+        bool "Permanently enable XTS-AES's pseudo rounds function"
+        default y if SECURE_FLASH_ENCRYPTION_MODE_RELEASE
+        default n
+        depends on SECURE_FLASH_ENC_ENABLED && SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+        help
+            If set (default), the bootloader will permanently enable the XTS-AES peripheral's pseudo rounds function.
+            Note: Enabling this config would burn an efuse.
+
+    choice SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        prompt "Strength of the pseudo rounds function"
+        depends on SECURE_FLASH_PSEUDO_ROUND_FUNC
+        default SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        help
+            The strength of the pseudo rounds functions can be configured to low, medium and high,
+            each denoting the values that would be stored in the efuses field.
+            By default the value to set to low.
+            You can configure the strength of the pseudo rounds functions according to your use cases,
+            for example, increasing the strength would provide higher security but would slow down the
+            flash encryption/decryption operations.
+            For more info regarding the performance impact, please checkout the pseudo round function section of the
+            security guide documentation.
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+            bool "Low"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+            bool "Medium"
+
+        config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+            bool "High"
+    endchoice
+
+    config SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH
+        int
+        default 1 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_LOW
+        default 2 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_MEDIUM
+        default 3 if SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH_HIGH
+
    config SECURE_ROM_DL_MODE_ENABLED
        bool
        default y if SOC_SUPPORTS_SECURE_DL_MODE && !SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT
@@ -1185,7 +1224,7 @@ menu "Security features"
                It is also possible to enable secure download mode at runtime by calling
                esp_efuse_enable_rom_secure_download_mode()

-                Note: Secure Download mode is not available for ESP32 (includes revisions till ECO3).
+                Note: Secure Download mode is not available for ESP32.

        config SECURE_INSECURE_ALLOW_DL_MODE
            bool "UART ROM download mode (Enabled (not recommended))"
--- a/components/bootloader_support/CMakeLists.txt
+++ b/components/bootloader_support/CMakeLists.txt
@@ -36,6 +36,10 @@ if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
        )
 endif()

+if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
+    list(APPEND srcs "src/${IDF_TARGET}/bootloader_ecdsa.c")
+endif()
+
 if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    set(include_dirs "include" "bootloader_flash/include"
        "private_include")
@@ -50,10 +54,6 @@ if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
    )
    list(APPEND priv_requires hal)
-    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
-        list(APPEND srcs
-            "src/${IDF_TARGET}/bootloader_ecdsa.c")
-    endif()
 else()
    list(APPEND srcs
        "src/idf/bootloader_sha.c")
--- a/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
+++ b/components/bootloader_support/bootloader_flash/include/bootloader_flash_priv.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -13,6 +13,7 @@
 #include <spi_flash_mmap.h> /* including in bootloader for error values */
 #include "sdkconfig.h"
 #include "bootloader_flash.h"
+#include "soc/ext_mem_defs.h"

 #ifdef __cplusplus
 extern "C" {
@@ -20,8 +21,11 @@ extern "C" {

 #define FLASH_SECTOR_SIZE 0x1000
 #define FLASH_BLOCK_SIZE 	0x10000
+
 #define MMAP_ALIGNED_MASK 	(SPI_FLASH_MMU_PAGE_SIZE - 1)
 #define MMU_FLASH_MASK    (~(SPI_FLASH_MMU_PAGE_SIZE - 1))
+#define MMU_FLASH_MASK_FROM_VAL(PAGE_SZ) (~((PAGE_SZ) - 1))
+#define MMU_DROM_END_ENTRY_VADDR_FROM_VAL(PAGE_SZ) (SOC_DRAM_FLASH_ADDRESS_HIGH - (PAGE_SZ))

 /**
 * MMU mapping must always be in the unit of a SPI_FLASH_MMU_PAGE_SIZE
@@ -89,7 +93,7 @@ uint32_t bootloader_mmap_get_free_pages(void);
 * @param length - Length of data to map.
 *
 * @return Pointer to mapped data memory (at src_addr), or NULL
- * if an allocation error occured.
+ * if an allocation error occurred.
 */
 const void *bootloader_mmap(uint32_t src_addr, uint32_t size);

--- a/components/bootloader_support/include/bootloader_memory_utils.h
+++ b/components/bootloader_support/include/bootloader_memory_utils.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2010-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2010-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -28,7 +28,21 @@ extern "C" {
 */
 __attribute__((always_inline))
 inline static bool esp_dram_match_iram(void) {
-    return (SOC_DRAM_LOW == SOC_IRAM_LOW && SOC_DRAM_HIGH == SOC_IRAM_HIGH);
+    return ((SOC_DRAM_LOW == SOC_IRAM_LOW) && (SOC_DRAM_HIGH == SOC_IRAM_HIGH));
+}
+
+/**
+ * @brief Check if the RTC IRAM and RTC DRAM are separate or using the same memory space
+ *
+ * @return true if the RTC DRAM and RTC IRAM are sharing the same memory space, false otherwise
+ */
+__attribute__((always_inline))
+inline static bool esp_rtc_dram_match_rtc_iram(void) {
+#if SOC_RTC_FAST_MEM_SUPPORTED
+    return ((SOC_RTC_IRAM_LOW == SOC_RTC_DRAM_LOW) && (SOC_RTC_IRAM_HIGH == SOC_RTC_DRAM_HIGH));
+#else
+    return false;
+#endif
 }

 /**
@@ -82,6 +96,7 @@ __attribute__((always_inline))
 inline static bool esp_ptr_in_diram_iram(const void *p) {
 // TODO: IDF-5980 esp32c6 D/I RAM share the same address
 #if SOC_DIRAM_IRAM_LOW == SOC_DIRAM_DRAM_LOW
+    (void)p;
    return false;
 #else
    return ((intptr_t)p >= SOC_DIRAM_IRAM_LOW && (intptr_t)p < SOC_DIRAM_IRAM_HIGH);
@@ -100,6 +115,7 @@ inline static bool esp_ptr_in_rtc_iram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
    return ((intptr_t)p >= SOC_RTC_IRAM_LOW && (intptr_t)p < SOC_RTC_IRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@@ -116,6 +132,7 @@ inline static bool esp_ptr_in_rtc_dram_fast(const void *p) {
 #if SOC_RTC_FAST_MEM_SUPPORTED
    return ((intptr_t)p >= SOC_RTC_DRAM_LOW && (intptr_t)p < SOC_RTC_DRAM_HIGH);
 #else
+    (void)p;
    return false;
 #endif
 }
@@ -151,6 +168,21 @@ inline static void * esp_ptr_diram_dram_to_iram(const void *p) {
 #endif
 }

+/* Convert a RTC DRAM pointer to equivalent word address in RTC IRAM
+
+   - Address must be word aligned
+   - Address must pass esp_ptr_in_rtc_dram_fast() test, or result will be invalid pointer
+*/
+__attribute__((always_inline))
+inline static void * esp_ptr_rtc_dram_to_iram(const void *p) {
+    intptr_t ptr = (intptr_t)p;
+#if SOC_RTC_FAST_MEM_SUPPORTED && (SOC_RTC_IRAM_LOW != SOC_RTC_DRAM_LOW)
+    return (void *) ( SOC_RTC_IRAM_LOW + (ptr - SOC_RTC_DRAM_LOW) );
+#else
+    return (void *) ptr;
+#endif
+}
+
 /* Convert a D/IRAM IRAM pointer to equivalent word address in DRAM

   - Address must be word aligned
--- a/components/bootloader_support/include/esp_flash_encrypt.h
+++ b/components/bootloader_support/include/esp_flash_encrypt.h
@@ -215,6 +215,10 @@ bool esp_flash_encryption_cfg_verify_release_mode(void);
 * It burns:
 *  - "disable encrypt in dl mode"
 *  - set FLASH_CRYPT_CNT efuse to max
+ *
+ * In case of the targets that support the XTS-AES peripheral's pseudo rounds function,
+ * this API would configure the pseudo rounds level efuse bit to level low if the efuse bit
+ * is not set already.
 */
 void esp_flash_encryption_set_release_mode(void);

--- a/components/bootloader_support/include/esp_image_format.h
+++ b/components/bootloader_support/include/esp_image_format.h
@@ -34,6 +34,7 @@ typedef struct {
  uint32_t image_len; /* Length of image on flash, in bytes */
  uint8_t image_digest[32]; /* appended SHA-256 digest */
  uint32_t secure_version; /* secure version for anti-rollback, it is covered by sha256 (set if CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK=y) */
+  uint32_t mmu_page_size; /* Flash MMU page size per binary header */
 } esp_image_metadata_t;

 typedef enum {
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@@ -236,6 +236,23 @@ typedef struct {
    uint8_t signature[64];
 } esp_secure_boot_sig_block_t;

+/** @brief Get the size of the secure boot signature block
+ *
+ * This is the size of the signature block appended to a signed image.
+ *
+ * @return Size of the secure boot signature block in bytes
+ */
+static inline uint32_t esp_secure_boot_sig_block_size(void)
+{
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
+    return sizeof(ets_secure_boot_signature_t);
+#elif defined(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
+    return sizeof(esp_secure_boot_sig_block_t);
+#else
+    return 0;
+#endif
+}
+
 /** @brief Verify the ECDSA secure boot signature block for Secure Boot V1.
 *
 *  Calculates Deterministic ECDSA w/ SHA256 based on the SHA256 hash of the image. ECDSA signature
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@@ -28,6 +28,7 @@

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
 #define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

 static const char* TAG = "boot_comm";

@@ -242,7 +243,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
    static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
    return s_bootloader_retain_mem;
--- a/components/bootloader_support/src/bootloader_console.c
+++ b/components/bootloader_support/src/bootloader_console.c
@@ -74,6 +74,12 @@ void bootloader_console_init(void)
        // Enable the peripheral
        uart_ll_enable_bus_clock(uart_num, true);
        uart_ll_reset_register(uart_num);
+        // Set clock source
+#if SOC_UART_SUPPORT_XTAL_CLK
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_XTAL);
+#else
+        uart_ll_set_sclk(UART_LL_GET_HW(uart_num), (soc_module_clk_t)UART_SCLK_APB);
+#endif
        // Reset TX and RX FIFOs
        uart_ll_txfifo_rst(UART_LL_GET_HW(uart_num));
        uart_ll_rxfifo_rst(UART_LL_GET_HW(uart_num));
--- a/components/bootloader_support/src/bootloader_random_esp32p4.c
+++ b/components/bootloader_support/src/bootloader_random_esp32p4.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -12,6 +12,7 @@
 #include "soc/lp_adc_reg.h"
 #include "esp_private/regi2c_ctrl.h"
 #include "esp_rom_regi2c.h"
+#include "soc/lpperi_reg.h"

 // TODO IDF-6497: once ADC API is supported, use the API instead of defining functions and constants here

@@ -30,8 +31,8 @@ static void adc1_fix_initcode_set(uint32_t initcode_value)
 {
    uint32_t msb = initcode_value >> 8;
    uint32_t lsb = initcode_value & 0xff;
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_SAR1_INIT_CODE_MSB, msb);
-    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_SAR1_INIT_CODE_LSB, lsb);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, msb);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, lsb);
 }

 //total 4 tables
@@ -50,6 +51,7 @@ void bootloader_random_enable(void)
    pattern_table sar1_table[4] = {};
    uint32_t pattern_len = 0;

+    SET_PERI_REG_MASK(LPPERI_CLK_EN_REG, LPPERI_CK_EN_LP_ADC);
    SET_PERI_REG_MASK(HP_SYS_CLKRST_SOC_CLK_CTRL2_REG, HP_SYS_CLKRST_REG_ADC_APB_CLK_EN);
    SET_PERI_REG_MASK(HP_SYS_CLKRST_PERI_CLK_CTRL23_REG, HP_SYS_CLKRST_REG_ADC_CLK_EN);

@@ -94,7 +96,8 @@ void bootloader_random_enable(void)

 void bootloader_random_disable(void)
 {
-    // No-op for now TODO IDF-6497
-    // ADC should be set to defaults here, once ADC API is implemented
-    // OR just keep this empty and let application continue to use RNG initialized by the bootloader
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_LOW_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, ADC_SAR1_INITIAL_CODE_HIGH_ADDR, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_ENT_VDD_GRP1, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, I2C_SAR_ADC_DTEST_VDD_GRP1, 0);
 }
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -20,6 +20,7 @@
 #include "esp_rom_spiflash.h"

 #include "soc/soc.h"
+#include "soc/soc_caps.h"
 #include "soc/rtc.h"
 #include "soc/efuse_periph.h"
 #include "soc/rtc_periph.h"
@@ -66,7 +67,7 @@ static void set_cache_and_start_app(uint32_t drom_addr,
                                    uint32_t irom_addr,
                                    uint32_t irom_load_addr,
                                    uint32_t irom_size,
-                                    uint32_t entry_addr);
+                                    const esp_image_metadata_t *data);

 esp_err_t bootloader_common_read_otadata(const esp_partition_pos_t *ota_info, esp_ota_select_entry_t *two_otadata)
 {
@@ -789,7 +790,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                            rom_addr[1],
                            rom_load_addr[1],
                            rom_size[1],
-                            data->image.entry_addr);
+                            data);
 }

 #else  //!SOC_MMU_DI_VADDR_SHARED
@@ -834,7 +835,7 @@ static void unpack_load_app(const esp_image_metadata_t *data)
                            irom_addr,
                            irom_load_addr,
                            irom_size,
-                            data->image.entry_addr);
+                            data);
 }
 #endif  //#if SOC_MMU_DI_VADDR_SHARED

@@ -859,9 +860,11 @@ static void set_cache_and_start_app(
    uint32_t irom_addr,
    uint32_t irom_load_addr,
    uint32_t irom_size,
-    uint32_t entry_addr)
+    const esp_image_metadata_t *data)
 {
    int rc __attribute__((unused));
+    const uint32_t entry_addr = data->image.entry_addr;
+    const uint32_t mmu_page_size = data->mmu_page_size;

    ESP_EARLY_LOGD(TAG, "configure drom and irom and start");
    //-----------------------Disable Cache to do the mapping---------
@@ -871,12 +874,18 @@ static void set_cache_and_start_app(
 #else
    cache_hal_disable(CACHE_LL_LEVEL_EXT_MEM, CACHE_TYPE_ALL);
 #endif
+
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    // re-configure MMU page size
+    mmu_ll_set_page_size(0, mmu_page_size);
+#endif //SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
    //reset MMU table first
    mmu_hal_unmap_all();

    //-----------------------MAP DROM--------------------------
-    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK;
-    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK;
+    uint32_t drom_load_addr_aligned = drom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t drom_addr_aligned = drom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
    ESP_EARLY_LOGV(TAG, "rodata starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, drom_addr, drom_load_addr, drom_size);
    //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
    drom_size = (drom_load_addr - drom_load_addr_aligned) + drom_size;
@@ -894,13 +903,13 @@ static void set_cache_and_start_app(
        ESP_EARLY_LOGV(TAG, "after mapping rodata, starting from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, drom_load_addr_aligned, actual_mapped_len);
    }
    //we use the MMU_LL_END_DROM_ENTRY_ID mmu entry as a map page for app to find the boot partition
-    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_LL_END_DROM_ENTRY_VADDR, drom_addr_aligned, CONFIG_MMU_PAGE_SIZE, &actual_mapped_len);
+    mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_DROM_END_ENTRY_VADDR_FROM_VAL(mmu_page_size), drom_addr_aligned, mmu_page_size, &actual_mapped_len);
    ESP_EARLY_LOGV(TAG, "mapped one page of the rodata, from paddr=0x%08" PRIx32 " and vaddr=0x%08" PRIx32 ", 0x%" PRIx32 " bytes are mapped", drom_addr_aligned, MMU_LL_END_DROM_ENTRY_VADDR, actual_mapped_len);
 #endif

    //-----------------------MAP IROM--------------------------
-    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK;
-    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK;
+    uint32_t irom_load_addr_aligned = irom_load_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
+    uint32_t irom_addr_aligned = irom_addr & MMU_FLASH_MASK_FROM_VAL(mmu_page_size);
    ESP_EARLY_LOGV(TAG, "text starts from paddr=0x%08" PRIx32 ", vaddr=0x%08" PRIx32 ", size=0x%" PRIx32, irom_addr, irom_load_addr, irom_size);
    //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
    irom_size = (irom_load_addr - irom_load_addr_aligned) + irom_size;
--- a/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
+++ b/components/bootloader_support/src/esp32h2/bootloader_esp32h2.c
@@ -92,6 +92,8 @@ static inline void bootloader_hardware_init(void)

    regi2c_ctrl_ll_master_enable_clock(true);
    regi2c_ctrl_ll_master_configure_clock();
+    REGI2C_WRITE_MASK(I2C_BIAS, I2C_BIAS_DREG_0P8, 8);  // fix low temp issue, need to increase this internal voltage
+
 }

 static inline void bootloader_ana_reset_config(void)
--- a/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/flash_encryption_secure_features.c
@@ -1,15 +1,18 @@
 /*
- * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

+#include <stdint.h>
 #include <strings.h>
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
 #include "esp_efuse_table.h"
 #include "esp_log.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "soc/soc_caps.h"
 #include "sdkconfig.h"

 static __attribute__((unused)) const char *TAG = "flash_encrypt";
@@ -33,6 +36,14 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

    esp_efuse_write_field_bit(ESP_EFUSE_DIS_DIRECT_BOOT);

+#if CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        ESP_LOGI(TAG, "Enable XTS-AES pseudo rounds function...");
+        uint8_t xts_pseudo_level = CONFIG_SECURE_FLASH_PSEUDO_ROUND_FUNC_STRENGTH;
+        esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+    }
+#endif
+
 #if defined(CONFIG_SECURE_BOOT_V2_ENABLED) && !defined(CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS)
    // This bit is set when enabling Secure Boot V2, but we can't enable it until this later point in the first boot
    // otherwise the Flash Encryption key cannot be read protected
--- a/components/bootloader_support/src/esp32h2/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/secure_boot_secure_features.c
@@ -1,10 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 #include <strings.h>
+#include "hal/ecdsa_ll.h"
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+    }
+#endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
    esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -22,6 +22,7 @@
 #include "bootloader_memory_utils.h"
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
+#include "spi_flash_mmap.h"

 #define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

@@ -47,7 +48,12 @@ static const char *TAG = "esp_image";

 #define HASH_LEN ESP_IMAGE_HASH_LEN

-#define SIXTEEN_MB 0x1000000
+#if SOC_SPI_MEM_SUPPORT_CACHE_32BIT_ADDR_MAP
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    UINT32_MAX
+#else
+#define ESP_IMAGE_MAX_FLASH_ADDR_SIZE    0x1000000
+#endif
+
 #define ESP_ROM_CHECKSUM_INITIAL 0xEF

 /* Headroom to ensure between stack SP (at time of checking) and data loaded from flash */
@@ -77,7 +83,7 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
 static esp_err_t verify_image_header(uint32_t src_addr, const esp_image_header_t *image, bool silent);

 /* Verify a segment header */
-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent);
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent);

 /* Log-and-fail macro for use in esp_image_load */
 #define FAIL_LOAD(...) do {                         \
@@ -138,7 +144,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    verify_sha = (part->offset != ESP_BOOTLOADER_OFFSET) && do_verify;
 #endif

-    if (part->size > SIXTEEN_MB) {
+    if (part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        err = ESP_ERR_INVALID_ARG;
        FAIL_LOAD("partition size 0x%"PRIx32" invalid, larger than 16MB", part->size);
    }
@@ -297,7 +303,7 @@ esp_err_t esp_image_verify(esp_image_load_mode_t mode, const esp_partition_pos_t
 esp_err_t esp_image_get_metadata(const esp_partition_pos_t *part, esp_image_metadata_t *metadata)
 {
    esp_err_t err;
-    if (metadata == NULL || part == NULL || part->size > SIXTEEN_MB) {
+    if (metadata == NULL || part == NULL || part->size > ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        return ESP_ERR_INVALID_ARG;
    }

@@ -559,7 +565,7 @@ static esp_err_t process_segment(int index, uint32_t flash_addr, esp_image_segme

    ESP_LOGV(TAG, "segment data length 0x%"PRIx32" data starts 0x%"PRIx32, data_len, data_addr);

-    CHECK_ERR(verify_segment_header(index, header, data_addr, silent));
+    CHECK_ERR(verify_segment_header(index, header, data_addr, metadata, silent));

    if (data_len % 4 != 0) {
        FAIL_LOAD("unaligned segment length 0x%"PRIx32, data_len);
@@ -748,10 +754,10 @@ static esp_err_t process_segment_data(int segment, intptr_t load_addr, uint32_t
    return ESP_OK;
 }

-static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, bool silent)
+static esp_err_t verify_segment_header(int index, const esp_image_segment_header_t *segment, uint32_t segment_data_offs, esp_image_metadata_t *metadata, bool silent)
 {
    if ((segment->data_len & 3) != 0
-            || segment->data_len >= SIXTEEN_MB) {
+            || segment->data_len >= ESP_IMAGE_MAX_FLASH_ADDR_SIZE) {
        if (!silent) {
            ESP_LOGE(TAG, "invalid segment length 0x%"PRIx32, segment->data_len);
        }
@@ -761,13 +767,46 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    uint32_t load_addr = segment->load_addr;
    bool map_segment = should_map(load_addr);

+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    esp_err_t err = ESP_FAIL;
+
+    /* ESP APP descriptor is present in the DROM segment #0 */
+    if (index == 0 && metadata->start_addr != ESP_BOOTLOADER_OFFSET) {
+        uint32_t mmu_page_size = 0, magic_word = 0;
+        const uint32_t mmu_page_size_offset = segment_data_offs + offsetof(esp_app_desc_t, mmu_page_size);
+        CHECK_ERR(bootloader_flash_read(segment_data_offs, &magic_word, sizeof(uint32_t), true));
+        CHECK_ERR(bootloader_flash_read(mmu_page_size_offset, &mmu_page_size, sizeof(uint32_t), true));
+        // Extract only the lowest byte from mmu_page_size (as per image format)
+        mmu_page_size &= 0xFF;
+
+        if (magic_word != ESP_APP_DESC_MAGIC_WORD) {
+            ESP_LOGE(TAG, "Failed to fetch app description header!");
+            return ESP_FAIL;
+        }
+
+        // Convert from log base 2 number to actual size while handling legacy image case (value 0)
+        metadata->mmu_page_size = (mmu_page_size > 0) ? (1UL << mmu_page_size) : SPI_FLASH_MMU_PAGE_SIZE;
+        if (metadata->mmu_page_size != SPI_FLASH_MMU_PAGE_SIZE) {
+            ESP_LOGI(TAG, "MMU page size mismatch, configured: 0x%x, found: 0x%"PRIx32, SPI_FLASH_MMU_PAGE_SIZE, metadata->mmu_page_size);
+        }
+    } else if (index == 0 && metadata->start_addr == ESP_BOOTLOADER_OFFSET) {
+        // Bootloader always uses the default MMU page size
+        metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+    }
+#else // SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
+#endif // !SOC_MMU_PAGE_SIZE_CONFIGURABLE
+
+    const int mmu_page_size = metadata->mmu_page_size;
+    ESP_LOGV(TAG, "MMU page size 0x%x", mmu_page_size);
+
    /* Check that flash cache mapped segment aligns correctly from flash to its mapped address,
-       relative to the 64KB page mapping size.
+       relative to the MMU page mapping size.
    */
    ESP_LOGV(TAG, "segment %d map_segment %d segment_data_offs 0x%"PRIx32" load_addr 0x%"PRIx32,
             index, map_segment, segment_data_offs, load_addr);
    if (map_segment
-            && ((segment_data_offs % SPI_FLASH_MMU_PAGE_SIZE) != (load_addr % SPI_FLASH_MMU_PAGE_SIZE))) {
+            && ((segment_data_offs % mmu_page_size) != (load_addr % mmu_page_size))) {
        if (!silent) {
            ESP_LOGE(TAG, "Segment %d load address 0x%08"PRIx32", doesn't match data 0x%08"PRIx32,
                     index, load_addr, segment_data_offs);
@@ -776,6 +815,10 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    }

    return ESP_OK;
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+err:
+    return err;
+#endif
 }

 static bool should_map(uint32_t load_addr)
--- a/components/bootloader_support/src/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encrypt.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -12,6 +12,9 @@
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"
+#include "hal/spi_flash_encrypted_ll.h"
+#include "hal/spi_flash_encrypt_hal.h"
+#include "soc/soc_caps.h"

 #if CONFIG_IDF_TARGET_ESP32
 #define CRYPT_CNT ESP_EFUSE_FLASH_CRYPT_CNT
@@ -207,6 +210,18 @@ void esp_flash_encryption_set_release_mode(void)
 #endif // CONFIG_SOC_FLASH_ENCRYPTION_XTS_AES_128_DERIVED
 #endif // !CONFIG_IDF_TARGET_ESP32

+#ifdef SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+
+        if (xts_pseudo_level == ESP_XTS_AES_PSEUDO_ROUNDS_DISABLE) {
+            xts_pseudo_level = ESP_XTS_AES_PSEUDO_ROUNDS_LOW;
+            esp_efuse_write_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        }
+    }
+#endif
+
 #ifdef CONFIG_IDF_TARGET_ESP32
    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_DIS_CACHE);
 #else
@@ -468,6 +483,17 @@ bool esp_flash_encryption_cfg_verify_release_mode(void)
    }
    result &= secure;

+#if SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND
+    if (spi_flash_encrypt_ll_is_pseudo_rounds_function_supported()) {
+        uint8_t xts_pseudo_level = 0;
+        esp_efuse_read_field_blob(ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL, &xts_pseudo_level, ESP_EFUSE_XTS_DPA_PSEUDO_LEVEL[0]->bit_count);
+        if (!xts_pseudo_level) {
+            result &= false;
+            ESP_LOGW(TAG, "Not enabled XTS-AES pseudo rounds function (set XTS_DPA_PSEUDO_LEVEL->1 or more)");
+        }
+    }
+#endif
+
    return result;
 }
 #endif // not CONFIG_IDF_TARGET_ESP32
--- a/components/bootloader_support/src/flash_encryption/flash_encrypt.c
+++ b/components/bootloader_support/src/flash_encryption/flash_encrypt.c
@@ -413,6 +413,10 @@ static esp_err_t encrypt_partition(int index, const esp_partition_info_t *partit
        if (should_encrypt) {
            // Encrypt only the app image instead of encrypting the whole partition
            size = image_data.image_len;
+#if CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
+            // If secure update without secure boot, also encrypt the signature block
+            size += esp_secure_boot_sig_block_size();
+#endif
        }
 #endif
    } else if ((partition->type == PART_TYPE_DATA && partition->subtype == PART_SUBTYPE_DATA_OTA)
--- a/components/bootloader_support/src/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot.c
@@ -12,6 +12,10 @@
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"

+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static __attribute__((unused)) const char *TAG = "secure_boot";

@@ -340,6 +344,23 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
 #endif
    }

+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+        if (!secure) {
+            uint8_t current_curve;
+            esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+            if (err == ESP_OK) {
+                if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+                    // If not P256 mode
+                    result &= secure;
+                    ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+                }
+            }
+        }
+    }
+#endif
+
 #ifdef CONFIG_SECURE_BOOT_ENABLE_AGGRESSIVE_KEY_REVOKE
    secure = esp_efuse_read_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
    result &= secure;
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
@@ -154,13 +154,12 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
    ets_secure_boot_key_digests_t trusted_key_digests = {0};
    bool valid_sig_blk = false;
    for (unsigned i = 0; i < SECURE_BOOT_NUM_BLOCKS; i++) {
+        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
        if (sig_block->block[i].version != ESP_SECURE_BOOT_SCHEME) {
            ESP_LOGD(TAG, "%s signing scheme selected but signature block %d generated for %s scheme", esp_secure_boot_get_scheme_name(ESP_SECURE_BOOT_SCHEME), i, esp_secure_boot_get_scheme_name(sig_block->block[i].version));
-            continue;
        } else {
            valid_sig_blk = true;
        }
-        trusted_key_digests.key_digests[i] = &trusted.key_digests[i];
    }
    if (valid_sig_blk != true) {
        ESP_LOGE(TAG, "No signature block generated for valid scheme");
--- a/components/bootloader_support/test_apps/.build-test-rules.yml
+++ b/components/bootloader_support/test_apps/.build-test-rules.yml
@@ -4,7 +4,3 @@ components/bootloader_support/test_apps/rtc_custom_section:
  enable:
    - if: SOC_RTC_MEM_SUPPORTED == 1
      reason: this feature is supported on chips that have RTC memory
-  disable:
-    - if: IDF_TARGET == "esp32c61"
-      temporary: true
-      reason: IDF-9260
--- a/components/bootloader_support/test_apps/bootloader_support/README.md
+++ b/components/bootloader_support/test_apps/bootloader_support/README.md
@@ -1,2 +1,2 @@
-| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C5 | ESP32-C6 | ESP32-C61 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
-| ----------------- | ----- | -------- | -------- | -------- | -------- | --------- | -------- | -------- | -------- | -------- |
+| Supported Targets | ESP32 | ESP32-C2 | ESP32-C3 | ESP32-C6 | ESP32-H2 | ESP32-P4 | ESP32-S2 | ESP32-S3 |
+| ----------------- | ----- | -------- | -------- | -------- | -------- | -------- | -------- | -------- |
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@@ -24,6 +24,7 @@ set(common_include_dirs
    common/btc/profile/esp/blufi/include
    common/btc/profile/esp/include
    common/hci_log/include
+    common/ble_log/include
 )

 set(ble_mesh_include_dirs
@@ -85,8 +86,13 @@ if(CONFIG_BT_ENABLED)
        elseif(CONFIG_IDF_TARGET_ESP32S3)
            list(APPEND ldscripts "linker_rw_bt_controller.lf")
        elseif(CONFIG_IDF_TARGET_ESP32C2)
+            list(APPEND srcs "controller/esp32c2/ble.c")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+                list(APPEND srcs "controller/esp32c2/dummy.c")
+            endif()
            set(ldscripts "linker_esp32c2.lf")
        else()
+            list(APPEND srcs "controller/${target_name}/ble.c")
            list(APPEND ldscripts "linker_esp_ble_controller.lf")
        endif()

@@ -127,8 +133,46 @@ if(CONFIG_BT_ENABLED)
         "common/osi/osi.c"
         "common/osi/semaphore.c"
         "porting/mem/bt_osi_mem.c"
+         "common/ble_log/ble_log_spi_out.c"
+         "common/ble_log/ble_log_uhci_out.c"
         )

+    # BLE Log Module
+    if(CONFIG_BLE_LOG_ENABLED)
+        # Core source files
+        list(APPEND srcs
+             common/ble_log/src/ble_log.c
+             common/ble_log/src/ble_log_lbm.c
+             common/ble_log/src/ble_log_rt.c
+             common/ble_log/src/ble_log_util.c
+        )
+
+        # Includes
+        list(APPEND include_dirs
+             common/ble_log/include
+        )
+
+        # Private includes
+        list(APPEND priv_include_dirs
+             common/ble_log/src/internal_include
+             common/ble_log/src/internal_include/prph
+        )
+
+        # Timestamp synchronization extension
+        if(CONFIG_BLE_LOG_TS_ENABLED)
+            list(APPEND srcs common/ble_log/src/ble_log_ts.c)
+        endif()
+
+        # Peripheral interface implementation
+        if(CONFIG_BLE_LOG_PRPH_DUMMY)
+            list(APPEND srcs common/ble_log/src/prph/ble_log_prph_dummy.c)
+        elseif(CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA)
+            list(APPEND srcs common/ble_log/src/prph/ble_log_prph_spi_master_dma.c)
+        elseif(CONFIG_BLE_LOG_PRPH_UART_DMA)
+            list(APPEND srcs common/ble_log/src/prph/ble_log_prph_uart_dma.c)
+        endif()
+    endif()
+
    # Host Bluedroid
    if(CONFIG_BT_BLUEDROID_ENABLED)

@@ -444,6 +488,19 @@ if(CONFIG_BT_ENABLED)
            list(APPEND srcs "esp_ble_mesh/core/bluedroid_host/adapter.c")
        endif()

+        if(CONFIG_BT_BLE_FEAT_ISO_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_iso.c"
+                            "host/bluedroid/btc/profile/std/iso/btc_iso_ble.c"
+                            "host/bluedroid/api/esp_ble_iso_api.c"
+                            "host/bluedroid/hci/ble_hci_iso.c")
+        endif()
+
+        if(CONFIG_BT_BLE_FEAT_CTE_EN)
+            list(APPEND srcs "host/bluedroid/stack/btm/btm_ble_cte.c"
+                            "host/bluedroid/btc/profile/std/cte/btc_ble_cte.c"
+                            "host/bluedroid/api/esp_ble_cte_api.c")
+        endif()
+
    endif()

    if(CONFIG_BLE_MESH)
@@ -621,23 +678,25 @@ if(CONFIG_BT_ENABLED)

    if(NOT (CONFIG_BT_LE_CRYPTO_STACK_MBEDTLS OR CONFIG_BT_NIMBLE_CRYPTO_STACK_MBEDTLS))
        list(APPEND include_dirs
-                porting/ext/tinycrypt/include
+                common/tinycrypt/include
+                common/tinycrypt/port
            )
-        list(APPEND srcs "porting/ext/tinycrypt/src/utils.c"
-                "porting/ext/tinycrypt/src/sha256.c"
-                "porting/ext/tinycrypt/src/ecc.c"
-                "porting/ext/tinycrypt/src/ctr_prng.c"
-                "porting/ext/tinycrypt/src/ctr_mode.c"
-                "porting/ext/tinycrypt/src/aes_decrypt.c"
-                "porting/ext/tinycrypt/src/aes_encrypt.c"
-                "porting/ext/tinycrypt/src/ccm_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dsa.c"
-                "porting/ext/tinycrypt/src/cmac_mode.c"
-                "porting/ext/tinycrypt/src/ecc_dh.c"
-                "porting/ext/tinycrypt/src/hmac_prng.c"
-                "porting/ext/tinycrypt/src/ecc_platform_specific.c"
-                "porting/ext/tinycrypt/src/hmac.c"
-                "porting/ext/tinycrypt/src/cbc_mode.c")
+        list(APPEND srcs "common/tinycrypt/src/utils.c"
+                "common/tinycrypt/src/sha256.c"
+                "common/tinycrypt/src/ecc.c"
+                "common/tinycrypt/src/ctr_prng.c"
+                "common/tinycrypt/src/ctr_mode.c"
+                "common/tinycrypt/src/aes_decrypt.c"
+                "common/tinycrypt/src/aes_encrypt.c"
+                "common/tinycrypt/src/ccm_mode.c"
+                "common/tinycrypt/src/ecc_dsa.c"
+                "common/tinycrypt/src/cmac_mode.c"
+                "common/tinycrypt/src/ecc_dh.c"
+                "common/tinycrypt/src/hmac_prng.c"
+                "common/tinycrypt/src/ecc_platform_specific.c"
+                "common/tinycrypt/src/hmac.c"
+                "common/tinycrypt/src/cbc_mode.c"
+                "common/tinycrypt/port/esp_tinycrypt_port.c")
    endif()

    if(CONFIG_BT_NIMBLE_ENABLED)
@@ -734,8 +793,16 @@ if(CONFIG_BT_ENABLED)
                    "host/nimble/nimble/nimble/host/store/config/src/ble_store_nvs.c"
                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache.c"
                    "host/nimble/nimble/nimble/host/src/ble_gattc_cache_conn.c"
+                    "host/nimble/nimble/nimble/host/src/ble_eatt.c"
                )

+            if(CONFIG_BT_NIMBLE_ISO)
+                list(APPEND srcs
+                            "host/nimble/nimble/nimble/host/src/ble_hs_iso_hci.c"
+                            "host/nimble/nimble/nimble/host/src/ble_hs_iso.c"
+                )
+            endif()
+
            if(CONFIG_BT_CONTROLLER_DISABLED AND CONFIG_BT_NIMBLE_TRANSPORT_UART)
                list(APPEND srcs
                        "host/nimble/nimble/nimble/transport/uart_ll/src/hci_uart.c"
@@ -848,11 +915,27 @@ if(CONFIG_BT_ENABLED)

 endif()

+
+set(bt_priv_requires
+    nvs_flash
+    soc
+    esp_pm
+    esp_phy
+    esp_coex
+    mbedtls
+    esp_driver_uart
+    vfs
+    esp_ringbuf
+    esp_driver_spi
+    esp_driver_gpio
+    esp_gdbstub
+)
+
 idf_component_register(SRCS "${srcs}"
                       INCLUDE_DIRS "${include_dirs}"
                       PRIV_INCLUDE_DIRS "${priv_include_dirs}"
                       REQUIRES esp_timer esp_wifi
-                       PRIV_REQUIRES nvs_flash soc esp_pm esp_phy esp_coex mbedtls esp_driver_uart vfs esp_ringbuf
+                       PRIV_REQUIRES "${bt_priv_requires}"
                       LDFRAGMENTS "${ldscripts}")

 if(CONFIG_BT_ENABLED)
@@ -865,21 +948,53 @@ if(CONFIG_BT_ENABLED)
    elseif(CONFIG_IDF_TARGET_ESP32C3)
        target_link_directories(${COMPONENT_LIB} INTERFACE
                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32c3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
    elseif(CONFIG_IDF_TARGET_ESP32S3)
        target_link_directories(${COMPONENT_LIB} INTERFACE
                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c3_family/esp32s3")
-        target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY)
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app_flash)
+        else()
+            target_link_libraries(${COMPONENT_LIB} PUBLIC btdm_app)
+        endif()
    elseif(CONFIG_BT_CONTROLLER_ENABLED)
+        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
+        endif()
+        if(DEFINED CONFIG_BLE_LOG_PRPH_UART_DMA_PORT)
+            if(CONFIG_BLE_LOG_PRPH_UART_DMA_PORT EQUAL 0)
+                target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_tx_chars")
+                target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes")
+                target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes_with_break")
+            endif()
+        endif()
+        if(CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_tx_chars")
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes")
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes_with_break")
+        endif()
        if(CONFIG_IDF_TARGET_ESP32C6)
            add_prebuilt_library(libble_app
-                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c6/libble_app.a")
+                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c6/libble_app.a"
+                REQUIRES esp_phy)
        elseif(CONFIG_IDF_TARGET_ESP32C61)
            add_prebuilt_library(libble_app
-                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c61/libble_app.a")
+                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c61/libble_app.a"
+                REQUIRES esp_phy)
        else()
-            add_prebuilt_library(libble_app
-                 "controller/lib_${target_name}/${target_name}-bt-lib/libble_app.a")
+            if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND CONFIG_IDF_TARGET_ESP32C2)
+                add_prebuilt_library(libble_app
+                    "controller/lib_${target_name}/${target_name}-bt-lib/libble_app_flash.a"
+                    REQUIRES esp_phy)
+            else()
+                add_prebuilt_library(libble_app
+                    "controller/lib_${target_name}/${target_name}-bt-lib/libble_app.a"
+                    REQUIRES esp_phy)
+            endif()
        endif()
        target_link_libraries(${COMPONENT_LIB} PRIVATE libble_app)
    endif()
--- a/components/bt/Kconfig
+++ b/components/bt/Kconfig
@@ -81,8 +81,6 @@ menu "Bluetooth"
            So this option will disable the PMP (ESP_SYSTEM_PMP_IDRAM_SPLIT)

    menu "Common Options"
-        visible if (BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED)
-
        source "$IDF_PATH/components/bt/common/Kconfig.in"
    endmenu

--- a/components/bt/common/Kconfig.in
+++ b/components/bt/common/Kconfig.in
@@ -1,6 +1,257 @@
 config BT_ALARM_MAX_NUM
    int "Maximum number of Bluetooth alarms"
    default 50
+    depends on (BT_BLUEDROID_ENABLED || BT_NIMBLE_ENABLED)
    help
        This option decides the maximum number of alarms which
        could be used by Bluetooth host.
+
+menu "BLE Log"
+    source "$IDF_PATH/components/bt/common/ble_log/Kconfig.in"
+endmenu
+
+config BT_BLE_LOG_SPI_OUT_ENABLED
+    bool "Output ble logs to SPI bus (Experimental)"
+    default n
+    help
+        Output ble logs to SPI bus
+
+config BT_BLE_LOG_SPI_OUT_UL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for upper layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    bool "Enable HCI log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.
+
+config BT_BLE_LOG_SPI_OUT_HCI_BUF_SIZE
+    int "SPI transaction buffer size for HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for HCI logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_TASK_CNT
+    int "HCI task count"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1
+    help
+        HCI task count
+
+config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    bool "Enable Host log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
+        When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.
+
+config BT_BLE_LOG_SPI_OUT_HOST_BUF_SIZE
+    int "SPI transaction buffer size for host logs"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for host logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HOST_TASK_CNT
+    int "Host task count"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 2
+    help
+        Host task count.
+
+config BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    bool "Enable Controller log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    depends on BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable controller log output to SPI bus.
+
+config BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE
+    int "SPI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for lower layer task logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
+    int "SPI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for lower layer ISR logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LL_HCI_BUF_SIZE
+    int "SPI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer HCI logs.
+        There will be 2 SPI DMA buffers with the same size
+
+config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
+    int "GPIO number of SPI MOSI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 0
+    help
+        GPIO number of SPI MOSI
+
+config BT_BLE_LOG_SPI_OUT_SCLK_IO_NUM
+    int "GPIO number of SPI SCLK"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 1
+    help
+        GPIO number of SPI SCLK
+
+config BT_BLE_LOG_SPI_OUT_CS_IO_NUM
+    int "GPIO number of SPI CS"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default 2
+    help
+        GPIO number of SPI CS
+
+config BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    bool "Enable ble log & logic analyzer log time sync"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default y
+    help
+        Enable ble log & logic analyzer log time sync
+
+config BT_BLE_LOG_SPI_OUT_SYNC_IO_NUM
+    int "GPIO number of SYNC IO"
+    depends on BT_BLE_LOG_SPI_OUT_TS_SYNC_ENABLED
+    default 3
+    help
+        GPIO number of SYNC IO
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    bool "Enable periodic buffer flush out"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable periodic buffer flush out
+        Not recommended when SPI receiver is unavailable
+
+config BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT
+    int "Buffer flush out period in unit of ms"
+    depends on BT_BLE_LOG_SPI_OUT_FLUSH_TIMER_ENABLED
+    default 1000
+    help
+        Buffer flush out period in unit of ms
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    bool "Enable LE Audio log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable LE Audio log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_BUF_SIZE
+    int "SPI transaction buffer size for LE Audio logs"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for LE Audio logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_TASK_CNT
+    int "LE audio task count"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1
+    help
+        LE audio task count
+
+config BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    bool "Enable BLE mesh log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable BLE mesh log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_MESH_BUF_SIZE
+    int "SPI transaction buffer size for BLE mesh logs"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for BLE mesh logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MESH_TASK_CNT
+    int "Mesh task count"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 3
+    help
+        Mesh task count
+
+config BT_BLE_LOG_UHCI_OUT_ENABLED
+    bool "Output ble logs via UHCI (UART DMA) driver (Experimental)"
+    default n
+    help
+        Output ble logs via UHCI (UART DMA) driver
+        On enable, BT_BLE_LOG_UHCI_OUT_UART_PORT would be reinited with
+        BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE as new baud rate and
+        BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX as new UART Tx IO
+
+config BT_BLE_LOG_UHCI_OUT_UART_PORT
+    int "UART port connected to UHCI controller"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 0
+    help
+        UART port connected to UHCI controller
+        If UART port 0 is selected, UART VFS Driver, UART ROM Driver
+        and UART Driver output would be redirected to BLE Log UHCI Out
+        to solve UART Tx FIFO multi-task access issue
+
+config BT_BLE_LOG_UHCI_OUT_LL_TASK_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer task logs
+
+config BT_BLE_LOG_UHCI_OUT_LL_ISR_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer ISR logs
+
+config BT_BLE_LOG_UHCI_OUT_LL_HCI_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer HCI logs
+
+config BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    bool "Enable to init UART port"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default y
+    help
+        Enable to init UART port
+
+config BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE
+    int "Baud rate for BT_BLE_LOG_UHCI_OUT_UART_PORT"
+    depends on BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    default 3000000
+    help
+        Baud rate for BT_BLE_LOG_UHCI_OUT_UART_PORT
+
+config BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX
+    int "IO number for UART TX port"
+    depends on BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    default 0
+    help
+        IO number for UART TX port
--- a/components/bt/common/ble_log/Kconfig.in
+++ b/components/bt/common/ble_log/Kconfig.in
@@ -0,0 +1,169 @@
+config BLE_LOG_ENABLED
+    bool "Enable BLE Log Module (Experimental)"
+    default n
+    help
+        Enable BLE Log Module
+
+if BLE_LOG_ENABLED
+    config BLE_LOG_LBM_TRANS_SIZE
+        int "Buffer size for each peripheral transport"
+        default 512
+        help
+            There're 2 log buffer managers (LBMs) with compare-and-swap
+            (CAS) protection, 1 LBM with FreeRTOS mutex protection, 1 LBM
+            without protection for critical section. Each LBM is managing
+            2 ping-pong buffers, which means there will be 4 * 2 *
+            BLE_LOG_LBM_TRANS_SIZE bytes buffer allocated
+
+    config BLE_LOG_LBM_ATOMIC_LOCK_TASK_CNT
+        int "Count of log buffer managers with atomic lock protection for task context"
+        default 2
+        help
+            BLE Log module will search for an LBM with atomic lock protection first; if
+            all LBMs with atomic lock protection are unavailable, BLE Log module will
+            try to use the LBM with spin lock protection. So the more LBMs with atomic
+            lock protection are created, the better the logging performance will be.
+
+    config BLE_LOG_LBM_ATOMIC_LOCK_ISR_CNT
+        int "Count of log buffer managers with atomic lock protection for ISR context"
+        default 1
+        help
+            BLE Log module will search for an LBM with atomic lock protection first; if
+            all LBMs with atomic lock protection are unavailable, BLE Log module will
+            try to use the LBM with spin lock protection. So the more LBMs with atomic
+            lock protection are created, the more ISRs can nest.
+
+    config BLE_LOG_IS_ESP_CONTROLLER
+        bool "Current BLE Controller is ESP BLE Controller"
+        depends on BT_CONTROLLER_ENABLED
+        depends on SOC_ESP_NIMBLE_CONTROLLER
+        default y
+        select BT_LE_CONTROLLER_LOG_ENABLED
+        select BT_LE_CONTROLLER_LOG_MODE_BLE_LOG_V2
+        select BLE_LOG_LL_ENABLED
+        help
+            Current BLE Controller is ESP BLE Controller
+
+    config BLE_LOG_IS_ESP_LEGACY_CONTROLLER
+        bool "Current BLE Controller is ESP BLE Legacy Controller"
+        depends on BT_CONTROLLER_ENABLED
+        depends on !SOC_ESP_NIMBLE_CONTROLLER
+        depends on BT_CTRL_RUN_IN_FLASH_ONLY
+        default y
+        select BT_CTRL_LE_LOG_EN
+        select BLE_LOG_LL_ENABLED
+        help
+            Current BLE Controller is ESP BLE Legacy Controller
+
+    config BLE_LOG_LL_ENABLED
+        bool "Enable BLE Log for Link Layer"
+        depends on BT_CONTROLLER_ENABLED
+        default n
+        help
+            Enable BLE Log for Link Layer
+
+    config BLE_LOG_LBM_LL_TRANS_SIZE
+        int "Buffer size for each peripheral transport of Link Layer LBM"
+        depends on BLE_LOG_LL_ENABLED
+        default 1024
+        help
+            There're 2 Link Layer dedicated log buffer managers (LBMs) with
+            compare-and-swap (CAS) protection. Each LBM is managing 2 ping-
+            pong buffers, which means there will be additional 2 * 2 *
+            BLE_LOG_LBM_LL_TRANS_SIZE bytes buffer allocated
+
+    config BLE_LOG_PAYLOAD_CHECKSUM_ENABLED
+        bool "Enable payload checksum for BLE Log data integrity check"
+        default y
+        help
+            Checksum is the default method for BLE Log data integrity check,
+            but for targets with slow CPU speed, it may cause significant system
+            performance decrease; a compromise could be made to balance the
+            realtime performance and log data integrity, which is calculating the
+            checksum of frame head and payload all together by default, or only
+            calculate the checksum of frame head to minimize performance decrease
+
+    config BLE_LOG_ENH_STAT_ENABLED
+        bool "Enable enhanced statistics for BLE Log"
+        default n
+        help
+            Enable enhanced statistics for written/lost frame/bytes count, which may
+            cost additional ~100kB memory
+
+    config BLE_LOG_TS_ENABLED
+        bool "Enable BLE Log Timestamp Synchronization (TS)"
+        default n
+        help
+            Enable BLE Log TS with external logging module
+
+    config BLE_LOG_SYNC_IO_NUM
+        int "GPIO number for Timestamp Synchronization (TS) toggle output"
+        depends on BLE_LOG_TS_ENABLED
+        default 0
+        help
+            GPIO number for TS toggle output
+
+    choice BLE_LOG_PRPH_CHOICE
+        prompt "BLE Log peripheral choice"
+        default BLE_LOG_PRPH_DUMMY
+        help
+            Choose BLE Log peripheral
+
+        config BLE_LOG_PRPH_DUMMY
+            bool "Dummy transport"
+            help
+                Dummy transport (dump only)
+
+        config BLE_LOG_PRPH_SPI_MASTER_DMA
+            bool "Utilize SPI master DMA driver as transport"
+            depends on SOC_GPSPI_SUPPORTED
+            help
+                Utilize SPI master DMA driver as transport
+
+        config BLE_LOG_PRPH_UART_DMA
+            bool "Utilize UART DMA driver as transport"
+            depends on SOC_UHCI_SUPPORTED
+            help
+                Utilize UART DMA driver as transport
+    endchoice
+
+    if BLE_LOG_PRPH_SPI_MASTER_DMA
+        config BLE_LOG_PRPH_SPI_MASTER_DMA_MOSI_IO_NUM
+            int "GPIO number of MOSI port for SPI master DMA transport"
+            default 0
+            help
+                GPIO number of MOSI port for SPI master DMA transport
+
+        config BLE_LOG_PRPH_SPI_MASTER_DMA_SCLK_IO_NUM
+            int "GPIO number of SCLK port for SPI master DMA transport"
+            default 0
+            help
+                GPIO number of SCLK port for SPI master DMA transport
+
+        config BLE_LOG_PRPH_SPI_MASTER_DMA_CS_IO_NUM
+            int "GPIO number of CS port for SPI master DMA transport"
+            default 0
+            help
+                GPIO number of CS port for SPI master DMA transport
+    endif
+
+    if BLE_LOG_PRPH_UART_DMA
+        config BLE_LOG_PRPH_UART_DMA_PORT
+            int "UART port number for UART DMA transport"
+            default 0
+            help
+                UART port number for UART DMA
+
+        config BLE_LOG_PRPH_UART_DMA_BAUD_RATE
+            int "Baud rate of UART port for UART DMA transport"
+            default 921600
+            help
+                Determine the baud rate of UART port
+
+        config BLE_LOG_PRPH_UART_DMA_TX_IO_NUM
+            int "GPIO number for UART TX"
+            default 0
+            help
+                GPIO number for UART TX
+    endif
+endif
--- a/components/bt/common/ble_log/README.md
+++ b/components/bt/common/ble_log/README.md
@@ -0,0 +1,450 @@
+# BLE Log Module
+
+A high-performance, modular Bluetooth logging system that provides real-time log capture and transmission capabilities for the ESP-IDF Bluetooth stack.
+
+## Table of Contents
+
+- [Overview](#overview)
+- [Architecture Design](#architecture-design)
+- [Features](#features)
+- [Quick Start](#quick-start)
+- [Configuration Options](#configuration-options)
+- [API Reference](#api-reference)
+- [Usage Examples](#usage-examples)
+- [Performance & Memory Optimization](#performance--memory-optimization)
+- [Troubleshooting](#troubleshooting)
+- [Important Notes](#important-notes)
+
+## Overview
+
+The BLE Log module is an efficient logging system specifically designed for the ESP-IDF Bluetooth stack, supporting real-time log capture, multi-source log collection, and various transmission methods. This module has been refactored with a modular design, featuring high-concurrency processing capabilities and low-latency characteristics.
+
+### Main Components
+
+- **BLE Log Core** (`ble_log.c`): Module core responsible for initialization and coordination of sub-modules
+- **Runtime Manager** (`ble_log_rt.c`): Runtime task management for log transmission scheduling
+- **Log Buffer Manager** (`ble_log_lbm.c`): Log buffer management supporting multiple locking mechanisms
+- **Peripheral Interface** (`ble_log_prph_*.c`): Peripheral interface abstraction layer supporting various transmission methods
+- **Timestamp Sync** (`ble_log_ts.c`): Timestamp synchronization module
+- **Utility** (`ble_log_util.c`): Common utility functions
+
+## Features
+
+### Core Functionality
+
+- **Multi-source Log Collection**: Supports multiple log sources including Link Layer, Host, HCI, etc.
+- **High Concurrency Processing**: Uses atomic and spin lock mechanisms for multi-task concurrent writing
+- **Real-time Transmission**: Asynchronous transmission mechanism based on FreeRTOS tasks
+- **Data Integrity**: Configurable checksum mechanism ensures data integrity
+- **Memory Optimization**: Ping-pong buffer design minimizes memory usage
+
+### Advanced Features
+
+- **Timestamp Synchronization**: Supports timestamp synchronization with external devices (optional)
+- **Enhanced Statistics**: Detailed logging statistics including loss rate analysis (optional)
+- **Link Layer Integration**: Deep integration with ESP-IDF Bluetooth Link Layer
+- **Multiple Transmission Methods**: Supports SPI DMA, UART DMA, and Dummy transmission
+
+### Performance Features
+
+- **IRAM Optimization**: Critical path code runs in IRAM ensuring low latency
+- **Lock-free Design**: Most operations use atomic operations reducing lock contention
+- **Buffer Reuse**: Intelligent buffer management reduces memory allocation overhead
+
+## Quick Start
+
+### 1. Enable Module
+
+Enable the BLE Log module in `menuconfig`:
+
+```
+Component config → Bluetooth → Enable BLE Log Module (Experimental)
+```
+
+### 2. Basic Configuration
+
+```c
+#include "ble_log.h"
+
+void app_main() {
+    // Initialize BLE Log module
+    if (!ble_log_init()) {
+        ESP_LOGE(TAG, "Failed to initialize BLE Log");
+        return;
+    }
+    
+    // Write log data
+    uint8_t data[] = {0x01, 0x02, 0x03, 0x04};
+    ble_log_write_hex(BLE_LOG_SRC_CUSTOM, data, sizeof(data));
+    
+    // Force flush buffers
+    ble_log_flush();
+    
+    // Cleanup resources
+    ble_log_deinit();
+}
+```
+
+### 3. Link Layer Integration
+
+When `CONFIG_BLE_LOG_LL_ENABLED` is enabled, Link Layer logs are automatically integrated:
+
+```c
+// Link Layer logs will automatically call this function
+void ble_log_write_hex_ll(uint32_t len, const uint8_t *addr,
+                          uint32_t len_append, const uint8_t *addr_append, 
+                          uint32_t flag);
+```
+
+## Configuration Options
+
+### Basic Configuration
+
+| Configuration | Default | Description |
+|---------------|---------|-------------|
+| `CONFIG_BLE_LOG_ENABLED` | n | Enable BLE Log module |
+| `CONFIG_BLE_LOG_LBM_TRANS_SIZE` | 512 | Size of each transport buffer |
+| `CONFIG_BLE_LOG_LBM_ATOMIC_LOCK_TASK_CNT` | 2 | Number of atomic lock LBMs for task context |
+| `CONFIG_BLE_LOG_LBM_ATOMIC_LOCK_ISR_CNT` | 1 | Number of atomic lock LBMs for ISR context |
+
+### Link Layer Configuration
+
+| Configuration | Default | Description |
+|---------------|---------|-------------|
+| `CONFIG_BLE_LOG_LL_ENABLED` | y | Enable Link Layer logging |
+| `CONFIG_BLE_LOG_LBM_LL_TRANS_SIZE` | 1024 | Link Layer transport buffer size |
+
+### Advanced Features
+
+| Configuration | Default | Description |
+|---------------|---------|-------------|
+| `CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED` | y | Enable payload checksum |
+| `CONFIG_BLE_LOG_ENH_STAT_ENABLED` | n | Enable enhanced statistics |
+| `CONFIG_BLE_LOG_TS_ENABLED` | n | Enable timestamp synchronization |
+
+### Transport Method Configuration
+
+| Transport | Configuration | Description |
+|-----------|---------------|-------------|
+| Dummy | `CONFIG_BLE_LOG_PRPH_DUMMY` | Debug dummy transport |
+| SPI Master DMA | `CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA` | SPI DMA transport |
+| UART DMA | `CONFIG_BLE_LOG_PRPH_UART_DMA` | UART DMA transport |
+
+## API Reference
+
+### Core API
+
+#### `bool ble_log_init(void)`
+
+Initialize the BLE Log module.
+
+**Return Value**: 
+- `true`: Initialization successful
+- `false`: Initialization failed
+
+**Note**: Must be called before using any other APIs.
+
+#### `void ble_log_deinit(void)`
+
+Cleanup the BLE Log module and release all resources.
+
+**Note**: 
+- All pending logs will be lost after calling this function
+- Peripheral interface will be cleaned up first to avoid DMA transmission issues during memory release
+
+#### `bool ble_log_write_hex(ble_log_src_t src_code, const uint8_t *addr, size_t len)`
+
+Write hexadecimal log data.
+
+**Parameters**:
+- `src_code`: Log source code
+- `addr`: Data pointer
+- `len`: Data length
+
+**Return Value**:
+- `true`: Write successful
+- `false`: Write failed (module not initialized or insufficient buffer)
+
+#### `void ble_log_flush(void)`
+
+Force flush all buffers and send pending logs immediately.
+
+**Note**: This operation is blocking and will pause module operation until all buffers are cleared.
+
+#### `void ble_log_dump_to_console(void)`
+
+Output all buffer contents to console in hexadecimal format for debugging.
+
+### Log Source Types
+
+```c
+typedef enum {
+    BLE_LOG_SRC_INTERNAL = 0,    // Internal system logs
+    BLE_LOG_SRC_CUSTOM,          // User-defined logs
+    BLE_LOG_SRC_LL_TASK,         // Link Layer task logs
+    BLE_LOG_SRC_LL_HCI,          // Link Layer HCI logs
+    BLE_LOG_SRC_LL_ISR,          // Link Layer interrupt logs
+    BLE_LOG_SRC_HOST,            // Host layer logs
+    BLE_LOG_SRC_HCI,             // HCI layer logs
+    BLE_LOG_SRC_ENCODE,          // Encoding layer logs
+    BLE_LOG_SRC_MAX,
+} ble_log_src_t;
+```
+
+### Link Layer API (Conditional Compilation)
+
+#### `void ble_log_write_hex_ll(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)`
+
+Link Layer dedicated log writing interface.
+
+**Parameters**:
+- `len`: Main data length
+- `addr`: Main data pointer
+- `len_append`: Append data length  
+- `addr_append`: Append data pointer
+- `flag`: Log flag bits
+
+**Flag Definitions**:
+```c
+enum {
+    BLE_LOG_LL_FLAG_CONTINUE = 0,
+    BLE_LOG_LL_FLAG_END,
+    BLE_LOG_LL_FLAG_TASK,
+    BLE_LOG_LL_FLAG_ISR,
+    BLE_LOG_LL_FLAG_HCI,
+    BLE_LOG_LL_FLAG_RAW,
+    BLE_LOG_LL_FLAG_HCI_UPSTREAM,
+};
+```
+
+### Timestamp Synchronization API (Conditional Compilation)
+
+#### `bool ble_log_sync_enable(bool enable)`
+
+Enable or disable timestamp synchronization functionality.
+
+**Parameters**:
+- `enable`: true to enable, false to disable
+
+**Return Value**:
+- `true`: Operation successful
+- `false`: Operation failed (module not initialized)
+
+## Usage Examples
+
+### Example 1: Basic Logging
+
+```c
+#include "ble_log.h"
+
+void example_basic_logging() {
+    // Initialize
+    if (!ble_log_init()) {
+        printf("BLE Log init failed\n");
+        return;
+    }
+    
+    // Log some example data
+    uint8_t hci_cmd[] = {0x01, 0x03, 0x0C, 0x00};  // HCI Reset Command
+    ble_log_write_hex(BLE_LOG_SRC_HCI, hci_cmd, sizeof(hci_cmd));
+    
+    uint8_t host_data[] = {0x02, 0x00, 0x20, 0x0B, 0x00, 0x07, 0x00, 0x04, 0x00, 0x10, 0x01, 0x00, 0xFF, 0xFF, 0x00, 0x28};
+    ble_log_write_hex(BLE_LOG_SRC_HOST, host_data, sizeof(host_data));
+    
+    // Force send
+    ble_log_flush();
+    
+    // Cleanup
+    ble_log_deinit();
+}
+```
+
+### Example 2: ISR Context Logging
+
+```c
+void IRAM_ATTR some_isr_handler() {
+    uint8_t isr_data[] = {0xDE, 0xAD, 0xBE, 0xEF};
+    
+    // Safe to write logs in ISR context
+    ble_log_write_hex(BLE_LOG_SRC_LL_ISR, isr_data, sizeof(isr_data));
+}
+```
+
+### Example 3: Logging with Timestamp Synchronization
+
+```c
+void example_with_timestamp_sync() {
+    if (!ble_log_init()) {
+        return;
+    }
+    
+    #if CONFIG_BLE_LOG_TS_ENABLED
+    // Enable timestamp synchronization
+    ble_log_sync_enable(true);
+    #endif
+    
+    // Log data...
+    uint8_t data[] = {0x01, 0x02, 0x03};
+    ble_log_write_hex(BLE_LOG_SRC_CUSTOM, data, sizeof(data));
+    
+    // Timestamp information will be automatically included in logs
+    
+    ble_log_deinit();
+}
+```
+
+### Example 4: Performance Testing
+
+```c
+void example_performance_test() {
+    if (!ble_log_init()) {
+        return;
+    }
+    
+    uint8_t test_data[100];
+    for (int i = 0; i < 100; i++) {
+        test_data[i] = i;
+    }
+    
+    uint32_t start_time = esp_timer_get_time();
+    
+    // Send 1000 logs
+    for (int i = 0; i < 1000; i++) {
+        ble_log_write_hex(BLE_LOG_SRC_CUSTOM, test_data, sizeof(test_data));
+    }
+    
+    ble_log_flush();
+    uint32_t end_time = esp_timer_get_time();
+    
+    printf("Time to write 1000 logs: %lu us\n", end_time - start_time);
+    
+    ble_log_deinit();
+}
+```
+
+## Performance & Memory Optimization
+
+### Memory Usage Estimation
+
+Memory usage under default configuration:
+
+```
+Total Buffers = (Atomic Task LBMs + Atomic ISR LBMs + Spin LBMs) × 2 × Transport Buffer Size
+Default Config = (2 + 1 + 2) × 2 × 512 = 5120 bytes
+
+Additional when Link Layer enabled:
+LL Buffers = 2 × 2 × 1024 = 4096 bytes
+
+Additional when Enhanced Statistics enabled:
+Statistics Data = Log Source Count × sizeof(ble_log_stat_mgr_t) = 8 × 40 = 320 bytes
+```
+
+### Performance Optimization Recommendations
+
+1. **Adjust LBM Count**: Adjust atomic lock LBM count based on concurrency requirements
+2. **Buffer Size**: Adjust transport buffer size based on log volume
+3. **Transport Method**: Choose optimal transport method based on hardware (SPI DMA typically has best performance)
+4. **Checksum**: Consider disabling payload checksum when performance requirements are extremely high
+
+### Real-time Considerations
+
+- Critical code paths are marked with `BLE_LOG_IRAM_ATTR` and run in IRAM
+- Atomic operations avoid lock contention
+- Ping-pong buffers ensure continuous writing
+
+## Troubleshooting
+
+### Common Issues
+
+#### 1. Initialization Failure
+
+**Symptoms**: `ble_log_init()` returns `false`
+
+**Possible Causes**:
+- Insufficient memory
+- Peripheral configuration error
+- Duplicate initialization
+
+**Solutions**:
+```c
+// Check available memory
+printf("Free heap: %d bytes\n", esp_get_free_heap_size());
+
+// Ensure initialization only happens once
+static bool initialized = false;
+if (!initialized) {
+    initialized = ble_log_init();
+}
+```
+
+#### 2. Log Loss
+
+**Symptoms**: Some logs don't appear in output
+
+**Possible Causes**:
+- Buffer overflow
+- Transmission speed can't keep up with write speed
+- Module not properly initialized
+
+**Solutions**:
+```c
+// Enable enhanced statistics to check loss rate
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+// Statistics will be automatically included in logs
+#endif
+
+// Adjust buffer size
+// CONFIG_BLE_LOG_LBM_TRANS_SIZE=1024
+
+// Increase atomic lock LBM count
+// CONFIG_BLE_LOG_LBM_ATOMIC_LOCK_TASK_CNT=4
+```
+
+#### 3. Performance Issues
+
+**Symptoms**: System response becomes slow
+
+**Possible Causes**:
+- Checksum calculation overhead
+- Transmission bottleneck
+- Lock contention
+
+**Solutions**:
+```c
+// Disable payload checksum
+// CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED=n
+
+// Use faster transmission method
+// CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA=y
+
+// Adjust task priority
+#define BLE_LOG_TASK_PRIO configMAX_PRIORITIES-3
+```
+
+### Debugging Techniques
+
+#### 1. Use Dummy Transport for Debugging
+
+```c
+// Select Dummy transport in menuconfig
+// Then use dump function to view buffer contents
+ble_log_dump_to_console();
+```
+
+#### 2. Enable Enhanced Statistics
+
+```c
+// Enable in menuconfig
+// CONFIG_BLE_LOG_ENH_STAT_ENABLED=y
+// Statistics will be automatically output to logs
+```
+
+#### 3. Monitor Memory Usage
+
+```c
+void monitor_memory() {
+    printf("Free heap before init: %d\n", esp_get_free_heap_size());
+    ble_log_init();
+    printf("Free heap after init: %d\n", esp_get_free_heap_size());
+}
+```
--- a/components/bt/common/ble_log/ble_log_spi_out.c
+++ b/components/bt/common/ble_log/ble_log_spi_out.c
--- a/components/bt/common/ble_log/ble_log_uhci_out.c
+++ b/components/bt/common/ble_log/ble_log_uhci_out.c
@@ -0,0 +1,780 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_uhci_out.h"
+
+
+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
+// Private includes
+#include "esp_bt.h"
+
+// sdkconfig defines
+#define UHCI_OUT_LL_TASK_BUF_SIZE               CONFIG_BT_BLE_LOG_UHCI_OUT_LL_TASK_BUF_SIZE
+#define UHCI_OUT_LL_ISR_BUF_SIZE                CONFIG_BT_BLE_LOG_UHCI_OUT_LL_ISR_BUF_SIZE
+#define UHCI_OUT_LL_HCI_BUF_SIZE                CONFIG_BT_BLE_LOG_UHCI_OUT_LL_HCI_BUF_SIZE
+#define UHCI_OUT_UART_PORT                      CONFIG_BT_BLE_LOG_UHCI_OUT_UART_PORT
+#define UHCI_OUT_UART_NEED_INIT                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+
+#if UHCI_OUT_UART_NEED_INIT
+#define UHCI_OUT_UART_BAUD_RATE                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE
+#define UHCI_OUT_UART_IO_NUM_TX                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX
+#endif // UHCI_OUT_UART_NEED_INIT
+
+// Private defines
+#define UHCI_OUT_MAX_TRANSFER_SIZE              (10240)
+#define UHCI_OUT_MALLOC(size)                   heap_caps_malloc(size, MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT)
+#define UHCI_OUT_FLUSH_TIMEOUT_MS               (100)
+#define UHCI_OUT_FLUSH_TIMEOUT_US               (UHCI_OUT_FLUSH_TIMEOUT_MS * 1000)
+#define UHCI_OUT_USER_BUF_SIZE                  (512)
+#define UHCI_OUT_UART_PORT0                     (0)
+#define UHCI_OUT_UART_PORT1                     (1)
+#define UHCI_OUT_UART_DRIVER_RX_BUF_SIZE        (32)
+
+// Queue size defines
+#define UHCI_OUT_PING_PONG_BUF_CNT              (2)
+#define UHCI_OUT_USER_QUEUE_SIZE                (UHCI_OUT_PING_PONG_BUF_CNT)
+#define UHCI_OUT_LL_QUEUE_SIZE                  (3 * UHCI_OUT_PING_PONG_BUF_CNT)
+#define UHCI_OUT_QUEUE_SIZE                     (UHCI_OUT_USER_QUEUE_SIZE + UHCI_OUT_LL_QUEUE_SIZE)
+
+// Private typedefs
+typedef struct {
+    // This flag is for multithreading, must be a word, do not modify
+    volatile uint32_t flag;
+    uint16_t buf_size;
+    uint16_t length;
+    uint8_t buffer[0];
+} uhci_out_trans_cb_t;
+
+typedef struct {
+    uhci_out_trans_cb_t *trans_cb[2];
+    uint8_t trans_cb_idx;
+    uint8_t type;
+    uint16_t lost_frame_cnt;
+    uint32_t lost_bytes_cnt;
+    uint32_t frame_sn;
+} uhci_out_log_cb_t;
+
+typedef struct {
+    uint16_t length;
+    uint8_t source;
+    uint8_t type;
+    uint16_t frame_sn;
+} __attribute__((packed)) frame_head_t;
+
+typedef struct {
+    uint8_t type;
+    uint16_t lost_frame_cnt;
+    uint32_t lost_bytes_cnt;
+} __attribute__((packed)) loss_payload_t;
+
+// Private enums
+enum {
+    TRANS_CB_FLAG_AVAILABLE = 0,
+    TRANS_CB_FLAG_NEED_QUEUE,
+    TRANS_CB_FLAG_IN_QUEUE,
+};
+
+enum {
+    LOG_CB_TYPE_USER = 0,
+    LOG_CB_TYPE_LL,
+};
+
+enum {
+    LOG_CB_LL_SUBTYPE_TASK = 0,
+    LOG_CB_LL_SUBTYPE_ISR,
+    LOG_CB_LL_SUBTYPE_HCI
+};
+
+enum {
+    LL_LOG_FLAG_CONTINUE = 0,
+    LL_LOG_FLAG_END,
+    LL_LOG_FLAG_TASK,
+    LL_LOG_FLAG_ISR,
+    LL_LOG_FLAG_HCI,
+    LL_LOG_FLAG_RAW,
+    LL_LOG_FLAG_SYNC
+};
+
+enum {
+    LL_EV_FLAG_ISR_APPEND = 0,
+    LL_EV_FLAG_FLUSH_LOG,
+};
+
+// Private variables
+static bool uhci_out_inited = false;
+static uhci_controller_handle_t uhci_handle = NULL;
+
+static bool user_log_inited = false;
+static SemaphoreHandle_t user_log_mutex = NULL;
+static uhci_out_log_cb_t *user_log_cb = NULL;
+static uint32_t user_last_write_ts = 0;
+
+static bool ll_log_inited = false;
+static uhci_out_log_cb_t *ll_task_log_cb = NULL;
+static uhci_out_log_cb_t *ll_isr_log_cb = NULL;
+static uhci_out_log_cb_t *ll_hci_log_cb = NULL;
+static uint32_t ll_ev_flags = 0;
+static uint32_t ll_last_write_ts = 0;
+
+static esp_timer_handle_t flush_timer = NULL;
+
+// Private function declarations
+extern void esp_panic_handler_feed_wdts(void);
+
+static int uhci_out_init_trans(uhci_out_trans_cb_t **trans_cb, uint16_t buf_size);
+static void uhci_out_deinit_trans(uhci_out_trans_cb_t **trans_cb);
+static bool uhci_out_tx_done_cb(uhci_controller_handle_t uhci_ctrl,
+                                const uhci_tx_done_event_data_t *edata, void *user_ctx);
+static inline void uhci_out_append_trans(uhci_out_trans_cb_t *trans_cb);
+
+static int uhci_out_log_cb_init(uhci_out_log_cb_t **log_cb, uint16_t buf_size, uint8_t type, uint8_t idx);
+static void uhci_out_log_cb_deinit(uhci_out_log_cb_t **log_cb);
+static inline bool uhci_out_log_cb_check_trans(uhci_out_log_cb_t *log_cb, uint16_t len, bool *need_append);
+static inline void uhci_out_log_cb_append_trans(uhci_out_log_cb_t *log_cb);
+static inline void uhci_out_log_cb_flush_trans(uhci_out_log_cb_t *log_cb);
+static bool uhci_out_log_cb_write(uhci_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len,
+                                 const uint8_t *addr_append, uint16_t len_append, uint8_t source);
+static void uhci_out_log_cb_write_loss(uhci_out_log_cb_t *log_cb);
+static void uhci_out_log_cb_dump(uhci_out_log_cb_t *log_cb);
+
+static void esp_timer_cb_log_flush(void);
+static void uhci_out_user_write_str(const uint8_t *src, uint16_t len);
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+static void uhci_out_user_write_char(char c);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+static int uhci_out_user_log_init(void);
+static void uhci_out_user_log_deinit(void);
+
+static int uhci_out_ll_log_init(void);
+static void uhci_out_ll_log_deinit(void);
+static void uhci_out_ll_log_flush(void);
+
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6) || defined(CONFIG_IDF_TARGET_ESP32C5) ||\
+    defined(CONFIG_IDF_TARGET_ESP32C61) || defined(CONFIG_IDF_TARGET_ESP32H21)
+extern void r_ble_log_simple_put_ev(void);
+#define UHCI_OUT_LL_PUT_EV r_ble_log_simple_put_ev()
+#elif defined(CONFIG_IDF_TARGET_ESP32C2)
+extern void ble_log_simple_put_ev(void);
+#define UHCI_OUT_LL_PUT_EV ble_log_simple_put_ev()
+#else
+#define UHCI_OUT_LL_PUT_EV
+#endif
+
+// Private macros
+#define UHCI_OUT_FRAME_HEAD_LEN     (sizeof(frame_head_t))
+#define UHCI_OUT_FRAME_TAIL_LEN     (sizeof(uint32_t))
+#define UHCI_OUT_FRAME_OVERHEAD     (UHCI_OUT_FRAME_HEAD_LEN + UHCI_OUT_FRAME_TAIL_LEN)
+#define UHCI_OUT_GET_FRAME_SN(VAR)  __atomic_fetch_add(VAR, 1, __ATOMIC_RELAXED)
+
+// Private functions
+static int uhci_out_init_trans(uhci_out_trans_cb_t **trans_cb, uint16_t buf_size)
+{
+    // Memory allocations
+    size_t cb_size = sizeof(uhci_out_trans_cb_t) + buf_size;
+    *trans_cb = (uhci_out_trans_cb_t *)UHCI_OUT_MALLOC(cb_size);
+    if (!(*trans_cb)) {
+        return -1;
+    }
+    memset(*trans_cb, 0, sizeof(uhci_out_trans_cb_t));
+
+    // Initialization
+    (*trans_cb)->buf_size = buf_size;
+    return 0;
+}
+
+static void uhci_out_deinit_trans(uhci_out_trans_cb_t **trans_cb)
+{
+    if (!(*trans_cb)) {
+        return;
+    }
+
+    free(*trans_cb);
+    *trans_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static bool uhci_out_tx_done_cb(uhci_controller_handle_t uhci_ctrl,
+                                          const uhci_tx_done_event_data_t *edata, void *user_ctx)
+{
+    uhci_out_trans_cb_t *trans_cb = (uhci_out_trans_cb_t *)((uint8_t *)edata->buffer - sizeof(uhci_out_trans_cb_t));
+    trans_cb->length = 0;
+    trans_cb->flag = TRANS_CB_FLAG_AVAILABLE;
+    return true;
+}
+
+IRAM_ATTR static inline void uhci_out_append_trans(uhci_out_trans_cb_t *trans_cb)
+{
+    if ((trans_cb->flag != TRANS_CB_FLAG_NEED_QUEUE) || !trans_cb->length) {
+        return;
+    }
+
+    // Note: If task yield after transmission but before flag set
+    //       flag might be reset in tx done ISR before flag set, leading to buffer access failure
+    trans_cb->flag = TRANS_CB_FLAG_IN_QUEUE;
+    if (uhci_transmit(uhci_handle, trans_cb->buffer, trans_cb->length) != ESP_OK) {
+        goto recycle;
+    }
+    return;
+
+recycle:
+    trans_cb->length = 0;
+    trans_cb->flag = TRANS_CB_FLAG_AVAILABLE;
+    return;
+}
+
+static int uhci_out_log_cb_init(uhci_out_log_cb_t **log_cb, uint16_t buf_size, uint8_t type, uint8_t idx)
+{
+    // Initialize log control block
+    *log_cb = (uhci_out_log_cb_t *)UHCI_OUT_MALLOC(sizeof(uhci_out_log_cb_t));
+    if (!(*log_cb)) {
+        return -1;
+    }
+    memset(*log_cb, 0, sizeof(uhci_out_log_cb_t));
+
+    // Initialize transactions
+    int ret = 0;
+    for (uint8_t i = 0; i < 2; i++) {
+        ret |= uhci_out_init_trans(&((*log_cb)->trans_cb[i]), buf_size);
+    }
+    if (ret != 0) {
+        uhci_out_log_cb_deinit(log_cb);
+        return -1;
+    }
+
+    (*log_cb)->type = (type << 4) | (idx);
+    return 0;
+}
+
+static void uhci_out_log_cb_deinit(uhci_out_log_cb_t **log_cb)
+{
+    if (!(*log_cb)) {
+        return;
+    }
+
+    for (uint8_t i = 0; i < 2; i++) {
+        if ((*log_cb)->trans_cb[i]) {
+            uhci_out_deinit_trans(&((*log_cb)->trans_cb[i]));
+        }
+    }
+    free(*log_cb);
+    *log_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static inline bool uhci_out_log_cb_check_trans(uhci_out_log_cb_t *log_cb, uint16_t len, bool *need_append)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    *need_append = false;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        if (len > trans_cb->buf_size) {
+            goto failed;
+        }
+        if (trans_cb->flag == TRANS_CB_FLAG_AVAILABLE) {
+            if ((trans_cb->buf_size - trans_cb->length) >= len) {
+                return true;
+            } else {
+                trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+                *need_append = true;
+            }
+        }
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+    }
+failed:
+    log_cb->lost_bytes_cnt += len;
+    log_cb->lost_frame_cnt++;
+    return false;
+}
+
+// CRITICAL: Shall not be called from ISR!
+IRAM_ATTR static inline void uhci_out_log_cb_append_trans(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    uint8_t idx = !log_cb->trans_cb_idx;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[idx];
+        if (trans_cb->flag == TRANS_CB_FLAG_NEED_QUEUE) {
+            uhci_out_append_trans(trans_cb);
+        }
+        idx = !idx;
+    }
+}
+
+IRAM_ATTR static inline void uhci_out_log_cb_flush_trans(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[i];
+        if (trans_cb->length && (trans_cb->flag == TRANS_CB_FLAG_AVAILABLE)) {
+            trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+        }
+    }
+}
+
+// Return value: Need append
+IRAM_ATTR static bool uhci_out_log_cb_write(uhci_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len,
+                                           const uint8_t *addr_append, uint16_t len_append, uint8_t source)
+{
+    uhci_out_trans_cb_t *trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+
+    uint8_t *buf = trans_cb->buffer + trans_cb->length;
+    uint16_t total_length = len + len_append;
+    frame_head_t head = {
+        .length = total_length,
+        .source = source,
+        .type = log_cb->type,
+        .frame_sn = UHCI_OUT_GET_FRAME_SN(&(log_cb->frame_sn)) & 0xFFFF,
+    };
+
+    memcpy(buf, (const uint8_t *)&head, UHCI_OUT_FRAME_HEAD_LEN);
+    memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN, addr, len);
+    if (len_append && addr_append) {
+        memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN + len, addr_append, len_append);
+    }
+
+    uint32_t checksum = 0;
+    for (int i = 0; i < UHCI_OUT_FRAME_HEAD_LEN + total_length; i++) {
+        checksum += buf[i];
+    }
+    memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN + total_length, &checksum, UHCI_OUT_FRAME_TAIL_LEN);
+
+    trans_cb->length += total_length + UHCI_OUT_FRAME_OVERHEAD;
+    if ((trans_cb->buf_size - trans_cb->length) <= UHCI_OUT_FRAME_OVERHEAD) {
+        trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+        return true;
+    }
+    return false;
+}
+
+IRAM_ATTR static void uhci_out_log_cb_write_loss(uhci_out_log_cb_t *log_cb)
+{
+    if (!log_cb->lost_bytes_cnt || !log_cb->lost_frame_cnt) {
+        return;
+    }
+    bool need_append;
+    uint16_t frame_len = sizeof(loss_payload_t) + UHCI_OUT_FRAME_OVERHEAD;
+    if (uhci_out_log_cb_check_trans(log_cb, frame_len, &need_append)) {
+        loss_payload_t payload = {
+            .type = log_cb->type,
+            .lost_frame_cnt = log_cb->lost_frame_cnt,
+            .lost_bytes_cnt = log_cb->lost_bytes_cnt,
+        };
+        uhci_out_log_cb_write(log_cb, (const uint8_t *)&payload, sizeof(loss_payload_t),
+                             NULL, 0, BLE_LOG_UHCI_OUT_SOURCE_LOSS);
+
+        log_cb->lost_frame_cnt = 0;
+        log_cb->lost_bytes_cnt = 0;
+    }
+}
+
+static void uhci_out_log_cb_dump(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    uint8_t *buf;
+    for (uint8_t i = 0; i < 2; i++) {
+        // Dump the last transaction before dumping the current transaction
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        buf = (uint8_t *)trans_cb->buffer;
+        for (uint16_t j = 0; j < trans_cb->buf_size; j++) {
+            esp_rom_printf("%02x ", buf[j]);
+
+            // Feed watchdogs periodically to avoid wdts timeout
+            if ((j % 100) == 0) {
+                esp_panic_handler_feed_wdts();
+            }
+        }
+    }
+}
+
+static void esp_timer_cb_log_flush(void)
+{
+    uint32_t os_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+
+    if ((os_ts - user_last_write_ts) > UHCI_OUT_FLUSH_TIMEOUT_MS) {
+        xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+        uhci_out_log_cb_flush_trans(user_log_cb);
+        uhci_out_log_cb_append_trans(user_log_cb);
+        xSemaphoreGive(user_log_mutex);
+    }
+
+    if ((esp_bt_controller_get_status() >= ESP_BT_CONTROLLER_STATUS_INITED) &&
+        ((os_ts - ll_last_write_ts) > UHCI_OUT_FLUSH_TIMEOUT_MS)) {
+        ll_ev_flags |= BIT(LL_EV_FLAG_FLUSH_LOG);
+        UHCI_OUT_LL_PUT_EV;
+    }
+
+    esp_timer_start_once(flush_timer, UHCI_OUT_FLUSH_TIMEOUT_US);
+}
+
+static void uhci_out_user_write_str(const uint8_t *src, uint16_t len)
+{
+    if (!user_log_inited || !src || !len) {
+        return;
+    }
+
+    xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+
+    bool need_append;
+    if (uhci_out_log_cb_check_trans(user_log_cb, len, &need_append)) {
+        uhci_out_trans_cb_t *trans_cb = user_log_cb->trans_cb[user_log_cb->trans_cb_idx];
+        uint8_t *buf = trans_cb->buffer + trans_cb->length;
+
+        memcpy(buf, (const uint8_t *)src, len);
+        trans_cb->length += len;
+    }
+
+    if (need_append) {
+        uhci_out_log_cb_append_trans(user_log_cb);
+    }
+
+    user_last_write_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+
+    xSemaphoreGive(user_log_mutex);
+}
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+static void uhci_out_user_write_char(char c)
+{
+    uhci_out_user_write_str((const uint8_t *)&c, 1);
+}
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+static int uhci_out_user_log_init(void)
+{
+    if (user_log_inited) {
+        return 0;
+    }
+
+    // Initialize mutex
+    user_log_mutex = xSemaphoreCreateMutex();
+    if (!user_log_mutex) {
+        goto failed;
+    }
+
+    // Initialize log control block
+    if (uhci_out_log_cb_init(&user_log_cb, UHCI_OUT_USER_BUF_SIZE, LOG_CB_TYPE_USER, 0) != 0) {
+        goto failed;
+    }
+
+    // Initialization done
+    user_log_inited = true;
+    return 0;
+
+failed:
+    uhci_out_user_log_deinit();
+    return -1;
+}
+
+static void uhci_out_user_log_deinit(void)
+{
+    user_log_inited = false;
+
+    if (!user_log_mutex) {
+        return;
+    }
+    xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+
+    uhci_out_log_cb_deinit(&user_log_cb);
+
+    xSemaphoreGive(user_log_mutex);
+    vSemaphoreDelete(user_log_mutex);
+    user_log_mutex = NULL;
+}
+
+static int uhci_out_ll_log_init(void)
+{
+    if (ll_log_inited) {
+        return 0;
+    }
+
+    if (uhci_out_log_cb_init(&ll_task_log_cb, UHCI_OUT_LL_TASK_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_TASK) != 0) {
+        goto failed;
+    }
+    if (uhci_out_log_cb_init(&ll_isr_log_cb, UHCI_OUT_LL_ISR_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_ISR) != 0) {
+        goto failed;
+    }
+    if (uhci_out_log_cb_init(&ll_hci_log_cb, UHCI_OUT_LL_HCI_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_HCI) != 0) {
+        goto failed;
+    }
+
+    ll_log_inited = true;
+    return 0;
+
+failed:
+    uhci_out_ll_log_deinit();
+    return -1;
+}
+
+static void uhci_out_ll_log_deinit(void)
+{
+    ll_log_inited = false;
+
+    uhci_out_log_cb_deinit(&ll_hci_log_cb);
+    uhci_out_log_cb_deinit(&ll_isr_log_cb);
+    uhci_out_log_cb_deinit(&ll_task_log_cb);
+}
+
+static void uhci_out_ll_log_flush(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+    uhci_out_log_cb_write_loss(ll_task_log_cb);
+    uhci_out_log_cb_write_loss(ll_hci_log_cb);
+
+    uhci_out_log_cb_flush_trans(ll_task_log_cb);
+    uhci_out_log_cb_flush_trans(ll_hci_log_cb);
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    uhci_out_log_cb_write_loss(ll_isr_log_cb);
+    uhci_out_log_cb_flush_trans(ll_isr_log_cb);
+    portEXIT_CRITICAL_SAFE(&spinlock);
+
+    uhci_out_log_cb_append_trans(ll_task_log_cb);
+    uhci_out_log_cb_append_trans(ll_hci_log_cb);
+    uhci_out_log_cb_append_trans(ll_isr_log_cb);
+}
+
+// Public functions
+int ble_log_uhci_out_init(void)
+{
+    // Avoid double init
+    if (uhci_out_inited) {
+        return 0;
+    }
+
+#if UHCI_OUT_UART_NEED_INIT
+    uart_config_t uart_config = {
+        .baud_rate = UHCI_OUT_UART_BAUD_RATE,
+        .data_bits = UART_DATA_8_BITS,
+        .parity = UART_PARITY_DISABLE,
+        .stop_bits = UART_STOP_BITS_1,
+        .flow_ctrl = UART_HW_FLOWCTRL_CTS_RTS,
+        .rx_flow_ctrl_thresh = 122,
+    };
+    // Configure UART parameters
+    uart_param_config(UHCI_OUT_UART_PORT, &uart_config);
+    uart_set_pin(UHCI_OUT_UART_PORT, UHCI_OUT_UART_IO_NUM_TX, -1, -1, -1);
+#endif // UHCI_OUT_UART_NEED_INIT
+
+    uhci_controller_config_t uhci_config = {
+        .uart_port = UHCI_OUT_UART_PORT,
+        .tx_trans_queue_depth = UHCI_OUT_QUEUE_SIZE,
+        .max_receive_internal_mem = 1024,
+        .max_transmit_size = UHCI_OUT_MAX_TRANSFER_SIZE,
+        .dma_burst_size = 32,
+        .rx_eof_flags.idle_eof = 1,
+    };
+    if (uhci_new_controller(&uhci_config, &uhci_handle) != ESP_OK) {
+        goto failed;
+    }
+
+    uhci_event_callbacks_t uhci_cbs = {
+        .on_tx_trans_done = uhci_out_tx_done_cb,
+    };
+    uhci_register_event_callbacks(uhci_handle, &uhci_cbs, NULL);
+
+    if (uhci_out_user_log_init() != 0) {
+        goto failed;
+    }
+
+    if (uhci_out_ll_log_init() != 0) {
+        goto failed;
+    }
+
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_log_flush,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    if (esp_timer_create(&timer_args, &flush_timer) != ESP_OK) {
+        goto failed;
+    }
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    // Install UART Driver if not installed
+    if (!uart_is_driver_installed(UHCI_OUT_UART_PORT0)) {
+        uart_driver_install(UHCI_OUT_UART_PORT0, UHCI_OUT_UART_DRIVER_RX_BUF_SIZE, 0, 0, NULL, 0);
+    }
+
+    // Redirect UART VFS Driver to UART Driver
+    uart_vfs_dev_use_driver(UHCI_OUT_UART_PORT0);
+
+    // Redirect esp_rom_printf to BLE Log UHCI Out
+    esp_rom_install_channel_putc(1, uhci_out_user_write_char);
+    esp_rom_install_channel_putc(2, NULL);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+    uhci_out_inited = true;
+    esp_timer_start_once(flush_timer, UHCI_OUT_FLUSH_TIMEOUT_US);
+    return 0;
+
+failed:
+    ble_log_uhci_out_deinit();
+    return -1;
+}
+
+void ble_log_uhci_out_deinit(void)
+{
+    uhci_out_inited = false;
+
+    if (flush_timer) {
+        esp_timer_stop(flush_timer);
+        esp_timer_delete(flush_timer);
+        flush_timer = NULL;
+    }
+
+    if (uhci_handle) {
+        uhci_wait_all_tx_transaction_done(uhci_handle, portMAX_DELAY);
+        uhci_del_controller(uhci_handle);
+        uhci_handle = NULL;
+    }
+
+    uhci_out_ll_log_deinit();
+    uhci_out_user_log_deinit();
+}
+
+IRAM_ATTR void ble_log_uhci_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,
+                                        const uint8_t *addr_append, uint32_t flag)
+{
+    // Raw logs will come in case of assert, shall be printed to console directly
+    if (flag & BIT(LL_LOG_FLAG_RAW)) {
+        if (len && addr) {
+            for (uint32_t i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
+        }
+        if (len_append && addr_append) {
+            for (uint32_t i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+        }
+        if (flag & BIT(LL_LOG_FLAG_END)) { esp_rom_printf("\n"); }
+    }
+
+    if (!ll_log_inited) {
+        return;
+    }
+
+    bool in_isr = false;
+    uint8_t source;
+    uhci_out_log_cb_t *log_cb;
+    if (flag & BIT(LL_LOG_FLAG_ISR)) {
+        log_cb = ll_isr_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_ESP_ISR;
+        in_isr = true;
+    } else if (flag & BIT(LL_LOG_FLAG_HCI)) {
+        log_cb = ll_hci_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_LL_HCI;
+    } else {
+        log_cb = ll_task_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_ESP;
+    }
+
+    bool need_append;
+    uint16_t frame_len = len + len_append + UHCI_OUT_FRAME_OVERHEAD;
+    if (uhci_out_log_cb_check_trans(log_cb, frame_len, &need_append)) {
+        need_append |= uhci_out_log_cb_write(log_cb, addr, len, addr_append,
+                                            len_append, source);
+    }
+
+    ll_last_write_ts = in_isr?\
+                       pdTICKS_TO_MS(xTaskGetTickCountFromISR()):\
+                       pdTICKS_TO_MS(xTaskGetTickCount());
+
+    if (need_append) {
+        if (in_isr) {
+            ll_ev_flags |= BIT(LL_EV_FLAG_ISR_APPEND);
+            UHCI_OUT_LL_PUT_EV;
+        } else {
+            uhci_out_log_cb_append_trans(log_cb);
+        }
+    }
+}
+
+IRAM_ATTR void ble_log_uhci_out_ll_log_ev_proc(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+    if (ll_ev_flags & BIT(LL_EV_FLAG_ISR_APPEND)) {
+        uhci_out_log_cb_append_trans(ll_isr_log_cb);
+        ll_ev_flags &= ~BIT(LL_EV_FLAG_ISR_APPEND);
+    }
+
+    if (ll_ev_flags & BIT(LL_EV_FLAG_FLUSH_LOG)) {
+        uhci_out_ll_log_flush();
+        ll_ev_flags &= ~BIT(LL_EV_FLAG_FLUSH_LOG);
+    }
+
+    ll_ev_flags = 0;
+}
+
+// Redirect UART Driver to BLE Log UHCI Out
+int __real_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len);
+int __wrap_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    uhci_out_user_write_str((const uint8_t *)buffer, len);
+    return 0;
+#else
+    return __real_uart_tx_chars(uart_num, buffer, len);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+int __real_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size);
+int __wrap_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    uhci_out_user_write_str((const uint8_t *)src, size);
+    return 0;
+#else
+    return __real_uart_write_bytes(uart_num, src, size);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+int __real_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len);
+int __wrap_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    return __wrap_uart_write_bytes(uart_num, src, size);
+#else
+    return __real_uart_write_bytes_with_break(uart_num, src, size, brk_len);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+void ble_log_uhci_out_dump_all(void)
+{
+    if (!uhci_out_inited) {
+        return;
+    }
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    esp_rom_output_tx_wait_idle(UHCI_OUT_UART_PORT0);
+    esp_rom_install_uart_printf();
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+    if (ll_log_inited) {
+        esp_rom_printf("[DUMP_START:\n");
+        uhci_out_log_cb_dump(ll_isr_log_cb);
+        uhci_out_log_cb_dump(ll_task_log_cb);
+        uhci_out_log_cb_dump(ll_hci_log_cb);
+        esp_rom_printf("\n:DUMP_END]\n\n");
+    }
+    portEXIT_CRITICAL_SAFE(&spinlock);
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    esp_rom_install_channel_putc(1, uhci_out_user_write_char);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
--- a/components/bt/common/ble_log/include/ble_log.h
+++ b/components/bt/common/ble_log/include/ble_log.h
@@ -0,0 +1,56 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_H__
+#define __BLE_LOG_H__
+
+/* ------- */
+/* BLE Log */
+/* ------- */
+
+/* INCLUDE */
+#include <stdbool.h>
+#include <stdint.h>
+#include <stddef.h>
+
+/* TYPEDEF */
+/* CRITICAL:
+ * The number of BLE Log source code will directly determine the number of statistic manager
+ * memory requirements, keep it as less as possible; it's recommended to use subcode for more
+ * log data structure decoding */
+typedef enum {
+    /* Internal */
+    BLE_LOG_SRC_INTERNAL = 0,
+
+    /* Custom */
+    BLE_LOG_SRC_CUSTOM,
+
+    /* BLE Stack */
+    BLE_LOG_SRC_LL_TASK,
+    BLE_LOG_SRC_LL_HCI,
+    BLE_LOG_SRC_LL_ISR,
+    BLE_LOG_SRC_HOST,
+    BLE_LOG_SRC_HCI,
+    BLE_LOG_SRC_ENCODE,
+
+    BLE_LOG_SRC_MAX,
+} ble_log_src_t;
+
+/* INTERFACE */
+bool ble_log_init(void);
+void ble_log_deinit(void);
+bool ble_log_enable(bool enable);
+void ble_log_flush(void);
+bool ble_log_write_hex(ble_log_src_t src_code, const uint8_t *addr, size_t len);
+void ble_log_dump_to_console(void);
+#if CONFIG_BLE_LOG_LL_ENABLED
+void ble_log_write_hex_ll(uint32_t len, const uint8_t *addr,
+                          uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+#if CONFIG_BLE_LOG_TS_ENABLED
+bool ble_log_sync_enable(bool enable);
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+#endif /* __BLE_LOG_H__ */
--- a/components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h
+++ b/components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h
@@ -0,0 +1,65 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/spi_master.h"
+#include "driver/gpio.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+#include "esp_heap_caps.h"
+#include "esp_task.h"
+
+// Public enums
+enum {
+    BLE_LOG_SPI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY,
+    BLE_LOG_SPI_OUT_SOURCE_BLUEDROID,
+    BLE_LOG_SPI_OUT_SOURCE_NIMBLE,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_LL_HCI,
+    BLE_LOG_SPI_OUT_SOURCE_LE_AUDIO,
+    BLE_LOG_SPI_OUT_SOURCE_MESH,
+    BLE_LOG_SPI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_SPI_OUT_SOURCE_SSC = 0xFD,
+    BLE_LOG_SPI_OUT_SOURCE_SYNC,
+    BLE_LOG_SPI_OUT_SOURCE_LOSS,
+};
+
+#define BLE_LOG_SPI_OUT_LEVEL_NONE                  0
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR                 1
+#define BLE_LOG_SPI_OUT_LEVEL_WARN                  2
+#define BLE_LOG_SPI_OUT_LEVEL_INFO                  3
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG                 4
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE               5
+#define BLE_LOG_SPI_OUT_STR(x)                      #x
+#define BLE_LOG_SPI_OUT_XSTR(x)                     BLE_LOG_SPI_OUT_STR(x)
+#define BLE_LOG_SPI_OUT_BUILD_PREFIX(LEVEL, TAG)    "[" BLE_LOG_SPI_OUT_XSTR(LEVEL) "][" TAG "]"
+
+// Public functions
+int ble_log_spi_out_init(void);
+void ble_log_spi_out_deinit(void);
+void ble_log_spi_out_timer_control(bool enable);
+int ble_log_spi_out_write(uint8_t source, const uint8_t *addr, uint16_t len);
+void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,\
+                              const uint8_t *addr_append, uint32_t flag);
+void ble_log_spi_out_ll_log_ev_proc(void);
+void ble_log_spi_out_ts_sync_start(void);
+void ble_log_spi_out_ts_sync_stop(void);
+void ble_log_spi_out_dump_all(void);
+void ble_log_spi_out_enable(bool enable);
+void ble_log_spi_out_flush(void);
+void ble_log_spi_out_le_audio_write(const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_host_write(uint8_t source, const char *prefix, const char *format, ...);
+int ble_log_spi_out_hci_write(uint8_t source, const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_mesh_write(const char *prefix, const char *format, ...);
+
+#endif // __BT_SPI_OUT_H__
--- a/components/bt/common/ble_log/include/ble_log/ble_log_uhci_out.h
+++ b/components/bt/common/ble_log/include/ble_log/ble_log_uhci_out.h
@@ -0,0 +1,36 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/uhci.h"
+#include "driver/uart.h"
+#include "driver/uart_vfs.h"
+#include "esp_rom_uart.h"
+#include "esp_rom_sys.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+
+// Public enums
+enum {
+    BLE_LOG_UHCI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_UHCI_OUT_SOURCE_ESP_ISR = 6,
+    BLE_LOG_UHCI_OUT_SOURCE_LL_HCI = 8,
+    BLE_LOG_UHCI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_UHCI_OUT_SOURCE_LOSS = 0xFF,
+};
+
+// Public functions
+int ble_log_uhci_out_init(void);
+void ble_log_uhci_out_deinit(void);
+void ble_log_uhci_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,
+                               const uint8_t *addr_append, uint32_t flag);
+void ble_log_uhci_out_ll_log_ev_proc(void);
+void ble_log_uhci_out_dump_all(void);
+
+#endif // __BT_SPI_OUT_H__
--- a/components/bt/common/ble_log/src/ble_log.c
+++ b/components/bt/common/ble_log/src/ble_log.c
@@ -0,0 +1,94 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* ------- */
+/* BLE Log */
+/* ------- */
+
+/* INCLUDE */
+#include "ble_log.h"
+#include "ble_log_rt.h"
+#include "ble_log_lbm.h"
+#include "ble_log_prph.h"
+#include "ble_log_util.h"
+#if CONFIG_BLE_LOG_TS_ENABLED
+#include "ble_log_ts.h"
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+/* VARIABLE */
+BLE_LOG_STATIC bool ble_log_inited = false;
+
+/* INTERFACE */
+bool ble_log_init(void)
+{
+    /* Avoid double init */
+    if (ble_log_inited) {
+        return true;
+    }
+
+#if CONFIG_BLE_LOG_TS_ENABLED
+    /* Initialize BLE Log TS */
+    if (!ble_log_ts_init()) {
+        goto exit;
+    }
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+    /* Initialize BLE Log Runtime */
+    if (!ble_log_rt_init()) {
+        goto exit;
+    }
+
+    /* Initialize BLE Log LBM */
+    if (!ble_log_lbm_init()) {
+        goto exit;
+    }
+
+    /* Initialize BLE Log peripheral interface */
+    if (!ble_log_prph_init(BLE_LOG_LBM_CNT)) {
+        goto exit;
+    }
+
+    /* Initialization done */
+    ble_log_inited = true;
+    ble_log_enable(true);
+
+    /* Write initialization done log */
+    ble_log_info_t ble_log_info = {
+        .int_src_code = BLE_LOG_INT_SRC_INIT_DONE,
+        .version = BLE_LOG_VERSION,
+    };
+    ble_log_write_hex(BLE_LOG_SRC_INTERNAL, (const uint8_t *)&ble_log_info, sizeof(ble_log_info_t));
+    return true;
+
+exit:
+    ble_log_deinit();
+    return false;
+}
+
+void ble_log_deinit(void)
+{
+    ble_log_enable(false);
+    ble_log_inited = false;
+
+    /* CRITICAL:
+     * BLE Log peripheral interface must be deinitialized at first,
+     * because there's a risky scenario that may cause severe peripheral
+     * driver fault - if a log buffer is sent to peripheral driver, and
+     * ble_log_deinit is called; in this case, if LBM is deinitialized
+     * before peripheral interface, the log buffer may be freed before
+     * peripheral driver completing tx, and the result would be faulty */
+    ble_log_prph_deinit();
+
+    /* Deinitialize BLE Log LBM */
+    ble_log_lbm_deinit();
+
+    /* Deinitialize BLE Log Runtime */
+    ble_log_rt_deinit();
+
+#if CONFIG_BLE_LOG_TS_ENABLED
+    /* Deinitialize BLE Log TS */
+    ble_log_ts_deinit();
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+}
--- a/components/bt/common/ble_log/src/ble_log_lbm.c
+++ b/components/bt/common/ble_log/src/ble_log_lbm.c
@@ -0,0 +1,543 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* ------------------------------- */
+/* BLE Log - Log Buffer Management */
+/* ------------------------------- */
+
+/* INCLUDE */
+#include "ble_log.h"
+#include "ble_log_lbm.h"
+#include "ble_log_rt.h"
+
+/* VARIABLE */
+BLE_LOG_STATIC volatile uint32_t lbm_ref_count = 0;
+BLE_LOG_STATIC bool lbm_inited = false;
+BLE_LOG_STATIC bool lbm_enabled = false;
+BLE_LOG_STATIC ble_log_lbm_ctx_t *lbm_ctx = NULL;
+BLE_LOG_STATIC ble_log_stat_mgr_t *stat_mgr_ctx[BLE_LOG_SRC_MAX] = {0};
+
+/* PRIVATE FUNCTION DECLARATION */
+BLE_LOG_STATIC ble_log_lbm_t *ble_log_lbm_acquire(void);
+BLE_LOG_STATIC void ble_log_lbm_release(ble_log_lbm_t *lbm);
+BLE_LOG_STATIC
+void ble_log_lbm_write_trans(ble_log_prph_trans_t **trans, ble_log_src_t src_code,
+                             const uint8_t *addr, uint16_t len,
+                             const uint8_t *addr_append, uint16_t len_append);
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+BLE_LOG_STATIC void ble_log_stat_mgr_update(ble_log_src_t src_code, uint32_t len, bool lost);
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+/* ------------------------- */
+/*     PRIVATE INTERFACE     */
+/* ------------------------- */
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC
+ble_log_lbm_t *ble_log_lbm_acquire(void)
+{
+    ble_log_lbm_t *lbm = NULL;
+    ble_log_lbm_t *atomic_pool;
+    ble_log_lbm_t *spin_lbm;
+    int atomic_pool_size;
+
+    if (BLE_LOG_IN_ISR()) {
+        atomic_pool = lbm_ctx->atomic_pool_isr;
+        spin_lbm = &(lbm_ctx->spin_isr);
+        atomic_pool_size = BLE_LOG_LBM_ATOMIC_ISR_CNT;
+    } else {
+        atomic_pool = lbm_ctx->atomic_pool_task;
+        spin_lbm = &(lbm_ctx->spin_task);
+        atomic_pool_size = BLE_LOG_LBM_ATOMIC_TASK_CNT;
+    }
+
+    /* Try to acquire atomic LBM first */
+    for (int i = 0; i < atomic_pool_size; i++) {
+        lbm = &atomic_pool[i];
+        if (ble_log_cas_acquire(&(lbm->atomic_lock))) {
+            return lbm;
+        }
+    }
+
+    /* Fallback to spinlock LBM */
+    lbm = spin_lbm;
+    BLE_LOG_ACQUIRE_SPIN_LOCK(&(lbm->spin_lock));
+    return lbm;
+}
+
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC
+void ble_log_lbm_release(ble_log_lbm_t *lbm)
+{
+    switch (lbm->lock_type) {
+    case BLE_LOG_LBM_LOCK_ATOMIC:
+        ble_log_cas_release(&(lbm->atomic_lock));
+        break;
+    case BLE_LOG_LBM_LOCK_SPIN:
+        BLE_LOG_RELEASE_SPIN_LOCK(&lbm->spin_lock);
+        break;
+    case BLE_LOG_LBM_LOCK_NONE:
+    default:
+        break;
+    }
+}
+
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC
+void ble_log_lbm_write_trans(ble_log_prph_trans_t **trans, ble_log_src_t src_code,
+                             const uint8_t *addr, uint16_t len,
+                             const uint8_t *addr_append, uint16_t len_append)
+{
+    /* Preparation before writing */
+    uint8_t *buf = (*trans)->buf + (*trans)->pos;
+    uint16_t payload_len = len + len_append;
+    ble_log_stat_mgr_t *stat_mgr = stat_mgr_ctx[src_code];
+    uint32_t frame_sn = BLE_LOG_GET_FRAME_SN(&(stat_mgr->frame_sn));
+    ble_log_frame_head_t frame_head = {
+        .length = payload_len,
+        .frame_meta = BLE_LOG_MAKE_FRAME_META(src_code, frame_sn),
+    };
+
+    /* Memory operation */
+    BLE_LOG_MEMCPY(buf, &frame_head, BLE_LOG_FRAME_HEAD_LEN);
+    if (len) {
+        BLE_LOG_MEMCPY(buf + BLE_LOG_FRAME_HEAD_LEN, addr, len);
+    }
+    if (len_append) {
+        BLE_LOG_MEMCPY(buf + BLE_LOG_FRAME_HEAD_LEN + len, addr_append, len_append);
+    }
+
+    /* Data integrity check */
+#if CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED
+    uint32_t checksum = ble_log_fast_checksum((const uint8_t *)buf, BLE_LOG_FRAME_HEAD_LEN + payload_len);
+#else /* !CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED */
+    /* Note:
+     * Minimum data integrity check is still required for log parsing reliability,
+     * which can be achieved by validating the checksum of frame head only */
+    uint32_t checksum = ble_log_fast_checksum((const uint8_t *)buf, BLE_LOG_FRAME_HEAD_LEN);
+#endif /* CONFIG_BLE_LOG_PAYLOAD_CHECKSUM_ENABLED */
+    BLE_LOG_MEMCPY(buf + BLE_LOG_FRAME_HEAD_LEN + payload_len, &checksum, BLE_LOG_FRAME_TAIL_LEN);
+
+    /* Update peripheral transport */
+    (*trans)->pos += payload_len + BLE_LOG_FRAME_OVERHEAD;
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+    ble_log_stat_mgr_update(src_code, payload_len, false);
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+    /* Queue trans if full */
+    if (BLE_LOG_TRANS_FREE_SPACE((*trans)) <= BLE_LOG_FRAME_OVERHEAD) {
+        ble_log_rt_queue_trans(trans);
+    }
+}
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC
+void ble_log_stat_mgr_update(ble_log_src_t src_code, uint32_t len, bool lost)
+{
+    /* Get statistic manager by source code */
+    ble_log_stat_mgr_t *stat_mgr = stat_mgr_ctx[src_code];
+
+    /* Update statistics */
+    uint32_t bytes_cnt = len + BLE_LOG_FRAME_OVERHEAD;
+    if (lost) {
+        stat_mgr->enh_stat.lost_frame_cnt++;
+        stat_mgr->enh_stat.lost_bytes_cnt += bytes_cnt;
+    } else {
+        stat_mgr->enh_stat.written_frame_cnt++;
+        stat_mgr->enh_stat.written_bytes_cnt += bytes_cnt;
+    }
+}
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+/* -------------------------- */
+/*     INTERNAL INTERFACE     */
+/* -------------------------- */
+bool ble_log_lbm_init(void)
+{
+    /* Avoid double init */
+    if (lbm_inited) {
+        return true;
+    }
+
+    /* Initialize LBM context */
+    lbm_ctx = (ble_log_lbm_ctx_t *)BLE_LOG_MALLOC(sizeof(ble_log_lbm_ctx_t));
+    if (!lbm_ctx) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(lbm_ctx, 0, sizeof(ble_log_lbm_ctx_t));
+
+    /* Initialize peripheral transport for common LBMs */
+    ble_log_lbm_t *lbm;
+    for (int i = 0; i < BLE_LOG_LBM_COMMON_CNT; i++) {
+        lbm = &(lbm_ctx->lbm_common_pool[i]);
+        for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+            if (!ble_log_prph_trans_init(&(lbm->trans[j]),
+                                         CONFIG_BLE_LOG_LBM_TRANS_SIZE)) {
+                goto exit;
+            }
+        }
+    }
+
+    /* Initialize lock types for atomic pool */
+    for (int i = 0; i < BLE_LOG_LBM_ATOMIC_CNT; i++) {
+        lbm_ctx->atomic_pool[i].lock_type = BLE_LOG_LBM_LOCK_ATOMIC;
+    }
+
+    /* Initialize lock types for spin pool */
+    for (int i = 0; i < BLE_LOG_LBM_SPIN_MAX; i++) {
+        lbm_ctx->spin_pool[i].lock_type = BLE_LOG_LBM_LOCK_SPIN;
+    }
+
+#if CONFIG_BLE_LOG_LL_ENABLED
+    for (int i = 0; i < BLE_LOG_LBM_LL_MAX; i++) {
+        lbm = &(lbm_ctx->lbm_ll_pool[i]);
+        for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+            if (!ble_log_prph_trans_init(&(lbm->trans[j]),
+                                         CONFIG_BLE_LOG_LBM_LL_TRANS_SIZE)) {
+                goto exit;
+            }
+        }
+    }
+
+    /* Initialize lock types for LL pool */
+    for (int i = 0; i < BLE_LOG_LBM_LL_MAX; i++) {
+        lbm_ctx->lbm_ll_pool[i].lock_type = BLE_LOG_LBM_LOCK_NONE;
+    }
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+
+    /* Initialize statistic manager context */
+    for (int i = 0; i < BLE_LOG_SRC_MAX; i++) {
+        stat_mgr_ctx[i] = (ble_log_stat_mgr_t *)BLE_LOG_MALLOC(sizeof(ble_log_stat_mgr_t));
+        if (!stat_mgr_ctx[i]) {
+            goto exit;
+        }
+        BLE_LOG_MEMSET(stat_mgr_ctx[i], 0, sizeof(ble_log_stat_mgr_t));
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+        stat_mgr_ctx[i]->enh_stat.int_src_code = BLE_LOG_INT_SRC_ENH_STAT;
+        stat_mgr_ctx[i]->enh_stat.src_code = i;
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+    }
+
+    /* Initialization done */
+    lbm_ref_count = 0;
+    lbm_inited = true;
+    lbm_enabled = false;
+    return true;
+
+exit:
+    ble_log_lbm_deinit();
+    return false;
+}
+
+void ble_log_lbm_deinit(void)
+{
+    /* Set inited flag to false to prevent new references */
+    lbm_inited = false;
+    lbm_enabled = false;
+
+    /* Disable module and wait for all references to be released */
+    uint32_t time_waited = 0;
+    while (lbm_ref_count > 0) {
+        vTaskDelay(pdMS_TO_TICKS(1));
+        BLE_LOG_ASSERT(time_waited++ < 1000);
+    }
+
+    /* Release statistic manager context */
+    for (int i = 0; i < BLE_LOG_SRC_MAX; i++) {
+        if (stat_mgr_ctx[i]) {
+            BLE_LOG_FREE(stat_mgr_ctx[i]);
+            stat_mgr_ctx[i] = NULL;
+        }
+    }
+
+    /* Release LBM */
+    if (lbm_ctx) {
+        /* Release peripheral transport for common pools */
+        ble_log_lbm_t *lbm;
+        for (int i = 0; i < BLE_LOG_LBM_CNT; i++) {
+            lbm = &(lbm_ctx->lbm_pool[i]);
+            for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+                ble_log_prph_trans_deinit(&(lbm->trans[j]));
+            }
+        }
+
+        /* Release LBM context */
+        BLE_LOG_FREE(lbm_ctx);
+        lbm_ctx = NULL;
+    }
+}
+
+/* Note:
+ * The function below should be private, but when UART redirection is required,
+ * it would be a waste to implement get transport function again, thus
+ * make it available internally */
+BLE_LOG_IRAM_ATTR
+ble_log_prph_trans_t **ble_log_lbm_get_trans(ble_log_lbm_t *lbm, size_t log_len)
+{
+    /* Check if available buffer can contain incoming log */
+    ble_log_prph_trans_t **trans;
+    for (int i = 0; i < BLE_LOG_TRANS_PING_PONG_BUF_CNT; i++) {
+        trans = &(lbm->trans[lbm->trans_idx]);
+        if (!(*trans)->prph_owned) {
+            /* Return if there's enough free space in current transport */
+            if (BLE_LOG_TRANS_FREE_SPACE((*trans)) >= (log_len + BLE_LOG_FRAME_OVERHEAD)) {
+                return trans;
+            }
+
+            /* Queue transport if there's insufficient free space */
+            if ((*trans)->pos) {
+                ble_log_rt_queue_trans(trans);
+            }
+        }
+
+        /* Current transport unavailable, switch to the other */
+        lbm->trans_idx = !lbm->trans_idx;
+    }
+
+    /* Both ping-pong buffers are unavailable */
+    return NULL;
+}
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+void ble_log_write_enh_stat(void)
+{
+    BLE_LOG_REF_COUNT_ACQUIRE(&lbm_ref_count);
+    if (!lbm_enabled) {
+        goto deref;
+    }
+
+    for (int i = 0; i < BLE_LOG_SRC_MAX; i++) {
+        ble_log_enh_stat_t *enh_stat = &(stat_mgr_ctx[i]->enh_stat);
+        ble_log_write_hex(BLE_LOG_SRC_INTERNAL, (const uint8_t *)enh_stat, sizeof(ble_log_enh_stat_t));
+    }
+
+deref:
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+}
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+/* ------------------------ */
+/*     PUBLIC INTERFACE     */
+/* ------------------------ */
+bool ble_log_enable(bool enable)
+{
+    if (!lbm_inited) {
+        return false;
+    }
+    lbm_enabled = enable;
+    return true;
+}
+
+void ble_log_flush(void)
+{
+    BLE_LOG_REF_COUNT_ACQUIRE(&lbm_ref_count);
+    if (!lbm_inited) {
+        goto deref;
+    }
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+    /* Write enhanced statistics before module disable */
+    ble_log_write_enh_stat();
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+    /* Write BLE Log flush log */
+    ble_log_info_t ble_log_info = {
+        .int_src_code = BLE_LOG_INT_SRC_FLUSH,
+        .version = BLE_LOG_VERSION,
+    };
+    ble_log_write_hex(BLE_LOG_SRC_INTERNAL, (const uint8_t *)&ble_log_info, sizeof(ble_log_info_t));
+
+    /* Disable module and wait for all other references to release */
+    bool lbm_enabled_copy = lbm_enabled;
+    lbm_enabled = false;
+    uint32_t time_waited = 0;
+    while (lbm_ref_count > 1) {
+        vTaskDelay(pdMS_TO_TICKS(1));
+        BLE_LOG_ASSERT(time_waited++ < 1000);
+    }
+
+    /* Queue transports with logs */
+    ble_log_lbm_t *lbm;
+    ble_log_prph_trans_t **trans;
+
+    /* Flush pools */
+    for (int i = 0; i < BLE_LOG_LBM_CNT; i++) {
+        lbm = &(lbm_ctx->lbm_pool[i]);
+        int trans_idx = lbm->trans_idx;
+        for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+            trans = &(lbm->trans[trans_idx]);
+            if (!(*trans)->prph_owned && (*trans)->pos) {
+                ble_log_rt_queue_trans(trans);
+            }
+            trans_idx = !trans_idx;
+        }
+    }
+
+    /* Wait for transportation to finish */
+    time_waited = 0;
+    bool in_progress;
+    do {
+        in_progress = false;
+        for (int i = 0; i < BLE_LOG_LBM_CNT; i++) {
+            lbm = &(lbm_ctx->lbm_pool[i]);
+            for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+                trans = &(lbm->trans[j]);
+                in_progress |= (*trans)->prph_owned;
+            }
+        }
+        if (in_progress) {
+            vTaskDelay(pdMS_TO_TICKS(1));
+            BLE_LOG_ASSERT(time_waited++ < 1000);
+        }
+    } while (in_progress);
+
+    /* Reset statistics manager after all operations complete */
+    for (int i = 0; i < BLE_LOG_SRC_MAX; i++) {
+        BLE_LOG_MEMSET(stat_mgr_ctx[i], 0, sizeof(ble_log_stat_mgr_t));
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+        /* Reinitialize enhanced statistics fields */
+        stat_mgr_ctx[i]->enh_stat.int_src_code = BLE_LOG_INT_SRC_ENH_STAT;
+        stat_mgr_ctx[i]->enh_stat.src_code = i;
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+    }
+
+    /* Resume enable status */
+    lbm_enabled = lbm_enabled_copy;
+
+deref:
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+}
+
+bool ble_log_write_hex(ble_log_src_t src_code, const uint8_t *addr, size_t len)
+{
+    BLE_LOG_REF_COUNT_ACQUIRE(&lbm_ref_count);
+    size_t payload_len = len + sizeof(uint32_t);
+    if (!lbm_enabled) {
+        goto exit;
+    }
+
+    /* Get transport */
+    ble_log_lbm_t *lbm = ble_log_lbm_acquire();
+    ble_log_prph_trans_t **trans = ble_log_lbm_get_trans(lbm, payload_len);
+    if (!trans) {
+        ble_log_lbm_release(lbm);
+        goto exit;
+    }
+
+    /* Write transport */
+    uint32_t os_ts = pdTICKS_TO_MS(BLE_LOG_IN_ISR()?
+                                   xTaskGetTickCountFromISR():
+                                   xTaskGetTickCount());
+    ble_log_lbm_write_trans(trans, src_code, (const uint8_t *)&os_ts,
+                            sizeof(uint32_t), addr, len);
+
+    /* Release */
+    ble_log_lbm_release(lbm);
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+    return true;
+
+exit:
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+    if (lbm_inited) {
+        ble_log_stat_mgr_update(src_code, payload_len, true);
+    }
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+    return false;
+}
+
+#if CONFIG_BLE_LOG_LL_ENABLED
+BLE_LOG_IRAM_ATTR
+void ble_log_write_hex_ll(uint32_t len, const uint8_t *addr,
+                          uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
+{
+    BLE_LOG_REF_COUNT_ACQUIRE(&lbm_ref_count);
+    size_t payload_len = len + len_append;
+
+    /* Source code shall be determined before LBM enable status check */
+    ble_log_src_t src_code;
+    bool use_ll_task = false;
+    if (flag & BIT(BLE_LOG_LL_FLAG_ISR)) {
+        src_code = BLE_LOG_SRC_LL_ISR;
+    } else if (flag & BIT(BLE_LOG_LL_FLAG_HCI)) {
+        src_code = BLE_LOG_SRC_LL_HCI;
+    } else if (flag & BIT(BLE_LOG_LL_FLAG_HCI_UPSTREAM)) {
+        src_code = BLE_LOG_SRC_HCI;
+    } else {
+        src_code = BLE_LOG_SRC_LL_TASK;
+        use_ll_task = true;
+    }
+
+    if (!lbm_enabled) {
+        goto exit;
+    }
+
+    /* Determine LBM by flag */
+    ble_log_lbm_t *lbm;
+    if (BLE_LOG_IN_ISR()) {
+        /* Reuse common LBM acquire logic */
+        lbm = ble_log_lbm_acquire();
+    } else {
+        lbm = (use_ll_task)? &(lbm_ctx->lbm_ll_task): &(lbm_ctx->lbm_ll_hci);
+    }
+
+    /* Get transport */
+    ble_log_prph_trans_t **trans = ble_log_lbm_get_trans(lbm, payload_len);
+    if (!trans) {
+        ble_log_lbm_release(lbm);
+        goto exit;
+    }
+
+    /* Write transport */
+    ble_log_lbm_write_trans(trans, src_code, addr, len, addr_append, len_append);
+
+    ble_log_lbm_release(lbm);
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+    return;
+
+exit:
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+    if (lbm_inited) {
+        ble_log_stat_mgr_update(src_code, payload_len, true);
+    }
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+    return;
+}
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+
+void ble_log_dump_to_console(void)
+{
+    BLE_LOG_REF_COUNT_ACQUIRE(&lbm_ref_count);
+    if (!lbm_inited) {
+        goto deref;
+    }
+
+    int trans_idx;
+    ble_log_lbm_t *lbm;
+    ble_log_prph_trans_t *trans;
+    BLE_LOG_ENTER_CRITICAL();
+    BLE_LOG_CONSOLE("[BLE_LOG_DUMP_START:\n");
+    for (int i = 0; i < BLE_LOG_LBM_CNT; i++) {
+        lbm = &(lbm_ctx->lbm_pool[i]);
+        trans_idx = lbm->trans_idx;
+        for (int j = 0; j < BLE_LOG_TRANS_PING_PONG_BUF_CNT; j++) {
+            trans = lbm->trans[trans_idx];
+            BLE_LOG_FEED_WDT();
+
+            for (int k = 0; k < trans->size; k++) {
+                BLE_LOG_CONSOLE("%02x ", trans->buf[k]);
+                if (!(k & 0xFF)) {
+                    BLE_LOG_FEED_WDT();
+                }
+            }
+            trans_idx = !trans_idx;
+        }
+    }
+    BLE_LOG_CONSOLE("\n:BLE_LOG_DUMP_END]\n\n");
+    BLE_LOG_EXIT_CRITICAL();
+
+deref:
+    BLE_LOG_REF_COUNT_RELEASE(&lbm_ref_count);
+    return;
+}
--- a/components/bt/common/ble_log/src/ble_log_rt.c
+++ b/components/bt/common/ble_log/src/ble_log_rt.c
@@ -0,0 +1,144 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* ----------------- */
+/* BLE Log - Runtime */
+/* ----------------- */
+
+/* INCLUDE */
+#include "ble_log.h"
+#include "ble_log_rt.h"
+#include "ble_log_lbm.h"
+
+/* VARIABLE */
+BLE_LOG_STATIC bool rt_inited = false;
+BLE_LOG_STATIC TaskHandle_t rt_task_handle = NULL;
+BLE_LOG_STATIC QueueHandle_t rt_queue_handle = NULL;
+#if CONFIG_BLE_LOG_TS_ENABLED
+BLE_LOG_STATIC bool rt_ts_enabled = false;
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+/* PRIVATE FUNCTION */
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC void ble_log_rt_task(void *pvParameters)
+{
+    (void)pvParameters;
+    ble_log_prph_trans_t *trans = NULL;
+    uint32_t curr_os_ts = 0;
+    uint32_t last_hook_os_ts = 0;
+#ifndef UNIT_TEST
+    while (1)
+#endif /* !UNIT_TEST */
+    {
+        /* CRITICAL:
+         * Blocking queue receive is mandatory for light sleep support */
+        if (xQueueReceive(rt_queue_handle, &trans, portMAX_DELAY) == pdTRUE) {
+            ble_log_prph_send_trans(trans);
+        }
+
+        /* Task hook */
+        curr_os_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+        if ((curr_os_ts - last_hook_os_ts) < BLE_LOG_TASK_HOOK_TIMEOUT_MS) {
+#ifndef UNIT_TEST
+            continue;
+#else /* UNIT_TEST */
+            return;
+#endif /* !UNIT_TEST */
+        }
+        last_hook_os_ts = curr_os_ts;
+
+        /* Write BLE Log info log */
+        ble_log_info_t ble_log_info = {
+            .int_src_code = BLE_LOG_INT_SRC_INFO,
+            .version = BLE_LOG_VERSION,
+        };
+        ble_log_write_hex(BLE_LOG_SRC_INTERNAL, (const uint8_t *)&ble_log_info, sizeof(ble_log_info_t));
+
+#if CONFIG_BLE_LOG_TS_ENABLED
+        if (rt_ts_enabled) {
+            ble_log_ts_info_t *ts_info = NULL;
+            ble_log_ts_info_update(&ts_info);
+            ble_log_write_hex(BLE_LOG_SRC_INTERNAL, (const uint8_t *)ts_info, sizeof(ble_log_ts_info_t));
+        }
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+        ble_log_write_enh_stat();
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+    }
+}
+
+/* INTERFACE */
+bool ble_log_rt_init(void)
+{
+    if (rt_inited) {
+        return true;
+    }
+
+    /* CRITICAL:
+     * Queue must be initialized before creating task */
+    rt_queue_handle = xQueueCreate(BLE_LOG_LBM_CNT, sizeof(ble_log_prph_trans_t *));
+    if (!rt_queue_handle) {
+        goto exit;
+    }
+
+    /* Initialize task */
+    if (xTaskCreate(ble_log_rt_task, "ble_log", BLE_LOG_TASK_STACK_SIZE, NULL,
+        BLE_LOG_TASK_PRIO, &rt_task_handle) != pdTRUE) {
+        goto exit;
+    }
+
+    rt_inited = true;
+#if CONFIG_BLE_LOG_TS_ENABLED
+    rt_ts_enabled = false;
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+    return true;
+
+exit:
+    ble_log_rt_deinit();
+    return false;
+}
+
+void ble_log_rt_deinit(void)
+{
+    rt_inited = false;
+#if CONFIG_BLE_LOG_TS_ENABLED
+    rt_ts_enabled = false;
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
+
+    /* CRITICAL:
+     * Task must be deinitialized before deinitializing queue */
+    if (rt_task_handle) {
+        vTaskDelete(rt_task_handle);
+        rt_task_handle = NULL;
+    }
+
+    /* Release task queue */
+    if (rt_queue_handle) {
+        vQueueDelete(rt_queue_handle);
+        rt_queue_handle = NULL;
+    }
+}
+
+BLE_LOG_IRAM_ATTR void ble_log_rt_queue_trans(ble_log_prph_trans_t **trans)
+{
+    (*trans)->prph_owned = true;
+    if (BLE_LOG_IN_ISR()) {
+        xQueueSendFromISR(rt_queue_handle, trans, NULL);
+    } else {
+        xQueueSend(rt_queue_handle, trans, portMAX_DELAY);
+    }
+}
+
+#if CONFIG_BLE_LOG_TS_ENABLED
+bool ble_log_sync_enable(bool enable)
+{
+    if (!rt_inited) {
+        return false;
+    }
+    rt_ts_enabled = enable;
+    return true;
+}
+#endif /* CONFIG_BLE_LOG_TS_ENABLED */
--- a/components/bt/common/ble_log/src/ble_log_ts.c
+++ b/components/bt/common/ble_log/src/ble_log_ts.c
@@ -0,0 +1,75 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* ----------------------------------- */
+/* BLE Log - Timestamp Synchronization */
+/* ----------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_ts.h"
+
+/* VARIABLE */
+BLE_LOG_STATIC bool ts_inited = false;
+BLE_LOG_STATIC ble_log_ts_info_t *ts_info = NULL;
+
+/* INTERFACE */
+bool ble_log_ts_init(void)
+{
+    if (ts_inited) {
+        return true;
+    }
+
+    /* Initialize toggle IO */
+    gpio_config_t sync_io_conf = {
+        .intr_type = GPIO_INTR_DISABLE,
+        .mode = GPIO_MODE_OUTPUT,
+        .pin_bit_mask = BIT(CONFIG_BLE_LOG_SYNC_IO_NUM),
+    };
+    if (gpio_config(&sync_io_conf) != ESP_OK) {
+        goto exit;
+    }
+
+    /* Initialize sync data */
+    ts_info = (ble_log_ts_info_t *)BLE_LOG_MALLOC(sizeof(ble_log_ts_info_t));
+    if (!ts_info) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(ts_info, 0, sizeof(ble_log_ts_info_t));
+    ts_info->int_src_code = BLE_LOG_INT_SRC_TS;
+
+    ts_inited = true;
+    return true;
+
+exit:
+    ble_log_ts_deinit();
+    return false;
+}
+
+void ble_log_ts_deinit(void)
+{
+    ts_inited = false;
+
+    /* Release sync data */
+    if (ts_info) {
+        BLE_LOG_FREE(ts_info);
+        ts_info = NULL;
+    }
+
+    /* Release toggle IO */
+    gpio_reset_pin(CONFIG_BLE_LOG_SYNC_IO_NUM);
+}
+
+void ble_log_ts_info_update(ble_log_ts_info_t **info)
+{
+    BLE_LOG_ENTER_CRITICAL();
+    ts_info->io_level = !ts_info->io_level;
+    gpio_set_level(CONFIG_BLE_LOG_SYNC_IO_NUM, ts_info->io_level);
+    ts_info->lc_ts = BLE_LOG_GET_LC_TS;
+    ts_info->esp_ts = esp_timer_get_time();
+    ts_info->os_ts = pdTICKS_TO_MS(xTaskGetTickCountFromISR());
+    BLE_LOG_EXIT_CRITICAL();
+
+    *info = ts_info;
+}
--- a/components/bt/common/ble_log/src/ble_log_util.c
+++ b/components/bt/common/ble_log/src/ble_log_util.c
@@ -0,0 +1,48 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* ----------------- */
+/* BLE Log - Utility */
+/* ----------------- */
+
+/* INCLUDE */
+#include "ble_log_util.h"
+
+/* VARIABLE */
+#ifndef UNIT_TEST
+portMUX_TYPE ble_log_spin_lock = portMUX_INITIALIZER_UNLOCKED;
+#endif /* !UNIT_TEST */
+
+/* INTERNAL INTERFACE */
+BLE_LOG_IRAM_ATTR uint32_t ble_log_fast_checksum(const uint8_t *data, size_t len)
+{
+    uint32_t sum = 0;
+    size_t i = 0;
+
+    /* Step 1: Sum up until 4-byte aligned */
+    while (((uintptr_t)(data + i) & 0x3) && (i < len)) {
+        sum += data[i++];
+    }
+
+    /* Step 2: Sum up 4-byte aligned blocks */
+    const uint32_t *p32 = (const uint32_t *)(data + i);
+    size_t blocks = (len - i) / 4;
+    for (size_t b = 0; b < blocks; b++) {
+        uint32_t v = p32[b];
+        sum += (v & 0xFF)
+             + ((v >> 8)  & 0xFF)
+             + ((v >> 16) & 0xFF)
+             + ((v >> 24) & 0xFF);
+    }
+    i += blocks * 4;
+
+    /* Step 3: Sum up remaining bytes */
+    while (i < len) {
+        sum += data[i++];
+    }
+
+    return sum;
+}
--- a/components/bt/common/ble_log/src/internal_include/ble_log_lbm.h
+++ b/components/bt/common/ble_log/src/internal_include/ble_log_lbm.h
@@ -0,0 +1,176 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_LBM_H__
+#define __BLE_LOG_LBM_H__
+
+/* --------------------------------------- */
+/*     BLE Log - Log Buffer Management     */
+/* --------------------------------------- */
+
+/* ---------------- */
+/*     Includes     */
+/* ---------------- */
+#include "ble_log_prph.h"
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/semphr.h"
+
+/* ------------------------- */
+/*     Log Frame Defines     */
+/* ------------------------- */
+typedef struct {
+    uint16_t length;
+    uint32_t frame_meta;
+} __attribute__((packed)) ble_log_frame_head_t;
+
+#define BLE_LOG_FRAME_HEAD_LEN                  (sizeof(ble_log_frame_head_t))
+#define BLE_LOG_FRAME_TAIL_LEN                  (sizeof(uint32_t))
+#define BLE_LOG_FRAME_OVERHEAD                  (BLE_LOG_FRAME_HEAD_LEN + BLE_LOG_FRAME_TAIL_LEN)
+#define BLE_LOG_MAKE_FRAME_META(src_code, sn)   ((src_code & 0xFF) | (sn << 8))
+
+/* ---------------------------------- */
+/*     Log Buffer Manager Defines     */
+/* ---------------------------------- */
+typedef enum {
+    BLE_LOG_LBM_LOCK_NONE,
+    BLE_LOG_LBM_LOCK_SPIN,
+    BLE_LOG_LBM_LOCK_ATOMIC,
+    BLE_LOG_LBM_LOCK_MUTEX,
+} ble_log_lbm_lock_t;
+
+typedef struct {
+    int trans_idx;
+    ble_log_prph_trans_t *trans[BLE_LOG_TRANS_PING_PONG_BUF_CNT];
+    ble_log_lbm_lock_t lock_type;
+    union {
+        /* BLE_LOG_LBM_LOCK_NONE */
+        void *none;
+        /* BLE_LOG_LBM_LOCK_SPIN */
+        portMUX_TYPE spin_lock;
+        /* BLE_LOG_LBM_LOCK_ATOMIC */
+        volatile bool atomic_lock;
+        /* BLE_LOG_LBM_LOCK_MUTEX */
+        SemaphoreHandle_t mutex;
+    };
+} ble_log_lbm_t;
+
+/* --------------------------------------- */
+/*     Log Buffer Manager Pool Defines     */
+/* --------------------------------------- */
+enum {
+#if CONFIG_BLE_LOG_LL_ENABLED
+    BLE_LOG_LBM_LL_TASK,
+    BLE_LOG_LBM_LL_HCI,
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+    BLE_LOG_LBM_LL_MAX,
+};
+
+enum {
+    BLE_LOG_LBM_SPIN_TASK = 0,
+    BLE_LOG_LBM_SPIN_ISR,
+    BLE_LOG_LBM_SPIN_MAX,
+};
+
+#define BLE_LOG_LBM_ATOMIC_TASK_CNT             CONFIG_BLE_LOG_LBM_ATOMIC_LOCK_TASK_CNT
+#define BLE_LOG_LBM_ATOMIC_ISR_CNT              CONFIG_BLE_LOG_LBM_ATOMIC_LOCK_ISR_CNT
+#define BLE_LOG_LBM_ATOMIC_CNT                  (BLE_LOG_LBM_ATOMIC_TASK_CNT +\
+                                                 BLE_LOG_LBM_ATOMIC_ISR_CNT)
+#define BLE_LOG_LBM_COMMON_CNT                  (BLE_LOG_LBM_ATOMIC_CNT + BLE_LOG_LBM_SPIN_MAX)
+#define BLE_LOG_LBM_CNT                         (BLE_LOG_LBM_COMMON_CNT + BLE_LOG_LBM_LL_MAX)
+#define BLE_LOG_TRANS_CNT                       (BLE_LOG_LBM_CNT * BLE_LOG_TRANS_PING_PONG_BUF_CNT)
+
+/* ------------------------------------------ */
+/*     Log Buffer Manager Context Defines     */
+/* ------------------------------------------ */
+typedef struct {
+    union {
+        ble_log_lbm_t lbm_pool[BLE_LOG_LBM_CNT];
+        struct {
+            union {
+                ble_log_lbm_t lbm_common_pool[BLE_LOG_LBM_COMMON_CNT];
+                struct {
+                    union {
+                        ble_log_lbm_t spin_pool[BLE_LOG_LBM_SPIN_MAX];
+                        struct {
+                            ble_log_lbm_t spin_task;
+                            ble_log_lbm_t spin_isr;
+                        };
+                    };
+                    union {
+                        ble_log_lbm_t atomic_pool[BLE_LOG_LBM_ATOMIC_CNT];
+                        struct {
+                            ble_log_lbm_t atomic_pool_task[BLE_LOG_LBM_ATOMIC_TASK_CNT];
+                            ble_log_lbm_t atomic_pool_isr[BLE_LOG_LBM_ATOMIC_ISR_CNT];
+                        };
+                    };
+                };
+            };
+            union {
+                ble_log_lbm_t lbm_ll_pool[BLE_LOG_LBM_LL_MAX];
+#if CONFIG_BLE_LOG_LL_ENABLED
+                struct {
+                    ble_log_lbm_t lbm_ll_task;
+                    ble_log_lbm_t lbm_ll_hci;
+                };
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+            };
+        };
+    };
+} ble_log_lbm_ctx_t;
+
+/* ---------------------------------------- */
+/*     Enhanced Statistics Data Defines     */
+/* ---------------------------------------- */
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+typedef struct {
+    uint8_t int_src_code;
+    uint8_t src_code;
+    uint32_t written_frame_cnt;
+    uint32_t lost_frame_cnt;
+    uint32_t written_bytes_cnt;
+    uint32_t lost_bytes_cnt;
+} __attribute__((packed)) ble_log_enh_stat_t;
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+/* -------------------------------------- */
+/*     Log Statistics Manager Context     */
+/* -------------------------------------- */
+typedef struct {
+    uint32_t frame_sn;
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+    ble_log_enh_stat_t enh_stat;
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+} ble_log_stat_mgr_t;
+
+#define BLE_LOG_GET_FRAME_SN(VAR)               __atomic_fetch_add(VAR, 1, __ATOMIC_RELAXED)
+
+/* -------------------------- */
+/*     Link Layer Defines     */
+/* -------------------------- */
+#if CONFIG_BLE_LOG_LL_ENABLED
+enum {
+    BLE_LOG_LL_FLAG_CONTINUE = 0,
+    BLE_LOG_LL_FLAG_END,
+    BLE_LOG_LL_FLAG_TASK,
+    BLE_LOG_LL_FLAG_ISR,
+    BLE_LOG_LL_FLAG_HCI,
+    BLE_LOG_LL_FLAG_RAW,
+    BLE_LOG_LL_FLAG_HCI_UPSTREAM,
+};
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+
+/* --------------------------- */
+/*     Internal Interfaces     */
+/* --------------------------- */
+bool ble_log_lbm_init(void);
+void ble_log_lbm_deinit(void);
+ble_log_prph_trans_t **ble_log_lbm_get_trans(ble_log_lbm_t *lbm, size_t log_len);
+void ble_log_lbm_enable(bool enable);
+#if CONFIG_BLE_LOG_ENH_STAT_ENABLED
+void ble_log_write_enh_stat(void);
+#endif /* CONFIG_BLE_LOG_ENH_STAT_ENABLED */
+
+#endif /* __BLE_LOG_LBM_H__ */
--- a/components/bt/common/ble_log/src/internal_include/ble_log_prph.h
+++ b/components/bt/common/ble_log/src/internal_include/ble_log_prph.h
@@ -0,0 +1,37 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_PRPH_H__
+#define __BLE_LOG_PRPH_H__
+
+/* ------------------------------ */
+/* BLE Log - Peripheral Interface */
+/* ------------------------------ */
+
+/* INCLUDE */
+#include "ble_log_util.h"
+
+/* TYPEDEF */
+typedef struct {
+    volatile bool prph_owned;
+    uint8_t *buf;
+    uint16_t size;
+    uint16_t pos;
+
+    /* Peripheral implementation specific context */
+    void *ctx;
+} ble_log_prph_trans_t;
+
+#define BLE_LOG_TRANS_FREE_SPACE(trans)         (trans->size - trans->pos)
+#define BLE_LOG_TRANS_PING_PONG_BUF_CNT         (2)
+
+/* INTERFACE */
+bool ble_log_prph_init(size_t trans_cnt);
+void ble_log_prph_deinit(void);
+bool ble_log_prph_trans_init(ble_log_prph_trans_t **trans, size_t trans_size);
+void ble_log_prph_trans_deinit(ble_log_prph_trans_t **trans);
+void ble_log_prph_send_trans(ble_log_prph_trans_t *trans);
+
+#endif /* __BLE_LOG_PRPH_H__ */
--- a/components/bt/common/ble_log/src/internal_include/ble_log_rt.h
+++ b/components/bt/common/ble_log/src/internal_include/ble_log_rt.h
@@ -0,0 +1,32 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_RT_H__
+#define __BLE_LOG_RT_H__
+
+/* ----------------- */
+/* BLE Log - Runtime */
+/* ----------------- */
+
+/* INCLUDE */
+#include "ble_log_prph.h"
+#include "ble_log_ts.h"
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/queue.h"
+#include "esp_task.h"
+
+/* MACRO */
+#define BLE_LOG_TASK_PRIO                       (ESP_TASK_PRIO_MAX - 1)
+#define BLE_LOG_TASK_STACK_SIZE                 (1024)
+#define BLE_LOG_TASK_HOOK_TIMEOUT_MS            (1000)
+
+/* INTERFACE */
+bool ble_log_rt_init();
+void ble_log_rt_deinit(void);
+void ble_log_rt_queue_trans(ble_log_prph_trans_t **trans);
+
+#endif /* __BLE_LOG_RT_H__ */
--- a/components/bt/common/ble_log/src/internal_include/ble_log_ts.h
+++ b/components/bt/common/ble_log/src/internal_include/ble_log_ts.h
@@ -0,0 +1,57 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_TS_H__
+#define __BLE_LOG_TS_H__
+
+/* ----------------------------------- */
+/* BLE Log - Timestamp Synchronization */
+/* ----------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_util.h"
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "esp_timer.h"
+#include "driver/gpio.h"
+
+/* MACRO */
+#if CONFIG_BLE_LOG_LL_ENABLED
+/* ESP BLE Controller Gen 2 */
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6) || defined(CONFIG_IDF_TARGET_ESP32C5) ||\
+    defined(CONFIG_IDF_TARGET_ESP32C61) || defined(CONFIG_IDF_TARGET_ESP32H21) || defined(CONFIG_IDF_TARGET_ESP32H4)
+extern uint32_t r_ble_lll_timer_current_tick_get(void);
+#define BLE_LOG_GET_LC_TS r_ble_lll_timer_current_tick_get()
+/* ESP BLE Controller Gen 1 */
+#elif defined(CONFIG_IDF_TARGET_ESP32C2)
+extern uint32_t r_os_cputime_get32(void);
+#define BLE_LOG_GET_LC_TS r_os_cputime_get32()
+/* Legacy BLE Controller (Wait for support) */
+// #elif defined(CONFIG_IDF_TARGET_ESP32C3) || defined(CONFIG_IDF_TARGET_ESP32S3)
+// extern uint32_t lld_read_clock_us(void);
+// #define BLE_LOG_GET_LC_TS lld_read_clock_us()
+#else /* Other targets */
+#define BLE_LOG_GET_LC_TS 0
+#endif /* BLE targets */
+#else /* !CONFIG_BLE_LOG_LL_ENABLED */
+#define BLE_LOG_GET_LC_TS 0
+#endif /* CONFIG_BLE_LOG_LL_ENABLED */
+
+/* TYPEDEF */
+typedef struct {
+    uint8_t int_src_code;
+    uint8_t io_level;
+    uint32_t lc_ts;
+    uint32_t esp_ts;
+    uint32_t os_ts;
+} __attribute__((packed)) ble_log_ts_info_t;
+
+/* INTERFACE */
+bool ble_log_ts_init(void);
+void ble_log_ts_deinit(void);
+void ble_log_ts_info_update(ble_log_ts_info_t **ts_info);
+
+#endif /* __BLE_LOG_TS_H__ */
--- a/components/bt/common/ble_log/src/internal_include/ble_log_util.h
+++ b/components/bt/common/ble_log/src/internal_include/ble_log_util.h
@@ -0,0 +1,153 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_UTIL_H__
+#define __BLE_LOG_UTIL_H__
+
+/* ----------------- */
+/* BLE Log - Utility */
+/* ----------------- */
+
+/* INCLUDE */
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include "esp_bit_defs.h"
+#include "freertos/FreeRTOS.h"
+
+#ifndef UNIT_TEST
+#include "esp_heap_caps.h"
+#include "esp_rom_uart.h"
+#endif /* !UNIT_TEST */
+
+/* MACRO */
+/* Unit test */
+#ifndef UNIT_TEST
+
+/* Reference counting macros */
+#define BLE_LOG_REF_COUNT_ACQUIRE(VAR)          __atomic_fetch_add(VAR, 1, __ATOMIC_ACQUIRE)
+#define BLE_LOG_REF_COUNT_RELEASE(VAR)          __atomic_fetch_sub(VAR, 1, __ATOMIC_RELEASE)
+
+/* Specifier */
+#define BLE_LOG_STATIC                          static
+#define BLE_LOG_INLINE                          inline
+
+/* Section */
+#define BLE_LOG_IRAM_ATTR                       IRAM_ATTR
+
+/* Memory operation */
+#define BLE_LOG_MEM_CAP                         (MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT | MALLOC_CAP_DMA)
+#define BLE_LOG_MALLOC(size)                    heap_caps_malloc(size, BLE_LOG_MEM_CAP)
+#define BLE_LOG_FREE(ptr)                       heap_caps_free(ptr)
+#define BLE_LOG_MEMCPY(dst, src, len)           memcpy(dst, src, len)
+#define BLE_LOG_MEMSET(ptr, value, len)         memset(ptr, value, len)
+
+/* Critical section wrapper */
+extern portMUX_TYPE ble_log_spin_lock;
+#define BLE_LOG_ENTER_CRITICAL()                portENTER_CRITICAL_SAFE(&ble_log_spin_lock);
+#define BLE_LOG_EXIT_CRITICAL()                 portEXIT_CRITICAL_SAFE(&ble_log_spin_lock);
+
+#define BLE_LOG_ACQUIRE_SPIN_LOCK(spin_lock)    portENTER_CRITICAL_SAFE(spin_lock)
+#define BLE_LOG_RELEASE_SPIN_LOCK(spin_lock)    portEXIT_CRITICAL_SAFE(spin_lock)
+
+#define BLE_LOG_IN_ISR()                        xPortInIsrContext()
+#define BLE_LOG_CONSOLE                         esp_rom_printf
+#define BLE_LOG_ASSERT(expr)                    assert(expr)
+
+extern void esp_panic_handler_feed_wdts(void);
+#define BLE_LOG_FEED_WDT()                      esp_panic_handler_feed_wdts()
+
+/* INLINE */
+BLE_LOG_IRAM_ATTR static inline
+bool ble_log_cas_acquire(volatile bool *cas_lock)
+{
+    bool expected = false;
+    return __atomic_compare_exchange_n(
+        cas_lock, &expected, true, false, __ATOMIC_ACQUIRE, __ATOMIC_RELAXED
+    );
+}
+
+BLE_LOG_IRAM_ATTR static inline
+void ble_log_cas_release(volatile bool *cas_lock)
+{
+    __atomic_store_n(cas_lock, false, __ATOMIC_RELEASE);
+}
+
+#else /* UNIT_TEST */
+
+/* Reference counting macros */
+#define BLE_LOG_REF_COUNT_ACQUIRE(VAR)          (*VAR)++
+#define BLE_LOG_REF_COUNT_RELEASE(VAR)          (*VAR)--
+
+/* Specifier*/
+#define BLE_LOG_STATIC
+#define BLE_LOG_INLINE
+
+/* Section */
+#define BLE_LOG_IRAM_ATTR
+
+/* Memory operation */
+void *mocked_malloc(size_t size);
+void mocked_free(void *ptr);
+void mocked_memcpy(void *dst, const void *src, size_t len);
+void mocked_memset(void *ptr, int value, size_t len);
+#define BLE_LOG_MALLOC(size)                    mocked_malloc(size)
+#define BLE_LOG_FREE(ptr)                       mocked_free(ptr)
+#define BLE_LOG_MEMCPY(dst, src, len)           mocked_memcpy(dst, src, len)
+#define BLE_LOG_MEMSET(ptr, value, len)         mocked_memset(ptr, value, len)
+
+/* Critical section wrapper */
+void mocked_enter_critical(void);
+void mocked_exit_critical(void);
+#define BLE_LOG_ENTER_CRITICAL()                mocked_enter_critical()
+#define BLE_LOG_EXIT_CRITICAL()                 mocked_exit_critical()
+
+/* FreeRTOS API wrapper */
+bool mocked_in_isr(void);
+#define BLE_LOG_IN_ISR()                        mocked_in_isr()
+
+/* Spin lock wrapper */
+void mocked_acquire_spin_lock(void *spin_lock);
+void mocked_release_spin_lock(void *spin_lock);
+#define BLE_LOG_ACQUIRE_SPIN_LOCK(spin_lock)    mocked_acquire_spin_lock(spin_lock)
+#define BLE_LOG_RELEASE_SPIN_LOCK(spin_lock)    mocked_release_spin_lock(spin_lock)
+
+/* Printf wrapper */
+void mocked_printf(const char *fmt, ...);
+#define BLE_LOG_CONSOLE                         mocked_printf
+
+/* Assert wrapper */
+void mocked_assert(bool expr);
+#define BLE_LOG_ASSERT(expr)                    mocked_assert(expr)
+
+#define BLE_LOG_FEED_WDT()
+
+bool ble_log_cas_acquire(volatile bool *cas_lock);
+void ble_log_cas_release(volatile bool *cas_lock);
+#endif /* UNIT_TEST */
+
+#define BLE_LOG_VERSION                         (2)
+
+/* TYPEDEF */
+typedef enum {
+    BLE_LOG_INT_SRC_INIT_DONE,
+    BLE_LOG_INT_SRC_TS,
+    BLE_LOG_INT_SRC_ENH_STAT,
+    BLE_LOG_INT_SRC_INFO,
+    BLE_LOG_INT_SRC_FLUSH,
+    BLE_LOG_INT_SRC_MAX,
+} ble_log_int_src_t;
+
+typedef struct {
+    uint8_t int_src_code;
+    uint8_t version;
+} __attribute__((packed)) ble_log_info_t;
+
+/* INTERFACE */
+uint32_t ble_log_fast_checksum(const uint8_t *data, size_t len);
+
+#endif /* __BLE_LOG_UTIL_H__ */
--- a/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_dummy.h
+++ b/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_dummy.h
@@ -0,0 +1,21 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_PRPH_DUMMY_H__
+#define __BLE_LOG_PRPH_DUMMY_H__
+
+/* ----------------------------------------------- */
+/* BLE Log - Peripheral-specific Transport - Dummy */
+/* ----------------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph.h"
+
+/* TYPEDEF */
+typedef struct {
+    uint8_t *trans_buf;
+} ble_log_prph_trans_ctx_t;
+
+#endif /* __BLE_LOG_PRPH_DUMMY_H__ */
--- a/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_spi_master_dma.h
+++ b/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_spi_master_dma.h
@@ -0,0 +1,22 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_PRPH_SPI_MASTER_DMA_H__
+#define __BLE_LOG_PRPH_SPI_MASTER_DMA_H__
+
+/* ----------------------------------------------- */
+/* BLE Log - Peripheral Interface - SPI Master DMA */
+/* ----------------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph.h"
+
+#include <string.h>
+#include "driver/spi_master.h"
+
+/* TYPEDEF */
+typedef spi_transaction_t ble_log_prph_trans_ctx_t;
+
+#endif /* __BLE_LOG_PRPH_SPI_MASTER_DMA_H__ */
--- a/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_uart_dma.h
+++ b/components/bt/common/ble_log/src/internal_include/prph/ble_log_prph_uart_dma.h
@@ -0,0 +1,32 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BLE_LOG_PRPH_UART_DMA_H__
+#define __BLE_LOG_PRPH_UART_DMA_H__
+
+/* ----------------------------------------- */
+/* BLE Log - Peripheral Interface - UART DMA */
+/* ----------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph.h"
+
+#include "driver/uart.h"
+#include "driver/uhci.h"
+
+/* MACRO */
+#if CONFIG_BLE_LOG_PRPH_UART_DMA_PORT == UART_NUM_0
+#define BLE_LOG_PRPH_UART_DMA_REDIR         (1)
+#else
+#define BLE_LOG_PRPH_UART_DMA_REDIR         (0)
+#endif /* CONFIG_BLE_LOG_PRPH_UART_DMA_PORT == UART_NUM_0 */
+
+/* TYPEDEF */
+typedef struct {
+    ble_log_prph_trans_t *trans;
+    uint8_t trans_buf[0];
+} ble_log_prph_trans_ctx_t;
+
+#endif /* __BLE_LOG_PRPH_UART_DMA_H__ */
--- a/components/bt/common/ble_log/src/prph/ble_log_prph_dummy.c
+++ b/components/bt/common/ble_log/src/prph/ble_log_prph_dummy.c
@@ -0,0 +1,86 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* ----------------------------------------------- */
+/* BLE Log - Peripheral-specific Transport - Dummy */
+/* ----------------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph_dummy.h"
+
+/* INTERFACE */
+bool ble_log_prph_init(size_t trans_cnt)
+{
+    (void)trans_cnt;
+    return true;
+}
+
+void ble_log_prph_deinit(void)
+{
+}
+
+bool ble_log_prph_trans_init(ble_log_prph_trans_t **trans, size_t trans_size)
+{
+    /* Validate inputs */
+    if (!trans || !trans_size) {
+        return false;
+    }
+
+    /* Initialize peripheral transport data */
+    *trans = (ble_log_prph_trans_t *)BLE_LOG_MALLOC(sizeof(ble_log_prph_trans_t));
+    if (!(*trans)) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(*trans, 0, sizeof(ble_log_prph_trans_t));
+    (*trans)->size = trans_size;
+
+    /* Initialize peripheral-specific transport context */
+    ble_log_prph_trans_ctx_t *dummy_trans_ctx = (ble_log_prph_trans_ctx_t *)BLE_LOG_MALLOC(sizeof(ble_log_prph_trans_ctx_t));
+    if (!dummy_trans_ctx) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(dummy_trans_ctx, 0, sizeof(ble_log_prph_trans_ctx_t));
+    (*trans)->ctx = (void *)dummy_trans_ctx;
+
+    /* Initialize log buffer */
+    (*trans)->buf = (uint8_t *)BLE_LOG_MALLOC(trans_size);
+    if (!(*trans)->buf) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET((*trans)->buf, 0, trans_size);
+    dummy_trans_ctx->trans_buf = (*trans)->buf;
+    return true;
+
+exit:
+    ble_log_prph_trans_deinit(trans);
+    return false;
+}
+
+void ble_log_prph_trans_deinit(ble_log_prph_trans_t **trans)
+{
+    /* Validate inputs */
+    if (!trans || !(*trans)) {
+        return;
+    }
+
+    /* Release log buffer */
+    if ((*trans)->buf) {
+        BLE_LOG_FREE((*trans)->buf);
+    }
+
+    /* Release peripheral-specific transport context */
+    if ((*trans)->ctx) {
+        BLE_LOG_FREE((*trans)->ctx);
+    }
+
+    /* Release peripheral transport data */
+    BLE_LOG_FREE(*trans);
+    *trans = NULL;
+}
+
+void ble_log_prph_send_trans(ble_log_prph_trans_t *trans)
+{
+    (void)trans;
+}
--- a/components/bt/common/ble_log/src/prph/ble_log_prph_spi_master_dma.c
+++ b/components/bt/common/ble_log/src/prph/ble_log_prph_spi_master_dma.c
@@ -0,0 +1,184 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/* ----------------------------------------------- */
+/* BLE Log - Peripheral Interface - SPI Master DMA */
+/* ----------------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph_spi_master_dma.h"
+
+#include "esp_timer.h"
+
+/* MACRO */
+#define BLE_LOG_SPI_BUS                     SPI2_HOST
+#define BLE_LOG_SPI_MAX_TRANSFER_SIZE       (10240)
+#define BLE_LOG_SPI_TRANS_ITVL_MIN_US       (30)
+
+/* VARIABLE */
+BLE_LOG_STATIC bool prph_inited = false;
+BLE_LOG_STATIC spi_device_handle_t dev_handle = NULL;
+BLE_LOG_STATIC uint32_t last_tx_done_ts = 0;
+
+/* PRIVATE FUNCTION DECLARATION */
+BLE_LOG_STATIC void spi_master_dma_tx_done_cb(spi_transaction_t *spi_trans);
+BLE_LOG_STATIC void spi_master_dma_pre_tx_cb(spi_transaction_t *spi_trans);
+
+/* PRIVATE FUNCTION */
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC void spi_master_dma_tx_done_cb(spi_transaction_t *spi_trans)
+{
+    /* SPI slave performance issue workaround */
+    last_tx_done_ts = esp_timer_get_time();
+
+    /* Recycle transport */
+    ble_log_prph_trans_t *trans = (ble_log_prph_trans_t *)(spi_trans->user);
+    trans->pos = 0;
+    trans->prph_owned = false;
+}
+
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC void spi_master_dma_pre_tx_cb(spi_transaction_t *spi_trans)
+{
+    /* SPI slave performance issue workaround */
+    while ((esp_timer_get_time() - last_tx_done_ts) < BLE_LOG_SPI_TRANS_ITVL_MIN_US) {}
+}
+
+/* INTERFACE */
+bool ble_log_prph_init(size_t trans_cnt)
+{
+    /* Avoid double init */
+    if (prph_inited) {
+        return true;
+    }
+
+    /* SPI master initialization */
+    spi_bus_config_t bus_config = {
+        .miso_io_num = -1,
+        .mosi_io_num = CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA_MOSI_IO_NUM,
+        .sclk_io_num = CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA_SCLK_IO_NUM,
+        .quadwp_io_num = -1,
+        .quadhd_io_num = -1,
+        .max_transfer_sz = BLE_LOG_SPI_MAX_TRANSFER_SIZE,
+#if CONFIG_SPI_MASTER_ISR_IN_IRAM
+        .intr_flags = ESP_INTR_FLAG_IRAM
+#endif // CONFIG_SPI_MASTER_ISR_IN_IRAM
+    };
+    if (spi_bus_initialize(BLE_LOG_SPI_BUS, &bus_config, SPI_DMA_CH_AUTO) != ESP_OK) {
+        goto exit;
+    }
+
+    spi_device_interface_config_t dev_config = {
+        .clock_speed_hz = SPI_MASTER_FREQ_20M,
+        .mode = 0,
+        .spics_io_num = CONFIG_BLE_LOG_PRPH_SPI_MASTER_DMA_CS_IO_NUM,
+        .queue_size = trans_cnt,
+        .post_cb = spi_master_dma_tx_done_cb,
+        .pre_cb = spi_master_dma_pre_tx_cb,
+        .flags = SPI_DEVICE_NO_RETURN_RESULT
+    };
+    if (spi_bus_add_device(BLE_LOG_SPI_BUS, &dev_config, &dev_handle) != ESP_OK) {
+        goto exit;
+    }
+
+    /* Initialization done */
+    prph_inited = true;
+    return true;
+
+exit:
+    ble_log_prph_deinit();
+    return false;
+}
+
+void ble_log_prph_deinit(void)
+{
+    prph_inited = false;
+    if (dev_handle) {
+        /* Drain all queued transactions */
+        if (spi_device_acquire_bus(dev_handle, portMAX_DELAY) == ESP_OK) {
+            spi_device_release_bus(dev_handle);
+            spi_bus_remove_device(dev_handle);
+            dev_handle = NULL;
+        }
+    }
+
+    /* Note: We don't care if the bus has been inited or not */
+    spi_bus_free(BLE_LOG_SPI_BUS);
+}
+
+bool ble_log_prph_trans_init(ble_log_prph_trans_t **trans, size_t trans_size)
+{
+    /* Validate inputs */
+    if (!trans || !trans_size) {
+        return false;
+    }
+
+    /* Initialize peripheral transport data */
+    *trans = (ble_log_prph_trans_t *)BLE_LOG_MALLOC(sizeof(ble_log_prph_trans_t));
+    if (!(*trans)) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(*trans, 0, sizeof(ble_log_prph_trans_t));
+    (*trans)->size = trans_size;
+
+    /* Initialize peripheral-specific transport context */
+    ble_log_prph_trans_ctx_t *spi_trans_ctx = (ble_log_prph_trans_ctx_t *)BLE_LOG_MALLOC(sizeof(ble_log_prph_trans_ctx_t));
+    if (!spi_trans_ctx) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(spi_trans_ctx, 0, sizeof(ble_log_prph_trans_ctx_t));
+    spi_trans_ctx->user = (void *)(*trans);
+    (*trans)->ctx = (void *)spi_trans_ctx;
+
+    /* Initialize log buffer */
+    (*trans)->buf = (uint8_t *)BLE_LOG_MALLOC(trans_size);
+    if (!(*trans)->buf) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET((*trans)->buf, 0, trans_size);
+    spi_trans_ctx->tx_buffer = (const void *)(*trans)->buf;
+    return true;
+
+exit:
+    ble_log_prph_trans_deinit(trans);
+    return false;
+}
+
+void ble_log_prph_trans_deinit(ble_log_prph_trans_t **trans)
+{
+    /* Validate inputs */
+    if (!trans || !(*trans)) {
+        return;
+    }
+
+    /* Release log buffer */
+    if ((*trans)->buf) {
+        BLE_LOG_FREE((*trans)->buf);
+    }
+
+    /* Release peripheral-specific transport context */
+    if ((*trans)->ctx) {
+        BLE_LOG_FREE((*trans)->ctx);
+    }
+
+    /* Release peripheral transport data */
+    BLE_LOG_FREE(*trans);
+    *trans = NULL;
+}
+
+/* CRITICAL:
+ * This function is designed to be called by BLE Log Runtime only,
+ * function call from any other submodules is not allowed */
+BLE_LOG_IRAM_ATTR void ble_log_prph_send_trans(ble_log_prph_trans_t *trans)
+{
+    spi_transaction_t *spi_trans = (spi_transaction_t *)trans->ctx;
+
+    /* CRITICAL:
+     * Bytes to bits length conversion is required for tx, and rxlength must be
+     * cleared regardless of whether it is used for rx as per SPI master driver */
+    spi_trans->length = (trans->pos << 3);
+    spi_trans->rxlength = 0;
+    if (spi_device_queue_trans(dev_handle, spi_trans, 0) != ESP_OK) {
+        trans->prph_owned = false;
+    }
+}
--- a/components/bt/common/ble_log/src/prph/ble_log_prph_uart_dma.c
+++ b/components/bt/common/ble_log/src/prph/ble_log_prph_uart_dma.c
@@ -0,0 +1,329 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/* ----------------------------------------- */
+/* BLE Log - Peripheral Interface - UART DMA */
+/* ----------------------------------------- */
+
+/* INCLUDE */
+#include "ble_log_prph_uart_dma.h"
+
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+#include "ble_log.h"
+#include "ble_log_rt.h"
+#include "ble_log_lbm.h"
+
+#include "esp_timer.h"
+#include "driver/uart.h"
+#include "driver/uart_vfs.h"
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+/* MACRO */
+#define BLE_LOG_UART_MAX_TRANSFER_SIZE      (10240)
+#define BLE_LOG_UART_RX_BUF_SIZE            (256)
+#define BLE_LOG_UART_DMA_BURST_SIZE         (32)
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+#define BLE_LOG_UART_REDIR_BUF_SIZE         (512)
+#define BLE_LOG_UART_REDIR_FLUSH_TIMEOUT    (100)
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+/* VARIABLE */
+BLE_LOG_STATIC bool prph_inited = false;
+BLE_LOG_STATIC uhci_controller_handle_t dev_handle = NULL;
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+BLE_LOG_STATIC bool uart_driver_inited = false;
+BLE_LOG_STATIC ble_log_lbm_t *redir_lbm = NULL;
+BLE_LOG_STATIC uint32_t redir_last_write_ts = 0;
+BLE_LOG_STATIC esp_timer_handle_t redir_flush_timer = NULL;
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+/* PRIVATE FUNCTION DECLARATION */
+BLE_LOG_STATIC bool uart_dma_tx_done_cb(
+    uhci_controller_handle_t uhci_ctrl, const uhci_tx_done_event_data_t *edata, void *user_ctx);
+
+/* PRIVATE FUNCTION */
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC bool uart_dma_tx_done_cb(
+    uhci_controller_handle_t uhci_ctrl, const uhci_tx_done_event_data_t *edata, void *user_ctx)
+{
+    /* Unused arguments */
+    (void)uhci_ctrl;
+    (void)user_ctx;
+
+    /* Recycle transport */
+    ble_log_prph_trans_ctx_t *uart_trans_ctx = (ble_log_prph_trans_ctx_t *)(
+        (uint8_t *)edata->buffer - sizeof(ble_log_prph_trans_ctx_t)
+    );
+    ble_log_prph_trans_t *trans = uart_trans_ctx->trans;
+    trans->pos = 0;
+    trans->prph_owned = false;
+    return true;
+}
+
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC void esp_timer_cb_flush_log(void)
+{
+    uint32_t os_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+    if ((os_ts - redir_last_write_ts) > BLE_LOG_UART_REDIR_FLUSH_TIMEOUT) {
+        xSemaphoreTake(redir_lbm->mutex, portMAX_DELAY);
+        int trans_idx = redir_lbm->trans_idx;
+        for (int i = 0; i < BLE_LOG_TRANS_PING_PONG_BUF_CNT; i++) {
+            ble_log_prph_trans_t **trans = &(redir_lbm->trans[trans_idx]);
+            if (!(*trans)->prph_owned && (*trans)->pos) {
+                ble_log_rt_queue_trans(trans);
+            }
+            trans_idx = !trans_idx;
+        }
+        xSemaphoreGive(redir_lbm->mutex);
+    }
+}
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+/* INTERFACE */
+bool ble_log_prph_init(size_t trans_cnt)
+{
+    /* Avoid double init */
+    if (prph_inited) {
+        return true;
+    }
+
+    /* Initialize UART */
+    uart_config_t uart_config = {
+        .baud_rate = CONFIG_BLE_LOG_PRPH_UART_DMA_BAUD_RATE,
+        .data_bits = UART_DATA_8_BITS,
+        .parity = UART_PARITY_DISABLE,
+        .stop_bits = UART_STOP_BITS_1,
+    };
+    if ((uart_param_config(CONFIG_BLE_LOG_PRPH_UART_DMA_PORT, &uart_config) != ESP_OK) ||
+        (uart_set_pin(CONFIG_BLE_LOG_PRPH_UART_DMA_PORT,
+                      CONFIG_BLE_LOG_PRPH_UART_DMA_TX_IO_NUM, -1, -1, -1) != ESP_OK)) {
+        goto exit;
+    }
+
+    /* Initialize UHCI */
+    uhci_controller_config_t uhci_config = {
+        .uart_port = CONFIG_BLE_LOG_PRPH_UART_DMA_PORT,
+        .tx_trans_queue_depth = trans_cnt,
+        .max_receive_internal_mem = BLE_LOG_UART_RX_BUF_SIZE,
+        .max_transmit_size = BLE_LOG_UART_MAX_TRANSFER_SIZE,
+        .dma_burst_size = BLE_LOG_UART_DMA_BURST_SIZE,
+        .rx_eof_flags.idle_eof = 1,
+    };
+    uhci_event_callbacks_t uhci_cbs = {
+        .on_tx_trans_done = uart_dma_tx_done_cb,
+    };
+    if ((uhci_new_controller(&uhci_config, &dev_handle) != ESP_OK) ||
+        (uhci_register_event_callbacks(dev_handle, &uhci_cbs, NULL) != ESP_OK)) {
+        goto exit;
+    }
+
+/* Redirection is required when utilizing UART port 0 */
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+    /* Initialize a dedicated LBM for redirection */
+    redir_lbm = (ble_log_lbm_t *)BLE_LOG_MALLOC(sizeof(ble_log_lbm_t));
+    if (!redir_lbm) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(redir_lbm, 0, sizeof(ble_log_lbm_t));
+
+    /* Transport initialization */
+    for (int i = 0; i < BLE_LOG_TRANS_PING_PONG_BUF_CNT; i++) {
+        if (!ble_log_prph_trans_init(&(redir_lbm->trans[i]),
+                                     BLE_LOG_UART_REDIR_BUF_SIZE)) {
+            goto exit;
+        }
+    }
+
+    /* Mutex initilaization */
+    redir_lbm->mutex = xSemaphoreCreateMutex();
+    if (!redir_lbm->mutex) {
+        goto exit;
+    }
+
+    /* Initialize UART driver for redirection */
+    if (!uart_is_driver_installed(UART_NUM_0)) {
+        uart_driver_install(UART_NUM_0, BLE_LOG_UART_RX_BUF_SIZE, 0, 0, NULL, 0);
+        uart_driver_inited = true;
+    }
+    uart_vfs_dev_use_driver(UART_NUM_0);
+
+    /* Initialize periodic flush timer */
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_flush_log,
+        .dispatch_method = ESP_TIMER_TASK,
+    };
+    if (esp_timer_create(&timer_args, &redir_flush_timer) != ESP_OK) {
+        goto exit;
+    }
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+    prph_inited = true;
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+    esp_timer_start_periodic(redir_flush_timer, BLE_LOG_UART_REDIR_FLUSH_TIMEOUT);
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+    return true;
+
+exit:
+    ble_log_prph_deinit();
+    return false;
+}
+
+void ble_log_prph_deinit(void)
+{
+    prph_inited = false;
+
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+    /* Release flush timer */
+    if (redir_flush_timer) {
+        esp_timer_stop(redir_flush_timer);
+        esp_timer_delete(redir_flush_timer);
+        redir_flush_timer = NULL;
+    }
+
+    /* Delete UART driver if it's installed by current module */
+    if (uart_driver_inited) {
+        uart_driver_delete(UART_NUM_0);
+    }
+
+    /* Release redirection LBM */
+    if (redir_lbm) {
+        /* Release mutex */
+        if (redir_lbm->mutex) {
+            xSemaphoreTake(redir_lbm->mutex, portMAX_DELAY);
+            xSemaphoreGive(redir_lbm->mutex);
+            vSemaphoreDelete(redir_lbm->mutex);
+        }
+
+        /* Release transport */
+        for (int i = 0; i < BLE_LOG_TRANS_PING_PONG_BUF_CNT; i++) {
+            ble_log_prph_trans_deinit(&(redir_lbm->trans[i]));
+        }
+
+        /* Release LBM */
+        BLE_LOG_FREE(redir_lbm);
+        redir_lbm = NULL;
+    }
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
+
+    if (dev_handle) {
+        uhci_wait_all_tx_transaction_done(dev_handle, portMAX_DELAY);
+        uhci_del_controller(dev_handle);
+        dev_handle = NULL;
+    }
+}
+
+bool ble_log_prph_trans_init(ble_log_prph_trans_t **trans, size_t trans_size)
+{
+    /* Validate inputs */
+    if (!trans || !trans_size) {
+        return false;
+    }
+
+    /* Initialize peripheral transport data */
+    *trans = (ble_log_prph_trans_t *)BLE_LOG_MALLOC(sizeof(ble_log_prph_trans_t));
+    if (!(*trans)) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(*trans, 0, sizeof(ble_log_prph_trans_t));
+    (*trans)->size = trans_size;
+
+    /* Initialize peripheral-specific transport context */
+    size_t trans_ctx_size = sizeof(ble_log_prph_trans_ctx_t) + trans_size;
+    ble_log_prph_trans_ctx_t *uart_trans_ctx = (ble_log_prph_trans_ctx_t *)BLE_LOG_MALLOC(trans_ctx_size);
+    if (!uart_trans_ctx) {
+        goto exit;
+    }
+    BLE_LOG_MEMSET(uart_trans_ctx, 0, trans_ctx_size);
+
+    /* Log buffer linking */
+    (*trans)->ctx = (void *)uart_trans_ctx;
+    (*trans)->buf = (uint8_t *)uart_trans_ctx->trans_buf;
+    uart_trans_ctx->trans = *trans;
+    return true;
+
+exit:
+    ble_log_prph_trans_deinit(trans);
+    return false;
+}
+
+void ble_log_prph_trans_deinit(ble_log_prph_trans_t **trans)
+{
+    /* Validate inputs */
+    if (!trans || !(*trans)) {
+        return;
+    }
+
+    /* Release peripheral-specific transport context */
+    if ((*trans)->ctx) {
+        BLE_LOG_FREE((*trans)->ctx);
+    }
+
+    /* Release peripheral transport data */
+    BLE_LOG_FREE(*trans);
+    *trans = NULL;
+}
+
+/* CRITICAL:
+ * This function is designed to be called by BLE Log Runtime only,
+ * function call from any other submodules is not allowed */
+BLE_LOG_IRAM_ATTR void ble_log_prph_send_trans(ble_log_prph_trans_t *trans)
+{
+    if (uhci_transmit(dev_handle, trans->buf, trans->pos) != ESP_OK) {
+        trans->prph_owned = false;
+    }
+}
+
+/* Redirection is required when utilizing UART port 0 */
+#if BLE_LOG_PRPH_UART_DMA_REDIR
+BLE_LOG_IRAM_ATTR BLE_LOG_STATIC
+void ble_log_redir_uart_tx_chars(const char *src, size_t len)
+{
+    xSemaphoreTake(redir_lbm->mutex, portMAX_DELAY);
+    ble_log_prph_trans_t **trans = ble_log_lbm_get_trans(redir_lbm, len);
+    if (trans) {
+        uint8_t *buf = (*trans)->buf + (*trans)->pos;
+        BLE_LOG_MEMCPY(buf, src, len);
+        (*trans)->pos += len;
+        redir_last_write_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+
+        if (BLE_LOG_TRANS_FREE_SPACE((*trans)) <= BLE_LOG_FRAME_OVERHEAD) {
+            ble_log_rt_queue_trans(trans);
+        }
+    }
+    xSemaphoreGive(redir_lbm->mutex);
+}
+
+int __real_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len);
+int __wrap_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len)
+{
+    if (!prph_inited || (uart_num != UART_NUM_0)) {
+        return __real_uart_tx_chars(uart_num, buffer, len);
+    }
+    ble_log_redir_uart_tx_chars(buffer, len);
+    return len;
+}
+
+int __real_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size);
+int __wrap_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size)
+{
+    if (!prph_inited || (uart_num != UART_NUM_0)) {
+        return __real_uart_write_bytes(uart_num, src, size);
+    }
+    ble_log_redir_uart_tx_chars(src, size);
+    return size;
+}
+
+int __real_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len);
+int __wrap_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len)
+{
+    if (!prph_inited || (uart_num != UART_NUM_0)) {
+        return __real_uart_write_bytes_with_break(uart_num, src, size, brk_len);
+    } else {
+        (void)brk_len;
+        return __wrap_uart_write_bytes(uart_num, src, size);
+    }
+}
+#endif /* BLE_LOG_PRPH_UART_DMA_REDIR */
--- a/components/bt/common/btc/core/btc_manage.c
+++ b/components/bt/common/btc/core/btc_manage.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -16,6 +16,12 @@ void **btc_profile_cb_tab;

 void esp_profile_cb_reset(void)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return;
+    }
+    #endif
+
    int i;

    for (i = 0; i < BTC_PID_NUM; i++) {
@@ -25,6 +31,12 @@ void esp_profile_cb_reset(void)

 int btc_profile_cb_set(btc_pid_t profile_id, void *cb)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return -1;
+    }
+    #endif
+
    if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
        return -1;
    }
@@ -36,6 +48,12 @@ int btc_profile_cb_set(btc_pid_t profile_id, void *cb)

 void *btc_profile_cb_get(btc_pid_t profile_id)
 {
+    #if BTC_DYNAMIC_MEMORY == TRUE
+    if (btc_profile_cb_tab == NULL) {
+        return NULL;
+    }
+    #endif
+
    if (profile_id < 0 || profile_id >= BTC_PID_NUM) {
        return NULL;
    }
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -24,6 +24,8 @@
 #include "btc_gattc.h"
 #include "btc_gatt_common.h"
 #include "btc_gap_ble.h"
+#include "btc_iso_ble.h"
+#include "btc_ble_cte.h"
 #include "btc/btc_dm.h"
 #include "bta/bta_gatt_api.h"
 #if CLASSIC_BT_INCLUDED
@@ -210,7 +212,7 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
    [BTC_PID_RPR_CLIENT]        = {btc_ble_mesh_rpr_client_call_handler,        btc_ble_mesh_rpr_client_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_CLI */
 #if CONFIG_BLE_MESH_RPR_SRV
-    [BTC_PID_RPR_SERVER]        = {NULL,                                        btc_ble_mesh_rpr_server_cb_handler       },
+    [BTC_PID_RPR_SERVER]        = {btc_ble_mesh_rpr_server_call_handler,        btc_ble_mesh_rpr_server_cb_handler       },
 #endif /* CONFIG_BLE_MESH_RPR_SRV */
 #if CONFIG_BLE_MESH_SAR_CLI
    [BTC_PID_SAR_CLIENT]        = {btc_ble_mesh_sar_client_call_handler,        btc_ble_mesh_sar_client_cb_handler       },
@@ -258,6 +260,12 @@ static const btc_func_t profile_tab[BTC_PID_NUM] = {
    [BTC_PID_BLE_MESH_BLE_COEX] = {btc_ble_mesh_ble_call_handler,               btc_ble_mesh_ble_cb_handler              },
 #endif /* CONFIG_BLE_MESH_BLE_COEX_SUPPORT */
 #endif /* #if CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    [BTC_PID_ISO_BLE]           = {btc_iso_ble_call_handler,                    btc_iso_ble_cb_handler                   },
+#endif  // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    [BTC_PID_BLE_CTE]           = {btc_ble_cte_call_handler,                    btc_ble_cte_cb_handler                   },
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
 };

 /*****************************************************************************
@@ -382,7 +390,8 @@ static void btc_deinit_mem(void) {
        btc_profile_cb_tab = NULL;
    }

-#if (BLE_INCLUDED == TRUE)
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+#if (BLE_42_ADV_EN == TRUE)
    if (gl_bta_adv_data_ptr) {
        osi_free(gl_bta_adv_data_ptr);
        gl_bta_adv_data_ptr = NULL;
@@ -392,7 +401,8 @@ static void btc_deinit_mem(void) {
        osi_free(gl_bta_scan_rsp_data_ptr);
        gl_bta_scan_rsp_data_ptr = NULL;
    }
-#endif  ///BLE_INCLUDED == TRUE
+#endif // #if (BLE_42_ADV_EN == TRUE)
+#endif // BLE_42_FEATURE_SUPPORT

 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
    if (btc_creat_tab_env_ptr) {
@@ -444,7 +454,9 @@ static bt_status_t btc_init_mem(void) {
    }
    memset((void *)btc_profile_cb_tab, 0, sizeof(void *) * BTC_PID_NUM);

-#if (BLE_INCLUDED == TRUE)
+#if BTC_DYNAMIC_MEMORY == TRUE
+#if (BLE_42_FEATURE_SUPPORT == TRUE)
+#if (BLE_42_ADV_EN == TRUE)
    if ((gl_bta_adv_data_ptr = (tBTA_BLE_ADV_DATA *)osi_malloc(sizeof(tBTA_BLE_ADV_DATA))) == NULL) {
        goto error_exit;
    }
@@ -454,7 +466,9 @@ static bt_status_t btc_init_mem(void) {
        goto error_exit;
    }
    memset((void *)gl_bta_scan_rsp_data_ptr, 0, sizeof(tBTA_BLE_ADV_DATA));
-#endif  ///BLE_INCLUDED == TRUE
+#endif // #if (BLE_42_ADV_EN == TRUE)
+#endif // (BLE_42_FEATURE_SUPPORT == TRUE)
+#endif // BTC_DYNAMIC_MEMORY == TRUE

 #if GATTS_INCLUDED == TRUE && GATT_DYNAMIC_MEMORY == TRUE
    if ((btc_creat_tab_env_ptr = (esp_btc_creat_tab_t *)osi_malloc(sizeof(esp_btc_creat_tab_t))) == NULL) {
@@ -470,10 +484,10 @@ static bt_status_t btc_init_mem(void) {
 #endif

 #if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
-    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(sizeof(hf_local_param_t))) == NULL) {
        goto error_exit;
    }
-    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+    memset((void *)hf_local_param_ptr, 0, sizeof(hf_local_param_t));
 #endif

 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
@@ -516,21 +530,30 @@ bt_status_t btc_init(void)
        return BT_STATUS_NOMEM;
    }
 #endif
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_init();
+#endif

 #if (BLE_INCLUDED == TRUE)
    btc_gap_callback_init();
+#if (BLE_FEAT_ISO_EN == TRUE)
+    btc_iso_callback_init();
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    btc_cte_callback_init();
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
    btc_gap_ble_init();
 #endif  ///BLE_INCLUDED == TRUE

-#if SCAN_QUEUE_CONGEST_CHECK
-    btc_adv_list_init();
-#endif
    /* TODO: initial the profile_tab */
    return BT_STATUS_SUCCESS;
 }

 void btc_deinit(void)
 {
+#if BTC_GAP_BT_INCLUDED
+    btc_gap_bt_deinit();
+#endif
 #if BTC_DYNAMIC_MEMORY
    btc_deinit_mem();
 #endif
@@ -540,18 +563,6 @@ void btc_deinit(void)
 #if (BLE_INCLUDED == TRUE)
    btc_gap_ble_deinit();
 #endif  ///BLE_INCLUDED == TRUE
-#if SCAN_QUEUE_CONGEST_CHECK
-    btc_adv_list_deinit();
-#endif
-}
-
-bool btc_check_queue_is_congest(void)
-{
-    if (osi_thread_queue_wait_size(btc_thread, 0) >= BT_QUEUE_CONGEST_SIZE) {
-        return true;
-    }
-
-    return false;
 }

 int get_btc_work_queue_size(void)
--- a/components/bt/common/btc/include/btc/btc_task.h
+++ b/components/bt/common/btc/include/btc/btc_task.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -105,6 +105,12 @@ typedef enum {
    BTC_PID_MBT_SERVER,
    BTC_PID_BLE_MESH_BLE_COEX,
 #endif /* CONFIG_BLE_MESH */
+#if (BLE_FEAT_ISO_EN == TRUE)
+    BTC_PID_ISO_BLE,
+#endif // #if (BLE_FEAT_ISO_EN == TRUE)
+#if (BLE_FEAT_CTE_EN == TRUE)
+    BTC_PID_BLE_CTE,
+#endif // #if (BLE_FEAT_CTE_EN == TRUE)
    BTC_PID_NUM,
 } btc_pid_t; //btc profile id

@@ -123,8 +129,8 @@ extern "C" {
 /**
 * transfer an message to another module in the different task.
 * @param  msg       message
- * @param  arg       paramter
- * @param  arg_len   length of paramter
+ * @param  arg       parameter
+ * @param  arg_len   length of parameter
 * @param  copy_func deep copy function
 * @param  free_func deep free function
 * @return           BT_STATUS_SUCCESS: success
@@ -134,7 +140,7 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
                                    btc_arg_deep_free_t free_func);

 /**
- * transfer an message to another module in tha same task.
+ * transfer an message to another module in the same task.
 * @param  msg       message
 * @return           BT_STATUS_SUCCESS: success
 *                   others: fail
@@ -143,7 +149,6 @@ bt_status_t btc_inter_profile_call(btc_msg_t *msg);

 bt_status_t btc_init(void);
 void btc_deinit(void);
-bool btc_check_queue_is_congest(void);
 int get_btc_work_queue_size(void);

 /**
--- a/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/bluedroid_host/esp_blufi.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -160,20 +160,31 @@ static void blufi_profile_cb(tBTA_GATTS_EVT event, tBTA_GATTS *p_data)
        if (p_data->req_data.p_data->write_req.is_prep) {
            tBTA_GATT_STATUS status = GATT_SUCCESS;

-            if (blufi_env.prepare_buf == NULL) {
-                blufi_env.prepare_buf = osi_malloc(BLUFI_PREPAIR_BUF_MAX_SIZE);
-                blufi_env.prepare_len = 0;
+            do {
+                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_OFFSET;
+                   break;
+                }
+
+                if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPARE_BUF_MAX_SIZE) {
+                   status = ESP_GATT_INVALID_ATTR_LEN;
+                   break;
+                }
+
                if (blufi_env.prepare_buf == NULL) {
-                    BLUFI_TRACE_ERROR("Blufi prep no mem\n");
-                    status = GATT_NO_RESOURCES;
+                    if (p_data->req_data.p_data->write_req.offset != 0) {
+                        status = GATT_INVALID_OFFSET;
+                        break;
+                    }
+                    blufi_env.prepare_buf = osi_malloc(BLUFI_PREPARE_BUF_MAX_SIZE);
+                    blufi_env.prepare_len = 0;
+                    if (blufi_env.prepare_buf == NULL) {
+                        BLUFI_TRACE_ERROR("Blufi prep no mem\n");
+                        status = GATT_NO_RESOURCES;
+                        break;
+                    }
                }
-            } else {
-                if (p_data->req_data.p_data->write_req.offset > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_OFFSET;
-                } else if ((p_data->req_data.p_data->write_req.offset + p_data->req_data.p_data->write_req.len) > BLUFI_PREPAIR_BUF_MAX_SIZE) {
-                    status = GATT_INVALID_ATTR_LEN;
-                }
-            }
+            } while (0);

            memset(&rsp, 0, sizeof(tGATTS_RSP));
            rsp.attr_value.handle = p_data->req_data.p_data->write_req.handle;
@@ -370,7 +381,15 @@ void esp_blufi_deinit(void)

 void esp_blufi_adv_start(void)
 {
-    esp_ble_gap_set_device_name(BLUFI_DEVICE_NAME);
+    esp_ble_gap_config_adv_data(&blufi_adv_data);
+}
+
+void esp_blufi_adv_start_with_name(const char *name)
+{
+    if (name != NULL) {
+        esp_ble_gap_set_device_name(name);
+    }
+
    esp_ble_gap_config_adv_data(&blufi_adv_data);
 }

--- a/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
+++ b/components/bt/common/btc/profile/esp/blufi/blufi_prf.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -95,7 +95,29 @@ void btc_blufi_report_error(esp_blufi_error_state_t state)

 void btc_blufi_recv_handler(uint8_t *data, int len)
 {
+    if (len < sizeof(struct blufi_hdr)) {
+        BTC_TRACE_ERROR("%s invalid data length: %d", __func__, len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
    struct blufi_hdr *hdr = (struct blufi_hdr *)data;
+
+    // Verify if the received data length matches the expected length based on the BLUFI protocol
+    int target_data_len;
+
+    if (BLUFI_FC_IS_CHECK(hdr->fc)) {
+        target_data_len = hdr->data_len + 4 + 2; // Data + (Type + Frame Control + Sequence Number + Data Length) + Checksum
+    } else {
+        target_data_len = hdr->data_len + 4; // Data + (Type + Frame Control + Sequence Number + Data Length)
+    }
+
+    if (len != target_data_len) {
+        BTC_TRACE_ERROR("%s: Invalid data length: %d, expected: %d", __func__, len, target_data_len);
+        btc_blufi_report_error(ESP_BLUFI_DATA_FORMAT_ERROR);
+        return;
+    }
+
    uint16_t checksum, checksum_pkt;
    int ret;

--- a/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
+++ b/components/bt/common/btc/profile/esp/blufi/include/blufi_int.h
@@ -36,7 +36,9 @@ typedef struct {
    UINT32                  trans_id;
    UINT8                   congest;
    UINT16                  frag_size;
+// Deprecated: This macro will be removed in the future
 #define BLUFI_PREPAIR_BUF_MAX_SIZE 1024
+#define BLUFI_PREPARE_BUF_MAX_SIZE 1024
    uint8_t                 *prepare_buf;
    int                     prepare_len;
    /* Control reference */
--- a/components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h
+++ b/components/bt/common/btc/profile/esp/blufi/include/esp_blufi.h
@@ -44,6 +44,7 @@ void esp_blufi_gatt_svr_register_cb(struct ble_gatt_register_ctxt *ctxt, void *a

 /* Initialise gatt server */
 int esp_blufi_gatt_svr_init(void);
+int esp_blufi_gatt_svr_deinit(void);
 void esp_blufi_btc_init(void);
 void esp_blufi_btc_deinit(void);
 #endif
@@ -84,6 +85,9 @@ void esp_blufi_adv_stop(void);
 /* Start advertisement */
 void esp_blufi_adv_start(void);

+/* Start advertisement with specified name. if the name is NULL just start advertisement */
+void esp_blufi_adv_start_with_name(const char *name);
+
 void esp_blufi_send_encap(void *arg);

 #ifdef CONFIG_BT_NIMBLE_ENABLED
--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -240,6 +240,32 @@ static void init_gatt_values(void)

 }

+static void deinit_gatt_values(void)
+{
+    int i = 0;
+    const struct ble_gatt_svc_def *svc;
+    const struct ble_gatt_chr_def *chr;
+    const struct ble_gatt_dsc_def *dsc;
+
+    for (svc = gatt_svr_svcs; svc && svc->uuid; svc++) {
+        for (chr = svc->characteristics; chr && chr->uuid; chr++) {
+            if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+            }
+            ++i;
+
+            for (dsc = chr->descriptors; dsc && dsc->uuid; dsc++) {
+                if (i < SERVER_MAX_VALUES && gatt_values[i].buf != NULL) {
+                    os_mbuf_free(gatt_values[i].buf);  /* Free the buffer */
+                    gatt_values[i].buf = NULL;         /* Nullify the pointer to avoid dangling references */
+                }
+                ++i;
+            }
+        }
+    }
+}
+
 int esp_blufi_gatt_svr_init(void)
 {
    int rc;
@@ -260,7 +286,19 @@ int esp_blufi_gatt_svr_init(void)
    return 0;
 }

-static int
+int esp_blufi_gatt_svr_deinit(void)
+{
+    deinit_gatt_values();
+
+    ble_gatts_free_svcs();
+    /* Deinitialize BLE GATT and GAP services */
+    ble_svc_gatt_deinit();
+    ble_svc_gap_deinit();
+
+    return 0;
+}
+
+int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
    struct ble_gap_conn_desc desc;
@@ -293,7 +331,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
        }
        if (event->connect.status != 0) {
            /* Connection failed; resume advertising. */
-            esp_blufi_adv_start();
+           ((void(*)(void))arg)();
        }
        return 0;
    case BLE_GAP_EVENT_DISCONNECT:
@@ -328,7 +366,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
    case BLE_GAP_EVENT_ADV_COMPLETE:
        ESP_LOGI(TAG, "advertise complete; reason=%d",
                 event->adv_complete.reason);
-        esp_blufi_adv_start();
+        ((void(*)(void))arg)();
        return 0;

    case BLE_GAP_EVENT_SUBSCRIBE:
@@ -423,13 +461,22 @@ void esp_blufi_adv_start(void)
    adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
    adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
    rc = ble_gap_adv_start(own_addr_type, NULL, BLE_HS_FOREVER,
-                           &adv_params, esp_blufi_gap_event, NULL);
+                           &adv_params, esp_blufi_gap_event, esp_blufi_adv_start);
    if (rc != 0) {
        ESP_LOGE(TAG, "error enabling advertisement; rc=%d", rc);
        return;
    }
 }

+void esp_blufi_adv_start_with_name(const char *name)
+{
+    if (name != NULL) {
+        ble_svc_gap_device_name_set(name);
+    }
+
+    esp_blufi_adv_start();
+}
+
 uint8_t esp_blufi_init(void)
 {
    blufi_env.enabled = true;
@@ -473,7 +520,10 @@ void esp_blufi_disconnect(void)
    ble_gap_terminate(blufi_env.conn_id, BLE_ERR_REM_USER_CONN_TERM);
 }

-void esp_blufi_adv_stop(void) {}
+void esp_blufi_adv_stop(void)
+{
+    ble_gap_adv_stop();
+}

 void esp_blufi_send_encap(void *arg)
 {
--- a/components/bt/common/hci_log/bt_hci_log.c
+++ b/components/bt/common/hci_log/bt_hci_log.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -10,6 +10,7 @@
 #include "bt_common.h"
 #include "osi/mutex.h"
 #include "esp_attr.h"
+#include "esp_timer.h"

 #if (BT_HCI_LOG_INCLUDED == TRUE)
 #define BT_HCI_LOG_PRINT_TAG                     (1)
@@ -124,6 +125,11 @@ static char IRAM_ATTR *bt_data_type_to_str(uint8_t data_type)
        // self-defining data
        tag = "S";
        break;
+    case HCI_LOG_DATA_TYPE_ISO_DATA:
+        // 5.2 iso data
+        tag = "I";
+        break;
+        break;
    default:
        // unknown data type
        tag = "U";
@@ -203,6 +209,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 {
    osi_mutex_t mutex_lock;
    uint8_t *g_hci_log_buffer;
+    int64_t ts;
+    uint8_t *temp_buf;

    if (!p_hci_log_ctl->p_hci_log_buffer) {
        return ESP_FAIL;
@@ -214,6 +222,16 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
        return ESP_FAIL;
    }

+    ts = esp_timer_get_time();
+
+    temp_buf = (uint8_t *)malloc(data_len + 8);
+    memset(temp_buf, 0x0, data_len + 8);
+
+    memcpy(temp_buf, &ts, 8);
+    memcpy(temp_buf + 8, data, data_len);
+
+    data_len += 8;
+
    mutex_lock = p_hci_log_ctl->mutex_lock;
    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);

@@ -245,7 +263,7 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
        bt_hci_log_record_string(p_hci_log_ctl, str);
    }

-    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+    bt_hci_log_record_hex(p_hci_log_ctl, temp_buf, data_len);

    g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';

@@ -261,6 +279,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st

    osi_mutex_unlock(&mutex_lock);

+    free(temp_buf);
+
    return ESP_OK;
 }

--- a/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
+++ b/components/bt/common/hci_log/include/hci_log/bt_hci_log.h
@@ -21,6 +21,7 @@ extern "C" {
 #define    HCI_LOG_DATA_TYPE_ADV             (5)
 #define    HCI_LOG_DATA_TYPE_SELF_DEFINE     (6)
 #define    HCI_LOG_DATA_TYPE_C2H_ACL         (7)
+#define    HCI_LOG_DATA_TYPE_ISO_DATA        (8)

 /**
 *
--- a/components/bt/common/include/bt_common.h
+++ b/components/bt/common/include/bt_common.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -84,6 +84,20 @@
 #define BT_HCI_LOG_INCLUDED  FALSE
 #endif

+// HCI LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+// BLURDROID LOG TO SPI
+#if UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#else
+#define BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #if UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define HCI_LOG_DATA_BUFFER_SIZE  UC_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else
--- a/components/bt/common/include/bt_user_config.h
+++ b/components/bt/common/include/bt_user_config.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -126,6 +126,20 @@
 #define UC_BT_HCI_LOG_DEBUG_EN  FALSE
 #endif

+//HCI LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HCI_ENABLED  FALSE
+#endif
+
+//BLUEDROID LOG TO SPI
+#ifdef CONFIG_BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  TRUE
+#else
+#define UC_BT_BLE_LOG_SPI_OUT_HOST_ENABLED  FALSE
+#endif
+
 #ifdef CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #define UC_BT_HCI_LOG_DATA_BUFFER_SIZE  CONFIG_BT_HCI_LOG_DATA_BUFFER_SIZE
 #else
--- a/components/bt/common/osi/allocator.c
+++ b/components/bt/common/osi/allocator.c
@@ -241,5 +241,8 @@ void *osi_calloc_func(size_t size)

 void osi_free_func(void *ptr)
 {
+#if HEAP_MEMORY_DEBUG
+    osi_mem_dbg_clean(ptr, __func__, __LINE__);
+#endif
    free(ptr);
 }
--- a/components/bt/common/osi/include/osi/allocator.h
+++ b/components/bt/common/osi/include/osi/allocator.h
@@ -29,6 +29,15 @@ void *osi_malloc_func(size_t size);
 void *osi_calloc_func(size_t size);
 void osi_free_func(void *ptr);

+// Memory alloc function without print and assertion
+#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
+#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
+#else
+#define osi_malloc_base(size)             malloc((size))
+#define osi_calloc_base(size)             calloc(1, (size))
+#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
+
 #if HEAP_MEMORY_DEBUG

 void osi_mem_dbg_init(void);
@@ -41,13 +50,10 @@ void osi_men_dbg_set_section_start(uint8_t index);
 void osi_men_dbg_set_section_end(uint8_t index);
 uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);

-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
 #define osi_malloc(size)                                \
 ({                                                      \
    void *p;                                            \
-    p = heap_caps_malloc_prefer(size, 2,                \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_malloc_base(size);                          \
    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
    (void *)p;                                          \
 })
@@ -55,34 +61,11 @@ uint32_t osi_mem_dbg_get_max_size_section(uint8_t index);
 #define osi_calloc(size)                                \
 ({                                                      \
    void *p;                                            \
-    p = heap_caps_calloc_prefer(1, size, 2,             \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM,           \
-        MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL);        \
+    p = osi_calloc_base(size);                          \
    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
    (void *)p;                                          \
 })

-#else
-
-#define osi_malloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = malloc((size));                                 \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#define osi_calloc(size)                                \
-({                                                      \
-    void *p;                                            \
-    p = calloc(1, (size));                              \
-    osi_mem_dbg_record(p, size, __func__, __LINE__);    \
-    (void *)p;                                          \
-})
-
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
-
 #if 0
 #define osi_malloc(size)                                \
 do {                                                    \
@@ -122,15 +105,6 @@ do {                                                    \

 #else

-// Memory alloc function without print and assertion
-#if HEAP_ALLOCATION_FROM_SPIRAM_FIRST
-#define osi_malloc_base(size)             heap_caps_malloc_prefer(size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#define osi_calloc_base(size)             heap_caps_calloc_prefer(1, size, 2, MALLOC_CAP_DEFAULT|MALLOC_CAP_SPIRAM, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL)
-#else
-#define osi_malloc_base(size)             malloc((size))
-#define osi_calloc_base(size)             calloc(1, (size))
-#endif /* #if HEAP_ALLOCATION_FROM_SPIRAM_FIRST */
-
 // Memory alloc function with print and assertion when fails
 #define osi_malloc(size)                  osi_malloc_func((size))
 #define osi_calloc(size)                  osi_calloc_func((size))
--- a/components/bt/common/osi/include/osi/fixed_pkt_queue.h
+++ b/components/bt/common/osi/include/osi/fixed_pkt_queue.h
@@ -76,4 +76,8 @@ void fixed_pkt_queue_unregister_dequeue(fixed_pkt_queue_t *queue);

 void fixed_pkt_queue_process(fixed_pkt_queue_t *queue);

+#ifdef __cplusplus
+}
+#endif
+
 #endif
--- a/components/bt/common/osi/pkt_queue.c
+++ b/components/bt/common/osi/pkt_queue.c
@@ -25,6 +25,7 @@ struct pkt_queue *pkt_queue_create(void)
    }
    if (osi_mutex_new(&queue->lock) != 0) {
        osi_free(queue);
+        return NULL;
    }
    struct pkt_queue_header *p = &queue->header;
    STAILQ_INIT(p);
--- a/components/bt/porting/ext/tinycrypt/AUTHORS
+++ b/components/bt/porting/ext/tinycrypt/AUTHORS
--- a/components/bt/porting/ext/tinycrypt/LICENSE
+++ b/components/bt/porting/ext/tinycrypt/LICENSE
--- a/components/bt/porting/ext/tinycrypt/README
+++ b/components/bt/porting/ext/tinycrypt/README
--- a/components/bt/porting/ext/tinycrypt/VERSION
+++ b/components/bt/porting/ext/tinycrypt/VERSION
--- a/components/bt/porting/ext/tinycrypt/documentation/tinycrypt.rst
+++ b/components/bt/porting/ext/tinycrypt/documentation/tinycrypt.rst
--- a/components/bt/porting/ext/tinycrypt/include/tinycrypt/aes.h
+++ b/components/bt/porting/ext/tinycrypt/include/tinycrypt/aes.h
@@ -1,4 +1,8 @@
-/* aes.h - TinyCrypt interface to an AES-128 implementation */
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */

 /*
 *  Copyright (C) 2017 by Intel Corporation, All Rights Reserved.
--- a/Show More
+++ b/Show More