change(version): Update version to 5.5.1

Merge branch 'feat/add_c5_c61_supported' into 'release/v5.5'
feat(tools): add c5, c61 into supported targets list See merge request espressif/esp-idf!41629
2025-08-30 21:42:28 +08:00 · 2025-08-30 21:39:07 +08:00 · 2025-08-30 01:23:15 +08:00 · 2025-08-29 10:58:55 +08:00 · 2025-08-27 20:12:05 +08:00 · 2025-08-22 17:52:32 +08:00
1648 changed files with 98532 additions and 65313 deletions
--- a/.github/workflows/release_zips.yml
+++ b/.github/workflows/release_zips.yml
@@ -8,10 +8,11 @@ on:
 jobs:
  release_zips:
    name: Create release zip file
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
    steps:
      - name: Create a recursive clone source zip
-        uses: espressif/github-actions/release_zips@master
-        env:
-            RELEASE_PROJECT_NAME: ESP-IDF
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: espressif/release-zips-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_project_name: ESP-IDF
+          git_extra_args: --shallow-since="1 year ago"
--- a/.gitlab/CODEOWNERS
+++ b/.gitlab/CODEOWNERS
@@ -2,253 +2,5 @@
 #
 #    https://docs.gitlab.com/ee/user/project/code_owners.html#the-syntax-of-code-owners-files
 #
-# If more than one rule matches a given file, the latest rule is used.
-# The file should be generally kept sorted, except when it is necessary
-# to use a different order due to the fact above. In that case, use
-# '# sort-order-reset' comment line to reset the sort order.
-#
-# Recipes for a few common cases:
-#
-# 1. Specific directory with all its contents:
-#
-#    /components/app_trace/
-#
-#    Note the trailing slash!
-#
-# 2. File with certain extension in any subdirectory of a certain directory:
-#
-#    /examples/**/*.py
-#
-#    This includes an *.py files in /examples/ directory as well.
-#
-# 3. Contents of a directory with a certain name, anywhere in the tree:
-#
-#    test_*_host/
-#
-#    Will match everything under components/efuse/test_efuse_host/,
-#    components/heap/test_multi_heap_host/, components/lwip/test_afl_host/, etc.
-#
-# 4. Same as above, except limited to a specific place in the tree:
-#
-#    /components/esp32*/
-#
-#    Matches everything under /components/esp32, /components/esp32s2, etc.
-#    Doesn't match /tools/some-test/components/esp32s5.
-#
-# 5. Specific file:
-#
-#    /tools/tools.json
-#
-# 6. File with a certain name anywhere in the tree
-#
-#    .gitignore
-#

-* @esp-idf-codeowners/other
-
-/.*                                   @esp-idf-codeowners/tools
-/.codespellrc                         @esp-idf-codeowners/ci
-/.github/workflows/                   @esp-idf-codeowners/ci
-/.gitlab-ci.yml                       @esp-idf-codeowners/ci
-/.gitlab/ci/                          @esp-idf-codeowners/ci
-/.pre-commit-config.yaml              @esp-idf-codeowners/ci
-/.readthedocs.yml                     @esp-idf-codeowners/docs
-/.vale.ini                            @esp-idf-codeowners/docs
-/CMakeLists.txt                       @esp-idf-codeowners/build-config
-/COMPATIBILITY*.md                    @esp-idf-codeowners/peripherals
-/CONTRIBUTING.md                      @esp-idf-codeowners/docs
-/Kconfig                              @esp-idf-codeowners/build-config
-/README*.md                           @esp-idf-codeowners/docs
-/ROADMAP*.md                          @esp-idf-codeowners/docs
-/SUPPORT_POLICY*.md                   @esp-idf-codeowners/docs
-/add_path.sh                          @esp-idf-codeowners/tools
-/conftest.py                          @esp-idf-codeowners/ci
-/export.*                             @esp-idf-codeowners/tools
-/install.*                            @esp-idf-codeowners/tools
-/pytest.ini                           @esp-idf-codeowners/ci
-/ruff.toml                            @esp-idf-codeowners/tools
-/sdkconfig.rename                     @esp-idf-codeowners/build-config
-/sonar-project.properties             @esp-idf-codeowners/ci
-
-# sort-order-reset
-
-/components/app_trace/                @esp-idf-codeowners/debugging
-/components/app_update/               @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/bootloader*/              @esp-idf-codeowners/system @esp-idf-codeowners/security
-/components/bootloader_support/bootloader_flash/    @esp-idf-codeowners/peripherals
-/components/bt/                       @esp-idf-codeowners/bluetooth
-/components/cmock/                    @esp-idf-codeowners/system
-/components/console/                  @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities/console
-/components/cxx/                      @esp-idf-codeowners/system
-/components/driver/                   @esp-idf-codeowners/peripherals
-/components/efuse/                    @esp-idf-codeowners/system
-/components/esp_adc/                  @esp-idf-codeowners/peripherals
-/components/esp_app_format/           @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_bootloader_format/    @esp-idf-codeowners/system @esp-idf-codeowners/app-utilities
-/components/esp_coex/                 @esp-idf-codeowners/wifi @esp-idf-codeowners/bluetooth @esp-idf-codeowners/ieee802154
-/components/esp_common/               @esp-idf-codeowners/system
-/components/esp_driver_*/             @esp-idf-codeowners/peripherals
-/components/esp_driver_sdmmc/         @esp-idf-codeowners/peripherals @esp-idf-codeowners/storage
-/components/esp_eth/                  @esp-idf-codeowners/network
-/components/esp_event/                @esp-idf-codeowners/system
-/components/esp_gdbstub/              @esp-idf-codeowners/debugging
-/components/esp_hid/                  @esp-idf-codeowners/bluetooth
-/components/esp_http_client/          @esp-idf-codeowners/app-utilities
-/components/esp_http_server/          @esp-idf-codeowners/app-utilities
-/components/esp_https_ota/            @esp-idf-codeowners/app-utilities
-/components/esp_https_server/         @esp-idf-codeowners/app-utilities
-/components/esp_hw_support/           @esp-idf-codeowners/system @esp-idf-codeowners/peripherals
-/components/esp_hw_support/lowpower/  @esp-idf-codeowners/power-management
-/components/esp_lcd/                  @esp-idf-codeowners/peripherals
-/components/esp_local_ctrl/           @esp-idf-codeowners/app-utilities
-/components/esp_mm/                   @esp-idf-codeowners/peripherals
-/components/esp_netif/                @esp-idf-codeowners/network
-/components/esp_netif_stack/          @esp-idf-codeowners/network
-/components/esp_partition/            @esp-idf-codeowners/storage
-/components/esp_phy/                  @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/components/esp_pm/                   @esp-idf-codeowners/power-management @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/system
-/components/esp_psram/                @esp-idf-codeowners/peripherals
-/components/esp_psram/system_layer/   @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/esp_ringbuf/              @esp-idf-codeowners/system
-/components/esp_rom/                  @esp-idf-codeowners/system @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi
-/components/esp_security/             @esp-idf-codeowners/security
-/components/esp_system/               @esp-idf-codeowners/system
-/components/esp_tee/                  @esp-idf-codeowners/security
-/components/esp_timer/                @esp-idf-codeowners/system
-/components/esp-tls/                  @esp-idf-codeowners/app-utilities
-/components/esp_vfs_*/                @esp-idf-codeowners/storage
-/components/esp_vfs_console/          @esp-idf-codeowners/storage @esp-idf-codeowners/system
-/components/esp_wifi/                 @esp-idf-codeowners/wifi
-/components/espcoredump/              @esp-idf-codeowners/debugging
-/components/esptool_py/               @esp-idf-codeowners/tools
-/components/fatfs/                    @esp-idf-codeowners/storage
-/components/freertos/                 @esp-idf-codeowners/system
-/components/hal/                      @esp-idf-codeowners/peripherals
-/components/hal/test_apps/crypto/     @esp-idf-codeowners/peripherals @esp-idf-codeowners/security
-/components/heap/                     @esp-idf-codeowners/system
-/components/http_parser/              @esp-idf-codeowners/app-utilities
-/components/idf_test/                 @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/ieee802154/               @esp-idf-codeowners/ieee802154
-/components/json/                     @esp-idf-codeowners/app-utilities
-/components/linux/                    @esp-idf-codeowners/system
-/components/log/                      @esp-idf-codeowners/system
-/components/lwip/                     @esp-idf-codeowners/lwip
-/components/mbedtls/                  @esp-idf-codeowners/app-utilities/mbedtls @esp-idf-codeowners/security
-/components/mqtt/                     @esp-idf-codeowners/network
-/components/newlib/                   @esp-idf-codeowners/system @esp-idf-codeowners/toolchain
-/components/nvs_flash/                @esp-idf-codeowners/storage
-/components/nvs_sec_provider/         @esp-idf-codeowners/storage @esp-idf-codeowners/security
-/components/openthread/               @esp-idf-codeowners/ieee802154
-/components/partition_table/          @esp-idf-codeowners/system
-/components/perfmon/                  @esp-idf-codeowners/debugging
-/components/protobuf-c/               @esp-idf-codeowners/app-utilities
-/components/protocomm/                @esp-idf-codeowners/app-utilities/provisioning
-/components/pthread/                  @esp-idf-codeowners/system
-/components/riscv/                    @esp-idf-codeowners/system
-/components/rt/                       @esp-idf-codeowners/system
-/components/sdmmc/                    @esp-idf-codeowners/storage
-/components/soc/                      @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/spi_flash/                @esp-idf-codeowners/peripherals
-/components/spiffs/                   @esp-idf-codeowners/storage
-/components/tcp_transport/            @esp-idf-codeowners/network
-/components/touch_element/            @esp-idf-codeowners/peripherals
-/components/ulp/                      @esp-idf-codeowners/system
-/components/unity/                    @esp-idf-codeowners/peripherals @esp-idf-codeowners/system
-/components/usb/                      @esp-idf-codeowners/peripherals/usb
-/components/vfs/                      @esp-idf-codeowners/storage
-/components/wear_levelling/           @esp-idf-codeowners/storage
-/components/wifi_provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/components/wpa_supplicant/           @esp-idf-codeowners/wifi @esp-idf-codeowners/app-utilities/mbedtls
-/components/xtensa/                   @esp-idf-codeowners/system
-
-/docs/                                      @esp-idf-codeowners/docs
-/docs/docs_not_updated/                     @esp-idf-codeowners/all-maintainers
-/docs/**/api-guides/tools/                  @esp-idf-codeowners/tools
-/docs/en/api-guides/core_dump.rst           @esp-idf-codeowners/debugging
-/docs/**/api-guides/wifi*                   @esp-idf-codeowners/wifi
-/docs/**/api-guides/esp-wifi-mesh.rst       @esp-idf-codeowners/wifi
-/docs/en/api-guides/jtag-debugging/         @esp-idf-codeowners/debugging
-/docs/**/api-reference/bluetooth/           @esp-idf-codeowners/bluetooth
-/docs/**/api-reference/network/             @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/docs/**/api-reference/peripherals/         @esp-idf-codeowners/peripherals
-/docs/**/api-reference/peripherals/usb*     @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/peripherals/usb*/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/docs/**/api-reference/protocols/           @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/docs/**/api-reference/provisioning/        @esp-idf-codeowners/app-utilities/provisioning
-/docs/**/api-reference/storage/             @esp-idf-codeowners/storage
-/docs/**/api-reference/system/              @esp-idf-codeowners/system
-/docs/**/security/                          @esp-idf-codeowners/security
-/docs/**/migration-guides/                  @esp-idf-codeowners/docs @esp-idf-codeowners/all-maintainers
-/docs/**/contribute/install-pre-commit-hook.rst @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/examples/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-/examples/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-/examples/bluetooth/          @esp-idf-codeowners/bluetooth
-/examples/build_system/       @esp-idf-codeowners/build-config
-/examples/common_components/  @esp-idf-codeowners/system @esp-idf-codeowners/wifi @esp-idf-codeowners/lwip @esp-idf-codeowners/network
-/examples/custom_bootloader/  @esp-idf-codeowners/system
-/examples/cxx/                @esp-idf-codeowners/system
-/examples/ethernet/           @esp-idf-codeowners/network
-/examples/get-started/        @esp-idf-codeowners/system
-/examples/ieee802154/         @esp-idf-codeowners/ieee802154
-/examples/lowpower/           @esp-idf-codeowners/power-management @esp-idf-codeowners/system
-/examples/mesh/               @esp-idf-codeowners/wifi
-/examples/network/            @esp-idf-codeowners/network @esp-idf-codeowners/wifi
-/examples/openthread/         @esp-idf-codeowners/ieee802154
-/examples/peripherals/        @esp-idf-codeowners/peripherals
-/examples/peripherals/usb/    @esp-idf-codeowners/peripherals @esp-idf-codeowners/peripherals/usb
-/examples/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/examples/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/examples/provisioning/       @esp-idf-codeowners/app-utilities/provisioning
-/examples/security/           @esp-idf-codeowners/security
-/examples/storage/            @esp-idf-codeowners/storage
-/examples/system/             @esp-idf-codeowners/system
-/examples/system/ota/         @esp-idf-codeowners/app-utilities
-/examples/wifi/               @esp-idf-codeowners/wifi
-/examples/zigbee/             @esp-idf-codeowners/ieee802154
-
-/tools/                       @esp-idf-codeowners/tools
-/tools/ble/                   @esp-idf-codeowners/app-utilities
-/tools/bt/                    @esp-idf-codeowners/bluetooth
-/tools/catch/                 @esp-idf-codeowners/ci
-/tools/ci/                    @esp-idf-codeowners/ci
-/tools/cmake/                 @esp-idf-codeowners/build-config
-/tools/cmake/toolchain-*.cmake      @esp-idf-codeowners/toolchain
-/tools/esp_app_trace/         @esp-idf-codeowners/debugging
-/tools/esp_prov/              @esp-idf-codeowners/app-utilities
-/tools/gdb_panic_server.py    @esp-idf-codeowners/debugging
-/tools/kconfig*/              @esp-idf-codeowners/build-config
-/tools/ldgen/                 @esp-idf-codeowners/build-config
-/tools/mass_mfg/              @esp-idf-codeowners/app-utilities
-/tools/mocks/                 @esp-idf-codeowners/system
-
-/tools/test_apps/                    @esp-idf-codeowners/ci
-/tools/test_apps/README.md           @esp-idf-codeowners/docs @esp-idf-codeowners/ci
-
-## Note: owners here should be the same as the owners for the same example subdir, above
-/tools/test_apps/build_system/       @esp-idf-codeowners/build-config
-/tools/test_apps/configs/            @esp-idf-codeowners/system
-/tools/test_apps/linux_compatible/   @esp-idf-codeowners/system
-/tools/test_apps/peripherals/        @esp-idf-codeowners/peripherals
-/tools/test_apps/phy/                @esp-idf-codeowners/bluetooth @esp-idf-codeowners/wifi @esp-idf-codeowners/ieee802154
-/tools/test_apps/protocols/          @esp-idf-codeowners/network @esp-idf-codeowners/app-utilities
-/tools/test_apps/security/           @esp-idf-codeowners/security
-/tools/test_apps/storage/            @esp-idf-codeowners/storage
-/tools/test_apps/system/             @esp-idf-codeowners/system
-
-/tools/test_apps/**/*.py             @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-/tools/test_build_system/     @esp-idf-codeowners/tools @esp-idf-codeowners/build-config
-
-/tools/tools.json             @esp-idf-codeowners/tools @esp-idf-codeowners/toolchain @esp-idf-codeowners/debugging
-
-/tools/unit-test-app/         @esp-idf-codeowners/system @esp-idf-codeowners/tools
-
-# sort-order-reset
-
-/components/**/test_apps/**/*.py     @esp-idf-codeowners/ci @esp-idf-codeowners/tools
-
-# ignore lists
-/tools/ci/check_copyright_config.yaml                   @esp-idf-codeowners/all-maintainers
-/tools/ci/check_copyright_ignore.txt                    @esp-idf-codeowners/all-maintainers
-/tools/ci/mypy_ignore_list.txt                          @esp-idf-codeowners/tools
+* @esp-idf-codeowners/all-maintainers
--- a/.gitlab/ci/build.yml
+++ b/.gitlab/ci/build.yml
@@ -237,7 +237,7 @@ pytest_build_system_macos:
    PYENV_VERSION: "3.9"
    # CCACHE_DIR: "/cache/idf_ccache". On macOS, you cannot write to this folder due to insufficient permissions.
    CCACHE_DIR: "" # ccache will use "$HOME/Library/Caches/ccache".
-    CCACHE_MAXSIZE: "5G" # To preserve the limited Macbook storage. CCACHE automatically prunes old caches to fit the set limit.
+
 build_docker:
  extends:
    - .before_script:minimal
--- a/.gitlab/ci/common.yml
+++ b/.gitlab/ci/common.yml
@@ -40,7 +40,7 @@ variables:
  GIT_FETCH_EXTRA_FLAGS: "--no-recurse-submodules --prune --prune-tags"
  # we're using .cache folder for caches
  GIT_CLEAN_FLAGS: -ffdx -e .cache/
-  LATEST_GIT_TAG: v5.5-dev
+  LATEST_GIT_TAG: v5.5.1

  SUBMODULE_FETCH_TOOL: "tools/ci/ci_fetch_submodule.py"
  # by default we will fetch all submodules
@@ -56,7 +56,7 @@ variables:

  # Docker images
  ESP_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-env-v5.5:3"
-  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.5:2-1"
+  ESP_IDF_DOC_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-doc-env-v5.5:3-1"
  TARGET_TEST_ENV_IMAGE: "${CI_DOCKER_REGISTRY}/target-test-env-v5.5:2"
  SONARQUBE_SCANNER_IMAGE: "${CI_DOCKER_REGISTRY}/sonarqube-scanner:5"
  PRE_COMMIT_IMAGE: "${CI_DOCKER_REGISTRY}/esp-idf-pre-commit:1"
@@ -191,13 +191,21 @@ variables:
  fi

  # Custom OpenOCD
-  if [[ ! -z "$OOCD_DISTRO_URL" && "$CI_JOB_STAGE" == "target_test" ]]; then
-    echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
-    wget $OOCD_DISTRO_URL
-    ARCH_NAME=$(basename $OOCD_DISTRO_URL)
-    tar -x -f $ARCH_NAME
-    export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
-    export PATH=$PWD/openocd-esp32/bin:$PATH
+  if [[ "$CI_JOB_STAGE" == "target_test" ]]; then
+    machine="$(uname -m)"
+    if [[ "$machine" == "armv7l" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARMHF"
+    elif [[ "$machine" == "aarch64" ]] ; then
+      OOCD_DISTRO_URL="$OOCD_DISTRO_URL_ARM64"
+    fi
+    if [[ ! -z "$OOCD_DISTRO_URL" ]]; then
+      echo "Using custom OpenOCD from ${OOCD_DISTRO_URL}"
+      wget $OOCD_DISTRO_URL
+      ARCH_NAME=$(basename $OOCD_DISTRO_URL)
+      tar -x -f $ARCH_NAME
+      export OPENOCD_SCRIPTS=$PWD/openocd-esp32/share/openocd/scripts
+      export PATH=$PWD/openocd-esp32/bin:$PATH
+    fi
  fi

  if [[ -n "$CI_PYTHON_TOOL_REPO" ]]; then
--- a/.gitlab/ci/deploy.yml
+++ b/.gitlab/ci/deploy.yml
@@ -19,6 +19,7 @@ check_submodule_sync:
  dependencies: []
  script:
    - git submodule deinit --force .
+    - rm -rf .git/modules  # remove all the cached metadata
    # setting the default remote URL to the public one, to resolve relative location URLs
    - git config remote.origin.url ${PUBLIC_IDF_URL}
    # check if all submodules are correctly synced to public repository
--- a/.gitlab/ci/host-test.yml
+++ b/.gitlab/ci/host-test.yml
@@ -113,7 +113,8 @@ test_cli_installer:
  script:
    # Tools must be downloaded for testing
    # We could use "idf_tools.py download all", but we don't want to install clang because of its huge size
-    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                      cmake@version that is supported
+    - python3 ${IDF_PATH}/tools/idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
    - cd ${IDF_PATH}/tools/test_idf_tools
    - python3 -m pip install jsonschema
    - python3 ./test_idf_tools.py -v
--- a/.gitlab/ci/pre_check.yml
+++ b/.gitlab/ci/pre_check.yml
@@ -165,6 +165,8 @@ pipeline_variables:
      if [ -n "$CI_PYTHON_CONSTRAINT_BRANCH" ]; then
        echo "BUILD_AND_TEST_ALL_APPS=1" >> pipeline.env
      fi
+    - echo "OOCD_DISTRO_URL_ARMHF=$OOCD_DISTRO_URL_ARMHF" >> pipeline.env
+    - echo "OOCD_DISTRO_URL_ARM64=$OOCD_DISTRO_URL_ARM64" >> pipeline.env
    - python tools/ci/ci_process_description.py
    - cat pipeline.env
    - python tools/ci/artifacts_handler.py upload --type modified_files_and_components_report
--- a/.gitlab/ci/test-win.yml
+++ b/.gitlab/ci/test-win.yml
@@ -18,6 +18,8 @@
  after_script: []

 test_cli_installer_win:
+  rules:
+    - when: never
  extends:
    - .host_test_win_template
    - .rules:labels:windows_pytest_build_system
@@ -30,9 +32,11 @@ test_cli_installer_win:
  variables:
    IDF_PATH: "$CI_PROJECT_DIR"
  timeout: 3h
+  allow_failure: true
  script:
    # Tools must be downloaded for testing
-    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake
+    #                                                                     cmake@version that is supported
+    - python ${IDF_PATH}\tools\idf_tools.py download required qemu-riscv32 qemu-xtensa cmake cmake@3.16.3
    - cd ${IDF_PATH}\tools\test_idf_tools
    - python -m pip install jsonschema
    - python .\test_idf_tools.py
--- a/.gitmodules
+++ b/.gitmodules
@@ -54,8 +54,10 @@
 	sbom-supplier = Person: Dave Gamble
 	sbom-url = https://github.com/DaveGamble/cJSON
 	sbom-description = Ultralightweight JSON parser in ANSI C
-	sbom-hash = acc76239bee01d8e9c858ae2cab296704e52d916
+	sbom-hash = 8f2beb57ddad1f94bed899790b00f46df893ccac
 	sbom-cve-exclude-list = CVE-2024-31755 Resolved in v1.7.18
+	sbom-cve-exclude-list = CVE-2023-26819 Resolved in commit a328d65ad490b64da8c87523cbbfe16050ba5bf6
+	sbom-cve-exclude-list = CVE-2023-53154 Resolved in v1.7.18

 [submodule "components/mbedtls/mbedtls"]
 	path = components/mbedtls/mbedtls
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -51,7 +51,8 @@ repos:
            .*.pb-c.c|
            .*.yuv|
            .*.rgb|
-            .*COPYING.*
+            .*COPYING.*|
+            docs/sphinx-known-warnings\.txt
          )$
      - id: end-of-file-fixer
        exclude: *whitespace_excludes
@@ -69,6 +70,7 @@ repos:
    rev: v2.3.0
    hooks:
      - id: codespell
+        exclude: ^docs/sphinx-known-warnings\.txt$
  - repo: local
    hooks:
      - id: check-executables
--- a/README.md
+++ b/README.md
@@ -15,18 +15,18 @@ ESP-IDF is the development framework for Espressif SoCs supported on Windows, Li

 The following table shows ESP-IDF support of Espressif SoCs where ![alt text][preview] and ![alt text][supported] denote preview status and support, respectively. The preview support is usually limited in time and intended for beta versions of chips. Please use an ESP-IDF release where the desired SoC is already supported.

-|Chip         |          v5.0          |         v5.1           |         v5.2           |         v5.3           |          v5.4           |                                                                     |
-|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: |  :--------------------: |:------------------------------------------------------------------- |
-|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
-|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
-|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |                                                                     |
-|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_S3)           |
-|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-C2)           |
-|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_C6)           |
-|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_H2)           |
-|ESP32-P4     |                        |                        |                        | ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-P4)           |
-|ESP32-C5     |                        |                        |                        |                        |  ![alt text][preview]   |[Announcement](https://www.espressif.com/en/news/ESP32-C5)           |
-|ESP32-C61    |                        |                        |                        |                        |  ![alt text][preview]   |[Announcement](https://www.espressif.com/en/products/socs/esp32-c61) |
+|Chip         |         v5.1           |         v5.2           |         v5.3           |          v5.4           |          v5.5           |                                                                    |
+|:----------- |:--------------------: | :--------------------: | :--------------------: |  :--------------------: |  :--------------------: |:------------------------------------------------------------------- |
+|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |                                                                    |
+|ESP32-S2     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |   ![alt text][supported] |                                                                    |
+|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |                                                                     |
+|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_S3) |
+|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-C2)           |
+|ESP32-C6     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_C6)           |
+|ESP32-H2     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32_H2)           |
+|ESP32-P4     |                        |                        | ![alt text][supported] |  ![alt text][supported] |  ![alt text][supported] |[Announcement](https://www.espressif.com/en/news/ESP32-P4)           |
+|ESP32-C5      |                        |                        |                        |               |![alt text][supported]   |since v5.5.1, [Announcement](https://www.espressif.com/en/news/ESP32-C5)           |
+|ESP32-C61     |                       |                        |                        |               |![alt text][supported]   |since v5.5.1, [Announcement](https://www.espressif.com/en/products/socs/esp32-c61) |

 [supported]: https://img.shields.io/badge/-supported-green "supported"
 [preview]: https://img.shields.io/badge/-preview-orange "preview"
--- a/README_CN.md
+++ b/README_CN.md
@@ -15,18 +15,19 @@ ESP-IDF 是乐鑫官方推出的物联网开发框架，支持 Windows、Linux

 下表总结了乐鑫芯片在 ESP-IDF 各版本中的支持状态，其中 ![alt text][supported] 代表已支持，![alt text][preview] 代表目前处于预览支持状态。预览支持状态通常有时间限制，而且仅适用于测试版芯片。请确保使用与芯片相匹配的 ESP-IDF 版本。

-|芯片         |          v5.0          |          v5.1          |          v5.2          |          v5.3          |          v5.4          |                                                                           |
-|:----------- | :---------------------:| :--------------------: | :--------------------: | :--------------------: | :--------------------: | :------------------------------------------------------------------------ |
-|ESP32        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
-|ESP32-S2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
-|ESP32-C3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                                           |
-|ESP32-S3     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_S3)           |
-|ESP32-C2     | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C2)           |
-|ESP32-C6     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_C6)           |
-|ESP32-H2     |                        | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_H2)           |
-|ESP32-P4     |                        |                        |                        | ![alt text][supported] | ![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-P4)           |
-|ESP32-C5     |                        |                        |                        |                        | ![alt text][preview]   | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C5)           |
-|ESP32-C61    |                        |                        |                        |                        | ![alt text][preview]   | [芯片发布公告](https://www.espressif.com/zh-hans/products/socs/esp32-c61) |
+芯片         |          v5.1          |          v5.2          |          v5.3          |          v5.4          |          v5.5          |                                                                           |
+|:----------- | :--------------------: | :--------------------: | :--------------------: | :--------------------: |  :--------------------: |:------------------------------------------------------------------------ |
+|ESP32        |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |![alt text][supported] |                                                              |
+|ESP32-S2     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                              |
+|ESP32-C3     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |                                                              |
+|ESP32-S3     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_S3)           |
+|ESP32-C2     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C2)           |
+|ESP32-C6     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_C6)           |
+|ESP32-H2     |![alt text][supported] | ![alt text][supported] | ![alt text][supported] | ![alt text][supported] |![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32_H2)           |
+|ESP32-P4     |                         |                        | ![alt text][supported] | ![alt text][supported] |![alt text][supported] | [芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-P4)           |
+|ESP32-C5       |                        |                        |                   |                        |![alt text][supported] | 自 v5.5.1 开始，[芯片发布公告](https://www.espressif.com/zh-hans/news/ESP32-C5)           |
+|ESP32-C61      |                       |                        |                    |                        |![alt text][supported] | 自 v5.5.1 开始，[芯片发布公告](https://www.espressif.com/zh-hans/products/socs/esp32-c61) |
+

 [supported]: https://img.shields.io/badge/-%E6%94%AF%E6%8C%81-green "supported"
 [preview]: https://img.shields.io/badge/-%E9%A2%84%E8%A7%88-orange "preview"
--- a/components/app_trace/app_trace_membufs_proto.c
+++ b/components/app_trace/app_trace_membufs_proto.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -92,7 +92,7 @@ static esp_err_t esp_apptrace_membufs_swap(esp_apptrace_membufs_proto_data_t *pr
    // switch to new block
    proto->state.in_block++;

-    proto->hw->swap(new_block_num);
+    proto->hw->swap(new_block_num, proto->state.markers[prev_block_num]);

    // handle data from host
    esp_hostdata_hdr_t *hdr = (esp_hostdata_hdr_t *)proto->blocks[new_block_num].start;
@@ -148,6 +148,18 @@ static esp_err_t esp_apptrace_membufs_swap_waitus(esp_apptrace_membufs_proto_dat
        if (res != ESP_OK) {
            break;
        }
+#if CONFIG_IDF_TARGET_ESP32S3
+        /*
+        * ESP32S3 has a serious data corruption issue with the transferred data to host.
+        * This delay helps reduce the failure rate by temporarily reducing heavy memory writes
+        * from RTOS-level tracing and giving OpenOCD more time to read trace memory before
+        * the current thread continues execution. While this doesn't completely prevent
+        * memory access from other threads/cores/ISRs, it has shown to significantly improve
+        * reliability when combined with CRC checks in OpenOCD. In practice, this reduces the
+        * number of retries needed to read an entire block without corruption.
+        */
+        esp_rom_delay_us(100);
+#endif
    }
    return res;
 }
@@ -339,7 +351,7 @@ uint8_t *esp_apptrace_membufs_up_buffer_get(esp_apptrace_membufs_proto_data_t *p
 esp_err_t esp_apptrace_membufs_up_buffer_put(esp_apptrace_membufs_proto_data_t *proto, uint8_t *ptr, esp_apptrace_tmo_t *tmo)
 {
    esp_apptrace_membufs_pkt_end(ptr);
-    // TODO: mark block as busy in order not to re-use it for other tracing calls until it is completely written
+    // TODO: mark block as busy in order not to reuse it for other tracing calls until it is completely written
    // TODO: avoid potential situation when all memory is consumed by low prio tasks which can not complete writing due to
    // higher prio tasks and the latter can not allocate buffers at all
    // this is abnormal situation can be detected on host which will receive only uncompleted buffers
--- a/components/app_trace/port/riscv/port.c
+++ b/components/app_trace/port/riscv/port.c
@@ -50,7 +50,7 @@ static uint8_t *esp_apptrace_riscv_down_buffer_get(esp_apptrace_riscv_data_t *hw
 static esp_err_t esp_apptrace_riscv_down_buffer_put(esp_apptrace_riscv_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_riscv_host_is_connected(esp_apptrace_riscv_data_t *hw_data);
 static esp_err_t esp_apptrace_riscv_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_riscv_host_data_pending(void);

@@ -353,7 +353,7 @@ static esp_err_t esp_apptrace_riscv_buffer_swap_end(uint32_t new_block_id, uint3
    return ESP_OK;
 }

-static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_riscv_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
    /* do nothing */
    return ESP_OK;
--- a/components/app_trace/port/xtensa/port.c
+++ b/components/app_trace/port/xtensa/port.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0 OR MIT
 */
@@ -12,7 +12,7 @@
 // ======================

 // Xtensa has useful feature: TRAX debug module. It allows recording program execution flow at run-time without disturbing CPU.
-// Exectution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
+// Execution flow data are written to configurable Trace RAM block. Besides accessing Trace RAM itself TRAX module also allows to read/write
 // trace memory via its registers by means of JTAG, APB or ERI transactions.
 // ESP32 has two Xtensa cores with separate TRAX modules on them and provides two special memory regions to be used as trace memory.
 // Chip allows muxing access to those trace memory blocks in such a way that while one block is accessed by CPUs another one can be accessed by host
@@ -47,7 +47,7 @@
 // 2. TRAX Registers layout
 // ========================

-// This module uses two TRAX HW registers to communicate with host SW (OpenOCD).
+// This module uses two TRAX HW registers and one Performance Monitor register to communicate with host SW (OpenOCD).
 //  - Control register uses TRAX_DELAYCNT as storage. Only lower 24 bits of TRAX_DELAYCNT are writable. Control register has the following bitfields:
 //   | 31..XXXXXX..24 | 23 .(host_connect). 23| 22..(block_id)..15 | 14..(block_len)..0 |
 //    14..0  bits - actual length of user data in trace memory block. Target updates it every time it fills memory block and exposes it to host.
@@ -55,9 +55,15 @@
 //    21..15 bits - trace memory block transfer ID. Block counter. It can overflow. Updated by target, host should not modify it. Actually can be 2 bits;
 //    22     bit  - 'host data present' flag. If set to one there is data from host, otherwise - no host data;
 //    23     bit  - 'host connected' flag. If zero then host is not connected and tracing module works in post-mortem mode, otherwise in streaming mode;
-// - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
-//   this register holds address of the instruction which application will execute when it finishes with those registers modifications.
-//   See 'Targets Connection' setion for details.
+//  - Status register uses TRAX_TRIGGERPC as storage. If this register is not zero then current CPU is changing TRAX registers and
+//    this register holds address of the instruction which application will execute when it finishes with those registers modifications.
+//    See 'Targets Connection' section for details.
+//  - CRC16 register uses ERI_PERFMON_PM1 as storage. This register is used to store CRC16 checksum of the exposed trace memory block.
+//    The register has the following format:
+//    | 31..16 (CRC indicator) | 15..0 (CRC16 value) |
+//    CRC indicator (0xA55A) is used to distinguish valid CRC values from other data that might be in the register.
+//    CRC16 is calculated over the entire exposed block and is updated every time a block is exposed to the host.
+//    This allows the host to verify data integrity of the received trace data.

 // 3. Modes of operation
 // =====================
@@ -127,7 +133,7 @@

 // Access to internal module's data is synchronized with custom mutex. Mutex is a wrapper for portMUX_TYPE and uses almost the same sync mechanism as in
 // vPortCPUAcquireMutex/vPortCPUReleaseMutex. The mechanism uses S32C1I Xtensa instruction to implement exclusive access to module's data from tasks and
-// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlaying mutex in cycle until
+// ISRs running on both cores. Also custom mutex allows specifying timeout for locking operation. Locking routine checks underlying mutex in cycle until
 // it gets its ownership or timeout expires. The differences of application tracing module's mutex implementation from vPortCPUAcquireMutex/vPortCPUReleaseMutex are:
 // - Support for timeouts.
 // - Local IRQs for CPU which owns the mutex are disabled till the call to unlocking routine. This is made to avoid possible task's prio inversion.
@@ -142,9 +148,9 @@

 // Timeout mechanism is based on xthal_get_ccount() routine and supports timeout values in microseconds.
 // There are two situations when task/ISR can be delayed by tracing API call. Timeout mechanism takes into account both conditions:
-// - Trace data are locked by another task/ISR. When wating on trace data lock.
+// - Trace data are locked by another task/ISR. When waiting on trace data lock.
 // - Current TRAX memory input block is full when working in streaming mode (host is connected). When waiting for host to complete previous block reading.
-// When wating for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
+// When waiting for any of above conditions xthal_get_ccount() is called periodically to calculate time elapsed from trace API routine entry. When elapsed
 // time exceeds specified timeout value operation is canceled and ESP_ERR_TIMEOUT code is returned.
 #include "sdkconfig.h"
 #include "soc/soc.h"
@@ -159,11 +165,15 @@
 #include "esp_log.h"
 #include "esp_app_trace_membufs_proto.h"
 #include "esp_app_trace_port.h"
+#include "esp_rom_crc.h"

 // TRAX is disabled, so we use its registers for our own purposes
 // | 31..XXXXXX..24 | 23 .(host_connect). 23 | 22 .(host_data). 22| 21..(block_id)..15 | 14..(block_len)..0 |
 #define ESP_APPTRACE_TRAX_CTRL_REG              ERI_TRAX_DELAYCNT
 #define ESP_APPTRACE_TRAX_STAT_REG              ERI_TRAX_TRIGGERPC
+#define ESP_APPTRACE_TRAX_CRC16_REG             ERI_PERFMON_PM1
+
+#define ESP_APPTRACE_CRC_INDICATOR              (0xA55AU << 16)

 #define ESP_APPTRACE_TRAX_BLOCK_LEN_MSK         0x7FFFUL
 #define ESP_APPTRACE_TRAX_BLOCK_LEN(_l_)        ((_l_) & ESP_APPTRACE_TRAX_BLOCK_LEN_MSK)
@@ -198,7 +208,7 @@ static uint8_t *esp_apptrace_trax_down_buffer_get(esp_apptrace_trax_data_t *hw_d
 static esp_err_t esp_apptrace_trax_down_buffer_put(esp_apptrace_trax_data_t *hw_data, uint8_t *ptr, esp_apptrace_tmo_t *tmo);
 static bool esp_apptrace_trax_host_is_connected(esp_apptrace_trax_data_t *hw_data);
 static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id);
-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id);
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len);
 static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32_t prev_block_len);
 static bool esp_apptrace_trax_host_data_pending(void);

@@ -498,7 +508,8 @@ static esp_err_t esp_apptrace_trax_buffer_swap_start(uint32_t curr_block_id)
        uint32_t acked_block = ESP_APPTRACE_TRAX_BLOCK_ID_GET(ctrl_reg);
        uint32_t host_to_read = ESP_APPTRACE_TRAX_BLOCK_LEN_GET(ctrl_reg);
        if (host_to_read != 0 || acked_block != (curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK)) {
-            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32, esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
+            ESP_APPTRACE_LOGD("HC[%d]: Can not switch %" PRIx32 " %" PRIu32 " %" PRIx32 " %" PRIx32 "/%" PRIx32,
+                esp_cpu_get_core_id(), ctrl_reg, host_to_read, acked_block,
                curr_block_id & ESP_APPTRACE_TRAX_BLOCK_ID_MSK, curr_block_id);
            res = ESP_ERR_NO_MEM;
            goto _on_err;
@@ -514,14 +525,22 @@ static esp_err_t esp_apptrace_trax_buffer_swap_end(uint32_t new_block_id, uint32
 {
    uint32_t ctrl_reg = eri_read(ESP_APPTRACE_TRAX_CTRL_REG);
    uint32_t host_connected = ESP_APPTRACE_TRAX_HOST_CONNECT & ctrl_reg;
+
    eri_write(ESP_APPTRACE_TRAX_CTRL_REG, ESP_APPTRACE_TRAX_BLOCK_ID(new_block_id) |
              host_connected | ESP_APPTRACE_TRAX_BLOCK_LEN(prev_block_len));
    esp_apptrace_trax_buffer_swap_unlock();
    return ESP_OK;
 }

-static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id)
+static esp_err_t esp_apptrace_trax_buffer_swap(uint32_t new_block_id, uint32_t prev_block_len)
 {
+    /* Before switching to the new block, calculate CRC16 of the current block */
+    if (prev_block_len > 0) {
+        const uint8_t *prev_block_start = s_trax_blocks[!((new_block_id % 2))];
+        uint16_t crc16 = esp_rom_crc16_le(0, prev_block_start, prev_block_len);
+        eri_write(ESP_APPTRACE_TRAX_CRC16_REG, crc16 | ESP_APPTRACE_CRC_INDICATOR);
+        ESP_APPTRACE_LOGD("CRC16:%x %d @%x", crc16, prev_block_len, prev_block_start);
+    }
    esp_apptrace_trax_select_memory_block(new_block_id);
    return ESP_OK;
 }
--- a/components/app_trace/private_include/esp_app_trace_membufs_proto.h
+++ b/components/app_trace/private_include/esp_app_trace_membufs_proto.h
@@ -29,7 +29,7 @@ typedef struct {

 typedef struct {
    esp_err_t (*swap_start)(uint32_t curr_block_id);
-    esp_err_t (*swap)(uint32_t new_block_id);
+    esp_err_t (*swap)(uint32_t new_block_id, uint32_t prev_block_len);
    esp_err_t (*swap_end)(uint32_t new_block_id, uint32_t prev_block_len);
    bool (*host_data_pending)(void);
 } esp_apptrace_membufs_proto_hw_t;
--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/Config/esp/SEGGER_SYSVIEW_Config_FreeRTOS.c
@@ -3,7 +3,7 @@
 *
 * SPDX-License-Identifier: BSD-1-Clause
 *
- * SPDX-FileContributor: 2017-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2017-2025 Espressif Systems (Shanghai) CO LTD
 */
 /*********************************************************************
 *                    SEGGER Microcontroller GmbH                     *
@@ -65,6 +65,7 @@ Revision: $Rev: 7745 $
 #include "esp_app_trace.h"
 #include "esp_app_trace_util.h"
 #include "esp_intr_alloc.h"
+#include "esp_clk_tree.h"
 #include "esp_cpu.h"
 #include "soc/soc.h"
 #include "soc/interrupts.h"
@@ -84,11 +85,7 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // The target device name
 #define SYSVIEW_DEVICE_NAME     CONFIG_IDF_TARGET
 // The target core name
-#if CONFIG_IDF_TARGET_ARCH_XTENSA
-#define SYSVIEW_CORE_NAME       "xtensa"
-#elif CONFIG_IDF_TARGET_ARCH_RISCV
-#define SYSVIEW_CORE_NAME       "riscv"
-#endif
+#define SYSVIEW_CORE_NAME       "core0" // In dual core, this will be renamed by OpenOCD as core1

 // Determine which timer to use as timestamp source
 #if CONFIG_APPTRACE_SV_TS_SOURCE_CCOUNT
@@ -105,9 +102,6 @@ extern const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI;
 // Timer group timer divisor
 #define SYSVIEW_TIMER_DIV       2

-// Frequency of the timestamp, using APB as GPTimer source clock
-#define SYSVIEW_TIMESTAMP_FREQ  (esp_clk_apb_freq() / SYSVIEW_TIMER_DIV)
-
 // GPTimer handle
 gptimer_handle_t s_sv_gptimer;

@@ -177,30 +171,38 @@ static void _cbSendSystemDesc(void) {
 *
 **********************************************************************
 */
-static void SEGGER_SYSVIEW_TS_Init(void)
+static int SEGGER_SYSVIEW_TS_Init(void)
 {
    /* We only need to initialize something if we use Timer Group.
     * esp_timer and ccount can be used as is.
     */
 #if TS_USE_TIMERGROUP
+    // get clock source frequency
+    uint32_t counter_src_hz = 0;
+    ESP_ERROR_CHECK(esp_clk_tree_src_get_freq_hz(
+        (soc_module_clk_t)GPTIMER_CLK_SRC_DEFAULT,
+        ESP_CLK_TREE_SRC_FREQ_PRECISION_CACHED, &counter_src_hz));
    gptimer_config_t config = {
        .clk_src = GPTIMER_CLK_SRC_DEFAULT,
        .direction = GPTIMER_COUNT_UP,
-        .resolution_hz = SYSVIEW_TIMESTAMP_FREQ,
+        .resolution_hz = counter_src_hz / SYSVIEW_TIMER_DIV,
    };
    // pick any free GPTimer instance
    ESP_ERROR_CHECK(gptimer_new_timer(&config, &s_sv_gptimer));
    /* Start counting */
    gptimer_enable(s_sv_gptimer);
    gptimer_start(s_sv_gptimer);
+    return config.resolution_hz;
+#else
+    return SYSVIEW_TIMESTAMP_FREQ;
 #endif // TS_USE_TIMERGROUP
 }

 void SEGGER_SYSVIEW_Conf(void) {
    U32 disable_evts = 0;

-    SEGGER_SYSVIEW_TS_Init();
-    SEGGER_SYSVIEW_Init(SYSVIEW_TIMESTAMP_FREQ, SYSVIEW_CPU_FREQ,
+    int timestamp_freq = SEGGER_SYSVIEW_TS_Init();
+    SEGGER_SYSVIEW_Init(timestamp_freq, SYSVIEW_CPU_FREQ,
                        &SYSVIEW_X_OS_TraceAPI, _cbSendSystemDesc);
    SEGGER_SYSVIEW_SetRAMBase(SYSVIEW_RAM_BASE);

--- a/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
+++ b/components/app_trace/sys_view/Sample/FreeRTOSV10.4/SEGGER_SYSVIEW_FreeRTOS.c
@@ -108,7 +108,7 @@ static void _cbSendTaskList(void) {
 *    Called from SystemView when asked by the host, returns the
 *    current system time in micro seconds.
 */
-static U64 _cbGetTime(void) {
+__attribute__((unused)) static U64 _cbGetTime(void) {
  U64 Time;

  Time = xTaskGetTickCountFromISR();
@@ -260,7 +260,10 @@ void SYSVIEW_SendTaskInfo(U32 TaskID, const char* sName, unsigned Prio, U32 Stac
 */
 // Callbacks provided to SYSTEMVIEW by FreeRTOS
 const SEGGER_SYSVIEW_OS_API SYSVIEW_X_OS_TraceAPI = {
-  _cbGetTime,
+  /* Callback _cbGetTime locks xKernelLock inside xTaskGetTickCountFromISR, this can cause deadlock on multi-core.
+     To prevent deadlock, always lock xKernelLock before s_sys_view_lock. Omitting the callback here results in sending
+     SYSVIEW_EVTID_SYSTIME_CYCLES events instead of SYSVIEW_EVTID_SYSTIME_US */
+  NULL,
  _cbSendTaskList,
 };

--- a/components/app_update/test_apps/test_app_update/.build-test-rules.yml
+++ b/components/app_update/test_apps/test_app_update/.build-test-rules.yml
@@ -7,6 +7,7 @@ components/app_update/test_apps:
    - if: CONFIG_NAME == "xip_psram" and SOC_SPIRAM_XIP_SUPPORTED == 1
    # S2 doesn't have ROM for flash
    - if: CONFIG_NAME == "xip_psram_with_rom_impl" and (SOC_SPIRAM_XIP_SUPPORTED == 1 and IDF_TARGET != "esp32s2")
+    - if: CONFIG_NAME == "recovery_bootloader" and SOC_RECOVERY_BOOTLOADER_SUPPORTED == 1
  disable:
    - if: IDF_TARGET in ["esp32h21", "esp32h4"]
      temporary: true
@@ -14,3 +15,7 @@ components/app_update/test_apps:
    - if: IDF_TARGET == "esp32c61" and CONFIG_NAME == "xip_psram_with_rom_impl"
      temporary: true
      reason: not supported yet  # TODO: [ESP32C61] IDF-12784
+  disable_test:
+    - if: CONFIG_NAME == "recovery_bootloader" and SOC_RECOVERY_BOOTLOADER_SUPPORTED == 1 and IDF_TARGET == "esp32c61"
+      temporary: true
+      reason: lack of runners  # TODO: [ESP32C61] IDF-13165
--- a/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
+++ b/components/app_update/test_apps/test_app_update/main/CMakeLists.txt
@@ -1,4 +1,15 @@
-idf_component_register(SRC_DIRS "."
-                       PRIV_INCLUDE_DIRS "."
-                       PRIV_REQUIRES cmock test_utils app_update bootloader_support nvs_flash driver spi_flash esp_psram
-                      WHOLE_ARCHIVE)
+idf_component_register(
+    SRC_DIRS "."
+    PRIV_INCLUDE_DIRS "."
+    PRIV_REQUIRES
+        cmock
+        test_utils
+        app_update
+        bootloader_support
+        nvs_flash
+        driver
+        spi_flash
+        esp_psram
+        efuse
+    WHOLE_ARCHIVE
+)
--- a/components/app_update/test_apps/test_app_update/main/test_bootloader_update.c
+++ b/components/app_update/test_apps/test_app_update/main/test_bootloader_update.c
@@ -0,0 +1,87 @@
+/*
+ * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/*
+ * Tests bootloader update.
+ */
+
+#include "unity.h"
+#include "esp_log.h"
+#include "esp_efuse.h"
+#include "esp_flash_internal.h"
+#include "esp_rom_sys.h"
+#include "utils_update.h"
+#include "sdkconfig.h"
+
+#define BOOT_COUNT_NAMESPACE "boot_count"
+
+static __attribute__((unused)) const char *TAG = "btldr_update";
+
+#if CONFIG_BOOTLOADER_RECOVERY_ENABLE
+
+/* @brief Checks and prepares the partition so that the factory app is launched after that.
+ */
+static void start_test(void)
+{
+    ESP_LOGI(TAG, "boot count 1 - reset");
+    set_boot_count_in_nvs(1);
+    erase_ota_data();
+    ESP_LOGI(TAG, "ota_data erased");
+    ESP_LOGI(TAG, "Bootloader offset: 0x%x", esp_rom_get_bootloader_offset());
+    reboot_as_deep_sleep();
+}
+
+static void test_flow1(void)
+{
+    uint8_t boot_count = get_boot_count_from_nvs();
+    boot_count++;
+    set_boot_count_in_nvs(boot_count);
+    ESP_LOGI(TAG, "boot count %d", boot_count);
+
+    ESP_LOGI(TAG, "Bootloader offset: 0x%x", esp_rom_get_bootloader_offset());
+
+    const esp_partition_t *primary_bootloader;
+    TEST_ESP_OK(esp_partition_register_external(NULL, ESP_PRIMARY_BOOTLOADER_OFFSET, ESP_BOOTLOADER_SIZE, "PrimaryBTLDR", ESP_PARTITION_TYPE_BOOTLOADER, ESP_PARTITION_SUBTYPE_BOOTLOADER_PRIMARY, &primary_bootloader));
+    const esp_partition_t *recovery_bootloader;
+    TEST_ESP_OK(esp_partition_register_external(NULL, CONFIG_BOOTLOADER_RECOVERY_OFFSET, ESP_BOOTLOADER_SIZE, "RecoveryBTLDR", ESP_PARTITION_TYPE_BOOTLOADER, ESP_PARTITION_SUBTYPE_BOOTLOADER_RECOVERY, &recovery_bootloader));
+    ESP_LOGI(TAG, "Bootloaders are registered");
+
+    // Remove write protection for the bootloader
+    esp_flash_set_dangerous_write_protection(esp_flash_default_chip, false);
+    switch (boot_count) {
+        case 2:
+            TEST_ASSERT_EQUAL_HEX32(ESP_PRIMARY_BOOTLOADER_OFFSET, esp_rom_get_bootloader_offset());
+
+            TEST_ESP_OK(esp_partition_erase_range(recovery_bootloader, 0, recovery_bootloader->size));
+            ESP_LOGI(TAG, "Erase recovery bootloader");
+
+            TEST_ESP_OK(esp_efuse_set_recovery_bootloader_offset(CONFIG_BOOTLOADER_RECOVERY_OFFSET));
+
+            ESP_LOGI(TAG, "Backup, copy <%s> -> <%s>", primary_bootloader->label, recovery_bootloader->label);
+            TEST_ESP_OK(esp_partition_copy(recovery_bootloader, 0, primary_bootloader, 0, primary_bootloader->size));
+
+            TEST_ESP_OK(esp_partition_erase_range(primary_bootloader, 0, primary_bootloader->size));
+            ESP_LOGI(TAG, "Erase primary bootloader");
+            reboot_as_deep_sleep();
+            break;
+        case 3:
+            TEST_ASSERT_EQUAL_HEX32(CONFIG_BOOTLOADER_RECOVERY_OFFSET, esp_rom_get_bootloader_offset());
+
+            ESP_LOGI(TAG, "Return to primary bootloader...");
+            ESP_LOGI(TAG, "Copy <%s> -> <%s>", recovery_bootloader->label, primary_bootloader->label);
+            TEST_ESP_OK(esp_partition_copy(primary_bootloader, 0, recovery_bootloader, 0, primary_bootloader->size));
+
+            TEST_ESP_OK(esp_partition_erase_range(recovery_bootloader, 0, recovery_bootloader->size));
+            ESP_LOGI(TAG, "Erase recovery bootloader");
+            break;
+        default:
+            TEST_FAIL_MESSAGE("Unexpected stage");
+            break;
+    }
+}
+
+TEST_CASE_MULTIPLE_STAGES("Recovery bootloader feature", "[recovery_bootloader][timeout=90][reset=DEEPSLEEP_RESET, DEEPSLEEP_RESET]", start_test, test_flow1, test_flow1);
+
+#endif // CONFIG_BOOTLOADER_RECOVERY_ENABLE
--- a/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
+++ b/components/app_update/test_apps/test_app_update/main/test_switch_ota.c
@@ -7,315 +7,16 @@
 * Tests for switching between partitions: factory, OTAx, test.
 */

-#include <esp_types.h>
-#include <stdio.h>
-#include "string.h"
-#include <inttypes.h>
-#include "sdkconfig.h"
-
-#include "esp_rom_spiflash.h"
-
-#include "freertos/FreeRTOS.h"
-#include "freertos/task.h"
-#include "freertos/semphr.h"
-#include "freertos/queue.h"
-#include "unity.h"
-
+#include "esp_system.h"
 #include "bootloader_common.h"
 #include "../bootloader_flash/include/bootloader_flash_priv.h"
-
-#include "esp_err.h"
 #include "esp_log.h"
-#include "esp_ota_ops.h"
-#include "esp_partition.h"
-#include "esp_flash_partitions.h"
-#include "esp_image_format.h"
-#include "nvs_flash.h"
-
-#include "driver/gpio.h"
-#include "esp_sleep.h"
-#include "test_utils.h"
-
-#define BOOT_COUNT_NAMESPACE "boot_count"
+#include "unity.h"
+#include "utils_update.h"
+#include "sdkconfig.h"

 static const char *TAG = "ota_test";

-static void set_boot_count_in_nvs(uint8_t boot_count)
-{
-    nvs_handle_t boot_count_handle;
-    esp_err_t err = nvs_open(BOOT_COUNT_NAMESPACE, NVS_READWRITE, &boot_count_handle);
-    if (err != ESP_OK) {
-        TEST_ESP_OK(nvs_flash_erase());
-        TEST_ESP_OK(nvs_flash_init());
-        TEST_ESP_OK(nvs_open(BOOT_COUNT_NAMESPACE, NVS_READWRITE, &boot_count_handle));
-    }
-    TEST_ESP_OK(nvs_set_u8(boot_count_handle, "boot_count", boot_count));
-    TEST_ESP_OK(nvs_commit(boot_count_handle));
-    nvs_close(boot_count_handle);
-}
-
-static uint8_t get_boot_count_from_nvs(void)
-{
-    nvs_handle_t boot_count_handle;
-    esp_err_t err = nvs_open(BOOT_COUNT_NAMESPACE, NVS_READONLY, &boot_count_handle);
-    if (err == ESP_ERR_NVS_NOT_FOUND) {
-        set_boot_count_in_nvs(0);
-    }
-    uint8_t boot_count;
-    TEST_ESP_OK(nvs_get_u8(boot_count_handle, "boot_count", &boot_count));
-    nvs_close(boot_count_handle);
-    return boot_count;
-}
-
-/* @brief Copies a current app to next partition using handle.
- *
- * @param[in] update_handle - Handle of API ota.
- * @param[in] cur_app - Current app.
- */
-static void copy_app_partition(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
-{
-    const void *partition_bin = NULL;
-    esp_partition_mmap_handle_t data_map;
-    ESP_LOGI(TAG, "start the copy process");
-    TEST_ESP_OK(esp_partition_mmap(curr_app, 0, curr_app->size, ESP_PARTITION_MMAP_DATA, &partition_bin, &data_map));
-    TEST_ESP_OK(esp_ota_write(update_handle, (const void *)partition_bin, curr_app->size));
-    esp_partition_munmap(data_map);
-    ESP_LOGI(TAG, "finish the copy process");
-}
-
-/* @brief Copies a current app to next partition using handle.
- *
- * @param[in] update_handle - Handle of API ota.
- * @param[in] cur_app - Current app.
- */
-static void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
-{
-    const void *partition_bin = NULL;
-    esp_partition_mmap_handle_t  data_map;
-    ESP_LOGI(TAG, "start the copy process");
-    uint32_t offset = 0, bytes_to_write = curr_app->size;
-    uint32_t write_bytes;
-    while (bytes_to_write > 0) {
-        write_bytes = (bytes_to_write > (4 * 1024)) ? (4 * 1024) : bytes_to_write;
-        TEST_ESP_OK(esp_partition_mmap(curr_app, offset, write_bytes, ESP_PARTITION_MMAP_DATA, &partition_bin, &data_map));
-        TEST_ESP_OK(esp_ota_write_with_offset(update_handle, (const void *)partition_bin, write_bytes, offset));
-        esp_partition_munmap(data_map);
-        bytes_to_write -= write_bytes;
-        offset += write_bytes;
-    }
-    ESP_LOGI(TAG, "finish the copy process");
-}
-
-/* @brief Get the next partition of OTA for the update.
- *
- * @return The next partition of OTA(OTA0-15).
- */
-static const esp_partition_t * get_next_update_partition(void)
-{
-    const esp_partition_t *update_partition = esp_ota_get_next_update_partition(NULL);
-    TEST_ASSERT_NOT_EQUAL(NULL, update_partition);
-    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, update_partition->subtype, update_partition->address);
-    return update_partition;
-}
-
-/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
- *
- * @param[in] cur_app_partition - Current app.
- * @param[in] next_app_partition - Next app for boot.
- */
-static void copy_current_app_to_next_part(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
-{
-    esp_ota_get_next_update_partition(NULL);
-    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
-    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, next_app_partition->subtype, next_app_partition->address);
-
-    esp_ota_handle_t update_handle = 0;
-    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
-
-    copy_app_partition(update_handle, cur_app_partition);
-
-    TEST_ESP_OK(esp_ota_end(update_handle));
-    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
-}
-
-/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
- *
- * @param[in] cur_app_partition - Current app.
- * @param[in] next_app_partition - Next app for boot.
- */
-static void copy_current_app_to_next_part_with_offset(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
-{
-    esp_ota_get_next_update_partition(NULL);
-    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
-    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, next_app_partition->subtype, next_app_partition->address);
-
-    esp_ota_handle_t update_handle = 0;
-    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
-
-    copy_app_partition_with_offset(update_handle, cur_app_partition);
-
-    TEST_ESP_OK(esp_ota_end(update_handle));
-    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
-}
-
-/* @brief Erase otadata partition
- */
-static void erase_ota_data(void)
-{
-    const esp_partition_t *data_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
-    TEST_ASSERT_NOT_EQUAL(NULL, data_partition);
-    TEST_ESP_OK(esp_partition_erase_range(data_partition, 0, 2 * data_partition->erase_size));
-}
-
-/* @brief Reboots ESP using mode deep sleep. This mode guaranty that RTC_DATA_ATTR variables is not reset.
- */
-static void reboot_as_deep_sleep(void)
-{
-    ESP_LOGI(TAG, "reboot as deep sleep");
-    esp_deep_sleep(20000);
-    TEST_FAIL_MESSAGE("Should never be reachable except when sleep is rejected, abort");
-}
-
-/* @brief Copies a current app to next partition (OTA0-15), after that ESP is rebooting and run this (the next) OTAx.
- */
-static void copy_current_app_to_next_part_and_reboot(void)
-{
-    const esp_partition_t *cur_app = esp_ota_get_running_partition();
-    ESP_LOGI(TAG, "copy current app to next part");
-    copy_current_app_to_next_part(cur_app, get_next_update_partition());
-    reboot_as_deep_sleep();
-}
-
-/* @brief Copies a current app to next partition (OTA0-15) using esp_ota_write_with_offest(), after that ESP is rebooting and run this (the next) OTAx.
- */
-static void copy_current_app_to_next_part_with_offset_and_reboot(void)
-{
-    const esp_partition_t *cur_app = esp_ota_get_running_partition();
-    ESP_LOGI(TAG, "copy current app to next part");
-    copy_current_app_to_next_part_with_offset(cur_app, get_next_update_partition());
-    reboot_as_deep_sleep();
-}
-
-/* @brief Get running app.
- *
- * @return The next partition of OTA(OTA0-15).
- */
-static const esp_partition_t* get_running_firmware(void)
-{
-    const esp_partition_t *configured = esp_ota_get_boot_partition();
-    const esp_partition_t *running = esp_ota_get_running_partition();
-    ESP_LOGI(TAG, "Running partition type %d subtype %d (offset 0x%08"PRIx32")",
-            running->type, running->subtype, running->address);
-    ESP_LOGI(TAG, "Configured partition type %d subtype %d (offset 0x%08"PRIx32")",
-            configured->type, configured->subtype, configured->address);
-    TEST_ASSERT_NOT_EQUAL(NULL, configured);
-    TEST_ASSERT_NOT_EQUAL(NULL, running);
-    if (running->subtype != ESP_PARTITION_SUBTYPE_APP_TEST) {
-        TEST_ASSERT_EQUAL_PTR(running, configured);
-    }
-    return running;
-}
-
-// type of a corrupt ota_data
-typedef enum {
-    CORR_CRC_1_SECTOR_OTA_DATA       = (1 << 0),   /*!< Corrupt CRC only 1 sector of ota_data */
-    CORR_CRC_2_SECTOR_OTA_DATA       = (1 << 1),   /*!< Corrupt CRC only 2 sector of ota_data */
-} corrupt_ota_data_t;
-
-/* @brief Get two copies ota_data from otadata partition.
- *
- * @param[in] otadata_partition - otadata partition.
- * @param[out] ota_data_0 - First copy from otadata_partition.
- * @param[out] ota_data_1 - Second copy from otadata_partition.
- */
-static void get_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data_0, esp_ota_select_entry_t *ota_data_1)
-{
-    uint32_t offset = otadata_partition->address;
-    uint32_t size   = otadata_partition->size;
-    if (offset != 0) {
-        const esp_ota_select_entry_t *ota_select_map;
-        ota_select_map = bootloader_mmap(offset, size);
-        TEST_ASSERT_NOT_EQUAL(NULL, ota_select_map);
-
-        memcpy(ota_data_0, ota_select_map, sizeof(esp_ota_select_entry_t));
-        memcpy(ota_data_1, (uint8_t *)ota_select_map + otadata_partition->erase_size, sizeof(esp_ota_select_entry_t));
-        bootloader_munmap(ota_select_map);
-    }
-}
-
-/* @brief Writes a ota_data into required sector of otadata_partition.
- *
- * @param[in] otadata_partition - Partition information otadata.
- * @param[in] ota_data - otadata structure.
- * @param[in] sec_id - Sector number 0 or 1.
- */
-static void write_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data, int sec_id)
-{
-    esp_partition_write(otadata_partition, otadata_partition->erase_size * sec_id, &ota_data[sec_id], sizeof(esp_ota_select_entry_t));
-}
-
-/* @brief Makes a corrupt of ota_data.
- * @param[in] err - type error
- */
-static void corrupt_ota_data(corrupt_ota_data_t err)
-{
-    esp_ota_select_entry_t ota_data[2];
-
-    const esp_partition_t *otadata_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
-    TEST_ASSERT_NOT_EQUAL(NULL, otadata_partition);
-    get_ota_data(otadata_partition, &ota_data[0], &ota_data[1]);
-
-    if (err & CORR_CRC_1_SECTOR_OTA_DATA) {
-        ota_data[0].crc = 0;
-    }
-    if (err & CORR_CRC_2_SECTOR_OTA_DATA) {
-        ota_data[1].crc = 0;
-    }
-    TEST_ESP_OK(esp_partition_erase_range(otadata_partition, 0, otadata_partition->size));
-    write_ota_data(otadata_partition, &ota_data[0], 0);
-    write_ota_data(otadata_partition, &ota_data[1], 1);
-}
-
-#if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
-/* @brief Sets the pin number to output and sets output level as low. After reboot (deep sleep) this pin keep the same level.
- *
- * The output level of the pad will be force locked and can not be changed.
- * Power down or call gpio_hold_dis will disable this function.
- *
- * @param[in] num_pin - Pin number
- */
-static void set_output_pin(uint32_t num_pin)
-{
-    TEST_ESP_OK(gpio_hold_dis(num_pin));
-
-    gpio_config_t io_conf;
-    io_conf.intr_type = GPIO_INTR_DISABLE;
-    io_conf.mode = GPIO_MODE_OUTPUT;
-    io_conf.pin_bit_mask = (1ULL << num_pin);
-    io_conf.pull_down_en = 0;
-    io_conf.pull_up_en = 0;
-    TEST_ESP_OK(gpio_config(&io_conf));
-
-    TEST_ESP_OK(gpio_set_level(num_pin, 0));
-    TEST_ESP_OK(gpio_hold_en(num_pin));
-}
-
-/* @brief Unset the pin number hold function.
- */
-static void reset_output_pin(uint32_t num_pin)
-{
-    TEST_ESP_OK(gpio_hold_dis(num_pin));
-    TEST_ESP_OK(gpio_reset_pin(num_pin));
-}
-#endif
-
-static void mark_app_valid(void)
-{
-#ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
-    TEST_ESP_OK(esp_ota_mark_app_valid_cancel_rollback());
-#endif
-}
-
 /* @brief Checks and prepares the partition so that the factory app is launched after that.
 */
 static void start_test(void)
@@ -546,20 +247,6 @@ static void test_flow5(void)
 TEST_CASE_MULTIPLE_STAGES("Switching between factory, test, factory", "[app_update][timeout=90][reset=SW_CPU_RESET, SW_CPU_RESET, DEEPSLEEP_RESET]", start_test, test_flow5, test_flow5, test_flow5);
 #endif

-static const esp_partition_t* app_update(void)
-{
-    const esp_partition_t *cur_app = get_running_firmware();
-    const esp_partition_t* update_partition = esp_ota_get_next_update_partition(NULL);
-    TEST_ASSERT_NOT_NULL(update_partition);
-    esp_ota_handle_t update_handle = 0;
-    TEST_ESP_OK(esp_ota_begin(update_partition, OTA_SIZE_UNKNOWN, &update_handle));
-    copy_app_partition(update_handle, cur_app);
-    TEST_ESP_OK(esp_ota_end(update_handle));
-    TEST_ESP_OK(esp_ota_set_boot_partition(update_partition));
-    return update_partition;
-}
-
-
 static void test_rollback1(void)
 {
    uint8_t boot_count = get_boot_count_from_nvs();
--- a/components/app_update/test_apps/test_app_update/main/utils_update.c
+++ b/components/app_update/test_apps/test_app_update/main/utils_update.c
@@ -0,0 +1,307 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "esp_rom_spiflash.h"
+#include "driver/gpio.h"
+#include "nvs_flash.h"
+#include "esp_partition.h"
+#include "esp_flash_partitions.h"
+#include "esp_image_format.h"
+#include "../bootloader_flash/include/bootloader_flash_priv.h"
+#include "esp_sleep.h"
+#include "esp_ota_ops.h"
+#include "esp_err.h"
+#include "esp_log.h"
+#include "test_utils.h"
+#include "utils_update.h"
+#include "unity.h"
+#include "sdkconfig.h"
+
+#define BOOT_COUNT_NAMESPACE "boot_count"
+
+static const char *TAG = "ota_test";
+
+
+void set_boot_count_in_nvs(uint8_t boot_count)
+{
+    nvs_handle_t boot_count_handle;
+    esp_err_t err = nvs_open(BOOT_COUNT_NAMESPACE, NVS_READWRITE, &boot_count_handle);
+    if (err != ESP_OK) {
+        TEST_ESP_OK(nvs_flash_erase());
+        TEST_ESP_OK(nvs_flash_init());
+        TEST_ESP_OK(nvs_open(BOOT_COUNT_NAMESPACE, NVS_READWRITE, &boot_count_handle));
+    }
+    TEST_ESP_OK(nvs_set_u8(boot_count_handle, "boot_count", boot_count));
+    TEST_ESP_OK(nvs_commit(boot_count_handle));
+    nvs_close(boot_count_handle);
+}
+
+uint8_t get_boot_count_from_nvs(void)
+{
+    nvs_handle_t boot_count_handle;
+    esp_err_t err = nvs_open(BOOT_COUNT_NAMESPACE, NVS_READONLY, &boot_count_handle);
+    if (err == ESP_ERR_NVS_NOT_FOUND) {
+        set_boot_count_in_nvs(0);
+    }
+    uint8_t boot_count;
+    TEST_ESP_OK(nvs_get_u8(boot_count_handle, "boot_count", &boot_count));
+    nvs_close(boot_count_handle);
+    return boot_count;
+}
+
+/* @brief Copies a current app to next partition using handle.
+ *
+ * @param[in] update_handle - Handle of API ota.
+ * @param[in] cur_app - Current app.
+ */
+void copy_app_partition(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
+{
+    const void *partition_bin = NULL;
+    esp_partition_mmap_handle_t data_map;
+    ESP_LOGI(TAG, "start the copy process");
+    TEST_ESP_OK(esp_partition_mmap(curr_app, 0, curr_app->size, ESP_PARTITION_MMAP_DATA, &partition_bin, &data_map));
+    TEST_ESP_OK(esp_ota_write(update_handle, (const void *)partition_bin, curr_app->size));
+    esp_partition_munmap(data_map);
+    ESP_LOGI(TAG, "finish the copy process");
+}
+
+/* @brief Copies a current app to next partition using handle.
+ *
+ * @param[in] update_handle - Handle of API ota.
+ * @param[in] cur_app - Current app.
+ */
+void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const esp_partition_t *curr_app)
+{
+    const void *partition_bin = NULL;
+    esp_partition_mmap_handle_t  data_map;
+    ESP_LOGI(TAG, "start the copy process");
+    uint32_t offset = 0, bytes_to_write = curr_app->size;
+    uint32_t write_bytes;
+    while (bytes_to_write > 0) {
+        write_bytes = (bytes_to_write > (4 * 1024)) ? (4 * 1024) : bytes_to_write;
+        TEST_ESP_OK(esp_partition_mmap(curr_app, offset, write_bytes, ESP_PARTITION_MMAP_DATA, &partition_bin, &data_map));
+        TEST_ESP_OK(esp_ota_write_with_offset(update_handle, (const void *)partition_bin, write_bytes, offset));
+        esp_partition_munmap(data_map);
+        bytes_to_write -= write_bytes;
+        offset += write_bytes;
+    }
+    ESP_LOGI(TAG, "finish the copy process");
+}
+
+/* @brief Get the next partition of OTA for the update.
+ *
+ * @return The next partition of OTA(OTA0-15).
+ */
+const esp_partition_t * get_next_update_partition(void)
+{
+    const esp_partition_t *update_partition = esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, update_partition);
+    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, update_partition->subtype, update_partition->address);
+    return update_partition;
+}
+
+/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
+ *
+ * @param[in] cur_app_partition - Current app.
+ * @param[in] next_app_partition - Next app for boot.
+ */
+void copy_current_app_to_next_part(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
+{
+    esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
+    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, next_app_partition->subtype, next_app_partition->address);
+
+    esp_ota_handle_t update_handle = 0;
+    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
+
+    copy_app_partition(update_handle, cur_app_partition);
+
+    TEST_ESP_OK(esp_ota_end(update_handle));
+    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
+}
+
+/* @brief Copies a current app to next partition (OTA0-15) and then configure OTA data for a new boot partition.
+ *
+ * @param[in] cur_app_partition - Current app.
+ * @param[in] next_app_partition - Next app for boot.
+ */
+void copy_current_app_to_next_part_with_offset(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition)
+{
+    esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, next_app_partition);
+    ESP_LOGI(TAG, "Writing to partition subtype %d at offset 0x%"PRIx32, next_app_partition->subtype, next_app_partition->address);
+
+    esp_ota_handle_t update_handle = 0;
+    TEST_ESP_OK(esp_ota_begin(next_app_partition, OTA_SIZE_UNKNOWN, &update_handle));
+
+    copy_app_partition_with_offset(update_handle, cur_app_partition);
+
+    TEST_ESP_OK(esp_ota_end(update_handle));
+    TEST_ESP_OK(esp_ota_set_boot_partition(next_app_partition));
+}
+
+/* @brief Erase otadata partition
+ */
+void erase_ota_data(void)
+{
+    const esp_partition_t *data_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, data_partition);
+    TEST_ESP_OK(esp_partition_erase_range(data_partition, 0, 2 * data_partition->erase_size));
+}
+
+/* @brief Reboots ESP using mode deep sleep. This mode guaranty that RTC_DATA_ATTR variables is not reset.
+ */
+void reboot_as_deep_sleep(void)
+{
+    ESP_LOGI(TAG, "reboot as deep sleep");
+    esp_deep_sleep(20000);
+    TEST_FAIL_MESSAGE("Should never be reachable except when sleep is rejected, abort");
+}
+
+/* @brief Copies a current app to next partition (OTA0-15), after that ESP is rebooting and run this (the next) OTAx.
+ */
+void copy_current_app_to_next_part_and_reboot(void)
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    copy_current_app_to_next_part(cur_app, get_next_update_partition());
+    reboot_as_deep_sleep();
+}
+
+/* @brief Copies a current app to next partition (OTA0-15) using esp_ota_write_with_offest(), after that ESP is rebooting and run this (the next) OTAx.
+ */
+void copy_current_app_to_next_part_with_offset_and_reboot(void)
+{
+    const esp_partition_t *cur_app = esp_ota_get_running_partition();
+    ESP_LOGI(TAG, "copy current app to next part");
+    copy_current_app_to_next_part_with_offset(cur_app, get_next_update_partition());
+    reboot_as_deep_sleep();
+}
+
+/* @brief Get running app.
+ *
+ * @return The next partition of OTA(OTA0-15).
+ */
+const esp_partition_t* get_running_firmware(void)
+{
+    const esp_partition_t *configured = esp_ota_get_boot_partition();
+    const esp_partition_t *running = esp_ota_get_running_partition();
+    // If a reboot hasn't occurred after app_update(), the configured and running partitions may differ
+    ESP_LOGI(TAG, "Running partition type %d subtype %d (offset 0x%08"PRIx32")",
+            running->type, running->subtype, running->address);
+    ESP_LOGI(TAG, "Configured partition type %d subtype %d (offset 0x%08"PRIx32")",
+            configured->type, configured->subtype, configured->address);
+    TEST_ASSERT_NOT_EQUAL(NULL, configured);
+    TEST_ASSERT_NOT_EQUAL(NULL, running);
+    return running;
+}
+
+/* @brief Get two copies ota_data from otadata partition.
+ *
+ * @param[in] otadata_partition - otadata partition.
+ * @param[out] ota_data_0 - First copy from otadata_partition.
+ * @param[out] ota_data_1 - Second copy from otadata_partition.
+ */
+void get_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data_0, esp_ota_select_entry_t *ota_data_1)
+{
+    uint32_t offset = otadata_partition->address;
+    uint32_t size   = otadata_partition->size;
+    if (offset != 0) {
+        const esp_ota_select_entry_t *ota_select_map;
+        ota_select_map = bootloader_mmap(offset, size);
+        TEST_ASSERT_NOT_EQUAL(NULL, ota_select_map);
+
+        memcpy(ota_data_0, ota_select_map, sizeof(esp_ota_select_entry_t));
+        memcpy(ota_data_1, (uint8_t *)ota_select_map + otadata_partition->erase_size, sizeof(esp_ota_select_entry_t));
+        bootloader_munmap(ota_select_map);
+    }
+}
+
+/* @brief Writes a ota_data into required sector of otadata_partition.
+ *
+ * @param[in] otadata_partition - Partition information otadata.
+ * @param[in] ota_data - otadata structure.
+ * @param[in] sec_id - Sector number 0 or 1.
+ */
+void write_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data, int sec_id)
+{
+    esp_partition_write(otadata_partition, otadata_partition->erase_size * sec_id, &ota_data[sec_id], sizeof(esp_ota_select_entry_t));
+}
+
+/* @brief Makes a corrupt of ota_data.
+ * @param[in] err - type error
+ */
+void corrupt_ota_data(corrupt_ota_data_t err)
+{
+    esp_ota_select_entry_t ota_data[2];
+
+    const esp_partition_t *otadata_partition = esp_partition_find_first(ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_DATA_OTA, NULL);
+    TEST_ASSERT_NOT_EQUAL(NULL, otadata_partition);
+    get_ota_data(otadata_partition, &ota_data[0], &ota_data[1]);
+
+    if (err & CORR_CRC_1_SECTOR_OTA_DATA) {
+        ota_data[0].crc = 0;
+    }
+    if (err & CORR_CRC_2_SECTOR_OTA_DATA) {
+        ota_data[1].crc = 0;
+    }
+    TEST_ESP_OK(esp_partition_erase_range(otadata_partition, 0, otadata_partition->size));
+    write_ota_data(otadata_partition, &ota_data[0], 0);
+    write_ota_data(otadata_partition, &ota_data[1], 1);
+}
+
+#if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
+/* @brief Sets the pin number to output and sets output level as low. After reboot (deep sleep) this pin keep the same level.
+ *
+ * The output level of the pad will be force locked and can not be changed.
+ * Power down or call gpio_hold_dis will disable this function.
+ *
+ * @param[in] num_pin - Pin number
+ */
+void set_output_pin(uint32_t num_pin)
+{
+    TEST_ESP_OK(gpio_hold_dis(num_pin));
+
+    gpio_config_t io_conf;
+    io_conf.intr_type = GPIO_INTR_DISABLE;
+    io_conf.mode = GPIO_MODE_OUTPUT;
+    io_conf.pin_bit_mask = (1ULL << num_pin);
+    io_conf.pull_down_en = 0;
+    io_conf.pull_up_en = 0;
+    TEST_ESP_OK(gpio_config(&io_conf));
+
+    TEST_ESP_OK(gpio_set_level(num_pin, 0));
+    TEST_ESP_OK(gpio_hold_en(num_pin));
+}
+
+/* @brief Unset the pin number hold function.
+ */
+void reset_output_pin(uint32_t num_pin)
+{
+    TEST_ESP_OK(gpio_hold_dis(num_pin));
+    TEST_ESP_OK(gpio_reset_pin(num_pin));
+}
+#endif
+
+void mark_app_valid(void)
+{
+#ifdef CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
+    TEST_ESP_OK(esp_ota_mark_app_valid_cancel_rollback());
+#endif
+}
+
+const esp_partition_t* app_update(void)
+{
+    const esp_partition_t *cur_app = get_running_firmware();
+    const esp_partition_t* update_partition = esp_ota_get_next_update_partition(NULL);
+    TEST_ASSERT_NOT_NULL(update_partition);
+    esp_ota_handle_t update_handle = 0;
+    TEST_ESP_OK(esp_ota_begin(update_partition, OTA_SIZE_UNKNOWN, &update_handle));
+    copy_app_partition(update_handle, cur_app);
+    TEST_ESP_OK(esp_ota_end(update_handle));
+    TEST_ESP_OK(esp_ota_set_boot_partition(update_partition));
+    return update_partition;
+}
--- a/components/app_update/test_apps/test_app_update/main/utils_update.h
+++ b/components/app_update/test_apps/test_app_update/main/utils_update.h
@@ -0,0 +1,148 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "esp_ota_ops.h"
+#include "esp_partition.h"
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+
+/**
+ * @brief Enumeration for specifying which OTA data sectors' CRCs to corrupt.
+ */
+typedef enum {
+    CORR_CRC_1_SECTOR_OTA_DATA       = (1 << 0),   /*!< Corrupt CRC only 1 sector of ota_data */
+    CORR_CRC_2_SECTOR_OTA_DATA       = (1 << 1),   /*!< Corrupt CRC only 2 sector of ota_data */
+} corrupt_ota_data_t;
+
+/**
+ * @brief Set boot count value in NVS.
+ * @param boot_count Value to set.
+ */
+void set_boot_count_in_nvs(uint8_t boot_count);
+
+/**
+ * @brief Get boot count value from NVS.
+ * @return Boot count value.
+ */
+uint8_t get_boot_count_from_nvs(void);
+
+/**
+ * @brief Copy current app to next partition using OTA handle.
+ * @param update_handle OTA update handle.
+ * @param curr_app Current app partition.
+ */
+void copy_app_partition(esp_ota_handle_t update_handle, const esp_partition_t *curr_app);
+
+/**
+ * @brief Copy current app to next partition using OTA handle with offset.
+ * @param update_handle OTA update handle.
+ * @param curr_app Current app partition.
+ */
+void copy_app_partition_with_offset(esp_ota_handle_t update_handle, const esp_partition_t *curr_app);
+
+/**
+ * @brief Get the next OTA update partition.
+ * @return Pointer to next OTA partition.
+ */
+const esp_partition_t * get_next_update_partition(void);
+
+/**
+ * @brief Copy current app to next partition and set boot partition.
+ * @param cur_app_partition Current app partition.
+ * @param next_app_partition Next app partition.
+ */
+void copy_current_app_to_next_part(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition);
+
+/**
+ * @brief Copy current app to next partition with offset and set boot partition.
+ * @param cur_app_partition Current app partition.
+ * @param next_app_partition Next app partition.
+ */
+void copy_current_app_to_next_part_with_offset(const esp_partition_t *cur_app_partition, const esp_partition_t *next_app_partition);
+
+/**
+ * @brief Erase OTA data partition.
+ */
+void erase_ota_data(void);
+
+/**
+ * @brief Reboot ESP using deep sleep mode.
+ */
+void reboot_as_deep_sleep(void);
+
+/**
+ * @brief Copy current app to next partition and reboot.
+ */
+void copy_current_app_to_next_part_and_reboot(void);
+
+/**
+ * @brief Copy current app to next partition with offset and reboot.
+ */
+void copy_current_app_to_next_part_with_offset_and_reboot(void);
+
+/**
+ * @brief Get running firmware partition.
+ * @return Pointer to running firmware partition.
+ */
+const esp_partition_t* get_running_firmware(void);
+
+/**
+ * @brief Get two OTA data copies from OTA data partition.
+ * @param otadata_partition OTA data partition.
+ * @param ota_data_0 First OTA data copy.
+ * @param ota_data_1 Second OTA data copy.
+ */
+void get_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data_0, esp_ota_select_entry_t *ota_data_1);
+
+/**
+ * @brief Write OTA data into required sector of OTA data partition.
+ * @param otadata_partition OTA data partition.
+ * @param ota_data OTA data structure.
+ * @param sec_id Sector number (0 or 1).
+ */
+void write_ota_data(const esp_partition_t *otadata_partition, esp_ota_select_entry_t *ota_data, int sec_id);
+
+/**
+ * @brief Corrupt OTA data for testing.
+ * @param err Type of corruption.
+ */
+void corrupt_ota_data(corrupt_ota_data_t err);
+
+#if defined(CONFIG_BOOTLOADER_FACTORY_RESET) || defined(CONFIG_BOOTLOADER_APP_TEST)
+/**
+ * @brief Set output pin to low and hold state.
+ * @param num_pin Pin number.
+ */
+void set_output_pin(uint32_t num_pin);
+
+/**
+ * @brief Reset output pin hold function.
+ * @param num_pin Pin number.
+ */
+void reset_output_pin(uint32_t num_pin);
+#endif
+
+/**
+ * @brief Mark app as valid and cancel rollback.
+ */
+void mark_app_valid(void);
+
+/**
+ * @brief Perform app update and set new boot partition.
+ * @return Pointer to updated partition.
+ */
+const esp_partition_t* app_update(void);
+
+#ifdef __cplusplus
+}
+#endif
--- a/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
+++ b/components/app_update/test_apps/test_app_update/pytest_app_update_ut.py
@@ -60,3 +60,18 @@ def test_app_update_xip_psram_rom_impl(dut: Dut) -> None:
@idf_parametrize('target', ['esp32', 'esp32c3', 'esp32s3', 'esp32p4'], indirect=['target'])
 def test_app_update_with_rollback(dut: Dut) -> None:
    dut.run_all_single_board_cases(timeout=90)
+
+
+@pytest.mark.recovery_bootloader
+@pytest.mark.parametrize(
+    'config',
+    ['recovery_bootloader'],
+    indirect=True,
+)
+@idf_parametrize('target', ['esp32c5'], indirect=['target'])
+def test_recovery_bootloader_update(dut: Dut) -> None:
+    try:
+        dut.run_all_single_board_cases(group='recovery_bootloader', timeout=90)
+    finally:
+        # Erase recovery bootloader after test because it may interfere with other tests using this runner
+        dut.serial.erase_flash()
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader
@@ -0,0 +1,3 @@
+CONFIG_BOOTLOADER_RECOVERY_ENABLE=y
+CONFIG_BOOTLOADER_RECOVERY_OFFSET=0x3F0000
+CONFIG_PARTITION_TABLE_OFFSET=0x9000
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader.esp32c5
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader.esp32c5
@@ -0,0 +1,2 @@
+# ESP32C5 supports the Recovery bootloader feature in ROM starting from v1.0 (ECO2)
+CONFIG_IDF_TARGET="esp32c5"
--- a/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader.esp32c61
+++ b/components/app_update/test_apps/test_app_update/sdkconfig.ci.recovery_bootloader.esp32c61
@@ -0,0 +1,2 @@
+# ESP32C61 supports the Recovery bootloader feature in ROM starting from v1.0 (ECO3)
+CONFIG_IDF_TARGET="esp32c61"
--- a/components/bootloader/Kconfig.bootloader_rollback
+++ b/components/bootloader/Kconfig.bootloader_rollback
@@ -1,8 +1,37 @@
-menu "Bootloader Rollback"
+menu "Recovery Bootloader and Rollback"
+
+    config BOOTLOADER_RECOVERY_ENABLE
+        bool "Enable Recovery Bootloader"
+        depends on SOC_RECOVERY_BOOTLOADER_SUPPORTED
+        default n
+        help
+            The recovery bootloader feature is implemented in the ROM bootloader. It is required for safe OTA
+            updates of the bootloader. The feature is activated when the eFuse field
+            (ESP_EFUSE_RECOVERY_BOOTLOADER_FLASH_SECTOR) is set, which defines the flash address of the
+            recovery bootloader. If activated and the primary bootloader fails to load, the ROM bootloader
+            will attempt to load the recovery bootloader from the address specified in eFuse.
+
+    config BOOTLOADER_RECOVERY_OFFSET
+        hex "Recovery Bootloader Flash Offset"
+        depends on BOOTLOADER_RECOVERY_ENABLE
+        default 0x3F0000
+        range 0x0 0xFFE000
+        help
+            Flash address where the recovery bootloader is stored.
+            This value must be written to the eFuse field (ESP_EFUSE_RECOVERY_BOOTLOADER_FLASH_SECTOR)
+            to activate the recovery bootloader in the ROM bootloader. The eFuse can be programmed
+            using espefuse.py or in the user application with the API esp_efuse_set_recovery_bootloader_offset().
+            Setting this value in the config allows parttool.py to verify that it does not overlap with existing
+            partitions in the partition table.
+
+            The address must be a multiple of the flash sector size (0x1000 bytes).
+            The eFuse field stores the offset in sectors.
+            If the feature is no longer needed or unused, you can burn the 0xFFF value to disable this feature in
+            the ROM bootloader.

    config BOOTLOADER_ANTI_ROLLBACK_ENABLE
        bool "Enable bootloader rollback support"
-        depends on SOC_RECOVERY_BOOTLOADER_SUPPORTED
+        depends on BOOTLOADER_RECOVERY_ENABLE
        default n
        help
            This option prevents rollback to previous bootloader image with lower security version.
--- a/components/bootloader/Kconfig.log.settings
+++ b/components/bootloader/Kconfig.log.settings
@@ -21,6 +21,7 @@ menu "Settings"
        config BOOTLOADER_LOG_MODE_BINARY
            bool "Binary Log Mode"
            select BOOTLOADER_LOG_MODE_BINARY_EN
+            depends on BOOTLOADER_LOG_VERSION_2
            help
                Enables binary logging with host-side format string expansion. In this mode, the
                format argument of ESP_LOGx, ESP_EARLY_LOG, and ESP_DRAM_LOG macros is stored in a
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -553,12 +553,13 @@ menu "Security features"
        depends on SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
        default SECURE_BOOT_ECDSA_KEY_LEN_256_BITS
        help
-            Select the ECDSA key size. Two key sizes are supported
+            Select the ECDSA key size. Three key sizes are supported depending upon on the target:

            - 192 bit key using NISTP192 curve
            - 256 bit key using NISTP256 curve (Recommended)
+            - 384 bit key using NISTP384 curve (Recommended)

-            The advantage of using 256 bit key is the extra randomness which makes it difficult to be
+            The advantage of using 384 and 256 bit keys is the extra randomness which makes it difficult to be
            bruteforced compared to 192 bit key.
            At present, both key sizes are practically implausible to bruteforce.

@@ -570,6 +571,10 @@ menu "Security features"
            bool "Using ECC curve NISTP256 (Recommended)"
            depends on SECURE_SIGNED_APPS_ECDSA_V2_SCHEME

+        config SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+            bool "Using ECC curve NISTP384 (Recommended)"
+            depends on SECURE_SIGNED_APPS_ECDSA_V2_SCHEME && SOC_ECDSA_SUPPORT_CURVE_P384
+
    endchoice

    config SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT
@@ -1162,7 +1167,7 @@ menu "Security features"
                It is also possible to enable secure download mode at runtime by calling
                esp_efuse_enable_rom_secure_download_mode()

-                Note: Secure Download mode is not available for ESP32 (includes revisions till ECO3).
+                Note: Secure Download mode is not available for ESP32.

        config SECURE_INSECURE_ALLOW_DL_MODE
            bool "UART ROM download mode (Enabled (not recommended))"
--- a/components/bootloader/project_include.cmake
+++ b/components/bootloader/project_include.cmake
@@ -70,6 +70,8 @@ if(CONFIG_SECURE_SIGNED_APPS)
                    set(scheme "ecdsa192")
                elseif(CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_256_BITS)
                    set(scheme "ecdsa256")
+                elseif(CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS)
+                    set(scheme "ecdsa384")
                endif()
                fail_at_build_time(gen_secure_boot_signing_key
                    "Secure Boot Signing Key ${CONFIG_SECURE_BOOT_SIGNING_KEY} does not exist. Generate using:"
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash.c
@@ -136,7 +136,7 @@ esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
 #if ESP_TEE_BUILD
 #include "esp_fault.h"
 #include "esp_flash_partitions.h"
-#include "esp32c6/rom/spi_flash.h"
+#include "rom/spi_flash.h"

 extern bool esp_tee_flash_check_paddr_in_active_tee_part(size_t paddr);
 #endif
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c5.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c5.c
@@ -55,7 +55,8 @@ void IRAM_ATTR bootloader_init_mspi_clock(void)
    // SPLL clock on C5 is 480MHz , and mspi_pll needs 80MHz
    // in this stage, set divider as 6
    _mspi_timing_ll_set_flash_clk_src(0, FLASH_CLK_SRC_SPLL);
-    mspi_ll_fast_set_hs_divider(6);
+    // MSPI0 and MSPI1 share this core clock register, but only setting to MSPI0 register is valid
+    mspi_timing_ll_set_core_clock(MSPI_TIMING_LL_MSPI_ID_0, MSPI_TIMING_LL_CORE_CLOCK_MHZ_DEFAULT);
 }

 void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
--- a/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c61.c
+++ b/components/bootloader_support/bootloader_flash/src/bootloader_flash_config_esp32c61.c
@@ -52,7 +52,8 @@ void IRAM_ATTR bootloader_init_mspi_clock(void)
    // SPLL clock on C61 is 480MHz , and mspi_pll needs 80MHz
    // in this stage, set divider as 6
    _mspi_timing_ll_set_flash_clk_src(0, FLASH_CLK_SRC_DEFAULT);
-    mspi_ll_fast_set_hs_divider(6);
+    // MSPI0 and MSPI1 share this core clock register, but only setting to MSPI0 register is valid
+    mspi_timing_ll_set_core_clock(MSPI_TIMING_LL_MSPI_ID_0, MSPI_TIMING_LL_CORE_CLOCK_MHZ_DEFAULT);
 }

 void IRAM_ATTR bootloader_flash_clock_config(const esp_image_header_t *pfhdr)
--- a/components/bootloader_support/include/esp_secure_boot.h
+++ b/components/bootloader_support/include/esp_secure_boot.h
@@ -17,7 +17,6 @@
 #if !CONFIG_IDF_TARGET_LINUX
 #include "rom/secure_boot.h"
 #endif
-
 #ifdef CONFIG_SECURE_BOOT_V1_ENABLED
 #if !defined(CONFIG_SECURE_SIGNED_ON_BOOT) || !defined(CONFIG_SECURE_SIGNED_ON_UPDATE) || !defined(CONFIG_SECURE_SIGNED_APPS)
 #error "internal sdkconfig error, secure boot should always enable all signature options"
@@ -33,12 +32,20 @@ extern "C" {
   Can be compiled as part of app or bootloader code.
 */

+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+#define ESP_SECURE_BOOT_DIGEST_LEN 48
+#else /* !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS */
 #define ESP_SECURE_BOOT_DIGEST_LEN 32
+#endif /* CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS */

+/* SHA-256 length of the public key digest */
+#define ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN 32
+
+/* Length of the public key digest that is stored in efuses */
 #if CONFIG_IDF_TARGET_ESP32C2
-#define ESP_SECURE_BOOT_KEY_DIGEST_LEN 16
+#define ESP_SECURE_BOOT_KEY_DIGEST_LEN ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN / 2
 #else
-#define ESP_SECURE_BOOT_KEY_DIGEST_LEN 32
+#define ESP_SECURE_BOOT_KEY_DIGEST_LEN ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN
 #endif

 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
@@ -193,7 +200,8 @@ esp_err_t esp_secure_boot_v2_permanently_enable(const esp_image_metadata_t *imag
 /** @brief Verify the secure boot signature appended to some binary data in flash.
 *
 * For ECDSA Scheme (Secure Boot V1) - deterministic ECDSA w/ SHA256 image
- * For RSA Scheme (Secure Boot V2) - RSA-PSS Verification of the SHA-256 image
+ * For RSA Scheme (Secure Boot V2) - RSA-PSS Verification of the SHA-256 image digest
+ * For ECDSA Scheme (Secure Boot V2) - ECDSA Verification of the SHA-256 / SHA-384 (in case of ECDSA-P384 secure boot key) image digest
 *
 * Public key is compiled into the calling program in the ECDSA Scheme.
 * See the apt docs/security/secure-boot-v1.rst or docs/security/secure-boot-v2.rst for details.
@@ -236,13 +244,13 @@ esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig

 /** @brief Verify the secure boot signature block for Secure Boot V2.
 *
- *  Performs RSA-PSS or ECDSA verification of the SHA-256 image based on the public key
+ *  Performs RSA-PSS or ECDSA verification of the SHA-256 / SHA-384 image based on the public key
 *  in the signature block, compared against the public key digest stored in efuse.
 *
 * Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
 * @param[in] sig_block Pointer to signature block data
- * @param[in] image_digest Pointer to 32 byte buffer holding SHA-256 hash.
- * @param[out] verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
+ * @param[in] image_digest Pointer to 32/48 byte buffer holding SHA-256/SHA-384 hash.
+ * @param[out] verified_digest Pointer to 32/48 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
 *
 */
 esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_signature_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
@@ -255,7 +263,7 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
 * Each image can have one or more signature blocks (up to SECURE_BOOT_NUM_BLOCKS). Each signature block includes a public key.
 */
 typedef struct {
-    uint8_t key_digests[SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS][ESP_SECURE_BOOT_DIGEST_LEN];    /* SHA of the public key components in the signature block */
+    uint8_t key_digests[SOC_EFUSE_SECURE_BOOT_KEY_DIGESTS][ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN];    /* SHA of the public key components in the signature block */
    unsigned num_digests;                                       /* Number of valid digests, starting at index 0 */
 } esp_image_sig_public_key_digests_t;

--- a/components/bootloader_support/private_include/bootloader_sha.h
+++ b/components/bootloader_support/private_include/bootloader_sha.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -12,15 +12,18 @@
   Use mbedTLS APIs or include esp32/sha.h to calculate SHA256 in IDF apps.
 */

+#include <stdbool.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include "esp_err.h"
+#include "soc/soc_caps.h"

 #ifdef __cplusplus
 extern "C" {
 #endif

 typedef void *bootloader_sha256_handle_t;
+typedef bootloader_sha256_handle_t bootloader_sha_handle_t;

 bootloader_sha256_handle_t bootloader_sha256_start(void);

@@ -28,6 +31,14 @@ void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data,

 void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest);

+#if SOC_SHA_SUPPORT_SHA512
+bootloader_sha_handle_t bootloader_sha512_start(bool is384);
+
+void bootloader_sha512_data(bootloader_sha_handle_t handle, const void *data, size_t data_len);
+
+void bootloader_sha512_finish(bootloader_sha_handle_t handle, uint8_t *digest);
+#endif /* SOC_SHA_SUPPORT_SHA512 */
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/private_include/bootloader_soc.h
+++ b/components/bootloader_support/private_include/bootloader_soc.h
@@ -25,12 +25,11 @@ void bootloader_ana_super_wdt_reset_config(bool enable);
 void bootloader_ana_clock_glitch_reset_config(bool enable);

 /**
- * @brief Configure analog power glitch reset & glitch reset dref
+ * @brief Configure analog power glitch reset
 *
 * @param enable Boolean to enable or disable power glitch reset
- * @param dref voltage threshold
 */
-void bootloader_power_glitch_reset_config(bool enable, uint8_t dref);
+void bootloader_power_glitch_reset_config(bool enable);

 #ifdef __cplusplus
 }
--- a/components/bootloader_support/private_include/bootloader_utility.h
+++ b/components/bootloader_support/private_include/bootloader_utility.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -138,6 +138,20 @@ void bootloader_debug_buffer(const void *buffer, size_t length, const char *labe
 */
 esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);

+/** @brief Generates the digest of the data between offset & offset+length.
+ *
+ * This function should be used when the size of the data is larger than 3.2MB.
+ * The MMU capacity is 3.2MB (50 pages - 64KB each). This function generates the SHA-384
+ * of the data in chunks of 3.2MB, considering the MMU capacity.
+ *
+ * @param[in]  flash_offset  Offset of the data in flash.
+ * @param[in]  len           Length of data in bytes.
+ * @param[out] digest        Pointer to buffer where the digest is written, if ESP_OK is returned.
+ *
+ * @return ESP_OK if secure boot digest is generated successfully.
+ */
+esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest);
+
 #ifdef __cplusplus
 }
 #endif
--- a/components/bootloader_support/src/bootloader_common_loader.c
+++ b/components/bootloader_support/src/bootloader_common_loader.c
@@ -28,6 +28,7 @@

 #define ESP_PARTITION_HASH_LEN 32 /* SHA-256 digest length */
 #define IS_FIELD_SET(rev_full) (((rev_full) != 65535) && ((rev_full) != 0))
+#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

 static const char* TAG = "boot_comm";

@@ -264,7 +265,10 @@ rtc_retain_mem_t* bootloader_common_get_rtc_retain_mem(void)
 #if ESP_ROM_HAS_LP_ROM
    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_LOW)
 #else
-    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - sizeof(rtc_retain_mem_t))
+    /* Since the structure containing the retain_mem_t is aligned on 8 by the linker, make sure we align this
+     * structure size here too */
+    #define RETAIN_MEM_SIZE     ALIGN_UP(sizeof(rtc_retain_mem_t), 8)
+    #define RTC_RETAIN_MEM_ADDR (SOC_RTC_DRAM_HIGH - RETAIN_MEM_SIZE)
 #endif //ESP_ROM_HAS_LP_ROM
    static rtc_retain_mem_t *const s_bootloader_retain_mem = (rtc_retain_mem_t *)RTC_RETAIN_MEM_ADDR;
    return s_bootloader_retain_mem;
--- a/components/bootloader_support/src/bootloader_init.c
+++ b/components/bootloader_support/src/bootloader_init.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -19,6 +19,7 @@
 #include "hal/wdt_hal.h"
 #include "hal/efuse_hal.h"
 #include "esp_bootloader_desc.h"
+#include "esp_rom_sys.h"

 static const char *TAG = "boot";

@@ -34,7 +35,12 @@ void bootloader_clear_bss_section(void)
 esp_err_t bootloader_read_bootloader_header(void)
 {
    /* load bootloader image header */
-    if (bootloader_flash_read(ESP_BOOTLOADER_OFFSET, &bootloader_image_hdr, sizeof(esp_image_header_t), true) != ESP_OK) {
+#if SOC_RECOVERY_BOOTLOADER_SUPPORTED
+    const uint32_t bootloader_flash_offset = esp_rom_get_bootloader_offset();
+#else
+    const uint32_t bootloader_flash_offset = ESP_PRIMARY_BOOTLOADER_OFFSET;
+#endif
+    if (bootloader_flash_read(bootloader_flash_offset, &bootloader_image_hdr, sizeof(esp_image_header_t), true) != ESP_OK) {
        ESP_EARLY_LOGE(TAG, "failed to load bootloader image header!");
        return ESP_FAIL;
    }
--- a/components/bootloader_support/src/bootloader_mem.c
+++ b/components/bootloader_support/src/bootloader_mem.c
@@ -25,20 +25,19 @@ void bootloader_init_mem(void)
     * So, at boot disabling these filters. They will enable as per the
     * use case by TEE initialization code.
     */
-#ifdef SOC_APM_CTRL_FILTER_SUPPORTED
-    apm_hal_apm_ctrl_filter_enable_all(false);
-    /* [APM] On power-up, only the HP CPU starts in TEE mode; others default to REE2.
-     * APM blocks REE0–REE2 access by default. C5 ECO2 adds per-peripheral control
-     * (default REEx blocking), but config support is pending. As a workaround,
-     * all masters are set to TEE mode.
+#if SOC_APM_CTRL_FILTER_SUPPORTED
+    apm_hal_enable_ctrl_filter_all(false);
+    /* [APM] On power-up, only the HP CPU starts in TEE mode; others
+     * default to REE2. APM blocks REE0–REE2 access by default.
+     * Thus, all masters are set to TEE mode.
     */
 #if SOC_APM_SUPPORT_TEE_PERI_ACCESS_CTRL
-    apm_tee_hal_set_master_secure_mode_all(APM_LL_SECURE_MODE_TEE);
+    apm_hal_set_master_sec_mode_all(APM_SEC_MODE_TEE);
 #endif // SOC_APM_SUPPORT_TEE_PERI_ACCESS_CTRL
 #endif // SOC_APM_CTRL_FILTER_SUPPORTED
 #endif

-#ifdef CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE
+#if CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE
    // protect memory region
    esp_cpu_configure_region_protection();
 #endif
--- a/components/bootloader_support/src/bootloader_random_esp32c5.c
+++ b/components/bootloader_support/src/bootloader_random_esp32c5.c
@@ -9,6 +9,7 @@
 #include "hal/adc_ll.h"
 #include "hal/adc_types.h"
 #include "esp_private/regi2c_ctrl.h"
+#include "soc/lpperi_reg.h"

 void bootloader_random_enable(void)
 {
@@ -48,6 +49,9 @@ void bootloader_random_enable(void)
    adc_ll_digi_set_trigger_interval(200);
    adc_ll_digi_trigger_enable();

+    SET_PERI_REG_MASK(LPPERI_RNG_CFG_REG, LPPERI_RNG_SAMPLE_ENABLE);
+    REG_SET_FIELD(LPPERI_RNG_CFG_REG, LPPERI_RTC_TIMER_EN, 0x3);
+    SET_PERI_REG_MASK(LPPERI_RNG_CFG_REG, LPPERI_RNG_TIMER_EN);
 }

 void bootloader_random_disable(void)
--- a/components/bootloader_support/src/bootloader_sha.c
+++ b/components/bootloader_support/src/bootloader_sha.c
@@ -29,15 +29,6 @@ bootloader_sha256_handle_t bootloader_sha256_start()
 void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len)
 {
    assert(handle != NULL);
-
-#if !SOC_SECURE_BOOT_V2_ECC
-    /* For secure boot, the key field consists of 1 byte of curve identifier and 64 bytes of ECDSA public key.
-     * While verifying the signature block, we need to calculate the SHA of this key field which is of 65 bytes.
-     * ets_sha_update handles it cleanly so we can safely remove the check:
-     */
-    assert(data_len % 4 == 0);
-#endif /* SOC_SECURE_BOOT_V2_ECC */
-
    ets_sha_update(&ctx, data, data_len, false);
 }

@@ -51,6 +42,33 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
    }
    ets_sha_finish(&ctx, digest);
 }
+
+#if SOC_SHA_SUPPORT_SHA512
+bootloader_sha_handle_t bootloader_sha512_start(bool is384)
+{
+    // Enable SHA hardware
+    ets_sha_enable();
+    ets_sha_init(&ctx, is384 ? SHA2_384 : SHA2_512);
+    return &ctx; // Meaningless non-NULL value
+}
+
+void bootloader_sha512_data(bootloader_sha_handle_t handle, const void *data, size_t data_len)
+{
+    assert(handle != NULL);
+    ets_sha_update(&ctx, data, data_len, false);
+}
+
+void bootloader_sha512_finish(bootloader_sha_handle_t handle, uint8_t *digest)
+{
+    assert(handle != NULL);
+
+    if (digest == NULL) {
+        bzero(&ctx, sizeof(ctx));
+        return;
+    }
+    ets_sha_finish(&ctx, digest);
+}
+#endif /* SOC_SHA_SUPPORT_SHA512 */
 #else /* !CONFIG_IDF_TARGET_ESP32 */

 #include "soc/dport_reg.h"
@@ -162,6 +180,7 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest

 #include "bootloader_flash_priv.h"
 #include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>

 bootloader_sha256_handle_t bootloader_sha256_start(void)
 {
@@ -199,4 +218,43 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
    free(handle);
    handle = NULL;
 }
+
+#if SOC_SHA_SUPPORT_SHA512
+bootloader_sha_handle_t bootloader_sha512_start(bool is384)
+{
+    mbedtls_sha512_context *ctx = (mbedtls_sha512_context *)malloc(sizeof(mbedtls_sha512_context));
+    if (!ctx) {
+        return NULL;
+    }
+    mbedtls_sha512_init(ctx);
+    int ret = mbedtls_sha512_starts(ctx, is384);
+    if (ret != 0) {
+        return NULL;
+    }
+    return ctx;
+}
+
+void bootloader_sha512_data(bootloader_sha_handle_t handle, const void *data, size_t data_len)
+{
+    assert(handle != NULL);
+    mbedtls_sha512_context *ctx = (mbedtls_sha512_context *)handle;
+    int ret = mbedtls_sha512_update(ctx, data, data_len);
+    assert(ret == 0);
+    (void)ret;
+}
+
+void bootloader_sha512_finish(bootloader_sha_handle_t handle, uint8_t *digest)
+{
+    assert(handle != NULL);
+    mbedtls_sha512_context *ctx = (mbedtls_sha512_context *)handle;
+    if (digest != NULL) {
+        int ret = mbedtls_sha512_finish(ctx, digest);
+        assert(ret == 0);
+        (void)ret;
+    }
+    mbedtls_sha512_free(ctx);
+    free(handle);
+    handle = NULL;
+}
+#endif /* SOC_SHA_SUPPORT_SHA512 */
 #endif /* !(NON_OS_BUILD || CONFIG_APP_BUILD_TYPE_RAM) */
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -30,6 +30,7 @@
 #include "hal/cache_types.h"
 #include "hal/cache_ll.h"
 #include "hal/cache_hal.h"
+#include "hal/sha_types.h"

 #include "esp_cpu.h"
 #include "esp_image_format.h"
@@ -1213,18 +1214,29 @@ void bootloader_debug_buffer(const void *buffer, size_t length, const char *labe
 #endif
 }

-esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+static esp_err_t bootloader_sha_flash_contents(esp_sha_type type, uint32_t flash_offset, uint32_t len, uint8_t *digest)
 {
-
    if (digest == NULL) {
        return ESP_ERR_INVALID_ARG;
    }

    /* Handling firmware images larger than MMU capacity */
    uint32_t mmu_free_pages_count = bootloader_mmap_get_free_pages();
-    bootloader_sha256_handle_t sha_handle = NULL;
+    bootloader_sha_handle_t sha_handle = NULL;
+
+    if (type == SHA2_256) {
+        sha_handle = bootloader_sha256_start();
+    } else
+    // Using SOC_ECDSA_SUPPORT_CURVE_P384 here so that there is no flash size impact in the case of existing targets like ESP32.
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+    if (type == SHA2_384) {
+        sha_handle = bootloader_sha512_start(true);
+    } else
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
+    {
+        return ESP_ERR_INVALID_ARG;
+    }

-    sha_handle = bootloader_sha256_start();
    if (sha_handle == NULL) {
        return ESP_ERR_NO_MEM;
    }
@@ -1234,7 +1246,14 @@ esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len,
        uint32_t max_pages = (mmu_free_pages_count > mmu_page_offset) ? (mmu_free_pages_count - mmu_page_offset) : 0;
        if (max_pages == 0) {
            ESP_LOGE(TAG, "No free MMU pages are available");
-            bootloader_sha256_finish(sha_handle, NULL);
+            if (type == SHA2_256) {
+                bootloader_sha256_finish(sha_handle, NULL);
+            }
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+            else if (type == SHA2_384) {
+                bootloader_sha512_finish(sha_handle, NULL);
+            }
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
            return ESP_ERR_NO_MEM;
        }
        uint32_t max_image_len;
@@ -1245,15 +1264,51 @@ esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len,

        const void * image = bootloader_mmap(flash_offset, partial_image_len);
        if (image == NULL) {
-            bootloader_sha256_finish(sha_handle, NULL);
+            if (type == SHA2_256) {
+                bootloader_sha256_finish(sha_handle, NULL);
+            }
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+            else if (type == SHA2_384) {
+                bootloader_sha512_finish(sha_handle, NULL);
+            }
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
            return ESP_FAIL;
        }
-        bootloader_sha256_data(sha_handle, image, partial_image_len);
+
+        if (type == SHA2_256) {
+            bootloader_sha256_data(sha_handle, image, partial_image_len);
+        }
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+        else if (type == SHA2_384) {
+            bootloader_sha512_data(sha_handle, image, partial_image_len);
+        }
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
+
        bootloader_munmap(image);

        flash_offset += partial_image_len;
        len -= partial_image_len;
    }
-    bootloader_sha256_finish(sha_handle, digest);
+
+    if (type == SHA2_256) {
+        bootloader_sha256_finish(sha_handle, digest);
+    }
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+    else if (type == SHA2_384) {
+        bootloader_sha512_finish(sha_handle, digest);
+    }
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
    return ESP_OK;
 }
+
+esp_err_t bootloader_sha256_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+{
+    return bootloader_sha_flash_contents(SHA2_256, flash_offset, len, digest);
+}
+
+#if SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384
+esp_err_t bootloader_sha384_flash_contents(uint32_t flash_offset, uint32_t len, uint8_t *digest)
+{
+    return bootloader_sha_flash_contents(SHA2_384, flash_offset, len, digest);
+}
+#endif /* SOC_SHA_SUPPORT_SHA384 && SOC_ECDSA_SUPPORT_CURVE_P384 */
--- a/components/bootloader_support/src/esp32c5/bootloader_esp32c5.c
+++ b/components/bootloader_support/src/esp32c5/bootloader_esp32c5.c
@@ -94,11 +94,7 @@ static inline void bootloader_ana_reset_config(void)
 {
    //Enable BOD reset (mode1)
    brownout_ll_ana_reset_enable(true);
-    if (efuse_hal_chip_revision() == 0) {
-        // decrease power glitch reset voltage to avoid start the glitch reset
-        uint8_t power_glitch_dref = 0;
-        bootloader_power_glitch_reset_config(true, power_glitch_dref);
-    }
+    bootloader_power_glitch_reset_config(true);
 }

 esp_err_t bootloader_init(void)
--- a/components/bootloader_support/src/esp32c5/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c5/bootloader_soc.c
@@ -17,18 +17,18 @@ void bootloader_ana_clock_glitch_reset_config(bool enable)
    (void)enable;
 }

-void bootloader_power_glitch_reset_config(bool enable, uint8_t dref)
+void bootloader_power_glitch_reset_config(bool enable)
 {
-    assert(dref < 8);
-    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);
+    //only detect VDDPST POWER GLITCH
+    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
+    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_PERIF, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_XTAL, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_PLL, 0);
+
+    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);//default val for chip from ECO1
    if (enable) {
-        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
-        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PERIF, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_VDDPST, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_XTAL, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLL, dref);
-        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_PWR_GLITCH_RESET_ENA, 0xf);
+        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_PWR_GLITCH_RESET_ENA, 0xf);//default val for chip from ECO1
    } else {
        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_PWR_GLITCH_RESET_ENA, 0);
    }
--- a/components/bootloader_support/src/esp32c5/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32c5/flash_encryption_secure_features.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -71,12 +71,9 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

 esp_err_t esp_flash_encryption_enable_key_mgr(void)
 {
-    // Enable and reset key manager
-    // To suppress build errors about spinlock's __DECLARE_RCC_ATOMIC_ENV
-    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused));
-    key_mgr_ll_enable_bus_clock(true);
-    key_mgr_ll_enable_peripheral_clock(true);
-    key_mgr_ll_reset_register();
+    _key_mgr_ll_enable_bus_clock(true);
+    _key_mgr_ll_enable_peripheral_clock(true);
+    _key_mgr_ll_reset_register();

    while (key_mgr_ll_get_state() != ESP_KEY_MGR_STATE_IDLE) {
    };
--- a/components/bootloader_support/src/esp32c5/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32c5/secure_boot_secure_features.c
@@ -49,6 +49,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE);
 #endif

+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_SHA384_EN);
+#endif
+
+    esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
+
    esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);

 #ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
--- a/components/bootloader_support/src/esp32c61/bootloader_esp32c61.c
+++ b/components/bootloader_support/src/esp32c61/bootloader_esp32c61.c
@@ -95,8 +95,7 @@ static inline void bootloader_ana_reset_config(void)
 {
    //Enable BOD reset (mode1)
    brownout_ll_ana_reset_enable(true);
-    uint8_t power_glitch_dref = 0;
-    bootloader_power_glitch_reset_config(true, power_glitch_dref);
+    bootloader_power_glitch_reset_config(true);
 }

 esp_err_t bootloader_init(void)
--- a/components/bootloader_support/src/esp32c61/bootloader_soc.c
+++ b/components/bootloader_support/src/esp32c61/bootloader_soc.c
@@ -17,18 +17,18 @@ void bootloader_ana_clock_glitch_reset_config(bool enable)
    (void)enable;
 }

-void bootloader_power_glitch_reset_config(bool enable, uint8_t dref)
+void bootloader_power_glitch_reset_config(bool enable)
 {
-    assert(dref < 8);
-    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);
+    //only detect VDDPST POWER GLITCH
+    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
+    SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_PERIF, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_PLLBB, 0);
+    REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_XPD_VDET_PLL, 0);
+
+    REG_SET_FIELD(LP_ANA_FIB_ENABLE_REG, LP_ANA_ANA_FIB_PWR_GLITCH_ENA, 0);//default val for chip from ECO2
    if (enable) {
-        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_PERIF_I2C_RSTB);
-        SET_PERI_REG_MASK(PMU_RF_PWC_REG, PMU_XPD_PERIF_I2C);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PERIF, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_VDDPST, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLLBB, dref);
-        REGI2C_WRITE_MASK(I2C_SAR_ADC, POWER_GLITCH_DREF_VDET_PLL, dref);
-        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_POWER_GLITCH_RESET_ENA, 0xf);
+        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_POWER_GLITCH_RESET_ENA, 0xf);//default val for chip from ECO2
    } else {
        REG_SET_FIELD(LP_ANA_POWER_GLITCH_CNTL_REG, LP_ANA_POWER_GLITCH_RESET_ENA, 0);
    }
--- a/components/bootloader_support/src/esp32h2/secure_boot_secure_features.c
+++ b/components/bootloader_support/src/esp32h2/secure_boot_secure_features.c
@@ -1,10 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */

 #include <strings.h>
+#include "hal/ecdsa_ll.h"
 #include "esp_flash_encrypt.h"
 #include "esp_secure_boot.h"
 #include "esp_efuse.h"
@@ -36,6 +37,12 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
    ESP_LOGW(TAG, "UART ROM Download mode kept enabled - SECURITY COMPROMISED");
 #endif

+#ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+    }
+#endif
+
 #ifndef CONFIG_SECURE_BOOT_ALLOW_JTAG
    ESP_LOGI(TAG, "Disable hardware & software JTAG...");
    esp_efuse_write_field_bit(ESP_EFUSE_DIS_PAD_JTAG);
--- a/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
+++ b/components/bootloader_support/src/esp32p4/flash_encryption_secure_features.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2022-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -53,12 +53,9 @@ esp_err_t esp_flash_encryption_enable_secure_features(void)

 esp_err_t esp_flash_encryption_enable_key_mgr(void)
 {
-    // Enable and reset key manager
-    // To suppress build errors about spinlock's __DECLARE_RCC_ATOMIC_ENV
-    int __DECLARE_RCC_ATOMIC_ENV __attribute__ ((unused));
-    key_mgr_ll_enable_bus_clock(true);
-    key_mgr_ll_enable_peripheral_clock(true);
-    key_mgr_ll_reset_register();
+    _key_mgr_ll_enable_bus_clock(true);
+    _key_mgr_ll_enable_peripheral_clock(true);
+    _key_mgr_ll_reset_register();

    while (key_mgr_ll_get_state() != ESP_KEY_MGR_STATE_IDLE) {
    };
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -23,6 +23,7 @@
 #include "soc/soc_caps.h"
 #include "hal/cache_ll.h"
 #include "spi_flash_mmap.h"
+#include "hal/efuse_hal.h"

 #define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))

@@ -104,7 +105,6 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
 static esp_err_t process_image_header(esp_image_metadata_t *data, uint32_t part_offset, bootloader_sha256_handle_t *sha_handle, bool do_verify, bool silent);
 static esp_err_t process_appended_hash_and_sig(esp_image_metadata_t *data, uint32_t part_offset, uint32_t part_len, bool do_verify, bool silent);
 static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_t checksum_word, esp_image_metadata_t *data, bool silent, bool skip_check_checksum);
-
 static esp_err_t __attribute__((unused)) verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest);
 static esp_err_t __attribute__((unused)) verify_simple_hash(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data);

@@ -119,11 +119,26 @@ void esp_image_bootloader_offset_set(const uint32_t offset)
 {
    s_bootloader_partition_offset = offset;
    ESP_LOGI(TAG, "Bootloader offsets for PRIMARY: 0x%x, Secondary: 0x%" PRIx32, ESP_PRIMARY_BOOTLOADER_OFFSET, s_bootloader_partition_offset);
+#if SOC_RECOVERY_BOOTLOADER_SUPPORTED
+    uint32_t recovery_offset = efuse_hal_get_recovery_bootloader_address();
+    if (efuse_hal_recovery_bootloader_enabled()) {
+        ESP_LOGI(TAG, "Bootloader offset for RECOVERY: 0x%" PRIx32, recovery_offset);
+    } else if (recovery_offset == 0) {
+        ESP_LOGI(TAG, "Bootloader offset for RECOVERY: has not been set yet");
+    } else {
+        ESP_LOGI(TAG, "Bootloader offset for RECOVERY: is disabled");
+    }
+#endif
 }

 static bool is_bootloader(uint32_t offset)
 {
-    return ((offset == ESP_PRIMARY_BOOTLOADER_OFFSET) || (offset == s_bootloader_partition_offset));
+    return ((offset == ESP_PRIMARY_BOOTLOADER_OFFSET)
+         || (offset == s_bootloader_partition_offset)
+#if SOC_RECOVERY_BOOTLOADER_SUPPORTED
+         || (efuse_hal_recovery_bootloader_enabled() ? offset == efuse_hal_get_recovery_bootloader_address() : false)
+#endif
+    );
 }

 static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_t *part, esp_image_metadata_t *data)
@@ -144,8 +159,8 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
    bool verify_sha;
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
     /* used for anti-FI checks */
-    uint8_t image_digest[HASH_LEN] = { [ 0 ... 31] = 0xEE };
-    uint8_t verified_digest[HASH_LEN] = { [ 0 ... 31 ] = 0x01 };
+    uint8_t image_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { [ 0 ... ESP_SECURE_BOOT_DIGEST_LEN - 1 ] = 0xEE };
+    uint8_t verified_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { [ 0 ... ESP_SECURE_BOOT_DIGEST_LEN - 1 ] = 0x01 };
 #endif

    if (data == NULL || part == NULL) {
@@ -221,7 +236,7 @@ static esp_err_t image_load(esp_image_load_mode_t mode, const esp_partition_pos_
       "only verify signature in bootloader" into the macro so it's tested multiple times.
     */
 #if CONFIG_SECURE_BOOT_V2_ENABLED
-    ESP_FAULT_ASSERT(!esp_secure_boot_enabled() || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
+    ESP_FAULT_ASSERT(!esp_secure_boot_enabled() || memcmp(image_digest, verified_digest, ESP_SECURE_BOOT_DIGEST_LEN) == 0);
 #else // Secure Boot V1 on ESP32, only verify signatures for apps not bootloaders
    ESP_FAULT_ASSERT(is_bootloader(data->start_addr) || memcmp(image_digest, verified_digest, HASH_LEN) == 0);
 #endif
@@ -796,20 +811,27 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    bool map_segment = should_map(load_addr);

 #if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+    esp_err_t err = ESP_FAIL;
+
    /* ESP APP descriptor is present in the DROM segment #0 */
    if (index == 0 && !is_bootloader(metadata->start_addr)) {
-        const esp_app_desc_t *app_desc = (const esp_app_desc_t *)bootloader_mmap(segment_data_offs, sizeof(esp_app_desc_t));
-        if (!app_desc || app_desc->magic_word != ESP_APP_DESC_MAGIC_WORD) {
+        uint32_t mmu_page_size = 0, magic_word = 0;
+        const uint32_t mmu_page_size_offset = segment_data_offs + offsetof(esp_app_desc_t, mmu_page_size);
+        CHECK_ERR(bootloader_flash_read(segment_data_offs, &magic_word, sizeof(uint32_t), true));
+        CHECK_ERR(bootloader_flash_read(mmu_page_size_offset, &mmu_page_size, sizeof(uint32_t), true));
+        // Extract only the lowest byte from mmu_page_size (as per image format)
+        mmu_page_size &= 0xFF;
+
+        if (magic_word != ESP_APP_DESC_MAGIC_WORD) {
            ESP_LOGE(TAG, "Failed to fetch app description header!");
            return ESP_FAIL;
        }

        // Convert from log base 2 number to actual size while handling legacy image case (value 0)
-        metadata->mmu_page_size = (app_desc->mmu_page_size > 0) ? (1UL << app_desc->mmu_page_size) : SPI_FLASH_MMU_PAGE_SIZE;
+        metadata->mmu_page_size = (mmu_page_size > 0) ? (1UL << mmu_page_size) : SPI_FLASH_MMU_PAGE_SIZE;
        if (metadata->mmu_page_size != SPI_FLASH_MMU_PAGE_SIZE) {
            ESP_LOGI(TAG, "MMU page size mismatch, configured: 0x%x, found: 0x%"PRIx32, SPI_FLASH_MMU_PAGE_SIZE, metadata->mmu_page_size);
        }
-        bootloader_munmap(app_desc);
    } else if (index == 0 && is_bootloader(metadata->start_addr)) {
        // Bootloader always uses the default MMU page size
        metadata->mmu_page_size = SPI_FLASH_MMU_PAGE_SIZE;
@@ -836,6 +858,10 @@ static esp_err_t verify_segment_header(int index, const esp_image_segment_header
    }

    return ESP_OK;
+#if SOC_MMU_PAGE_SIZE_CONFIGURABLE
+err:
+    return err;
+#endif
 }

 static bool should_map(uint32_t load_addr)
@@ -996,43 +1022,14 @@ err:
    return err;
 }

-static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest)
-{
 #if (SECURE_BOOT_CHECK_SIGNATURE == 1)
-    uint32_t end = data->start_addr + data->image_len;
-
-    ESP_LOGI(TAG, "Verifying image signature...");
-
-    // For secure boot, we calculate the signature hash over the whole file, which includes any "simple" hash
-    // appended to the image for corruption detection
-    if (data->image.hash_appended) {
-        const void *simple_hash = bootloader_mmap(end - HASH_LEN, HASH_LEN);
-        bootloader_sha256_data(sha_handle, simple_hash, HASH_LEN);
-        bootloader_munmap(simple_hash);
-    }
-
-#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
-    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
-    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
-    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
-    if (padded_end > end) {
-        const void *padding = bootloader_mmap(end, padded_end - end);
-        bootloader_sha256_data(sha_handle, padding, padded_end - end);
-        bootloader_munmap(padding);
-        end = padded_end;
-    }
-#endif // CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
-
-    bootloader_sha256_finish(sha_handle, image_digest);
-
-    // Log the hash for debugging
-    bootloader_debug_buffer(image_digest, HASH_LEN, "Calculated secure boot hash");
-
+static esp_err_t verify_signature_and_adjust_image_len(esp_image_metadata_t *data, uint32_t end, uint8_t *image_digest, uint8_t *verified_digest)
+{
    // Use hash to verify signature block
    esp_err_t err = ESP_ERR_IMAGE_INVALID;
 #if CONFIG_SECURE_BOOT || CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT
    const void *sig_block;
-    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, HASH_LEN) != 0); /* sanity check that these values start differently */
+    ESP_FAULT_ASSERT(memcmp(image_digest, verified_digest, ESP_SECURE_BOOT_DIGEST_LEN) != 0); /* sanity check that these values start differently */
 #if defined(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
    sig_block = bootloader_mmap(data->start_addr + data->image_len, sizeof(esp_secure_boot_sig_block_t));
    err = esp_secure_boot_verify_ecdsa_signature_block(sig_block, image_digest, verified_digest);
@@ -1049,7 +1046,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
        ESP_LOGI(TAG, "Calculating simple hash to check for corruption...");
        const void *whole_image = bootloader_mmap(data->start_addr, data->image_len - HASH_LEN);
        if (whole_image != NULL) {
-            sha_handle = bootloader_sha256_start();
+            bootloader_sha256_handle_t sha_handle = bootloader_sha256_start();
            bootloader_sha256_data(sha_handle, whole_image, data->image_len - HASH_LEN);
            bootloader_munmap(whole_image);
            if (verify_simple_hash(sha_handle, data) != ESP_OK) {
@@ -1070,6 +1067,64 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
    }
 #endif

+    return ESP_OK;
+}
+#endif /* SECURE_BOOT_CHECK_SIGNATURE */
+
+static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_handle, esp_image_metadata_t *data, uint8_t *image_digest, uint8_t *verified_digest)
+{
+#if (SECURE_BOOT_CHECK_SIGNATURE == 1)
+    uint32_t end = data->start_addr + data->image_len;
+
+    ESP_LOGI(TAG, "Verifying image signature...");
+
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    (void) sha_handle;
+    /* Re-calculating image digest using SHA384 */
+    const void *image_data = bootloader_mmap(data->start_addr, data->image_len - HASH_LEN);
+    bootloader_sha_handle_t sha384_handle = bootloader_sha512_start(true);
+    bootloader_sha512_data(sha384_handle, image_data, data->image_len - HASH_LEN);
+    bootloader_munmap(image_data);
+#endif
+
+    // For secure boot, we calculate the signature hash over the whole file, which includes any "simple" hash
+    // appended to the image for corruption detection
+    if (data->image.hash_appended) {
+        const void *simple_hash = bootloader_mmap(end - HASH_LEN, HASH_LEN);
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+        bootloader_sha512_data(sha384_handle, simple_hash, HASH_LEN);
+#else
+        bootloader_sha256_data(sha_handle, simple_hash, HASH_LEN);
+#endif
+        bootloader_munmap(simple_hash);
+    }
+
+#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
+    // End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
+    // (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
+    uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
+    if (padded_end > end) {
+        const void *padding = bootloader_mmap(end, padded_end - end);
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+        bootloader_sha512_data(sha384_handle, padding, padded_end - end);
+#else
+        bootloader_sha256_data(sha_handle, padding, padded_end - end);
+#endif
+        bootloader_munmap(padding);
+        end = padded_end;
+    }
+#endif // CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
+
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    bootloader_sha512_finish(sha384_handle, image_digest);
+#else
+    bootloader_sha256_finish(sha_handle, image_digest);
+#endif
+
+    // Log the hash for debugging
+    bootloader_debug_buffer(image_digest, ESP_SECURE_BOOT_DIGEST_LEN, "Calculated secure boot hash");
+
+    return verify_signature_and_adjust_image_len(data, end, image_digest, verified_digest);
 #endif // SECURE_BOOT_CHECK_SIGNATURE
    return ESP_OK;
 }
--- a/components/bootloader_support/src/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot.c
@@ -12,6 +12,10 @@
 #include "esp_secure_boot.h"
 #include "hal/efuse_hal.h"

+#ifdef SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
 #ifndef BOOTLOADER_BUILD
 static __attribute__((unused)) const char *TAG = "secure_boot";

@@ -341,15 +345,17 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
    }

 #ifdef SOC_ECDSA_P192_CURVE_DEFAULT_DISABLED
-    secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
-    if (!secure) {
-        uint8_t current_curve;
-        esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
-        if (err == ESP_OK) {
-            if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
-                // If not P256 mode
-                result &= secure;
-                ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+    if (ecdsa_ll_is_configurable_curve_supported()) {
+        secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_ECDSA_CURVE_MODE);
+        if (!secure) {
+            uint8_t current_curve;
+            esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_ECDSA_CURVE_MODE, &current_curve, ESP_EFUSE_ECDSA_CURVE_MODE[0]->bit_count);
+            if (err == ESP_OK) {
+                if (current_curve != ESP_EFUSE_ECDSA_CURVE_MODE_ALLOW_ONLY_P256_BIT_LOCKED) {
+                    // If not P256 mode
+                    result &= secure;
+                    ESP_LOGW(TAG, "Not write disabled ECDSA curve mode (set WR_DIS_ECDSA_CURVE_MODE->1)");
+                }
            }
        }
    }
@@ -421,7 +427,19 @@ bool esp_secure_boot_cfg_verify_release_mode(void)
 #endif
        }
    }
+
+#if SOC_ECDSA_SUPPORT_CURVE_P384
+    /* When using Secure Boot with SHA-384, the efuse bit representing Secure Boot with SHA-384 would already be programmed.
+     * But in the case of the existing Secure Boot V2 schemes using SHA-256, the efuse bit representing
+     * Secure Boot with SHA-384 needs to be write-protected, so that an attacker cannot perform a denial-of-service
+     * attack by changing the existing secure boot mode using SHA-256 to SHA-384.
+     */
+    secure = esp_efuse_read_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
    result &= secure;
+    if (!secure) {
+        ESP_LOGW(TAG, "Not write-protected secure boot using SHA-384 mode (set WR_DIS_SECURE_BOOT_SHA384_EN->1)");
+    }
+#endif

    secure = (num_keys != 0);
    result &= secure;
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -69,16 +69,21 @@ static esp_err_t validate_signature_block(const ets_secure_boot_sig_block_t *blo
 */
 static esp_err_t s_calculate_image_public_key_digests(uint32_t flash_offset, uint32_t flash_size, esp_image_sig_public_key_digests_t *public_key_digests)
 {
-    esp_err_t ret;
+    esp_err_t ret = ESP_FAIL;
    uint8_t image_digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};
-    uint8_t __attribute__((aligned(4))) key_digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};
+    uint8_t __attribute__((aligned(4))) key_digest[ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN] = {0};
    size_t sig_block_addr = flash_offset + ALIGN_UP(flash_size, FLASH_SECTOR_SIZE);

    ESP_LOGD(TAG, "calculating public key digests for sig blocks of image offset 0x%" PRIx32 " (sig block offset 0x%x)", flash_offset, sig_block_addr);

    bzero(public_key_digests, sizeof(esp_image_sig_public_key_digests_t));

+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    ret = bootloader_sha384_flash_contents(flash_offset, sig_block_addr - flash_offset, image_digest);
+#else
    ret = bootloader_sha256_flash_contents(flash_offset, sig_block_addr - flash_offset, image_digest);
+#endif
+
    if (ret != ESP_OK) {
        ESP_LOGE(TAG, "error generating image digest, %d", ret);
        return ret;
@@ -129,7 +134,7 @@ static esp_err_t s_calculate_image_public_key_digests(uint32_t flash_offset, uin
        }
        ESP_LOGD(TAG, "Signature block (%d) is verified", i);
        /* Copy the key digest to the buffer provided by the caller */
-        memcpy((void *)public_key_digests->key_digests[i], key_digest, ESP_SECURE_BOOT_DIGEST_LEN);
+        memcpy((void *)public_key_digests->key_digests[i], key_digest, ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN);
        public_key_digests->num_digests++;
    }

@@ -317,7 +322,7 @@ static esp_err_t check_and_generate_secure_boot_keys(const esp_image_metadata_t
        }

        for (unsigned j = 0; j < tee_key_digests.num_digests; j++) {
-            if (!memcmp(boot_key_digests.key_digests[i], tee_key_digests.key_digests[j], ESP_SECURE_BOOT_DIGEST_LEN)) {
+            if (!memcmp(boot_key_digests.key_digests[i], tee_key_digests.key_digests[j], ESP_SECURE_BOOT_KEY_DIGEST_LEN)) {
                ESP_LOGI(TAG, "TEE key(%d) matches with bootloader key(%d).", j, i);
                tee_match = true;
            }
--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_app.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_app.c
@@ -73,7 +73,7 @@ static esp_err_t calculate_image_public_key_digests(bool verify_image_digest, bo
    }

    uint8_t image_digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};
-    uint8_t __attribute__((aligned(4))) key_digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};
+    uint8_t __attribute__((aligned(4))) key_digest[ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN] = {0};
    size_t sig_block_addr = img_metadata.start_addr + ALIGN_UP(img_metadata.image_len, FLASH_SECTOR_SIZE);

    ESP_LOGD(TAG, "calculating public key digests for sig blocks of image offset 0x%"PRIu32" (sig block offset 0x%u)", img_metadata.start_addr, sig_block_addr);
@@ -81,7 +81,11 @@ static esp_err_t calculate_image_public_key_digests(bool verify_image_digest, bo
    bzero(public_key_digests, sizeof(esp_image_sig_public_key_digests_t));

    if (verify_image_digest) {
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+        ret = bootloader_sha384_flash_contents(img_metadata.start_addr, sig_block_addr - img_metadata.start_addr, image_digest);
+#else
        ret = bootloader_sha256_flash_contents(img_metadata.start_addr, sig_block_addr - img_metadata.start_addr, image_digest);
+#endif
        if (ret != ESP_OK) {
            ESP_LOGE(TAG, "error generating image digest, %d", ret);
            return ret;
@@ -118,7 +122,7 @@ static esp_err_t calculate_image_public_key_digests(bool verify_image_digest, bo
                        ESP_LOGD(TAG, "Signature block (%d) is verified", i);
                    }
                    /* Copy the key digest to the buffer provided by the caller */
-                    memcpy((void *)public_key_digests->key_digests[public_key_digests->num_digests], key_digest, ESP_SECURE_BOOT_DIGEST_LEN);
+                    memcpy((void *)public_key_digests->key_digests[public_key_digests->num_digests], key_digest, ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN);
                }
                public_key_digests->num_digests++;
            }
@@ -184,14 +188,19 @@ static esp_err_t get_secure_boot_key_digests(esp_image_sig_public_key_digests_t

 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
-    uint8_t digest[ESP_SECURE_BOOT_KEY_DIGEST_LEN] = {0};
-    uint8_t verified_digest[ESP_SECURE_BOOT_KEY_DIGEST_LEN] = {0};
+    esp_err_t err = ESP_FAIL;
+    uint8_t digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};

    /* Rounding off length to the upper 4k boundary */
    uint32_t padded_length = ALIGN_UP(length, FLASH_SECTOR_SIZE);
    ESP_LOGD(TAG, "verifying signature src_addr 0x%"PRIx32" length 0x%"PRIx32, src_addr, length);

-    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    err = bootloader_sha384_flash_contents(src_addr, padded_length, digest);
+#else
+    err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+#endif
+
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Digest calculation failed 0x%"PRIx32", 0x%"PRIx32, src_addr, padded_length);
        return err;
@@ -203,7 +212,7 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
        return ESP_FAIL;
    }

-    err = esp_secure_boot_verify_sbv2_signature_block(sig_block, digest, verified_digest);
+    err = esp_secure_boot_verify_sbv2_signature_block(sig_block, digest, NULL);
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Secure Boot V2 verification failed.");
    }
@@ -218,9 +227,11 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
 {
    bool any_trusted_key = false;

-    /* Note: in IDF verification we don't add any fault injection resistance, as we don't expect this to be called
-        during boot-time verification. */
-    memset(verified_digest, 0, ESP_SECURE_BOOT_KEY_DIGEST_LEN);
+    if (verified_digest != NULL) {
+        /* Note: in IDF verification we don't add any fault injection resistance, as we don't expect this to be called
+            during boot-time verification. */
+        memset(verified_digest, 0, ESP_SECURE_BOOT_DIGEST_LEN);
+    }

    esp_image_sig_public_key_digests_t trusted = {0};

@@ -237,7 +248,7 @@ esp_err_t esp_secure_boot_verify_sbv2_signature_block(const ets_secure_boot_sign
 #endif

    for (unsigned app_blk_idx = 0; app_blk_idx < secure_boot_num_blocks; app_blk_idx++) {
-        uint8_t app_blk_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { 0 };
+        uint8_t app_blk_digest[ESP_SECURE_BOOT_KEY_DIGEST_SHA_256_LEN] = { 0 };
        const ets_secure_boot_sig_block_t *app_blk = &sig_block->block[app_blk_idx];
        const ets_secure_boot_sig_block_t *trusted_block = NULL;

--- a/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
+++ b/components/bootloader_support/src/secure_boot_v2/secure_boot_signatures_bootloader.c
@@ -26,6 +26,7 @@ static const char* TAG = "secure_boot_v2";

 esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
 {
+    esp_err_t err = ESP_FAIL;
    uint8_t digest[ESP_SECURE_BOOT_DIGEST_LEN] = {0};
    uint8_t verified_digest[ESP_SECURE_BOOT_DIGEST_LEN] = { 0 }; /* Note: this function doesn't do any anti-FI checks on this buffer */

@@ -34,7 +35,12 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
    ESP_LOGD(TAG, "verifying signature src_addr 0x%" PRIx32 " length 0x%" PRIx32, src_addr, length);

    /* Calculate digest of main image */
-    esp_err_t err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+#if CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+    err = bootloader_sha384_flash_contents(src_addr, padded_length, digest);
+#else
+    err = bootloader_sha256_flash_contents(src_addr, padded_length, digest);
+#endif
+
    if (err != ESP_OK) {
        ESP_LOGE(TAG, "Digest calculation failed 0x%" PRIx32 ", 0x%" PRIx32, src_addr, padded_length);
        return err;
--- a/components/bt/CMakeLists.txt
+++ b/components/bt/CMakeLists.txt
@@ -134,6 +134,7 @@ if(CONFIG_BT_ENABLED)
         "common/osi/semaphore.c"
         "porting/mem/bt_osi_mem.c"
         "common/ble_log/ble_log_spi_out.c"
+         "common/ble_log/ble_log_uhci_out.c"
         )

    # Host Bluedroid
@@ -155,9 +156,6 @@ if(CONFIG_BT_ENABLED)
            host/bluedroid/bta/sys/include
            host/bluedroid/device/include
            host/bluedroid/hci/include
-            host/bluedroid/external/sbc/decoder/include
-            host/bluedroid/external/sbc/encoder/include
-            host/bluedroid/external/sbc/plc/include
            host/bluedroid/btc/profile/esp/include
            host/bluedroid/btc/profile/std/a2dp/include
            host/bluedroid/btc/profile/std/include
@@ -315,29 +313,6 @@ if(CONFIG_BT_ENABLED)
                   "host/bluedroid/device/bdaddr.c"
                   "host/bluedroid/device/controller.c"
                   "host/bluedroid/device/interop.c"
-                   "host/bluedroid/external/sbc/decoder/srce/alloc.c"
-                   "host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c"
-                   "host/bluedroid/external/sbc/decoder/srce/bitalloc.c"
-                   "host/bluedroid/external/sbc/decoder/srce/bitstream-decode.c"
-                   "host/bluedroid/external/sbc/decoder/srce/decoder-oina.c"
-                   "host/bluedroid/external/sbc/decoder/srce/decoder-private.c"
-                   "host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c"
-                   "host/bluedroid/external/sbc/decoder/srce/dequant.c"
-                   "host/bluedroid/external/sbc/decoder/srce/framing-sbc.c"
-                   "host/bluedroid/external/sbc/decoder/srce/framing.c"
-                   "host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c"
-                   "host/bluedroid/external/sbc/decoder/srce/synthesis-8-generated.c"
-                   "host/bluedroid/external/sbc/decoder/srce/synthesis-dct8.c"
-                   "host/bluedroid/external/sbc/decoder/srce/synthesis-sbc.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_analysis.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_dct.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_dct_coeffs.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_enc_coeffs.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_encoder.c"
-                   "host/bluedroid/external/sbc/encoder/srce/sbc_packing.c"
-                   "host/bluedroid/external/sbc/plc/sbc_plc.c"
                   "host/bluedroid/hci/hci_audio.c"
                   "host/bluedroid/hci/hci_hal_h4.c"
                   "host/bluedroid/hci/hci_layer.c"
@@ -474,6 +449,38 @@ if(CONFIG_BT_ENABLED)
                            "host/bluedroid/api/esp_ble_cte_api.c")
        endif()

+        if((CONFIG_BT_A2DP_ENABLE AND NOT CONFIG_BT_A2DP_USE_EXTERNAL_CODEC) OR
+           (CONFIG_BT_HFP_ENABLE AND CONFIG_BT_HFP_AUDIO_DATA_PATH_HCI AND NOT CONFIG_BT_HFP_USE_EXTERNAL_CODEC))
+            list(APPEND priv_include_dirs
+                host/bluedroid/external/sbc/decoder/include
+                host/bluedroid/external/sbc/encoder/include
+                host/bluedroid/external/sbc/plc/include)
+
+            list(APPEND srcs "host/bluedroid/external/sbc/decoder/srce/alloc.c"
+                "host/bluedroid/external/sbc/decoder/srce/bitalloc-sbc.c"
+                "host/bluedroid/external/sbc/decoder/srce/bitalloc.c"
+                "host/bluedroid/external/sbc/decoder/srce/bitstream-decode.c"
+                "host/bluedroid/external/sbc/decoder/srce/decoder-oina.c"
+                "host/bluedroid/external/sbc/decoder/srce/decoder-private.c"
+                "host/bluedroid/external/sbc/decoder/srce/decoder-sbc.c"
+                "host/bluedroid/external/sbc/decoder/srce/dequant.c"
+                "host/bluedroid/external/sbc/decoder/srce/framing-sbc.c"
+                "host/bluedroid/external/sbc/decoder/srce/framing.c"
+                "host/bluedroid/external/sbc/decoder/srce/oi_codec_version.c"
+                "host/bluedroid/external/sbc/decoder/srce/synthesis-8-generated.c"
+                "host/bluedroid/external/sbc/decoder/srce/synthesis-dct8.c"
+                "host/bluedroid/external/sbc/decoder/srce/synthesis-sbc.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_analysis.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_dct.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_dct_coeffs.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_mono.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_enc_bit_alloc_ste.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_enc_coeffs.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_encoder.c"
+                "host/bluedroid/external/sbc/encoder/srce/sbc_packing.c"
+                "host/bluedroid/external/sbc/plc/sbc_plc.c")
+        endif()
+
    endif()

    if(CONFIG_BLE_MESH)
@@ -938,6 +945,11 @@ if(CONFIG_BT_ENABLED)
        if(CONFIG_BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE)
            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=esp_panic_handler")
        endif()
+        if(CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED)
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_tx_chars")
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes")
+            target_link_libraries(${COMPONENT_LIB} INTERFACE "-Wl,--wrap=uart_write_bytes_with_break")
+        endif()
        if(CONFIG_IDF_TARGET_ESP32C6)
            add_prebuilt_library(libble_app
                "${CMAKE_CURRENT_LIST_DIR}/controller/lib_esp32c6/esp32c6-bt-lib/esp32c6/libble_app.a"
--- a/components/bt/common/Kconfig.in
+++ b/components/bt/common/Kconfig.in
@@ -27,6 +27,21 @@ config BT_BLE_LOG_SPI_OUT_HCI_ENABLED
    help
        Enable logging of HCI packets to the SPI bus when BLE SPI log output is enabled.

+config BT_BLE_LOG_SPI_OUT_HCI_BUF_SIZE
+    int "SPI transaction buffer size for HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for HCI logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HCI_TASK_CNT
+    int "HCI task count"
+    depends on BT_BLE_LOG_SPI_OUT_HCI_ENABLED
+    default 1
+    help
+        HCI task count
+
 config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
    bool "Enable Host log output to SPI"
    depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -35,6 +50,21 @@ config BT_BLE_LOG_SPI_OUT_HOST_ENABLED
        This configuration applies to the logs of both Bluedroid Host and NimBLE Host.
        When BLE SPI log output is enabled, this option allows host logs to be transmitted via SPI.

+config BT_BLE_LOG_SPI_OUT_HOST_BUF_SIZE
+    int "SPI transaction buffer size for host logs"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for host logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_HOST_TASK_CNT
+    int "Host task count"
+    depends on BT_BLE_LOG_SPI_OUT_HOST_ENABLED
+    default 2
+    help
+        Host task count.
+
 config BT_BLE_LOG_SPI_OUT_LL_ENABLED
    bool "Enable Controller log output to SPI"
    depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -48,7 +78,7 @@ config BT_BLE_LOG_SPI_OUT_LL_TASK_BUF_SIZE
    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
    default 1024
    help
-        SPI transaction buffer size for upper layer task logs.
+        SPI transaction buffer size for lower layer task logs.
        There will be 2 SPI DMA buffers with the same size.

 config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
@@ -56,9 +86,17 @@ config BT_BLE_LOG_SPI_OUT_LL_ISR_BUF_SIZE
    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
    default 512
    help
-        SPI transaction buffer size for upper layer ISR logs.
+        SPI transaction buffer size for lower layer ISR logs.
        There will be 2 SPI DMA buffers with the same size.

+config BT_BLE_LOG_SPI_OUT_LL_HCI_BUF_SIZE
+    int "SPI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_SPI_OUT_LL_ENABLED
+    default 512
+    help
+        SPI transaction buffer size for upper layer HCI logs.
+        There will be 2 SPI DMA buffers with the same size
+
 config BT_BLE_LOG_SPI_OUT_MOSI_IO_NUM
    int "GPIO number of SPI MOSI"
    depends on BT_BLE_LOG_SPI_OUT_ENABLED
@@ -108,3 +146,108 @@ config BT_BLE_LOG_SPI_OUT_FLUSH_TIMEOUT
    default 1000
    help
        Buffer flush out period in unit of ms
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    bool "Enable LE Audio log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable LE Audio log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_BUF_SIZE
+    int "SPI transaction buffer size for LE Audio logs"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for LE Audio logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_LE_AUDIO_TASK_CNT
+    int "LE audio task count"
+    depends on BT_BLE_LOG_SPI_OUT_LE_AUDIO_ENABLED
+    default 1
+    help
+        LE audio task count
+
+config BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    bool "Enable BLE mesh log output to SPI"
+    depends on BT_BLE_LOG_SPI_OUT_ENABLED
+    default n
+    help
+        Enable BLE mesh log output to SPI
+
+config BT_BLE_LOG_SPI_OUT_MESH_BUF_SIZE
+    int "SPI transaction buffer size for BLE mesh logs"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 1024
+    help
+        SPI transaction buffer size for BLE mesh logs.
+        There will be 2 SPI DMA buffers with the same size.
+
+config BT_BLE_LOG_SPI_OUT_MESH_TASK_CNT
+    int "Mesh task count"
+    depends on BT_BLE_LOG_SPI_OUT_MESH_ENABLED
+    default 3
+    help
+        Mesh task count
+
+config BT_BLE_LOG_UHCI_OUT_ENABLED
+    bool "Output ble logs via UHCI (UART DMA) driver (Experimental)"
+    default n
+    help
+        Output ble logs via UHCI (UART DMA) driver
+        On enable, BT_BLE_LOG_UHCI_OUT_UART_PORT would be reinited with
+        BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE as new baud rate and
+        BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX as new UART Tx IO
+
+config BT_BLE_LOG_UHCI_OUT_UART_PORT
+    int "UART port connected to UHCI controller"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 0
+    help
+        UART port connected to UHCI controller
+        If UART port 0 is selected, UART VFS Driver, UART ROM Driver
+        and UART Driver output would be redirected to BLE Log UHCI Out
+        to solve UART Tx FIFO multi-task access issue
+
+config BT_BLE_LOG_UHCI_OUT_LL_TASK_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer task logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer task logs
+
+config BT_BLE_LOG_UHCI_OUT_LL_ISR_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer ISR logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer ISR logs
+
+config BT_BLE_LOG_UHCI_OUT_LL_HCI_BUF_SIZE
+    int "UHCI transaction buffer size for lower layer HCI logs"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default 1024
+    help
+        UHCI transaction buffer size for lower layer HCI logs
+
+config BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    bool "Enable to init UART port"
+    depends on BT_BLE_LOG_UHCI_OUT_ENABLED
+    default y
+    help
+        Enable to init UART port
+
+config BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE
+    int "Baud rate for BT_BLE_LOG_UHCI_OUT_UART_PORT"
+    depends on BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    default 3000000
+    help
+        Baud rate for BT_BLE_LOG_UHCI_OUT_UART_PORT
+
+config BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX
+    int "IO number for UART TX port"
+    depends on BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+    default 0
+    help
+        IO number for UART TX port
--- a/components/bt/common/ble_log/ble_log_spi_out.c
+++ b/components/bt/common/ble_log/ble_log_spi_out.c
--- a/components/bt/common/ble_log/ble_log_uhci_out.c
+++ b/components/bt/common/ble_log/ble_log_uhci_out.c
@@ -0,0 +1,780 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#include "ble_log/ble_log_uhci_out.h"
+
+
+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
+// Private includes
+#include "esp_bt.h"
+
+// sdkconfig defines
+#define UHCI_OUT_LL_TASK_BUF_SIZE               CONFIG_BT_BLE_LOG_UHCI_OUT_LL_TASK_BUF_SIZE
+#define UHCI_OUT_LL_ISR_BUF_SIZE                CONFIG_BT_BLE_LOG_UHCI_OUT_LL_ISR_BUF_SIZE
+#define UHCI_OUT_LL_HCI_BUF_SIZE                CONFIG_BT_BLE_LOG_UHCI_OUT_LL_HCI_BUF_SIZE
+#define UHCI_OUT_UART_PORT                      CONFIG_BT_BLE_LOG_UHCI_OUT_UART_PORT
+#define UHCI_OUT_UART_NEED_INIT                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_NEED_INIT
+
+#if UHCI_OUT_UART_NEED_INIT
+#define UHCI_OUT_UART_BAUD_RATE                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_BAUD_RATE
+#define UHCI_OUT_UART_IO_NUM_TX                 CONFIG_BT_BLE_LOG_UHCI_OUT_UART_IO_NUM_TX
+#endif // UHCI_OUT_UART_NEED_INIT
+
+// Private defines
+#define UHCI_OUT_MAX_TRANSFER_SIZE              (10240)
+#define UHCI_OUT_MALLOC(size)                   heap_caps_malloc(size, MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT)
+#define UHCI_OUT_FLUSH_TIMEOUT_MS               (100)
+#define UHCI_OUT_FLUSH_TIMEOUT_US               (UHCI_OUT_FLUSH_TIMEOUT_MS * 1000)
+#define UHCI_OUT_USER_BUF_SIZE                  (512)
+#define UHCI_OUT_UART_PORT0                     (0)
+#define UHCI_OUT_UART_PORT1                     (1)
+#define UHCI_OUT_UART_DRIVER_RX_BUF_SIZE        (32)
+
+// Queue size defines
+#define UHCI_OUT_PING_PONG_BUF_CNT              (2)
+#define UHCI_OUT_USER_QUEUE_SIZE                (UHCI_OUT_PING_PONG_BUF_CNT)
+#define UHCI_OUT_LL_QUEUE_SIZE                  (3 * UHCI_OUT_PING_PONG_BUF_CNT)
+#define UHCI_OUT_QUEUE_SIZE                     (UHCI_OUT_USER_QUEUE_SIZE + UHCI_OUT_LL_QUEUE_SIZE)
+
+// Private typedefs
+typedef struct {
+    // This flag is for multithreading, must be a word, do not modify
+    volatile uint32_t flag;
+    uint16_t buf_size;
+    uint16_t length;
+    uint8_t buffer[0];
+} uhci_out_trans_cb_t;
+
+typedef struct {
+    uhci_out_trans_cb_t *trans_cb[2];
+    uint8_t trans_cb_idx;
+    uint8_t type;
+    uint16_t lost_frame_cnt;
+    uint32_t lost_bytes_cnt;
+    uint32_t frame_sn;
+} uhci_out_log_cb_t;
+
+typedef struct {
+    uint16_t length;
+    uint8_t source;
+    uint8_t type;
+    uint16_t frame_sn;
+} __attribute__((packed)) frame_head_t;
+
+typedef struct {
+    uint8_t type;
+    uint16_t lost_frame_cnt;
+    uint32_t lost_bytes_cnt;
+} __attribute__((packed)) loss_payload_t;
+
+// Private enums
+enum {
+    TRANS_CB_FLAG_AVAILABLE = 0,
+    TRANS_CB_FLAG_NEED_QUEUE,
+    TRANS_CB_FLAG_IN_QUEUE,
+};
+
+enum {
+    LOG_CB_TYPE_USER = 0,
+    LOG_CB_TYPE_LL,
+};
+
+enum {
+    LOG_CB_LL_SUBTYPE_TASK = 0,
+    LOG_CB_LL_SUBTYPE_ISR,
+    LOG_CB_LL_SUBTYPE_HCI
+};
+
+enum {
+    LL_LOG_FLAG_CONTINUE = 0,
+    LL_LOG_FLAG_END,
+    LL_LOG_FLAG_TASK,
+    LL_LOG_FLAG_ISR,
+    LL_LOG_FLAG_HCI,
+    LL_LOG_FLAG_RAW,
+    LL_LOG_FLAG_SYNC
+};
+
+enum {
+    LL_EV_FLAG_ISR_APPEND = 0,
+    LL_EV_FLAG_FLUSH_LOG,
+};
+
+// Private variables
+static bool uhci_out_inited = false;
+static uhci_controller_handle_t uhci_handle = NULL;
+
+static bool user_log_inited = false;
+static SemaphoreHandle_t user_log_mutex = NULL;
+static uhci_out_log_cb_t *user_log_cb = NULL;
+static uint32_t user_last_write_ts = 0;
+
+static bool ll_log_inited = false;
+static uhci_out_log_cb_t *ll_task_log_cb = NULL;
+static uhci_out_log_cb_t *ll_isr_log_cb = NULL;
+static uhci_out_log_cb_t *ll_hci_log_cb = NULL;
+static uint32_t ll_ev_flags = 0;
+static uint32_t ll_last_write_ts = 0;
+
+static esp_timer_handle_t flush_timer = NULL;
+
+// Private function declarations
+extern void esp_panic_handler_feed_wdts(void);
+
+static int uhci_out_init_trans(uhci_out_trans_cb_t **trans_cb, uint16_t buf_size);
+static void uhci_out_deinit_trans(uhci_out_trans_cb_t **trans_cb);
+static bool uhci_out_tx_done_cb(uhci_controller_handle_t uhci_ctrl,
+                                const uhci_tx_done_event_data_t *edata, void *user_ctx);
+static inline void uhci_out_append_trans(uhci_out_trans_cb_t *trans_cb);
+
+static int uhci_out_log_cb_init(uhci_out_log_cb_t **log_cb, uint16_t buf_size, uint8_t type, uint8_t idx);
+static void uhci_out_log_cb_deinit(uhci_out_log_cb_t **log_cb);
+static inline bool uhci_out_log_cb_check_trans(uhci_out_log_cb_t *log_cb, uint16_t len, bool *need_append);
+static inline void uhci_out_log_cb_append_trans(uhci_out_log_cb_t *log_cb);
+static inline void uhci_out_log_cb_flush_trans(uhci_out_log_cb_t *log_cb);
+static bool uhci_out_log_cb_write(uhci_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len,
+                                 const uint8_t *addr_append, uint16_t len_append, uint8_t source);
+static void uhci_out_log_cb_write_loss(uhci_out_log_cb_t *log_cb);
+static void uhci_out_log_cb_dump(uhci_out_log_cb_t *log_cb);
+
+static void esp_timer_cb_log_flush(void);
+static void uhci_out_user_write_str(const uint8_t *src, uint16_t len);
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+static void uhci_out_user_write_char(char c);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+static int uhci_out_user_log_init(void);
+static void uhci_out_user_log_deinit(void);
+
+static int uhci_out_ll_log_init(void);
+static void uhci_out_ll_log_deinit(void);
+static void uhci_out_ll_log_flush(void);
+
+#if defined(CONFIG_IDF_TARGET_ESP32H2) || defined(CONFIG_IDF_TARGET_ESP32C6) || defined(CONFIG_IDF_TARGET_ESP32C5) ||\
+    defined(CONFIG_IDF_TARGET_ESP32C61) || defined(CONFIG_IDF_TARGET_ESP32H21)
+extern void r_ble_log_simple_put_ev(void);
+#define UHCI_OUT_LL_PUT_EV r_ble_log_simple_put_ev()
+#elif defined(CONFIG_IDF_TARGET_ESP32C2)
+extern void ble_log_simple_put_ev(void);
+#define UHCI_OUT_LL_PUT_EV ble_log_simple_put_ev()
+#else
+#define UHCI_OUT_LL_PUT_EV
+#endif
+
+// Private macros
+#define UHCI_OUT_FRAME_HEAD_LEN     (sizeof(frame_head_t))
+#define UHCI_OUT_FRAME_TAIL_LEN     (sizeof(uint32_t))
+#define UHCI_OUT_FRAME_OVERHEAD     (UHCI_OUT_FRAME_HEAD_LEN + UHCI_OUT_FRAME_TAIL_LEN)
+#define UHCI_OUT_GET_FRAME_SN(VAR)  __atomic_fetch_add(VAR, 1, __ATOMIC_RELAXED)
+
+// Private functions
+static int uhci_out_init_trans(uhci_out_trans_cb_t **trans_cb, uint16_t buf_size)
+{
+    // Memory allocations
+    size_t cb_size = sizeof(uhci_out_trans_cb_t) + buf_size;
+    *trans_cb = (uhci_out_trans_cb_t *)UHCI_OUT_MALLOC(cb_size);
+    if (!(*trans_cb)) {
+        return -1;
+    }
+    memset(*trans_cb, 0, sizeof(uhci_out_trans_cb_t));
+
+    // Initialization
+    (*trans_cb)->buf_size = buf_size;
+    return 0;
+}
+
+static void uhci_out_deinit_trans(uhci_out_trans_cb_t **trans_cb)
+{
+    if (!(*trans_cb)) {
+        return;
+    }
+
+    free(*trans_cb);
+    *trans_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static bool uhci_out_tx_done_cb(uhci_controller_handle_t uhci_ctrl,
+                                          const uhci_tx_done_event_data_t *edata, void *user_ctx)
+{
+    uhci_out_trans_cb_t *trans_cb = (uhci_out_trans_cb_t *)((uint8_t *)edata->buffer - sizeof(uhci_out_trans_cb_t));
+    trans_cb->length = 0;
+    trans_cb->flag = TRANS_CB_FLAG_AVAILABLE;
+    return true;
+}
+
+IRAM_ATTR static inline void uhci_out_append_trans(uhci_out_trans_cb_t *trans_cb)
+{
+    if ((trans_cb->flag != TRANS_CB_FLAG_NEED_QUEUE) || !trans_cb->length) {
+        return;
+    }
+
+    // Note: If task yield after transmission but before flag set
+    //       flag might be reset in tx done ISR before flag set, leading to buffer access failure
+    trans_cb->flag = TRANS_CB_FLAG_IN_QUEUE;
+    if (uhci_transmit(uhci_handle, trans_cb->buffer, trans_cb->length) != ESP_OK) {
+        goto recycle;
+    }
+    return;
+
+recycle:
+    trans_cb->length = 0;
+    trans_cb->flag = TRANS_CB_FLAG_AVAILABLE;
+    return;
+}
+
+static int uhci_out_log_cb_init(uhci_out_log_cb_t **log_cb, uint16_t buf_size, uint8_t type, uint8_t idx)
+{
+    // Initialize log control block
+    *log_cb = (uhci_out_log_cb_t *)UHCI_OUT_MALLOC(sizeof(uhci_out_log_cb_t));
+    if (!(*log_cb)) {
+        return -1;
+    }
+    memset(*log_cb, 0, sizeof(uhci_out_log_cb_t));
+
+    // Initialize transactions
+    int ret = 0;
+    for (uint8_t i = 0; i < 2; i++) {
+        ret |= uhci_out_init_trans(&((*log_cb)->trans_cb[i]), buf_size);
+    }
+    if (ret != 0) {
+        uhci_out_log_cb_deinit(log_cb);
+        return -1;
+    }
+
+    (*log_cb)->type = (type << 4) | (idx);
+    return 0;
+}
+
+static void uhci_out_log_cb_deinit(uhci_out_log_cb_t **log_cb)
+{
+    if (!(*log_cb)) {
+        return;
+    }
+
+    for (uint8_t i = 0; i < 2; i++) {
+        if ((*log_cb)->trans_cb[i]) {
+            uhci_out_deinit_trans(&((*log_cb)->trans_cb[i]));
+        }
+    }
+    free(*log_cb);
+    *log_cb = NULL;
+    return;
+}
+
+IRAM_ATTR static inline bool uhci_out_log_cb_check_trans(uhci_out_log_cb_t *log_cb, uint16_t len, bool *need_append)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    *need_append = false;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        if (len > trans_cb->buf_size) {
+            goto failed;
+        }
+        if (trans_cb->flag == TRANS_CB_FLAG_AVAILABLE) {
+            if ((trans_cb->buf_size - trans_cb->length) >= len) {
+                return true;
+            } else {
+                trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+                *need_append = true;
+            }
+        }
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+    }
+failed:
+    log_cb->lost_bytes_cnt += len;
+    log_cb->lost_frame_cnt++;
+    return false;
+}
+
+// CRITICAL: Shall not be called from ISR!
+IRAM_ATTR static inline void uhci_out_log_cb_append_trans(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    uint8_t idx = !log_cb->trans_cb_idx;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[idx];
+        if (trans_cb->flag == TRANS_CB_FLAG_NEED_QUEUE) {
+            uhci_out_append_trans(trans_cb);
+        }
+        idx = !idx;
+    }
+}
+
+IRAM_ATTR static inline void uhci_out_log_cb_flush_trans(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    for (uint8_t i = 0; i < 2; i++) {
+        trans_cb = log_cb->trans_cb[i];
+        if (trans_cb->length && (trans_cb->flag == TRANS_CB_FLAG_AVAILABLE)) {
+            trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+        }
+    }
+}
+
+// Return value: Need append
+IRAM_ATTR static bool uhci_out_log_cb_write(uhci_out_log_cb_t *log_cb, const uint8_t *addr, uint16_t len,
+                                           const uint8_t *addr_append, uint16_t len_append, uint8_t source)
+{
+    uhci_out_trans_cb_t *trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+
+    uint8_t *buf = trans_cb->buffer + trans_cb->length;
+    uint16_t total_length = len + len_append;
+    frame_head_t head = {
+        .length = total_length,
+        .source = source,
+        .type = log_cb->type,
+        .frame_sn = UHCI_OUT_GET_FRAME_SN(&(log_cb->frame_sn)) & 0xFFFF,
+    };
+
+    memcpy(buf, (const uint8_t *)&head, UHCI_OUT_FRAME_HEAD_LEN);
+    memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN, addr, len);
+    if (len_append && addr_append) {
+        memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN + len, addr_append, len_append);
+    }
+
+    uint32_t checksum = 0;
+    for (int i = 0; i < UHCI_OUT_FRAME_HEAD_LEN + total_length; i++) {
+        checksum += buf[i];
+    }
+    memcpy(buf + UHCI_OUT_FRAME_HEAD_LEN + total_length, &checksum, UHCI_OUT_FRAME_TAIL_LEN);
+
+    trans_cb->length += total_length + UHCI_OUT_FRAME_OVERHEAD;
+    if ((trans_cb->buf_size - trans_cb->length) <= UHCI_OUT_FRAME_OVERHEAD) {
+        trans_cb->flag = TRANS_CB_FLAG_NEED_QUEUE;
+        return true;
+    }
+    return false;
+}
+
+IRAM_ATTR static void uhci_out_log_cb_write_loss(uhci_out_log_cb_t *log_cb)
+{
+    if (!log_cb->lost_bytes_cnt || !log_cb->lost_frame_cnt) {
+        return;
+    }
+    bool need_append;
+    uint16_t frame_len = sizeof(loss_payload_t) + UHCI_OUT_FRAME_OVERHEAD;
+    if (uhci_out_log_cb_check_trans(log_cb, frame_len, &need_append)) {
+        loss_payload_t payload = {
+            .type = log_cb->type,
+            .lost_frame_cnt = log_cb->lost_frame_cnt,
+            .lost_bytes_cnt = log_cb->lost_bytes_cnt,
+        };
+        uhci_out_log_cb_write(log_cb, (const uint8_t *)&payload, sizeof(loss_payload_t),
+                             NULL, 0, BLE_LOG_UHCI_OUT_SOURCE_LOSS);
+
+        log_cb->lost_frame_cnt = 0;
+        log_cb->lost_bytes_cnt = 0;
+    }
+}
+
+static void uhci_out_log_cb_dump(uhci_out_log_cb_t *log_cb)
+{
+    uhci_out_trans_cb_t *trans_cb;
+    uint8_t *buf;
+    for (uint8_t i = 0; i < 2; i++) {
+        // Dump the last transaction before dumping the current transaction
+        log_cb->trans_cb_idx = !(log_cb->trans_cb_idx);
+        trans_cb = log_cb->trans_cb[log_cb->trans_cb_idx];
+        buf = (uint8_t *)trans_cb->buffer;
+        for (uint16_t j = 0; j < trans_cb->buf_size; j++) {
+            esp_rom_printf("%02x ", buf[j]);
+
+            // Feed watchdogs periodically to avoid wdts timeout
+            if ((j % 100) == 0) {
+                esp_panic_handler_feed_wdts();
+            }
+        }
+    }
+}
+
+static void esp_timer_cb_log_flush(void)
+{
+    uint32_t os_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+
+    if ((os_ts - user_last_write_ts) > UHCI_OUT_FLUSH_TIMEOUT_MS) {
+        xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+        uhci_out_log_cb_flush_trans(user_log_cb);
+        uhci_out_log_cb_append_trans(user_log_cb);
+        xSemaphoreGive(user_log_mutex);
+    }
+
+    if ((esp_bt_controller_get_status() >= ESP_BT_CONTROLLER_STATUS_INITED) &&
+        ((os_ts - ll_last_write_ts) > UHCI_OUT_FLUSH_TIMEOUT_MS)) {
+        ll_ev_flags |= BIT(LL_EV_FLAG_FLUSH_LOG);
+        UHCI_OUT_LL_PUT_EV;
+    }
+
+    esp_timer_start_once(flush_timer, UHCI_OUT_FLUSH_TIMEOUT_US);
+}
+
+static void uhci_out_user_write_str(const uint8_t *src, uint16_t len)
+{
+    if (!user_log_inited || !src || !len) {
+        return;
+    }
+
+    xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+
+    bool need_append;
+    if (uhci_out_log_cb_check_trans(user_log_cb, len, &need_append)) {
+        uhci_out_trans_cb_t *trans_cb = user_log_cb->trans_cb[user_log_cb->trans_cb_idx];
+        uint8_t *buf = trans_cb->buffer + trans_cb->length;
+
+        memcpy(buf, (const uint8_t *)src, len);
+        trans_cb->length += len;
+    }
+
+    if (need_append) {
+        uhci_out_log_cb_append_trans(user_log_cb);
+    }
+
+    user_last_write_ts = pdTICKS_TO_MS(xTaskGetTickCount());
+
+    xSemaphoreGive(user_log_mutex);
+}
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+static void uhci_out_user_write_char(char c)
+{
+    uhci_out_user_write_str((const uint8_t *)&c, 1);
+}
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+static int uhci_out_user_log_init(void)
+{
+    if (user_log_inited) {
+        return 0;
+    }
+
+    // Initialize mutex
+    user_log_mutex = xSemaphoreCreateMutex();
+    if (!user_log_mutex) {
+        goto failed;
+    }
+
+    // Initialize log control block
+    if (uhci_out_log_cb_init(&user_log_cb, UHCI_OUT_USER_BUF_SIZE, LOG_CB_TYPE_USER, 0) != 0) {
+        goto failed;
+    }
+
+    // Initialization done
+    user_log_inited = true;
+    return 0;
+
+failed:
+    uhci_out_user_log_deinit();
+    return -1;
+}
+
+static void uhci_out_user_log_deinit(void)
+{
+    user_log_inited = false;
+
+    if (!user_log_mutex) {
+        return;
+    }
+    xSemaphoreTake(user_log_mutex, portMAX_DELAY);
+
+    uhci_out_log_cb_deinit(&user_log_cb);
+
+    xSemaphoreGive(user_log_mutex);
+    vSemaphoreDelete(user_log_mutex);
+    user_log_mutex = NULL;
+}
+
+static int uhci_out_ll_log_init(void)
+{
+    if (ll_log_inited) {
+        return 0;
+    }
+
+    if (uhci_out_log_cb_init(&ll_task_log_cb, UHCI_OUT_LL_TASK_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_TASK) != 0) {
+        goto failed;
+    }
+    if (uhci_out_log_cb_init(&ll_isr_log_cb, UHCI_OUT_LL_ISR_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_ISR) != 0) {
+        goto failed;
+    }
+    if (uhci_out_log_cb_init(&ll_hci_log_cb, UHCI_OUT_LL_HCI_BUF_SIZE,
+                             LOG_CB_TYPE_LL, LOG_CB_LL_SUBTYPE_HCI) != 0) {
+        goto failed;
+    }
+
+    ll_log_inited = true;
+    return 0;
+
+failed:
+    uhci_out_ll_log_deinit();
+    return -1;
+}
+
+static void uhci_out_ll_log_deinit(void)
+{
+    ll_log_inited = false;
+
+    uhci_out_log_cb_deinit(&ll_hci_log_cb);
+    uhci_out_log_cb_deinit(&ll_isr_log_cb);
+    uhci_out_log_cb_deinit(&ll_task_log_cb);
+}
+
+static void uhci_out_ll_log_flush(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+    uhci_out_log_cb_write_loss(ll_task_log_cb);
+    uhci_out_log_cb_write_loss(ll_hci_log_cb);
+
+    uhci_out_log_cb_flush_trans(ll_task_log_cb);
+    uhci_out_log_cb_flush_trans(ll_hci_log_cb);
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+    uhci_out_log_cb_write_loss(ll_isr_log_cb);
+    uhci_out_log_cb_flush_trans(ll_isr_log_cb);
+    portEXIT_CRITICAL_SAFE(&spinlock);
+
+    uhci_out_log_cb_append_trans(ll_task_log_cb);
+    uhci_out_log_cb_append_trans(ll_hci_log_cb);
+    uhci_out_log_cb_append_trans(ll_isr_log_cb);
+}
+
+// Public functions
+int ble_log_uhci_out_init(void)
+{
+    // Avoid double init
+    if (uhci_out_inited) {
+        return 0;
+    }
+
+#if UHCI_OUT_UART_NEED_INIT
+    uart_config_t uart_config = {
+        .baud_rate = UHCI_OUT_UART_BAUD_RATE,
+        .data_bits = UART_DATA_8_BITS,
+        .parity = UART_PARITY_DISABLE,
+        .stop_bits = UART_STOP_BITS_1,
+        .flow_ctrl = UART_HW_FLOWCTRL_CTS_RTS,
+        .rx_flow_ctrl_thresh = 122,
+    };
+    // Configure UART parameters
+    uart_param_config(UHCI_OUT_UART_PORT, &uart_config);
+    uart_set_pin(UHCI_OUT_UART_PORT, UHCI_OUT_UART_IO_NUM_TX, -1, -1, -1);
+#endif // UHCI_OUT_UART_NEED_INIT
+
+    uhci_controller_config_t uhci_config = {
+        .uart_port = UHCI_OUT_UART_PORT,
+        .tx_trans_queue_depth = UHCI_OUT_QUEUE_SIZE,
+        .max_receive_internal_mem = 1024,
+        .max_transmit_size = UHCI_OUT_MAX_TRANSFER_SIZE,
+        .dma_burst_size = 32,
+        .rx_eof_flags.idle_eof = 1,
+    };
+    if (uhci_new_controller(&uhci_config, &uhci_handle) != ESP_OK) {
+        goto failed;
+    }
+
+    uhci_event_callbacks_t uhci_cbs = {
+        .on_tx_trans_done = uhci_out_tx_done_cb,
+    };
+    uhci_register_event_callbacks(uhci_handle, &uhci_cbs, NULL);
+
+    if (uhci_out_user_log_init() != 0) {
+        goto failed;
+    }
+
+    if (uhci_out_ll_log_init() != 0) {
+        goto failed;
+    }
+
+    esp_timer_create_args_t timer_args = {
+        .callback = (esp_timer_cb_t)esp_timer_cb_log_flush,
+        .dispatch_method = ESP_TIMER_TASK
+    };
+    if (esp_timer_create(&timer_args, &flush_timer) != ESP_OK) {
+        goto failed;
+    }
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    // Install UART Driver if not installed
+    if (!uart_is_driver_installed(UHCI_OUT_UART_PORT0)) {
+        uart_driver_install(UHCI_OUT_UART_PORT0, UHCI_OUT_UART_DRIVER_RX_BUF_SIZE, 0, 0, NULL, 0);
+    }
+
+    // Redirect UART VFS Driver to UART Driver
+    uart_vfs_dev_use_driver(UHCI_OUT_UART_PORT0);
+
+    // Redirect esp_rom_printf to BLE Log UHCI Out
+    esp_rom_install_channel_putc(1, uhci_out_user_write_char);
+    esp_rom_install_channel_putc(2, NULL);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+    uhci_out_inited = true;
+    esp_timer_start_once(flush_timer, UHCI_OUT_FLUSH_TIMEOUT_US);
+    return 0;
+
+failed:
+    ble_log_uhci_out_deinit();
+    return -1;
+}
+
+void ble_log_uhci_out_deinit(void)
+{
+    uhci_out_inited = false;
+
+    if (flush_timer) {
+        esp_timer_stop(flush_timer);
+        esp_timer_delete(flush_timer);
+        flush_timer = NULL;
+    }
+
+    if (uhci_handle) {
+        uhci_wait_all_tx_transaction_done(uhci_handle, portMAX_DELAY);
+        uhci_del_controller(uhci_handle);
+        uhci_handle = NULL;
+    }
+
+    uhci_out_ll_log_deinit();
+    uhci_out_user_log_deinit();
+}
+
+IRAM_ATTR void ble_log_uhci_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,
+                                        const uint8_t *addr_append, uint32_t flag)
+{
+    // Raw logs will come in case of assert, shall be printed to console directly
+    if (flag & BIT(LL_LOG_FLAG_RAW)) {
+        if (len && addr) {
+            for (uint32_t i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
+        }
+        if (len_append && addr_append) {
+            for (uint32_t i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+        }
+        if (flag & BIT(LL_LOG_FLAG_END)) { esp_rom_printf("\n"); }
+    }
+
+    if (!ll_log_inited) {
+        return;
+    }
+
+    bool in_isr = false;
+    uint8_t source;
+    uhci_out_log_cb_t *log_cb;
+    if (flag & BIT(LL_LOG_FLAG_ISR)) {
+        log_cb = ll_isr_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_ESP_ISR;
+        in_isr = true;
+    } else if (flag & BIT(LL_LOG_FLAG_HCI)) {
+        log_cb = ll_hci_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_LL_HCI;
+    } else {
+        log_cb = ll_task_log_cb;
+        source = BLE_LOG_UHCI_OUT_SOURCE_ESP;
+    }
+
+    bool need_append;
+    uint16_t frame_len = len + len_append + UHCI_OUT_FRAME_OVERHEAD;
+    if (uhci_out_log_cb_check_trans(log_cb, frame_len, &need_append)) {
+        need_append |= uhci_out_log_cb_write(log_cb, addr, len, addr_append,
+                                            len_append, source);
+    }
+
+    ll_last_write_ts = in_isr?\
+                       pdTICKS_TO_MS(xTaskGetTickCountFromISR()):\
+                       pdTICKS_TO_MS(xTaskGetTickCount());
+
+    if (need_append) {
+        if (in_isr) {
+            ll_ev_flags |= BIT(LL_EV_FLAG_ISR_APPEND);
+            UHCI_OUT_LL_PUT_EV;
+        } else {
+            uhci_out_log_cb_append_trans(log_cb);
+        }
+    }
+}
+
+IRAM_ATTR void ble_log_uhci_out_ll_log_ev_proc(void)
+{
+    if (!ll_log_inited) {
+        return;
+    }
+
+    if (ll_ev_flags & BIT(LL_EV_FLAG_ISR_APPEND)) {
+        uhci_out_log_cb_append_trans(ll_isr_log_cb);
+        ll_ev_flags &= ~BIT(LL_EV_FLAG_ISR_APPEND);
+    }
+
+    if (ll_ev_flags & BIT(LL_EV_FLAG_FLUSH_LOG)) {
+        uhci_out_ll_log_flush();
+        ll_ev_flags &= ~BIT(LL_EV_FLAG_FLUSH_LOG);
+    }
+
+    ll_ev_flags = 0;
+}
+
+// Redirect UART Driver to BLE Log UHCI Out
+int __real_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len);
+int __wrap_uart_tx_chars(uart_port_t uart_num, const char *buffer, uint32_t len)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    uhci_out_user_write_str((const uint8_t *)buffer, len);
+    return 0;
+#else
+    return __real_uart_tx_chars(uart_num, buffer, len);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+int __real_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size);
+int __wrap_uart_write_bytes(uart_port_t uart_num, const void *src, size_t size)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    uhci_out_user_write_str((const uint8_t *)src, size);
+    return 0;
+#else
+    return __real_uart_write_bytes(uart_num, src, size);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+int __real_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len);
+int __wrap_uart_write_bytes_with_break(uart_port_t uart_num, const void *src, size_t size, int brk_len)
+{
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    return __wrap_uart_write_bytes(uart_num, src, size);
+#else
+    return __real_uart_write_bytes_with_break(uart_num, src, size, brk_len);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+
+void ble_log_uhci_out_dump_all(void)
+{
+    if (!uhci_out_inited) {
+        return;
+    }
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    esp_rom_output_tx_wait_idle(UHCI_OUT_UART_PORT0);
+    esp_rom_install_uart_printf();
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+
+    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
+    portENTER_CRITICAL_SAFE(&spinlock);
+
+    if (ll_log_inited) {
+        esp_rom_printf("[DUMP_START:\n");
+        uhci_out_log_cb_dump(ll_isr_log_cb);
+        uhci_out_log_cb_dump(ll_task_log_cb);
+        uhci_out_log_cb_dump(ll_hci_log_cb);
+        esp_rom_printf("\n:DUMP_END]\n\n");
+    }
+    portEXIT_CRITICAL_SAFE(&spinlock);
+
+#if UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+    esp_rom_install_channel_putc(1, uhci_out_user_write_char);
+#endif // UHCI_OUT_UART_PORT == UHCI_OUT_UART_PORT0
+}
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
--- a/components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h
+++ b/components/bt/common/ble_log/include/ble_log/ble_log_spi_out.h
@@ -11,30 +11,38 @@
 #include "driver/spi_master.h"
 #include "driver/gpio.h"
 #include "esp_timer.h"
-#include "esp_log.h"
 #include "freertos/semphr.h"
+#include "esp_heap_caps.h"
+#include "esp_task.h"

-// Public typedefs
-#define BLE_LOG_SPI_OUT_SOURCE_ESP 0
-#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY 1
-#define BLE_LOG_SPI_OUT_SOURCE_BLUEDROID 2
-#define BLE_LOG_SPI_OUT_SOURCE_NIMBLE 3
-#define BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM 4
-#define BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM 5
-#define BLE_LOG_SPI_OUT_SOURCE_ESP_ISR 6
-#define BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR 7
-#define BLE_LOG_SPI_OUT_SOURCE_USER 0x10
-#define BLE_LOG_SPI_OUT_SOURCE_SYNC 0xFE
-#define BLE_LOG_SPI_OUT_SOURCE_LOSS 0xFF
+// Public enums
+enum {
+    BLE_LOG_SPI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY,
+    BLE_LOG_SPI_OUT_SOURCE_BLUEDROID,
+    BLE_LOG_SPI_OUT_SOURCE_NIMBLE,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_UPSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_HCI_DOWNSTREAM,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY_ISR,
+    BLE_LOG_SPI_OUT_SOURCE_LL_HCI,
+    BLE_LOG_SPI_OUT_SOURCE_LE_AUDIO,
+    BLE_LOG_SPI_OUT_SOURCE_MESH,
+    BLE_LOG_SPI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_SPI_OUT_SOURCE_SSC = 0xFD,
+    BLE_LOG_SPI_OUT_SOURCE_SYNC,
+    BLE_LOG_SPI_OUT_SOURCE_LOSS,
+};

-// SPI Log Level Definitions
-#define BLE_LOG_SPI_OUT_LEVEL_NONE      0  /*!< No log output */
-#define BLE_LOG_SPI_OUT_LEVEL_ERROR     1  /*!< Critical errors that SPI driver cannot recover from */
-#define BLE_LOG_SPI_OUT_LEVEL_WARN      2  /*!< Recoverable error conditions in SPI communication */
-#define BLE_LOG_SPI_OUT_LEVEL_INFO      3  /*!< Informational messages about SPI transactions */
-#define BLE_LOG_SPI_OUT_LEVEL_DEBUG     4  /*!< Detailed debug information, such as SPI register values */
-#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE   5  /*!< Very detailed debugging logs, potentially flooding output */
-#define BLE_LOG_SPI_OUT_LEVEL_MAX       6  /*!< Number of SPI log levels supported */
+#define BLE_LOG_SPI_OUT_LEVEL_NONE                  0
+#define BLE_LOG_SPI_OUT_LEVEL_ERROR                 1
+#define BLE_LOG_SPI_OUT_LEVEL_WARN                  2
+#define BLE_LOG_SPI_OUT_LEVEL_INFO                  3
+#define BLE_LOG_SPI_OUT_LEVEL_DEBUG                 4
+#define BLE_LOG_SPI_OUT_LEVEL_VERBOSE               5
+#define BLE_LOG_SPI_OUT_STR(x)                      #x
+#define BLE_LOG_SPI_OUT_XSTR(x)                     BLE_LOG_SPI_OUT_STR(x)
+#define BLE_LOG_SPI_OUT_BUILD_PREFIX(LEVEL, TAG)    "[" BLE_LOG_SPI_OUT_XSTR(LEVEL) "][" TAG "]"

 // Public functions
 int ble_log_spi_out_init(void);
@@ -46,9 +54,12 @@ void ble_log_spi_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_ap
 void ble_log_spi_out_ll_log_ev_proc(void);
 void ble_log_spi_out_ts_sync_start(void);
 void ble_log_spi_out_ts_sync_stop(void);
-int ble_log_spi_out_printf(uint8_t source, const char *format, ...);
-int ble_log_spi_out_printf_enh(uint8_t source, uint8_t level, const char *tag, const char *format, ...);
-int ble_log_spi_out_write_with_ts(uint8_t source, const uint8_t *addr, uint16_t len);
 void ble_log_spi_out_dump_all(void);
+void ble_log_spi_out_enable(bool enable);
+void ble_log_spi_out_flush(void);
+void ble_log_spi_out_le_audio_write(const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_host_write(uint8_t source, const char *prefix, const char *format, ...);
+int ble_log_spi_out_hci_write(uint8_t source, const uint8_t *addr, uint16_t len);
+int ble_log_spi_out_mesh_write(const char *prefix, const char *format, ...);

 #endif // __BT_SPI_OUT_H__
--- a/components/bt/common/ble_log/include/ble_log/ble_log_uhci_out.h
+++ b/components/bt/common/ble_log/include/ble_log/ble_log_uhci_out.h
@@ -0,0 +1,35 @@
+/*
+ * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef __BT_SPI_OUT_H__
+#define __BT_SPI_OUT_H__
+
+#include <stdarg.h>
+#include <string.h>
+#include "driver/uhci.h"
+#include "driver/uart.h"
+#include "driver/uart_vfs.h"
+#include "esp_rom_uart.h"
+#include "esp_timer.h"
+#include "freertos/semphr.h"
+
+// Public enums
+enum {
+    BLE_LOG_UHCI_OUT_SOURCE_ESP = 0,
+    BLE_LOG_UHCI_OUT_SOURCE_ESP_ISR = 6,
+    BLE_LOG_UHCI_OUT_SOURCE_LL_HCI = 8,
+    BLE_LOG_UHCI_OUT_SOURCE_USER = 0x10,
+    BLE_LOG_UHCI_OUT_SOURCE_LOSS = 0xFF,
+};
+
+// Public functions
+int ble_log_uhci_out_init(void);
+void ble_log_uhci_out_deinit(void);
+void ble_log_uhci_out_ll_write(uint32_t len, const uint8_t *addr, uint32_t len_append,
+                               const uint8_t *addr_append, uint32_t flag);
+void ble_log_uhci_out_ll_log_ev_proc(void);
+void ble_log_uhci_out_dump_all(void);
+
+#endif // __BT_SPI_OUT_H__
--- a/components/bt/common/btc/core/btc_task.c
+++ b/components/bt/common/btc/core/btc_task.c
@@ -490,10 +490,10 @@ static bt_status_t btc_init_mem(void) {
 #endif

 #if BTC_HF_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
-    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+    if ((hf_local_param_ptr = (hf_local_param_t *)osi_malloc(sizeof(hf_local_param_t))) == NULL) {
        goto error_exit;
    }
-    memset((void *)hf_local_param_ptr, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+    memset((void *)hf_local_param_ptr, 0, sizeof(hf_local_param_t));
 #endif

 #if BTC_HF_CLIENT_INCLUDED == TRUE && HFP_DYNAMIC_MEMORY == TRUE
--- a/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
+++ b/components/bt/common/btc/profile/esp/blufi/nimble_host/esp_blufi.c
@@ -298,7 +298,7 @@ int esp_blufi_gatt_svr_deinit(void)
    return 0;
 }

-static int
+int
 esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
 {
    struct ble_gap_conn_desc desc;
@@ -331,7 +331,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
        }
        if (event->connect.status != 0) {
            /* Connection failed; resume advertising. */
-            esp_blufi_adv_start();
+           ((void(*)(void))arg)();
        }
        return 0;
    case BLE_GAP_EVENT_DISCONNECT:
@@ -366,7 +366,7 @@ esp_blufi_gap_event(struct ble_gap_event *event, void *arg)
    case BLE_GAP_EVENT_ADV_COMPLETE:
        ESP_LOGI(TAG, "advertise complete; reason=%d",
                 event->adv_complete.reason);
-        esp_blufi_adv_start();
+        ((void(*)(void))arg)();
        return 0;

    case BLE_GAP_EVENT_SUBSCRIBE:
@@ -461,7 +461,7 @@ void esp_blufi_adv_start(void)
    adv_params.conn_mode = BLE_GAP_CONN_MODE_UND;
    adv_params.disc_mode = BLE_GAP_DISC_MODE_GEN;
    rc = ble_gap_adv_start(own_addr_type, NULL, BLE_HS_FOREVER,
-                           &adv_params, esp_blufi_gap_event, NULL);
+                           &adv_params, esp_blufi_gap_event, esp_blufi_adv_start);
    if (rc != 0) {
        ESP_LOGE(TAG, "error enabling advertisement; rc=%d", rc);
        return;
--- a/components/bt/common/hci_log/bt_hci_log.c
+++ b/components/bt/common/hci_log/bt_hci_log.c
@@ -10,6 +10,7 @@
 #include "bt_common.h"
 #include "osi/mutex.h"
 #include "esp_attr.h"
+#include "esp_timer.h"

 #if (BT_HCI_LOG_INCLUDED == TRUE)
 #define BT_HCI_LOG_PRINT_TAG                     (1)
@@ -208,6 +209,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
 {
    osi_mutex_t mutex_lock;
    uint8_t *g_hci_log_buffer;
+    int64_t ts;
+    uint8_t *temp_buf;

    if (!p_hci_log_ctl->p_hci_log_buffer) {
        return ESP_FAIL;
@@ -219,6 +222,16 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
        return ESP_FAIL;
    }

+    ts = esp_timer_get_time();
+
+    temp_buf = (uint8_t *)malloc(data_len + 8);
+    memset(temp_buf, 0x0, data_len + 8);
+
+    memcpy(temp_buf, &ts, 8);
+    memcpy(temp_buf + 8, data, data_len);
+
+    data_len += 8;
+
    mutex_lock = p_hci_log_ctl->mutex_lock;
    osi_mutex_lock(&mutex_lock, OSI_MUTEX_MAX_TIMEOUT);

@@ -250,7 +263,7 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st
        bt_hci_log_record_string(p_hci_log_ctl, str);
    }

-    bt_hci_log_record_hex(p_hci_log_ctl, data, data_len);
+    bt_hci_log_record_hex(p_hci_log_ctl, temp_buf, data_len);

    g_hci_log_buffer[p_hci_log_ctl->log_record_in] = '\n';

@@ -266,6 +279,8 @@ esp_err_t IRAM_ATTR bt_hci_log_record_data(bt_hci_log_t *p_hci_log_ctl, char *st

    osi_mutex_unlock(&mutex_lock);

+    free(temp_buf);
+
    return ESP_OK;
 }

--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@@ -459,6 +459,7 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX

 config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
    bool "Enable enhanced Access Address check in CONNECT_IND"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
    default n
    help
        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@@ -252,6 +252,7 @@ extern uint32_t _bt_controller_data_end;
 extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
+extern void btdm_aa_check_enhance_enable(void);

 #ifdef CONFIG_BT_BLUEDROID_ENABLED
 extern void bt_stack_enableSecCtrlVsCmd(bool en);
@@ -261,6 +262,7 @@ extern void bt_stack_enableCoexVsCmd(bool en);
 extern void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
 extern void adv_stack_enableClearLegacyAdvVsCmd(bool en);
 extern void advFilter_stack_enableDupExcListVsCmd(bool en);
+extern void arr_stack_enableMultiConnVsCmd(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)

 /* Local Function Declare
@@ -965,7 +967,7 @@ static void btdm_sleep_enter_phase1_wrapper(uint32_t lpcycles)
    assert(us_to_sleep > BTDM_MIN_TIMER_UNCERTAINTY_US);
    // allow a maximum time uncertainty to be about 488ppm(1/2048) at least as clock drift
    // and set the timer in advance
-    uint32_t uncertainty = (us_to_sleep >> 11);
+    uint32_t uncertainty = (us_to_sleep / 1000);
    if (uncertainty < BTDM_MIN_TIMER_UNCERTAINTY_US) {
        uncertainty = BTDM_MIN_TIMER_UNCERTAINTY_US;
    }
@@ -1540,12 +1542,14 @@ static esp_err_t btdm_low_power_mode_init(void)
    bool select_src_ret __attribute__((unused));
    bool set_div_ret __attribute__((unused));
    if (btdm_lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+        ESP_LOGI(BTDM_LOG_TAG, "Using main XTAL as clock source");
        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL);
        set_div_ret = btdm_lpclk_set_div(esp_clk_xtal_freq() * 2 / MHZ - 1);
        assert(select_src_ret && set_div_ret);
        btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
        btdm_lpcycle_us = 2 << (btdm_lpcycle_us_frac);
    } else { // btdm_lpclk_sel == BTDM_LPCLK_SEL_XTAL32K
+        ESP_LOGI(BTDM_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
        select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
        set_div_ret = btdm_lpclk_set_div(0);
        assert(select_src_ret && set_div_ret);
@@ -1701,6 +1705,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
    if (ble_log_spi_out_init() != 0) {
        ESP_LOGE(BTDM_LOG_TAG, "BLE Log SPI output init failed");
+        err = ESP_ERR_NO_MEM;
        goto error;
    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
@@ -1723,6 +1728,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
    scan_stack_enableAdvFlowCtrlVsCmd(true);
    adv_stack_enableClearLegacyAdvVsCmd(true);
    advFilter_stack_enableDupExcListVsCmd(true);
+    arr_stack_enableMultiConnVsCmd(true);
 #endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)

    btdm_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
@@ -1762,6 +1768,7 @@ esp_err_t esp_bt_controller_deinit(void)
    scan_stack_enableAdvFlowCtrlVsCmd(false);
    adv_stack_enableClearLegacyAdvVsCmd(false);
    advFilter_stack_enableDupExcListVsCmd(false);
+    arr_stack_enableMultiConnVsCmd(false);
 #endif // (CONFIG_BT_NIMBLE_ENABLED) || (CONFIG_BT_BLUEDROID_ENABLED)

    return ESP_OK;
@@ -1848,6 +1855,10 @@ static void patch_apply(void)
 #ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
    config_ble_funcs_reset();
 #endif
+
+#if BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }

 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
--- a/components/bt/controller/esp32c2/Kconfig.in
+++ b/components/bt/controller/esp32c2/Kconfig.in
@@ -281,94 +281,103 @@ config BT_LE_CONTROLLER_TASK_STACK_SIZE
    help
        This configures stack size of NimBLE controller task

-menuconfig BT_LE_CONTROLLER_LOG_ENABLED
-    bool "Controller log enable"
-    default n
-    help
-        Enable controller log
+menu "Controller debug features"
+    menuconfig BT_LE_CONTROLLER_LOG_ENABLED
+        bool "Controller log enable"
+        default n
+        help
+            Enable controller log

-config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
-    bool "enable controller log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable controller log module
+    config BT_LE_CONTROLLER_LOG_CTRL_ENABLED
+        bool "enable controller log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable controller log module

-config BT_LE_CONTROLLER_LOG_HCI_ENABLED
-    bool "enable HCI log module"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Enable hci log module
+    config BT_LE_CONTROLLER_LOG_HCI_ENABLED
+        bool "enable HCI log module"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Enable hci log module

-config BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    bool "Controller log dump mode only"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default y
-    help
-            Only operate in dump mode
+    config BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        bool "Controller log dump mode only"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default y
+        help
+                Only operate in dump mode

-config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
-    bool "Output ble controller logs to SPI bus (Experimental)"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    select BT_BLE_LOG_SPI_OUT_ENABLED
-    default n
-    help
-        Output ble controller logs to SPI bus
+    config BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        bool "Output ble controller logs to SPI bus (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        select BT_BLE_LOG_SPI_OUT_ENABLED
+        default n
+        help
+            Output ble controller logs to SPI bus

-config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    bool "Store ble controller logs to flash(Experimental)"
-    depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-            Store ble controller logs to flash memory.
+    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        bool "Store ble controller logs to flash(Experimental)"
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+                Store ble controller logs to flash memory.

-config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
-    int "size of ble controller log partition(Multiples of 4K)"
-    depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
-    default 65536
-    help
-            The size of ble controller log partition shall be a multiples of 4K.
-            The name of log partition shall be "bt_ctrl_log".
-            The partition type shall be ESP_PARTITION_TYPE_DATA.
-            The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.
+    config BT_LE_CONTROLLER_LOG_PARTITION_SIZE
+        int "size of ble controller log partition(Multiples of 4K)"
+        depends on BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
+        default 65536
+        help
+                The size of ble controller log partition shall be a multiples of 4K.
+                The name of log partition shall be "bt_ctrl_log".
+                The partition type shall be ESP_PARTITION_TYPE_DATA.
+                The partition sub_type shall be ESP_PARTITION_SUBTYPE_ANY.

-config BT_LE_LOG_CTRL_BUF1_SIZE
-    int "size of the first BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the first BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF1_SIZE
+        int "size of the first BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the first BLE controller LOG buffer.

-config BT_LE_LOG_CTRL_BUF2_SIZE
-    int "size of the second BLE controller LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 1024
-    help
-            Configure the size of the second BLE controller LOG buffer.
+    config BT_LE_LOG_CTRL_BUF2_SIZE
+        int "size of the second BLE controller LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 1024
+        help
+                Configure the size of the second BLE controller LOG buffer.

-config BT_LE_LOG_HCI_BUF_SIZE
-    int "size of the BLE HCI LOG buffer"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default 4096
-    help
-            Configure the size of the BLE HCI LOG buffer.
+    config BT_LE_LOG_HCI_BUF_SIZE
+        int "size of the BLE HCI LOG buffer"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default 4096
+        help
+                Configure the size of the BLE HCI LOG buffer.

-config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
-    bool "Enable wrap panic handler"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+    config BT_LE_CONTROLLER_LOG_WRAP_PANIC_HANDLER_ENABLE
+        bool "Enable wrap panic handler"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Wrap esp_panic_handler to get controller logs when PC pointer exception crashes.
+
+    config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
+        bool "Enable esp_task_wdt_isr_user_handler implementation"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        default n
+        help
+            Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
+endmenu

-config BT_LE_CONTROLLER_LOG_TASK_WDT_USER_HANDLER_ENABLE
-    bool "Enable esp_task_wdt_isr_user_handler implementation"
-    depends on BT_LE_CONTROLLER_LOG_ENABLED
-    default n
-    help
-        Implement esp_task_wdt_isr_user_handler to get controller logs when task wdt issue is triggered.
 config BT_LE_LL_RESOLV_LIST_SIZE
    int "BLE LL Resolving list size"
    range 1 5
@@ -584,7 +593,7 @@ config BT_LE_CCA_RSSI_THRESH
    int "CCA RSSI threshold value"
    depends on BT_LE_TX_CCA_ENABLED
    range 20 100
-    default 20
+    default 65
    help
        Power threshold of CCA in unit of -1 dBm.

--- a/components/bt/controller/esp32c2/ble.c
+++ b/components/bt/controller/esp32c2/ble.c
@@ -13,6 +13,7 @@
 */
 #if (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 void scan_stack_enableAdvFlowCtrlVsCmd(bool en);
+void scan_stack_enableSpecifyScanChanVsCmd(bool en);
 void adv_stack_enableClearLegacyAdvVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
 void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
@@ -34,6 +35,7 @@ void ble_stack_enableVsCmds(bool en)

 #if DEFAULT_BT_LE_ROLE_OBSERVER
    scan_stack_enableAdvFlowCtrlVsCmd(en);
+    scan_stack_enableSpecifyScanChanVsCmd(en);
 #endif // DEFAULT_BT_LE_ROLE_OBSERVER

    chanSel_stack_enableSetCsaVsCmd(en);
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@@ -119,6 +119,11 @@ struct ext_funcs_t {

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

 /* External functions or variables
@@ -136,7 +141,7 @@ extern void esp_panic_handler_feed_wdts(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 extern int ble_controller_deinit(void);
 extern int ble_controller_enable(uint8_t mode);
-extern int ble_controller_disable(void);
+extern void ble_controller_disable(void);
 extern int esp_register_ext_funcs (struct ext_funcs_t *);
 extern void esp_unregister_ext_funcs (void);
 extern int esp_ble_ll_set_public_addr(const uint8_t *addr);
@@ -411,20 +416,22 @@ void esp_bt_read_ctrl_log_from_flash(bool output)
 #if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    bool end = flag ? true : false;
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_controller_log_storage(len, addr, end);
 #else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }

-    if (end) {
-        esp_rom_printf("\n");
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
    }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
    portEXIT_CRITICAL_SAFE(&spinlock);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
@@ -1070,9 +1077,9 @@ esp_err_t esp_bt_controller_disable(void)
        ESP_LOGW(NIMBLE_PORT_LOG_TAG, "invalid controller state");
        return ESP_FAIL;
    }
-    if (ble_controller_disable() != 0) {
-        return ESP_FAIL;
-    }
+    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
+
+    ble_controller_disable();
    ble_stack_disable();
    if (s_ble_active) {
        esp_phy_disable(PHY_MODEM_BT);
@@ -1084,7 +1091,6 @@ esp_err_t esp_bt_controller_disable(void)
 #if CONFIG_SW_COEXIST_ENABLE
    coex_disable();
 #endif
-    ble_controller_status = ESP_BT_CONTROLLER_STATUS_INITED;
    return ESP_OK;
 }

@@ -1567,3 +1573,10 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)

 #endif // CONFIG_BT_LE_SM_LEGACY || CONFIG_BT_LE_SM_SC
 #endif // (!CONFIG_BT_NIMBLE_ENABLED) && (CONFIG_BT_CONTROLLER_ENABLED)
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
--- a/components/bt/controller/esp32c3/Kconfig.in
+++ b/components/bt/controller/esp32c3/Kconfig.in
@@ -231,7 +231,7 @@ config BT_CTRL_DFT_TX_POWER_LEVEL_EFF

 config BT_CTRL_BLE_ADV_REPORT_FLOW_CTRL_SUPP
    bool "BLE adv report flow control supported"
-    depends on (!BT_CTRL_RUN_IN_FLASH_ONLY) || (BT_CTRL_RUN_IN_FLASH_ONLY && BT_CTRL_BLE_SCAN)
+    depends on BT_CTRL_BLE_SCAN
    default y
    help
        The function is mainly used to enable flow control for advertising reports. When it is enabled,
@@ -416,10 +416,10 @@ menu "MODEM SLEEP Options"
                modem sleep to be used with both DFS and light sleep.

        config BT_CTRL_LPCLK_SEL_RTC_SLOW
-            bool "Internal 150kHz RC oscillator"
+            bool "Internal 136kHz RC oscillator"
            depends on RTC_CLK_SRC_INT_RC
            help
-                Internal 150kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
+                Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is required
                in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.
    endchoice

@@ -530,30 +530,31 @@ config BT_CTRL_RUN_IN_FLASH_ONLY
        impact on Bluetooth performance.

 config BT_CTRL_DTM_ENABLE
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
    bool "Enable direct test mode feature"
-    default n
-
-config BT_CTRL_BLE_MASTER
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
-    bool "Enable BLE master role feature"
    default y

+config BT_CTRL_BLE_MASTER
+    bool "Enable BLE connection feature"
+    default y
+    help
+        If this option is disabled, it is not recommended to use connectable ADV.
+
 config BT_CTRL_BLE_TEST
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
-    bool "Enable BLE QA test feature"
+    bool "Enable BLE QA test feature (Not Used)"
    default n

 config BT_CTRL_BLE_SCAN
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
    bool "Enable BLE scan feature"
    default y

 config BT_CTRL_BLE_SECURITY_ENABLE
-    depends on BT_CTRL_RUN_IN_FLASH_ONLY
    bool "Enable BLE security feature"
    default y

+config BT_CTRL_BLE_ADV
+    bool "Enable BLE ADV feature"
+    default y
+
 config BT_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
    bool "Enable enhanced Access Address check in CONNECT_IND"
    default n
@@ -598,6 +599,7 @@ menu "Controller debug log Options (Experimental)"
        depends on BT_CTRL_LE_LOG_EN
        depends on !BT_CTRL_LE_LOG_DUMP_ONLY
        select BT_BLE_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_SPI_OUT_LL_ENABLED
        default n
        help
            Output ble controller logs to SPI bus
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@@ -312,6 +312,17 @@ extern void advFilter_stack_enableDupExcListVsCmd(bool en);
 extern void chanSel_stack_enableSetCsaVsCmd(bool en);
 #endif // (CONFIG_BT_BLUEDROID_ENABLED || CONFIG_BT_NIMBLE_ENABLED)

+extern void ble_dtm_funcs_reset(void);
+extern void ble_scan_funcs_reset(void);
+extern void ble_42_adv_funcs_reset(void);
+extern void ble_init_funcs_reset(void);
+extern void ble_con_funcs_reset(void);
+extern void ble_cca_funcs_reset(void);
+extern void ble_ext_adv_funcs_reset(void);
+extern void ble_ext_scan_funcs_reset(void);
+extern void ble_base_funcs_reset(void);
+extern void ble_enc_funcs_reset(void);
+
 extern uint32_t _bt_bss_start;
 extern uint32_t _bt_bss_end;
 extern uint32_t _bt_controller_bss_start;
@@ -540,7 +551,7 @@ static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, b
 #if CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN
 static IRAM_ATTR void esp_bt_controller_spi_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
-    ble_log_spi_out_write(BLE_LOG_SPI_OUT_SOURCE_ESP_LEGACY, addr, len);
+    ble_log_spi_out_ll_write(len, addr, 0, NULL, 0);
 }
 #endif // CONFIG_BT_CTRL_LE_LOG_SPI_OUT_EN

@@ -1265,6 +1276,46 @@ static void btdm_funcs_table_ready_wrapper(void)
 #if BLE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
    btdm_aa_check_enhance_enable();
 #endif
+#if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
+    // do nothing
+#else
+    ESP_LOGI(BT_LOG_TAG, "Feature Config, ADV:%d, BLE_50:%d, DTM:%d, SCAN:%d, CCA:%d, SMP:%d, CONNECT:%d",
+                        BT_CTRL_BLE_ADV, BT_CTRL_50_FEATURE_SUPPORT, BT_CTRL_DTM_ENABLE, BT_CTRL_BLE_SCAN,
+                        BT_BLE_CCA_MODE, BLE_SECURITY_ENABLE, BT_CTRL_BLE_MASTER);
+
+    ble_base_funcs_reset();
+#if CONFIG_BT_CTRL_BLE_ADV
+    ble_42_adv_funcs_reset();
+#if (BT_CTRL_50_FEATURE_SUPPORT == 1)
+    ble_ext_adv_funcs_reset();
+#endif //
+#endif // CONFIG_BT_CTRL_BLE_ADV
+
+#if CONFIG_BT_CTRL_DTM_ENABLE
+    ble_dtm_funcs_reset();
+#endif // CONFIG_BT_CTRL_DTM_ENABLE
+
+#if CONFIG_BT_CTRL_BLE_SCAN
+    ble_scan_funcs_reset();
+#if (BT_CTRL_50_FEATURE_SUPPORT == 1)
+    ble_ext_scan_funcs_reset();
+#endif // (BT_CTRL_50_FEATURE_SUPPORT == 1)
+#endif // CONFIG_BT_CTRL_BLE_SCAN
+
+#if (BT_BLE_CCA_MODE != 0)
+    ble_cca_funcs_reset();
+#endif // (BT_BLE_CCA_MODE != 0)
+
+#if CONFIG_BT_CTRL_BLE_SECURITY_ENABLE
+    ble_enc_funcs_reset();
+#endif // CONFIG_BT_CTRL_BLE_SECURITY_ENABLE
+
+#if CONFIG_BT_CTRL_BLE_MASTER
+    ble_init_funcs_reset();
+    ble_con_funcs_reset();
+#endif // CONFIG_BT_CTRL_BLE_MASTER
+
+#endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 }

 bool bt_async_wakeup_request(void)
@@ -1599,15 +1650,11 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
 #endif
                }
            } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {  // Internal 136kHz RC oscillator
-                if (rtc_clk_slow_src_get() == SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
-                    ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator. The accuracy of this clock is a lot larger than 500ppm which is "
-                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
-                } else {
+                if (rtc_clk_slow_src_get() != SOC_RTC_SLOW_CLK_SRC_RC_SLOW) {
                    ESP_LOGW(BT_LOG_TAG, "Internal 136kHz RC oscillator not detected.");
                    assert(0);
                }
            } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
-                ESP_LOGI(BT_LOG_TAG, "Bluetooth will use main XTAL as Bluetooth sleep clock.");
 #if !CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
                s_lp_cntl.no_light_sleep = 1;
 #endif
@@ -1619,6 +1666,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
        bool select_src_ret __attribute__((unused));
        bool set_div_ret __attribute__((unused));
        if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_MAIN_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using main XTAL as clock source");
 #ifdef CONFIG_BT_CTRL_MAIN_XTAL_PU_DURING_LIGHT_SLEEP
            ESP_ERROR_CHECK(esp_sleep_pd_config(ESP_PD_DOMAIN_XTAL, ESP_PD_OPTION_ON));
            s_lp_cntl.main_xtal_pu = 1;
@@ -1629,6 +1677,7 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
            btdm_lpcycle_us_frac = RTC_CLK_CAL_FRACT;
            btdm_lpcycle_us = 1 << (btdm_lpcycle_us_frac);
        } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_EXT_32K_XTAL) {
+            ESP_LOGI(BT_LOG_TAG, "Using external 32.768 kHz crystal/oscillator as clock source");
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_XTAL32K);
            set_div_ret = btdm_lpclk_set_div(0);
            assert(select_src_ret && set_div_ret);
@@ -1637,6 +1686,8 @@ static esp_err_t btdm_low_power_mode_init(esp_bt_controller_config_t *cfg)
                (1000000 >> (15 - RTC_CLK_CAL_FRACT));
            assert(btdm_lpcycle_us != 0);
        } else if (s_lp_cntl.lpclk_sel == ESP_BT_SLEEP_CLOCK_RTC_SLOW) {
+            ESP_LOGW(BT_LOG_TAG, "Using 136 kHz RC as clock source. The accuracy of this clock is a lot larger than 500ppm which is "
+                                "required in Bluetooth communication, so don't select this option in scenarios such as BLE connection state.");
            select_src_ret = btdm_lpclk_select_src(BTDM_LPCLK_SEL_RTC_SLOW);
            set_div_ret = btdm_lpclk_set_div(0);
            assert(select_src_ret && set_div_ret);
@@ -1758,6 +1809,7 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
    if (ble_log_spi_out_init() != 0) {
        ESP_LOGE(BT_LOG_TAG, "BLE Log SPI output init failed");
+        err = ESP_ERR_NO_MEM;
        goto error;
    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
--- a/components/bt/controller/esp32c5/Kconfig.in
+++ b/components/bt/controller/esp32c5/Kconfig.in
@@ -320,6 +320,16 @@ menu "Controller debug features"
        help
            Output ble controller logs to SPI bus

+    config BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+        bool "Output ble controller logs via UART DMA (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on !BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_UHCI_OUT_ENABLED
+        default y
+        help
+            Output ble controller logs via UART DMA
+
    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
        bool "Store ble controller logs to flash(Experimental)"
        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -406,6 +416,12 @@ menu "Controller debug features"
    config BT_LE_PTR_CHECK_ENABLED
        bool "Enable boundary check for internal memory"
        default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu

 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -681,7 +697,7 @@ config BT_LE_CCA_RSSI_THRESH
    int "CCA RSSI threshold value"
    depends on BT_LE_TX_CCA_ENABLED
    range 20 100
-    default 20
+    default 65
    help
        Power threshold of CCA in unit of -1 dBm.

@@ -805,3 +821,45 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
 config BT_LE_RXBUF_OPT_ENABLED
    bool "Enable rxbuf optimization feature"
    default y
+
+config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
+    bool "Enable fast sending of connection data"
+    default y
+    help
+        If this option is enabled, The Controller will continue to
+        Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            connection instances and the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
--- a/components/bt/controller/esp32c5/ble.c
+++ b/components/bt/controller/esp32c5/ble.c
@@ -17,6 +17,28 @@ void base_stack_deinitEnv(void);
 int base_stack_enable(void);
 void base_stack_disable(void);

+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 int conn_stack_initEnv(void);
 void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
@@ -85,6 +107,27 @@ int ble_stack_initEnv(void)
        return rc;
    }

+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
    rc = conn_stack_initEnv();
    if (rc) {
@@ -97,7 +140,6 @@ int ble_stack_initEnv(void)
    }
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
    return 0;
 }

@@ -109,7 +151,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
    base_stack_deinitEnv();
 }

@@ -122,6 +169,28 @@ int ble_stack_enable(void)
        return rc;
    }

+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
    rc = conn_stack_enable();
    if (rc) {
@@ -143,7 +212,20 @@ int ble_stack_enable(void)
 #if CONFIG_BT_LE_RXBUF_OPT_ENABLED
    mmgmt_enableRxbufOptFeature();
 #endif // CONFIG_BT_LE_RXBUF_OPT_ENABLED
+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }

+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
    return 0;
 }

@@ -160,6 +242,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
    base_stack_disable();
 }
--- a/components/bt/controller/esp32c5/bt.c
+++ b/components/bt/controller/esp32c5/bt.c
@@ -60,6 +60,10 @@
 #include "ble_log/ble_log_spi_out.h"
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+#include "ble_log/ble_log_uhci_out.h"
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 /* Macro definition
 ************************************************************************
 */
@@ -67,7 +71,7 @@
 #define OSI_COEX_VERSION              0x00010006
 #define OSI_COEX_MAGIC_VALUE          0xFADEBEAD

-#define EXT_FUNC_VERSION             0x20240422
+#define EXT_FUNC_VERSION             0x20250415
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5

 #define BT_ASSERT_PRINT              ets_printf
@@ -98,14 +102,17 @@ struct ext_funcs_t {
    int (* _ecc_gen_key_pair)(uint8_t *public, uint8_t *priv);
    int (* _ecc_gen_dh_key)(const uint8_t *remote_pub_key_x, const uint8_t *remote_pub_key_y,
                            const uint8_t *local_priv_key, uint8_t *dhkey);
-    void (* _esp_reset_rpa_moudle)(void);
    uint32_t magic;
 };

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
+#endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* External functions or variables
 ************************************************************************
 */
@@ -140,8 +147,7 @@ extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
-extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+extern void esp_ble_controller_flash_only_param_config(void);
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
@@ -182,14 +188,13 @@ static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
 static int esp_intr_free_wrapper(void **ret_handle);
 static void osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2);
 static uint32_t osi_random_wrapper(void);
-static void esp_reset_rpa_moudle(void);
 static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                              const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -216,25 +221,35 @@ esp_err_t esp_bt_controller_log_init(void)
    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    if (ble_log_uhci_out_init() != 0) {
+        goto uhci_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
        goto log_init_failed;
    }
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_uhci_out_ll_write, ble_log_uhci_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else
    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
    buffers |= ESP_BLE_LOG_BUF_HCI;
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_HCI_ENABLED
+#endif

    bool task_create = true;
 #if CONFIG_BT_LE_CONTROLLER_LOG_DUMP_ONLY
    task_create = false;
 #elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_ctrl_log_partition_get_and_erase_first_block();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
        goto log_init_failed;
@@ -250,14 +265,20 @@ esp_err_t esp_bt_controller_log_init(void)
 ctrl_level_init_failed:
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif
 log_init_failed:
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
    ble_log_spi_out_deinit();
 spi_out_init_failed:
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+uhci_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
    return ESP_FAIL;
 }

@@ -267,11 +288,17 @@ void esp_bt_controller_log_deinit(void)
    ble_log_spi_out_deinit();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    log_is_inited = false;
 }
@@ -459,15 +486,9 @@ struct ext_funcs_t ext_funcs_ro = {
    ._os_random = osi_random_wrapper,
    ._ecc_gen_key_pair = esp_ecc_gen_key_pair,
    ._ecc_gen_dh_key = esp_ecc_gen_dh_key,
-    ._esp_reset_rpa_moudle = esp_reset_rpa_moudle,
    .magic = EXT_FUNC_MAGIC_VALUE,
 };

-static void IRAM_ATTR esp_reset_rpa_moudle(void)
-{
-
-}
-
 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn,
                                         uint32_t param1, uint32_t param2)
 {
@@ -1115,8 +1136,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #endif // CONFIG_SW_COEXIST_ENABLE

 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-    r_ble_ll_scan_start_time_init_compensation(500);
-    r_priv_sdk_config_insert_proc_time_set(500);
+    esp_ble_controller_flash_only_param_config();
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY

    if (ble_stack_enable() != 0) {
@@ -1416,27 +1436,29 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    bool end = flag ? true : false;
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_controller_log_storage(len, addr, end);
 #else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }

-    if (end) {
-        esp_rom_printf("\n");
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
    }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
    portEXIT_CRITICAL_SAFE(&spinlock);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED

 void esp_ble_controller_log_dump_all(bool output)
 {
@@ -1444,9 +1466,13 @@ void esp_ble_controller_log_dump_all(bool output)
    ble_log_spi_out_dump_all();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_read_ctrl_log_from_flash(output);
-#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
@@ -1675,7 +1701,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #endif // CONFIG_BT_LE_DEBUG_REMAIN_SCENE_ENABLED

 int IRAM_ATTR
-ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, uint32_t param2)
 {
    int i;

@@ -1702,3 +1728,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason)
    }
    return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
--- a/components/bt/controller/esp32c5/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c5/esp_bt_cfg.h
@@ -192,6 +192,12 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif

+#if defined(CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -274,6 +280,9 @@ extern "C" {

 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)

+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@@ -361,6 +361,16 @@ menu "Controller debug features"
        help
            Output ble controller logs to SPI bus

+    config BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+        bool "Output ble controller logs via UART DMA (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on !BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_UHCI_OUT_ENABLED
+        default y
+        help
+            Output ble controller logs via UART DMA
+
    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
        bool "Store ble controller logs to flash(Experimental)"
        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -447,6 +457,12 @@ menu "Controller debug features"
    config BT_LE_PTR_CHECK_ENABLED
        bool "Enable boundary check for internal memory"
        default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu

 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -721,7 +737,7 @@ config BT_LE_CCA_RSSI_THRESH
    int "CCA RSSI threshold value"
    depends on BT_LE_TX_CCA_ENABLED
    range 20 100
-    default 20
+    default 65
    help
        Power threshold of CCA in unit of -1 dBm.

@@ -839,3 +855,45 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
 config BT_LE_RXBUF_OPT_ENABLED
    bool "Enable rxbuf optimization feature"
    default y
+
+config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
+    bool "Enable fast sending of connection data"
+    default y
+    help
+        If this option is enabled, The Controller will continue to
+        Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            connection instances and the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
--- a/components/bt/controller/esp32c6/ble.c
+++ b/components/bt/controller/esp32c6/ble.c
@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);

+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -104,6 +126,27 @@ int ble_stack_initEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS

+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
    return 0;
 }

@@ -115,7 +158,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
    base_stack_deinitEnv();
 }

@@ -128,6 +176,28 @@ int ble_stack_enable(void)
        return rc;
    }

+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
    rc = conn_stack_enable();
    if (rc) {
@@ -166,6 +236,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
    base_stack_disable();
 }
--- a/components/bt/controller/esp32c6/bt.c
+++ b/components/bt/controller/esp32c6/bt.c
@@ -58,11 +58,16 @@

 #include "hal/efuse_hal.h"
 #include "soc/rtc.h"
+#include "modem/modem_syscon_struct.h"

 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
 #include "ble_log/ble_log_spi_out.h"
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+#include "ble_log/ble_log_uhci_out.h"
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 /* Macro definition
 ************************************************************************
 */
@@ -70,7 +75,7 @@
 #define OSI_COEX_VERSION              0x00010006
 #define OSI_COEX_MAGIC_VALUE          0xFADEBEAD

-#define EXT_FUNC_VERSION             0x20240422
+#define EXT_FUNC_VERSION             0x20250415
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5

 #define BT_ASSERT_PRINT              ets_printf
@@ -101,17 +106,29 @@ struct ext_funcs_t {
    int (* _ecc_gen_key_pair)(uint8_t *public, uint8_t *priv);
    int (* _ecc_gen_dh_key)(const uint8_t *remote_pub_key_x, const uint8_t *remote_pub_key_y,
                            const uint8_t *local_priv_key, uint8_t *dhkey);
-    void (* _esp_reset_rpa_moudle)(void);
+#if CONFIG_IDF_TARGET_ESP32C6
+    void (* _esp_reset_modem)(uint8_t mdl_opts, uint8_t start);
+#endif // CONFIG_IDF_TARGET_ESP32C6
    uint32_t magic;
 };

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED

 /* External functions or variables
 ************************************************************************
 */
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+extern void coex_hw_timer_set(uint8_t idx,uint8_t src, uint8_t pti,uint32_t latency, uint32_t perioidc);
+extern void coex_hw_timer_enable(uint8_t idx);
+extern void coex_hw_timer_disable(uint8_t idx);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
 extern int ble_osi_coex_funcs_register(struct osi_coex_funcs_t *coex_funcs);
 extern int r_ble_controller_init(esp_bt_controller_config_t *cfg);
 extern void esp_ble_controller_info_capture(uint32_t cycle_times);
@@ -143,8 +160,7 @@ extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
-extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+extern void esp_ble_controller_flash_only_param_config(void);
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
@@ -185,14 +201,16 @@ static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
 static int esp_intr_free_wrapper(void **ret_handle);
 static void osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2);
 static uint32_t osi_random_wrapper(void);
-static void esp_reset_rpa_moudle(void);
+#if CONFIG_IDF_TARGET_ESP32C6
+static void esp_reset_modem(uint8_t mdl_opts,uint8_t start);
+#endif // CONFIG_IDF_TARGET_ESP32C6
 static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                              const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -219,11 +237,21 @@ esp_err_t esp_bt_controller_log_init(void)
    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    if (ble_log_uhci_out_init() != 0) {
+        goto uhci_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
        goto log_init_failed;
    }
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_uhci_out_ll_write, ble_log_uhci_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else
    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
@@ -237,12 +265,12 @@ esp_err_t esp_bt_controller_log_init(void)
    task_create = false;
 #elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_ctrl_log_partition_get_and_erase_first_block();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
        goto log_init_failed;
    }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    if (r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH) != ESP_OK) {
        goto ctrl_level_init_failed;
@@ -253,14 +281,20 @@ esp_err_t esp_bt_controller_log_init(void)
 ctrl_level_init_failed:
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif
 log_init_failed:
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
    ble_log_spi_out_deinit();
 spi_out_init_failed:
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+uhci_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
    return ESP_FAIL;
 }

@@ -270,11 +304,17 @@ void esp_bt_controller_log_deinit(void)
    ble_log_spi_out_deinit();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    log_is_inited = false;
 }
@@ -463,15 +503,34 @@ struct ext_funcs_t ext_funcs_ro = {
    ._os_random = osi_random_wrapper,
    ._ecc_gen_key_pair = esp_ecc_gen_key_pair,
    ._ecc_gen_dh_key = esp_ecc_gen_dh_key,
-    ._esp_reset_rpa_moudle = esp_reset_rpa_moudle,
+#if CONFIG_IDF_TARGET_ESP32C6
+    ._esp_reset_modem = esp_reset_modem,
+#endif // CONFIG_IDF_TARGET_ESP32C6
    .magic = EXT_FUNC_MAGIC_VALUE,
 };

-static void IRAM_ATTR esp_reset_rpa_moudle(void)
+#if CONFIG_IDF_TARGET_ESP32C6
+static void IRAM_ATTR esp_reset_modem(uint8_t mdl_opts,uint8_t start)
 {
+    if (mdl_opts == 0x05) {
+        if (start) {
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            coex_hw_timer_set(0x04, 0x02, 15, 0, 5000);
+            coex_hw_timer_enable(0x04);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            MODEM_SYSCON.modem_rst_conf.val |= (BIT(16) | BIT(18));
+            MODEM_SYSCON.modem_rst_conf.val &= ~(BIT(16) | BIT(18));
+        } else {
+#if CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+            coex_hw_timer_disable(0x04);
+#endif // CONFIG_SW_COEXIST_ENABLE || CONFIG_EXTERNAL_COEX_ENABLE
+        }

+    }
 }

+#endif // CONFIG_IDF_TARGET_ESP32C6
+
 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn,
                                         uint32_t param1, uint32_t param2)
 {
@@ -1148,8 +1207,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #endif // CONFIG_SW_COEXIST_ENABLE

 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-    r_ble_ll_scan_start_time_init_compensation(500);
-    r_priv_sdk_config_insert_proc_time_set(500);
+    esp_ble_controller_flash_only_param_config();
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY

    if (ble_stack_enable() != 0) {
@@ -1449,27 +1507,29 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    bool end = flag ? true : false;
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_controller_log_storage(len, addr, end);
 #else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }

-    if (end) {
-        esp_rom_printf("\n");
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
    }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
    portEXIT_CRITICAL_SAFE(&spinlock);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED

 void esp_ble_controller_log_dump_all(bool output)
 {
@@ -1477,9 +1537,13 @@ void esp_ble_controller_log_dump_all(bool output)
    ble_log_spi_out_dump_all();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_read_ctrl_log_from_flash(output);
-#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
@@ -1708,7 +1772,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #endif // CONFIG_BT_LE_DEBUG_REMAIN_SCENE_ENABLED

 int IRAM_ATTR
-ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, uint32_t param2)
 {
    int i;

@@ -1735,3 +1799,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason)
    }
    return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@@ -195,6 +195,12 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif

+#if defined(CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -277,6 +283,9 @@ extern "C" {

 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)

+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)
--- a/components/bt/controller/esp32h2/Kconfig.in
+++ b/components/bt/controller/esp32h2/Kconfig.in
@@ -355,6 +355,16 @@ menu "Controller debug features"
        help
            Output ble controller logs to SPI bus

+    config BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+        bool "Output ble controller logs via UART DMA (Experimental)"
+        depends on BT_LE_CONTROLLER_LOG_ENABLED
+        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
+        depends on !BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+        select BT_BLE_LOG_UHCI_OUT_ENABLED
+        default y
+        help
+            Output ble controller logs via UART DMA
+
    config BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
        bool "Store ble controller logs to flash(Experimental)"
        depends on !BT_LE_CONTROLLER_LOG_DUMP_ONLY
@@ -441,6 +451,12 @@ menu "Controller debug features"
    config BT_LE_PTR_CHECK_ENABLED
        bool "Enable boundary check for internal memory"
        default n
+
+    config BT_LE_MEM_CHECK_ENABLED
+        bool "Enable memory allocation check"
+        default n
+        help
+            Used in internal tests only. Enable the memory allocation check.
 endmenu

 config BT_LE_LL_RESOLV_LIST_SIZE
@@ -716,7 +732,7 @@ config BT_LE_CCA_RSSI_THRESH
    int "CCA RSSI threshold value"
    depends on BT_LE_TX_CCA_ENABLED
    range 20 100
-    default 20
+    default 65
    help
        Power threshold of CCA in unit of -1 dBm.

@@ -843,3 +859,45 @@ config BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX
 config BT_LE_RXBUF_OPT_ENABLED
    bool "Enable rxbuf optimization feature"
    default y
+
+config BT_LE_CTRL_FAST_CONN_DATA_TX_EN
+    bool "Enable fast sending of connection data"
+    default y
+    help
+        If this option is enabled, The Controller will continue to
+        Send an empty PDU after sending valid connection data within an interval.
+
+menu "Reserved Memory Config"
+    config BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT
+        int "The value of reserved EXT ADV memory count at initialization"
+        range 0 4
+        default 2
+        help
+            This value sets the number the Controller will allocate for extended advertisement
+            instances at initialization process. If more extended advertisement instances are
+            enabled, those memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at advertising start process and possible advertising start failure
+            due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum
+            extended advertisement instances and the BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT.
+
+
+    config BT_LE_CONN_RESERVED_MEMORY_COUNT
+        int "The value of reserved CONN memory count at initialization"
+        range 0 70
+        default 2
+        help
+            This value sets the number the Controller will allocate for connection instances
+            at the initialization process. If more connection instances are enabled, those
+            memory will be dynamically allocated.
+            Using reduced amount of reserved memory will save heap size at the cost of extra
+            time consumption at connection establishment process and possible connection
+            establishment failure due to memory shortage.
+            The actual reserved memory count will be the minimum value between the maximum connection instances and
+            the BT_LE_CONN_RESERVED_MEMORY_COUNT.
+endmenu
+
+config BT_LE_DTM_ENABLED
+    bool "Enable Direct Test Mode (DTM) feature"
+    default n
--- a/components/bt/controller/esp32h2/ble.c
+++ b/components/bt/controller/esp32h2/ble.c
@@ -22,6 +22,28 @@ void conn_stack_deinitEnv(void);
 int conn_stack_enable(void);
 void conn_stack_disable(void);

+int adv_stack_initEnv(void);
+void adv_stack_deinitEnv(void);
+int adv_stack_enable(void);
+void adv_stack_disable(void);
+
+int extAdv_stack_initEnv(void);
+void extAdv_stack_deinitEnv(void);
+int extAdv_stack_enable(void);
+void extAdv_stack_disable(void);
+
+int sync_stack_initEnv(void);
+void sync_stack_deinitEnv(void);
+int sync_stack_enable(void);
+void sync_stack_disable(void);
+
+#if CONFIG_BT_LE_DTM_ENABLED
+int dtm_stack_initEnv(void);
+void dtm_stack_deinitEnv(void);
+int dtm_stack_enable(void);
+void dtm_stack_disable(void);
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if CONFIG_BT_LE_ERROR_SIM_ENABLED
 int conn_errorSim_initEnv(void);
 void conn_errorSim_deinitEnv(void);
@@ -85,6 +107,28 @@ int ble_stack_initEnv(void)
        return rc;
    }

+    rc = adv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_initEnv();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
    rc = conn_stack_initEnv();
    if (rc) {
@@ -109,7 +153,12 @@ void ble_stack_deinitEnv(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_deinitEnv();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_deinitEnv();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_deinitEnv();
+    extAdv_stack_deinitEnv();
+    adv_stack_deinitEnv();
    base_stack_deinitEnv();
 }

@@ -122,6 +171,28 @@ int ble_stack_enable(void)
        return rc;
    }

+    rc = adv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = extAdv_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+    rc = sync_stack_enable();
+    if (rc) {
+        return rc;
+    }
+
+#if CONFIG_BT_LE_DTM_ENABLED
+    rc = dtm_stack_enable();
+    if (rc) {
+        return rc;
+    }
+#endif // CONFIG_BT_LE_DTM_ENABLED
+
 #if DEFAULT_BT_LE_MAX_CONNECTIONS
    rc = conn_stack_enable();
    if (rc) {
@@ -160,6 +231,11 @@ void ble_stack_disable(void)
 #endif // CONFIG_BT_LE_ERROR_SIM_ENABLED
    conn_stack_disable();
 #endif // DEFAULT_BT_LE_MAX_CONNECTIONS
-
+#if CONFIG_BT_LE_DTM_ENABLED
+    dtm_stack_disable();
+#endif // CONFIG_BT_LE_DTM_ENABLED
+    sync_stack_disable();
+    extAdv_stack_disable();
+    adv_stack_disable();
    base_stack_disable();
 }
--- a/components/bt/controller/esp32h2/bt.c
+++ b/components/bt/controller/esp32h2/bt.c
@@ -59,6 +59,10 @@
 #include "ble_log/ble_log_spi_out.h"
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+#include "ble_log/ble_log_uhci_out.h"
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 /* Macro definition
 ************************************************************************
 */
@@ -66,7 +70,7 @@
 #define OSI_COEX_VERSION              0x00010006
 #define OSI_COEX_MAGIC_VALUE          0xFADEBEAD

-#define EXT_FUNC_VERSION             0x20240422
+#define EXT_FUNC_VERSION             0x20250415
 #define EXT_FUNC_MAGIC_VALUE         0xA5A5A5A5

 #define BT_ASSERT_PRINT              ets_printf
@@ -97,12 +101,16 @@ struct ext_funcs_t {
    int (* _ecc_gen_key_pair)(uint8_t *public, uint8_t *priv);
    int (* _ecc_gen_dh_key)(const uint8_t *remote_pub_key_x, const uint8_t *remote_pub_key_y,
                            const uint8_t *local_priv_key, uint8_t *dhkey);
-    void (* _esp_reset_rpa_moudle)(void);
    uint32_t magic;
 };

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 typedef void (*interface_func_t) (uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
+
+enum {
+    BLE_LOG_INTERFACE_FLAG_CONTINUE = 0,
+    BLE_LOG_INTERFACE_FLAG_END,
+};
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 /* External functions or variables
 ************************************************************************
@@ -138,8 +146,7 @@ extern void r_ble_rtc_wake_up_state_clr(void);
 extern int os_msys_init(void);
 extern void os_msys_deinit(void);
 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-extern void r_ble_ll_scan_start_time_init_compensation(uint32_t init_compensation);
-extern void r_priv_sdk_config_insert_proc_time_set(uint16_t insert_proc_time);
+extern void esp_ble_controller_flash_only_param_config(void);
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
 #if CONFIG_FREERTOS_USE_TICKLESS_IDLE
 extern sleep_retention_entries_config_t *r_esp_ble_mac_retention_link_get(uint8_t *size, uint8_t extra);
@@ -183,14 +190,13 @@ static int esp_intr_alloc_wrapper(int source, int flags, intr_handler_t handler,
 static int esp_intr_free_wrapper(void **ret_handle);
 static void osi_assert_wrapper(const uint32_t ln, const char *fn, uint32_t param1, uint32_t param2);
 static uint32_t osi_random_wrapper(void);
-static void esp_reset_rpa_moudle(void);
 static int esp_ecc_gen_key_pair(uint8_t *pub, uint8_t *priv);
 static int esp_ecc_gen_dh_key(const uint8_t *peer_pub_key_x, const uint8_t *peer_pub_key_y,
                              const uint8_t *our_priv_key, uint8_t *out_dhkey);
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag);
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 static void esp_bt_ctrl_log_partition_get_and_erase_first_block(void);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
@@ -217,11 +223,21 @@ esp_err_t esp_bt_controller_log_init(void)
    }
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    if (ble_log_uhci_out_init() != 0) {
+        goto uhci_out_init_failed;
+    }
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    if (r_ble_log_init_simple(ble_log_spi_out_ll_write, ble_log_spi_out_ll_log_ev_proc) != 0) {
        goto log_init_failed;
    }
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    if (r_ble_log_init_simple(ble_log_uhci_out_ll_write, ble_log_uhci_out_ll_log_ev_proc) != 0) {
+        goto log_init_failed;
+    }
+#else
    uint8_t buffers = 0;
 #if CONFIG_BT_LE_CONTROLLER_LOG_CTRL_ENABLED
    buffers |= ESP_BLE_LOG_BUF_CONTROLLER;
@@ -235,12 +251,12 @@ esp_err_t esp_bt_controller_log_init(void)
    task_create = false;
 #elif CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_ctrl_log_partition_get_and_erase_first_block();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    if (r_ble_log_init_async(esp_bt_controller_log_interface, task_create, buffers, (uint32_t *)log_bufs_size) != 0) {
        goto log_init_failed;
    }
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    if (r_ble_log_ctrl_level_and_mod(CONFIG_BT_LE_CONTROLLER_LOG_OUTPUT_LEVEL, CONFIG_BT_LE_CONTROLLER_LOG_MOD_OUTPUT_SWITCH) != ESP_OK) {
        goto ctrl_level_init_failed;
@@ -251,14 +267,20 @@ esp_err_t esp_bt_controller_log_init(void)
 ctrl_level_init_failed:
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif
 log_init_failed:
 #if CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
    ble_log_spi_out_deinit();
 spi_out_init_failed:
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED
+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+uhci_out_init_failed:
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
    return ESP_FAIL;
 }

@@ -268,11 +290,17 @@ void esp_bt_controller_log_deinit(void)
    ble_log_spi_out_deinit();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_deinit();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
    r_ble_log_deinit_simple();
-#else // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
+    r_ble_log_deinit_simple();
+#else
    r_ble_log_deinit_async();
-#endif // CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif

    log_is_inited = false;
 }
@@ -460,15 +488,9 @@ struct ext_funcs_t ext_funcs_ro = {
    ._os_random = osi_random_wrapper,
    ._ecc_gen_key_pair = esp_ecc_gen_key_pair,
    ._ecc_gen_dh_key = esp_ecc_gen_dh_key,
-    ._esp_reset_rpa_moudle = esp_reset_rpa_moudle,
    .magic = EXT_FUNC_MAGIC_VALUE,
 };

-static void IRAM_ATTR esp_reset_rpa_moudle(void)
-{
-
-}
-
 static void IRAM_ATTR osi_assert_wrapper(const uint32_t ln, const char *fn,
                                         uint32_t param1, uint32_t param2)
 {
@@ -1109,8 +1131,7 @@ esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
 #endif // CONFIG_SW_COEXIST_ENABLE

 #if CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY
-    r_ble_ll_scan_start_time_init_compensation(500);
-    r_priv_sdk_config_insert_proc_time_set(500);
+    esp_ble_controller_flash_only_param_config();
 #endif // CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY

    if (ble_stack_enable() != 0) {
@@ -1409,27 +1430,29 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 }

 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
-#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#if !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, uint32_t len_append, const uint8_t *addr_append, uint32_t flag)
 {
-    bool end = flag ? true : false;
+    bool end = (flag & BIT(BLE_LOG_INTERFACE_FLAG_END));
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_controller_log_storage(len, addr, end);
 #else // !CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
-    for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x ", addr[i]);
-    }

-    if (end) {
-        esp_rom_printf("\n");
+    if (len && addr) {
+        for (int i = 0; i < len; i++) { esp_rom_printf("%02x ", addr[i]); }
    }
+    if (len_append && addr_append) {
+        for (int i = 0; i < len_append; i++) { esp_rom_printf("%02x ", addr_append[i]); }
+    }
+    if (end) { esp_rom_printf("\n"); }
+
    portEXIT_CRITICAL_SAFE(&spinlock);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
 }
-#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#endif // !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED

 void esp_ble_controller_log_dump_all(bool output)
 {
@@ -1437,9 +1460,13 @@ void esp_ble_controller_log_dump_all(bool output)
    ble_log_spi_out_dump_all();
 #endif // CONFIG_BT_BLE_LOG_SPI_OUT_ENABLED

+#if CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+    ble_log_uhci_out_dump_all();
+#endif // CONFIG_BT_BLE_LOG_UHCI_OUT_ENABLED
+
 #if CONFIG_BT_LE_CONTROLLER_LOG_STORAGE_ENABLE
    esp_bt_read_ctrl_log_from_flash(output);
-#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED
+#elif !CONFIG_BT_LE_CONTROLLER_LOG_SPI_OUT_ENABLED && !CONFIG_BT_LE_CONTROLLER_LOG_UHCI_OUT_ENABLED
    portMUX_TYPE spinlock = portMUX_INITIALIZER_UNLOCKED;
    portENTER_CRITICAL_SAFE(&spinlock);
    esp_panic_handler_feed_wdts();
@@ -1667,7 +1694,7 @@ int ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 #endif // CONFIG_BT_LE_DEBUG_REMAIN_SCENE_ENABLED

 int IRAM_ATTR
-ble_capture_info_user_handler(uint8_t type, uint32_t reason)
+ble_capture_info_user_handler(uint8_t type, uint32_t reason, uint32_t param1, uint32_t param2)
 {
    int i;

@@ -1694,3 +1721,10 @@ ble_capture_info_user_handler(uint8_t type, uint32_t reason)
    }
    return 0;
 }
+
+#if CONFIG_BT_LE_MEM_CHECK_ENABLED
+void ble_memory_count_limit_set(uint16_t count_limit)
+{
+    bt_osi_mem_count_limit_set(count_limit);
+}
+#endif // CONFIG_BT_LE_MEM_CHECK_ENABLED
--- a/components/bt/controller/esp32h2/esp_bt_cfg.h
+++ b/components/bt/controller/esp32h2/esp_bt_cfg.h
@@ -192,6 +192,12 @@ extern "C" {
 #define DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX (0)
 #endif

+#if defined(CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (CONFIG_BT_LE_CTRL_FAST_CONN_DATA_TX_EN)
+#else
+#define DEFAULT_BT_LE_CTRL_FAST_CONN_DATA_TX_EN (0)
+#endif
+
 #ifdef CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #define HCI_UART_EN CONFIG_BT_LE_HCI_INTERFACE_USE_UART
 #else
@@ -274,6 +280,9 @@ extern "C" {

 #define BLE_LL_TX_PWR_DBM_N                 (CONFIG_BT_LE_DFT_TX_POWER_LEVEL_DBM_EFF)

+#define BLE_LL_ADV_SM_RESERVE_CNT_N         MIN(DEFAULT_BT_LE_MAX_EXT_ADV_INSTANCES, CONFIG_BT_LE_EXT_ADV_RESERVED_MEMORY_COUNT)
+#define BLE_LL_CONN_SM_RESERVE_CNT_N        MIN(DEFAULT_BT_LE_MAX_CONNECTIONS, CONFIG_BT_LE_CONN_RESERVED_MEMORY_COUNT)
+
 #define RUN_BQB_TEST                        (0)
 #define RUN_QA_TEST                         (0)
 #define NIMBLE_DISABLE_SCAN_BACKOFF         (0)
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
--- a/components/bt/controller/lib_esp32c3_family
+++ b/components/bt/controller/lib_esp32c3_family
--- a/components/bt/controller/lib_esp32c5/esp32c5-bt-lib
+++ b/components/bt/controller/lib_esp32c5/esp32c5-bt-lib
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@@ -25,7 +25,6 @@ if BLE_MESH
    menuconfig BLE_MESH_USE_BLE_50
        bool "Support using BLE 5.0 APIs for BLE Mesh"
        depends on BLE_MESH_EXPERIMENTAL
-        depends on IDF_TARGET_ESP32C3 || IDF_TARGET_ESP32S3
        select BT_NIMBLE_50_FEATURE_SUPPORT if BT_NIMBLE_ENABLED
        select BT_NIMBLE_EXT_ADV if BT_NIMBLE_ENABLED
        select BT_BLE_50_FEATURES_SUPPORTED if BT_BLUEDROID_ENABLED
@@ -477,7 +476,7 @@ if BLE_MESH
        int "Maximum capacity of solicitation replay protection list"
        depends on BLE_MESH_PROXY_SOLIC_PDU_RX
        default 2
-        range 1 255
+        range 1 65536
        help
            This option specifies the maximum capacity of the solicitation replay
            protection list. The solicitation replay protection list is used to
--- a/components/bt/esp_ble_mesh/core/adv.c
+++ b/components/bt/esp_ble_mesh/core/adv.c
@@ -94,17 +94,16 @@ static inline int adv_send(struct net_buf *buf)
 #if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
        if (BLE_MESH_ADV(buf)->type == BLE_MESH_ADV_PROXY_SOLIC) {
            bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
-            struct bt_mesh_adv_data solic_ad[3] = {
-                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
+            struct bt_mesh_adv_data solic_ad[2] = {
                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
                BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
            };
 #if CONFIG_BLE_MESH_USE_BLE_50
            param.primary_phy = BLE_MESH_ADV_PHY_1M;
            param.secondary_phy = BLE_MESH_ADV_PHY_1M;
-            err = bt_le_ext_adv_start(CONFIG_BLE_MESH_ADV_INST_ID, &param, &ad, 3, NULL, 0);
+            err = bt_le_ext_adv_start(CONFIG_BLE_MESH_ADV_INST_ID, &param, solic_ad, ARRAY_SIZE(solic_ad), NULL, 0);
 #else /* CONFIG_BLE_MESH_USE_BLE_50 */
-            err = bt_le_adv_start(&param, &ad, 3, NULL, 0);
+            err = bt_le_adv_start(&param, solic_ad, ARRAY_SIZE(solic_ad), NULL, 0);
 #endif /* CONFIG_BLE_MESH_USE_BLE_50 */
        } else
 #endif
--- a/components/bt/esp_ble_mesh/core/adv_common.c
+++ b/components/bt/esp_ble_mesh/core/adv_common.c
@@ -625,6 +625,9 @@ void bt_mesh_adv_common_init(void)
    bt_mesh_adv_type_init(BLE_MESH_ADV_DATA, &adv_queue, &adv_buf_pool, adv_alloc);
    bt_mesh_adv_type_init(BLE_MESH_ADV_BEACON, &adv_queue, &adv_buf_pool, adv_alloc);
    bt_mesh_adv_type_init(BLE_MESH_ADV_URI, &adv_queue, &adv_buf_pool, adv_alloc);
+#if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
+    bt_mesh_adv_type_init(BLE_MESH_ADV_PROXY_SOLIC, &adv_queue, &adv_buf_pool, adv_alloc);
+#endif

 #if CONFIG_BLE_MESH_USE_BLE_50
    bt_mesh_adv_inst_init(BLE_MESH_ADV_INS, CONFIG_BLE_MESH_ADV_INST_ID);
--- a/components/bt/esp_ble_mesh/core/adv_common.h
+++ b/components/bt/esp_ble_mesh/core/adv_common.h
@@ -140,6 +140,9 @@ enum bt_mesh_adv_type {
 #endif
    BLE_MESH_ADV_BEACON,
    BLE_MESH_ADV_URI,
+#if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
+    BLE_MESH_ADV_PROXY_SOLIC,
+#endif
 #if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
    BLE_MESH_ADV_BLE,
 #endif
--- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
@@ -667,7 +667,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
        interval >>= 1;
        interval += (bt_mesh_get_rand() % (interval + 1));

-        BT_INFO("%u->%u", param->interval_min, interval);
+        BT_DBG("%u->%u", param->interval_min, interval);
    }
 #endif

@@ -2153,8 +2153,10 @@ static void bt_mesh_bta_gattc_cb(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
        for (i = 0; i < ARRAY_SIZE(bt_mesh_gattc_info); i++) {
            if (bt_mesh_gattc_info[i].conn.handle == handle) {
                if (bt_mesh_gattc_info[i].wr_desc_done == false) {
-                    BT_DBG("Receive notification before finishing to write ccc");
+                    BT_WARN("Receive notification before finishing to write ccc");
+#if !CONFIG_BLE_MESH_BQB_TEST
                    return;
+#endif
                }

                conn = &bt_mesh_gattc_info[i].conn;
--- a/components/bt/esp_ble_mesh/core/ext_adv.c
+++ b/components/bt/esp_ble_mesh/core/ext_adv.c
@@ -70,6 +70,9 @@ static inline int adv_send(struct bt_mesh_adv_inst *inst, uint16_t *adv_duration
 #endif
 #if CONFIG_BLE_MESH_RELAY_ADV_BUF
    case BLE_MESH_ADV_RELAY_DATA:
+#endif
+#if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
+    case BLE_MESH_ADV_PROXY_SOLIC:
 #endif
    case BLE_MESH_ADV_BEACON:
    case BLE_MESH_ADV_URI: {
@@ -96,9 +99,20 @@ static inline int adv_send(struct bt_mesh_adv_inst *inst, uint16_t *adv_duration
        param.primary_phy = BLE_MESH_ADV_PHY_1M;
        param.secondary_phy = BLE_MESH_ADV_PHY_1M;

-        bt_mesh_adv_buf_ref_debug(__func__, buf, 4U, BLE_MESH_BUF_REF_SMALL);
-
-        err = bt_le_ext_adv_start(inst->id, &param, &ad, 1, NULL, 0);
+#if CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX
+        if (BLE_MESH_ADV(buf)->type == BLE_MESH_ADV_PROXY_SOLIC) {
+            bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
+            struct bt_mesh_adv_data solic_ad[2] = {
+                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
+                BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
+            };
+            err = bt_le_ext_adv_start(CONFIG_BLE_MESH_ADV_INST_ID, &param, solic_ad, ARRAY_SIZE(solic_ad), NULL, 0);
+        } else
+#endif
+        {
+            bt_mesh_adv_buf_ref_debug(__func__, buf, 4U, BLE_MESH_BUF_REF_SMALL);
+            err = bt_le_ext_adv_start(inst->id, &param, &ad, 1, NULL, 0);
+        }
        }
        break;
 #if CONFIG_BLE_MESH_SUPPORT_BLE_ADV
@@ -303,6 +317,7 @@ static uint32_t received_adv_evts_handle(uint32_t recv_evts)
 CONFIG_BLE_MESH_GATT_PROXY_SERVER
            if (unlikely(i == BLE_MESH_ADV_PROXY_INS)) {
                BT_DBG("Mesh Proxy Advertising auto stop");
+                bt_mesh_proxy_server_adv_flag_set(false);
            } else
 #endif
            {
@@ -366,7 +381,7 @@ void bt_mesh_adv_update(void)
 {
 #if (CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_GATT) || \
     CONFIG_BLE_MESH_GATT_PROXY_SERVER
-    BT_WARN("Mesh Proxy Advertising stopped manually");
+    BT_DBG("Mesh Proxy Advertising stopped manually");
    bt_mesh_proxy_server_adv_stop();
    if (adv_insts[BLE_MESH_ADV_PROXY_INS].busy) {
        ble_mesh_adv_task_wakeup(ADV_TASK_PROXY_ADV_UPD_EVT);
--- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
@@ -1223,7 +1223,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id,
        interval >>= 1;
        interval += (bt_mesh_get_rand() % (interval + 1));

-        BT_INFO("%u->%u", param->interval_min, interval);
+        BT_DBG("%u->%u", param->interval_min, interval);
    }
 #endif

--- a/components/bt/esp_ble_mesh/core/proxy_client.c
+++ b/components/bt/esp_ble_mesh/core/proxy_client.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD
 *
 * SPDX-License-Identifier: Apache-2.0
 */
@@ -31,7 +31,7 @@

 static struct bt_mesh_proxy_server {
    struct bt_mesh_conn *conn;
-
+    bt_mesh_addr_t addr;
    enum __attribute__((packed)) {
        CLI_NONE,
        CLI_PROV,
@@ -465,6 +465,7 @@ static void proxy_connected(bt_mesh_addr_t *addr, struct bt_mesh_conn *conn, int

    server->conn = bt_mesh_conn_ref(conn);
    server->conn_type = CLI_NONE;
+    memcpy(&server->addr, addr, sizeof(bt_mesh_addr_t));
    net_buf_simple_reset(&server->buf);

 #if CONFIG_BLE_MESH_RPR_SRV && CONFIG_BLE_MESH_PB_GATT
@@ -629,6 +630,12 @@ static ssize_t proxy_write_ccc(bt_mesh_addr_t *addr, struct bt_mesh_conn *conn)
        return 0;
    }

+#if CONFIG_BLE_MESH_BQB_TEST
+    /* notify maybe received first */
+    if (server->conn_type == CLI_PROXY) {
+        return 0;
+    }
+#endif
    return -EINVAL;
 }

@@ -641,6 +648,16 @@ static ssize_t proxy_recv_ntf(struct bt_mesh_conn *conn, uint8_t *data, uint16_t
        return -ENOTCONN;
    }

+#if CONFIG_BLE_MESH_BQB_TEST
+    /* update conn type if notify received before write ccc */
+    if (server->conn_type == CLI_NONE) {
+        server->conn_type = CLI_PROXY;
+        if (proxy_client_connect_cb) {
+            proxy_client_connect_cb(&server->addr, server - servers, server->net_idx);
+        }
+    }
+#endif
+
    if (server->conn_type == CLI_PROXY) {
        return proxy_recv(conn, NULL, data, len, 0, 0);
    }
--- a/Show More
+++ b/Show More